Repository navigation
Complete policy governance: source sync, executable adoption, lifecycle admission and team review #455
Description
Accepted product scope
Track the complete agreed policy workspace beyond the first local single-admin slice. A local administrator may author, review and publish when the workflow permits self-review; this is useful independently of team/RBAC. Pack/graph remains executable authority. Policies retain narrative, provenance, explicit release lifecycle and reviewed relationships to executable artifacts. This issue is not a claim that the full workflow is implemented.
The agreed design and proposed service interfaces are being preserved under docs/design/policy-governance-{design,interfaces}.md; policy-governance-delivery.md records what actually works.
Delivery and dependencies
- Typed Library discovery, preserving existing Dialect URLs, drafts and chats — Unify Dialects and drafts in Library with typed discovery and preserved routes #451 / Unify Dialects and drafts in Library #453.
- Local persistent drafts, exact candidate/workflow review, immutable publication, conflict handling and lost-response recovery — Local single-admin Policy drafts, explicit review and immutable publication #454 / Add local Policy drafts, explicit review and immutable publication #458 (merged into integration/v0.13).
- Local
.txt/.mdoriginal import, exact retained read/download and shared Policy draft authoring — Import retained policy source files and author policy drafts through shared chat #459 / Import policy originals and author drafts through shared chat #460, merged intointegration/v0.13. Import creates a draft, never approval. - Explicit Desk-managed/external ownership, current Drive administrator fallback, exact retained external versions and Published-source import as a fresh Desk draft — Configure source lifecycle mappings and administrator fallback for Policies #473 / Review Policy source ownership, fallback status and external versions #477, merged as
4b3455b. Source Published is not local approval. Genuine provider lifecycle evidence and production mappings remain Gateway Nightly mutation run 2026-10-07: 9 survivors, 3 inconclusive #295 / the reconciliation item below. - Initial automatic Google Drive snapshot checking under explicit recurring consent, durable restart recovery, revocation/auth-generation fences, semantic deduplication, exact retained observations and source-bound review/publication — Synchronize connected policy sources under explicit recurring consent #461 / Retain connected Policy source updates with exact review and durable consent #462 and published Gateway v0.20.0 adopted by Adopt published Gateway v0.20.0 for connected policy sources #463. Producer-contract and browser checks passed; no live Google-account end-to-end test is claimed.
- Broader source reconciliation, lifecycle-only updates, event/cursor coverage and explicit gaps. Source updates must not overwrite drafts, transfer approval or upgrade jobs. Current Drive coverage is snapshot-only and external lifecycle is not exposed. Gateway observation/admission boundary: Source revision observations for durable policy sync and governed action admission judgment-pack-gateway#295.
- Initial exact retained Policy revision/publication to ordinary pack-authoring handoff — Start pack interpretation drafts from exact retained Policy revisions #464 / Start pack authoring from exact retained Policy sources #465, merged into
integration/v0.13as8602585. Manual and reviewed Policy-chat entry points share source resolution; the request stays unsent. Private provenance survives chat/draft ownership changes and uses shared managed context. Full CI, independent same-vendor review and isolated browser checks passed. This does not establish governing adoption or portable Policy identity. - Exact Policy-to-Graph authoring and independent Graph custody through shared context, Plan and reviewed handoff — Retain Graph drafts independently and interpret exact Policy sources #468 / Retain Policy-based graph drafts independently of chats #471, merged as
66566ed. Existing Pack handoff remains Start pack authoring from exact retained Policy sources #465. These are informational source associations, not governing adoption. - Reviewed executable coverage relationships through the shared authoring/correction and scoped action framework; no model-authored authority or new provider loop.
- Explicit governing adoption of exact policy versions/scopes by exact pack releases; coverage may be manual, automated, awaiting or out of scope. Citations are not governing dependencies; tests passing does not establish complete coverage. Portable proposal: Define a portable Policy companion and governing adoption boundary judgment-pack-spec#211 / PR212. Shared offline tooling after adoption: Add shared offline Policy document tooling after companion adoption judgment-pack-runtime#293.
- Local publication/effective/superseded/expired/withdrawn states and lifecycle history — Add explicit local Policy activation, expiry and withdrawal history #469 / Record explicit Policy activation, expiry and withdrawal #470, merged as
36c950d. This is local lifecycle management, not executor enforcement. - Real withdrawal/eligibility enforcement: default withdrawal blocks new governed run starts and new actions; admitted attempts may finish. Runner/executor start ordering, retries and recovery: Retain governing policy adoption and enforce current run admission at dispatch judgment-pack-runner#147 and Gateway#295. Do not advertise enforcement until a real executor honors it.
- Team/guest membership and current resource authorization through existing OIDC/password/session integration — User management and RBAC integrated with existing identity providers and sessions #452. Configurable whole-policy/section review, required signatories, honest independent review, access revocation on retrieval and search. Live co-editing remains Phase 2.
- Project-scoped Policy recovery archive, exact ledger/blob closure and fenced restore with fresh review/source consent — Include Policies and retained source evidence in project backup and restore #476 / Restore project Policy archives with fresh review and source consent #478, merged as
86328fc. Restore creates a new inactive project; existing explicitly named chat backup is unchanged. This is not complete project backup or anti-rollback/execution authority. - Full isolated end-to-end scenarios across two installations, including source-update/review races, withdrawal-before-dispatch, stale restore and denied guest retrieval. Publish Exchange examples only after a supported portable contract and entry definition exist.
Boundaries
Spec owns portable content/reference meaning, not Desk ACLs or live authority. Runtime checks supplied documents and versions offline. Desk owns workspace lifecycle and adoption authority. Gateway owns connected observations and enforcement for actions it actually executes. Runner retains exact closure and enforces dispatch admission. No new IAM or policy repository is required; collections do not imply governing edges, priority or access.
Metadata
Metadata
Assignees
Labels
No labels
Activity
kikashy commentedon Oct 18, 2026
Connected-source delivery is now prepared for review:
The source UI browser test uses explicit synthetic API responses; it is not live Google end-to-end. No installed binaries or live project data were changed, and no unpublished Gateway was pinned as a release.
Remaining dependency order: independent review/merge and a verified Gateway release → Spec #211/#212 contract review/adoption → policy-to-pack/graph governing adoption and Runtime #293 deterministic tools → Runner #147 / Gateway #295 start/action admission. Team/guest identity and permissions remain #452. The current local one-admin workflow is useful independently; this issue stays open for the full lifecycle.
kikashy commentedon Oct 18, 2026
Final CI for #462 is now fully green at
c6bbe6b5f163a4e21c6be9c0073baf45b1772da2, including 6,952 passing web tests, Go/Jobs, both Gateway platforms, Exchange, all release archives, mutation checks and the exact producer-contract job. The implementation/review handoff is complete for this connected-source slice. Remaining immediate gate: independent different-vendor review of #460/#462 and Judgment-Pack/judgment-pack-gateway#297, followed by the supported Gateway release and Desk pin update. No merge exception was inferred from the earlier permission for #453/#458.kikashy commentedon Oct 18, 2026
Current delivery update
integration/v0.13at36c950d. Exact publication activation (now/future), expiry, explicit supersession, terminal withdrawal and recovery are implemented without rewriting prior Policy bytes/reviews/publications.66566ed160fc89333a91452bfeb3d386cc2686bd. Manual and reviewed chat handoffs use the exact retained Policy revision/publication and remain unsent. Independent Graph custody survives originating-chat deletion and reload; scoped folder/helper identities avoid duplicate-draft collisions. Public save/private-history recovery does not repeat a public write.Next source-status work: #473, assigned to kikashy, captures the latest accepted rule: map actual lifecycle evidence from capable sources; otherwise use an explicitly administrator-configured fallback, initially Draft. Retain authority provenance. Unknown capable-provider states, fetch failures, revoked access and deletion do not invoke fallback. Gateway #295 retains raw capabilities/evidence and connection custody. Current Drive is snapshot-only / lifecycle-not-exposed.
Still open: externally managed ownership/imported publication and source-status configuration; reviewed coverage and governing adoption; trusted complete release dependencies and real Runner/Gateway start/action enforcement (including default withdrawal blocking new governed starts); team/guest review/RBAC; portable contract adoption/interop. Sources and administrative status alone do not establish governing authority or executor admission. The existing parent checkboxes spanning those features should remain open.
Spec PR212 remains Draft. Its prototype same-bytes/media-type fix is pushed and tested, but different-vendor review and the remaining closure/admission/migration contract findings are not waived by these Desk merges. Claude's acquisition-scope and Runner release lanes were left alone.
kikashy commentedon Oct 18, 2026
Progress reconciled after #477 merged (
4b3455b):Remaining delivery: provider lifecycle/reconciliation coverage; adopted portable contract and exact executable coverage/adoption; real run/action admission; team/RBAC; cross-installation enforcement scenarios; and project-scoped Policy recovery archives (#476). Spec PR #212 remains Draft. Existing chat backup keeps its stated scope. No local Desk restart or install was performed.
kikashy commentedon Oct 18, 2026
Policy recovery is complete in #478 (
86328fc,integration/v0.13). The archive preserves exact Policy history and required retained bytes, restores to a new inactive project, and fences archived approvals/source grants behind fresh review and consent. Lost replies recover without repeating the restore. Current chat backup scope is unchanged.Reviewed head
40319e5passed final CI and isolated recovery/browser validation; broader source/lifecycle/reconnection scenarios were tested on the preceding head, with the final one-line repository-accessor delta independently reviewed and rechecked. No live provider/model use, live Desk restart or installation.Remaining agreed work is unchanged: broader provider lifecycle/reconciliation coverage; reviewed executable coverage and governing adoption after the portable contract is adopted; real run/action admission; team/RBAC; and cross-installation enforcement scenarios. Spec #212 remains Draft, and recovery does not claim anti-rollback authority or executor enforcement.
kikashy commentedon Oct 18, 2026
Exact Policy change review is merged in #481 as
d33defbf6fb2d994e3880bbf172288222cd4cb0b(reviewed head37980b733d8996b843c573410fa4537dda862bfa).This completes #479: shared plain-text comparison of saved revisions/publications and retained source observations; fixed selected pairs despite newer state; explicit extraction limitations; and unsent, persisted comparison requests in the existing linked chat through the shared read-only Plan/context framework. Source-review admission and operation recovery remain unchanged.
All required CI is green. Clean-room Codex findings were repaired, and isolated native browser verification passed eight stages with twelve geometry checks, including reload, source CAS, large-text suffix retention and revoked access. Connected-source checks used a marked synthetic snapshot adapter; no live provider/OAuth/model validation is claimed. The running Desk on port 5173 was not restarted or replaced.
Broader tracker scope remains open: portable governing adoption awaits the Spec contract review; current dispatch enforcement belongs to the dependent Runner/authority work; team permissions remain tracked separately in #452. This comparison feature does not establish approval, governing adoption or complete requirement coverage.