Knowledge Wiki Orchestrata Ultimate

Orchestrata Ultimate › Plans › governance-promotions

Governance promotions table (W1-P7)

Source: plans/governance-promotions.md at 8a2cb42ad · last changed 2026-08-19 · first committed 2026-07-21 · 46 lines.

Prose pending.

Plan text

Governance promotions table (W1-P7)

The SINGLE registry for every governance interim state — each row carries owner + trigger + expiry per the ratified standing rule (ADR-023: "no interim state without owner + trigger + expiry"). When a row's trigger fires, the promotion executes and the row moves to the Promoted section with its commit. Non-governance interim states live in plans/master-execution-plan.md.

Instrumentation these triggers read: the W1-P6 verdict-provenance log stream (source=POLICY_ALLOW|POLICY_DENY|ERROR_ALLOW|ERROR_DENY lines from governance/verdict.py, commit 44e2f8b7) and the boot health line at both production seams.

Active interim states

# Interim state Promotes to Owner Trigger (concrete, measurable) Expiry
1 Kernel dispatcher policy evaluation is AUDIT-ONLY (policy_audit_mode=True logs verdicts, never blocks — kernel/dispatcher.py) Enforcing: POLICY_DENY blocks dispatch ORCH P6 validation window over real runs: ERROR_ALLOW == 0 AND every POLICY_DENY attributable to a named rule (grep the verdict log stream) The G-D1 flip commit removes audit-only mode
2 Default-allow rule posture — governance.pl permissive fallback for unknown agents (lines ~692-699) + intent_policy.pl default-allow G-D1 deny-by-default flip (ratified ADR-023), both files same posture ORCH (user gets ONE confirmation look at the metric evidence before it lands — recorded in wiki open-decisions) Same P6 window as row 1: ERROR_ALLOW == 0, all POLICY_DENYs attributable The flip commit deletes the permissive fallback clauses
3 Postman governance is SHADOW-MODE (prolog_agrees divergence logging, Python decision authoritative — postman/governance.py) Prolog verdict authoritative ORCH prolog_agrees divergence == 0 over one full pipeline cycle (dogfood e2e run) The flip commit removes the Python-authoritative branch
4 grpc aio hard-exit mitigation (tests/knowledge_graph/conftest.py interactive-run os._exit, gated on test_server.py selection — commit efe8a6f8) Clean interpreter exit with no mitigation builder Next scripts/build_ft_grpcio.py rebuild carrying the refcount decref-race fix (upstream-identical bug, same class as the patched janus races) Removing the conftest mitigation IS the promotion
5 AmbiguityResolver boundary-gate whitelist entry (scripts/check_prolog_boundary.py — dead class, zero production constructors, queries undeclared resolve_ambiguity/3) Entry deleted ORCH The wire-or-delete work item for AmbiguityResolver (REQ-003-US-003-012) resolves — either wiring (predicate then gets real rules) or deletion (site disappears) The entry's own justification text names this item
6 cxp.send NOT governance-gated (G-D3 scope: orchestrator.intent + volk lifecycle + session open/close gate NOW; cxp.send excluded pending cost data) Per-message gating (or a batched/journaled redesign) wirer Per-message Prolog-cost benchmark: added p50 ≤ 5 ms/message → gate it; > 5 ms → redesign first (ratified threshold) The gating (or redesign) commit

Permanent postures (NOT interim — documented so nobody "promotes" them)

State Promoted Commit
Routing timeout/query-error branches hardcoded ALLOW regardless of posture strict→DENY / permissive→ALLOW, both error:-labelled 44e2f8b7
Dispatcher policy-evaluator bridge loaded only governance.pl (pam delegation inert) full corpus via the blessed loader b0e18dd6
Kernel marked optional in start_test_services (false-green suite runs) required=True, suite aborts without kernel (session 233, see docs/kernel-is-required.md)