[Kernel][G07] Deliver versioned private outcome and full-cost evidence export #58

Closed
opened 2026-10-04 22:27:40 +00:00 by kilo · 4 comments
Member

Priority: P2

Type: implementation.

This active scope supersedes conflicting historical descriptive scope, priorities and dependencies. The entire previous body is preserved unchanged under Historical Scope And Evidence; its evidence, unknowns, dispositions and review counters are not reset. PR #104 is integrated at ace7175e087cd70e207594f5631c8f4f70fabfd4; historical pending wording is not current integration status. Prepared A/B are registered as #105/#106. Publication is not feature implementation or overall alignment acceptance.

Goal

Export the whole accepted-result journey and uncertainties from durable work/effect/evidence records.

Why

Thin task/reference/pure-outcomes paths are distinct and not one collection pipeline. Retain prior local/privacy/causality specification.

Scope

Versioned origin-local outcome schema and installed export spanning both modes and independent drivers, attributable Attempts/checks/review/remediation/effects/resources and corrections.

Acceptance Criteria

  1. Bind exact Program/spec/WorkUnit/Attempt/claim/Operation/candidate/review lineage and driver/native references/provenance; keep current read-back separate from historical receipts and UI progress.
  2. Compose #56's unitful known/estimated/reported/measured/unknown observations without double counting corrections or assuming missing hidden calls, charges, reviewer time or remote settlement are zero.
  3. Basic cooperative and strict Router profiles expose different evidence availability explicitly; unavailable route/usage is representable, not a blanket #52 gate on local export.
  4. Export defaults local/private; redact/refuse according to explicit owner policy and source rights. Local creation is not upload, MI operational intake, consent or Router learning authority.
  5. Installed schema/version/old-record/unsupported/corrupt/privacy/correction/crash tests prove the actual composed pipeline. PASS/APPROVE is conditional exact-subject evidence, not causal model quality.

Dependencies

Native predecessor plan: #56, #106 and #54. #56, #106 and accepted #54 lineage; #52 enriches strict-profile facts only. SR #177 is an optional downstream local consumer. MI #17 is closed with rejected operational sharing; it is neither an export prerequisite nor implicit publication permission. Native edge publication is separate from this body amendment.

Constraints

ADR 0012 and ADR 0011 govern this work. Keep inward dependencies (adapters -> ports -> core) and a self-contained public core. No new coding agent, tracker, catalogue, gateway or generic workflow DSL; no credential/runtime-state copying. Preserve old bytes, IDs and unknowns, all historical evidence and review counters, and #53 CLOSED/NOT IMPLEMENTED with PR #85 CLOSED/UNMERGED; its diagnostic is not accepted implementation. Require synthetic offline tests plus the installed path and fresh independent exact-subject review. Live inference/effects/releases require separate authority. Registration/publication grants no production credentials, paid/live execution, external mutation, release or deployment authority.

The single active priority above follows the integrated Priority Contract: P2 is required integration, evidence/operability or installed reception, not a budget or deadline. Eligibility and evidence precede priority; no rank bypasses prerequisites, owner decisions or STOP_REVISE. Historical descriptive priorities are superseded, not deleted. Excluded invalid/wontfix/duplicate dispositions and unchanged /loop ordering remain intact; this amendment selects no feature for execution.

Producer evidence correction supplied for this publication: SR develop 4a182affa4775a4a38b47860ad7622a099c56c4a, #222/PR #223, integrates default-off D-082 opt-in MI admission. It does not establish real-source positive adoption, authorize operational sharing or expand this Kernel issue's external scope; Router/MI operation and policy remain their owners' responsibility.

Historical Scope And Evidence

Goal

Owner: Kernel outcome/evidence producer. Integrate durable complete-task observations with a versioned local-by-default export and explicit authorized sharing contract; Router owns downstream consumption/calibration and MI owns any separately agreed operational evidence intake. Source: shared architecture v1.0, sections 1-8, 9.2-9.4, 10-18 via #46 brief.

Why

Users need evidence of the cost and acceptance path, not only final success or a thin allocation summary. PASS/APPROVE is conditional exact-subject evidence, not absolute model quality or a causal ranking; private task data cannot become public telemetry by default.

Current Evidence

At eb4f4a2956, core/outcomes.py export_outcomes models units/provenance/unknown/correction/deduplication but has no task application call site. reference.py reference_export is richer than task_execution.py export_task_store:1121-1165, which omits full identity/provenance, usage, checks/remediation and cancellation. Persisted PR receipt is historical observation, not current remote status. #7/#10 are foundations and expressly excluded analytics/telemetry.

Scope

Connect whole-task budget/outcomes and exact candidate/verdict/finding lineage to durable export, including failure/review/remediation/retry/tools/auxiliary/owner intervention. Publish compatibility/validation/redaction semantics after inspecting producer-consumer needs; retain local files/user storage by default. Sharing requires explicit destination/scope/rights consent and known licence constraints, not automatic upload.

Acceptance Criteria

  1. Offline scenario exports task/Attempt/session/route/call/candidate/spec/policy/verdict/provenance, the selected trust profile, original deadline decision, STOP/cancellation outcome and multidimensional consumption/unknowns for the whole journey; imported/consumer fixture reproduces facts without granting authority. Native effects during the termination interval are not exported as zero or rolled back, and no field/receipt claims strict native syscall expiry.
  2. Duplicate/corrected receipts, missing identity/usage, abandoned attempts, failed checks, stale review and moved remote PR are represented honestly; no final-Attempt-only costs or historic receipt labelled current.
  3. Unsupported schema, malformed/incomplete/corrupt export and restricted-source evidence fail safely; migrations retain immutable subject IDs and corrections without rewriting historical provenance.
  4. Default produces no network upload. Explicit sharing tests prove destination/authority/redaction and refusal of secrets/private prompts/workload content outside consent; revocation stops future sharing.
  5. Explain causal limitations, selection bias and conditional PASS/APPROVE; no automatic quality score/global benchmark, learned routing or public model claim.
  6. Actual Router consumer conformance covers allowed local evidence and unknowns; optional MI contract is proved separately. Safe CLI diagnostics/docs, links and gates/exact-HEAD independent review.

Do not add telemetry, prompt contents, a new service, or inferred provider usage.

Reuse

Adopt existing core outcomes, correction lineage and receipt dedupe; compare reference export and durable artifact manifest before adding types. Router #177 and MI #17 are counterparts, not authority to publish. Verify exact revisions/files/license/data rights/negative/privacy/dependency/maintenance before external telemetry or formats; OpenTelemetry is diagnostic candidate, not the durable source.

Dependencies And Priority

After whole-task cost collection, #54 review/remediation and #52 identity; can specify version/rights now. Router #177 owns consumption/calibration; MI #17 owns a privacy decision about optional evidence sharing. Required before claims about accepted-result efficiency, not a reason to delay safety repairs.

Constraints And Permissions

No central telemetry, causal certainty, model ranking, prompts in evidence by default, shared state DB or automatic publication. Synthetic/local export needs no inference; real evidence capture and any upload require separately approved inference/effect/service/privacy scope. Registration grants none.

Non-Goals

No analytics platform, automatic data redistribution, ranking or learning implementation.

Priority: P2 Type: implementation. This active scope supersedes conflicting historical descriptive scope, priorities and dependencies. The entire previous body is preserved unchanged under Historical Scope And Evidence; its evidence, unknowns, dispositions and review counters are not reset. PR #104 is integrated at `ace7175e087cd70e207594f5631c8f4f70fabfd4`; historical pending wording is not current integration status. Prepared A/B are registered as #105/#106. Publication is not feature implementation or overall alignment acceptance. ## Goal Export the whole accepted-result journey and uncertainties from durable work/effect/evidence records. ## Why Thin task/reference/pure-outcomes paths are distinct and not one collection pipeline. Retain prior local/privacy/causality specification. ## Scope Versioned origin-local outcome schema and installed export spanning both modes and independent drivers, attributable Attempts/checks/review/remediation/effects/resources and corrections. ## Acceptance Criteria 1. Bind exact Program/spec/WorkUnit/Attempt/claim/Operation/candidate/review lineage and driver/native references/provenance; keep current read-back separate from historical receipts and UI progress. 2. Compose #56's unitful known/estimated/reported/measured/unknown observations without double counting corrections or assuming missing hidden calls, charges, reviewer time or remote settlement are zero. 3. Basic cooperative and strict Router profiles expose different evidence availability explicitly; unavailable route/usage is representable, not a blanket #52 gate on local export. 4. Export defaults local/private; redact/refuse according to explicit owner policy and source rights. Local creation is not upload, MI operational intake, consent or Router learning authority. 5. Installed schema/version/old-record/unsupported/corrupt/privacy/correction/crash tests prove the actual composed pipeline. PASS/APPROVE is conditional exact-subject evidence, not causal model quality. ## Dependencies Native predecessor plan: #56, #106 and #54. #56, #106 and accepted #54 lineage; #52 enriches strict-profile facts only. SR #177 is an optional downstream local consumer. MI #17 is closed with rejected operational sharing; it is neither an export prerequisite nor implicit publication permission. Native edge publication is separate from this body amendment. ## Constraints ADR 0012 and ADR 0011 govern this work. Keep inward dependencies (`adapters -> ports -> core`) and a self-contained public core. No new coding agent, tracker, catalogue, gateway or generic workflow DSL; no credential/runtime-state copying. Preserve old bytes, IDs and unknowns, all historical evidence and review counters, and #53 CLOSED/NOT IMPLEMENTED with PR #85 CLOSED/UNMERGED; its diagnostic is not accepted implementation. Require synthetic offline tests plus the installed path and fresh independent exact-subject review. Live inference/effects/releases require separate authority. Registration/publication grants no production credentials, paid/live execution, external mutation, release or deployment authority. The single active priority above follows the integrated Priority Contract: P2 is required integration, evidence/operability or installed reception, not a budget or deadline. Eligibility and evidence precede priority; no rank bypasses prerequisites, owner decisions or STOP_REVISE. Historical descriptive priorities are superseded, not deleted. Excluded invalid/wontfix/duplicate dispositions and unchanged /loop ordering remain intact; this amendment selects no feature for execution. Producer evidence correction supplied for this publication: SR develop `4a182affa4775a4a38b47860ad7622a099c56c4a`, #222/PR #223, integrates default-off D-082 opt-in MI admission. It does not establish real-source positive adoption, authorize operational sharing or expand this Kernel issue's external scope; Router/MI operation and policy remain their owners' responsibility. ## Links - Architecture/backlog mandate: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/103 - Integrated architecture PR #104: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/104 (merge `ace7175e087cd70e207594f5631c8f4f70fabfd4`). - ADR 0012: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/adr/0012-unified-work-coordination-and-drivers.md - ADR 0011: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/adr/0011-task-level-authority-and-trusted-development.md - Current target: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/architecture/target.md - Migration: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/architecture/migration.md - Exact publication payload, Shared Constraints and Priority Contract: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/architecture/backlog-alignment.md - Work policy: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/56 ; ordinary engine: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/106 ; accepted review lineage: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/54 ; review implementation: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/92 - Existing outcome/export source: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/src/creatidy_kernel/core/outcomes.py ; https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/src/creatidy_kernel/adapters/reference.py ; https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/src/creatidy_kernel/adapters/task_execution.py - Prior privacy specification: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/architecture/successor.md#g07-local-outcome-export-boundaries-planned ; PR #96: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/96 ; receipt: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/58#issuecomment-17678 - Optional downstream consumer: https://forgejo.creatidy.com/BioMedical-IT/scarcity-router/issues/177 ; rejected sharing: https://forgejo.creatidy.com/Creatidy/model-intelligence/issues/17 - Separate producer observation: https://forgejo.creatidy.com/BioMedical-IT/scarcity-router/issues/222 ; https://forgejo.creatidy.com/BioMedical-IT/scarcity-router/pulls/223 ## Historical Scope And Evidence ## Goal Owner: Kernel outcome/evidence producer. Integrate durable complete-task observations with a versioned local-by-default export and explicit authorized sharing contract; Router owns downstream consumption/calibration and MI owns any separately agreed operational evidence intake. Source: shared architecture v1.0, sections 1-8, 9.2-9.4, 10-18 via #46 brief. ## Why Users need evidence of the cost and acceptance path, not only final success or a thin allocation summary. PASS/APPROVE is conditional exact-subject evidence, not absolute model quality or a causal ranking; private task data cannot become public telemetry by default. ## Current Evidence At eb4f4a2956712bfaf39a3271e1523e7f77a91e26, core/outcomes.py export_outcomes models units/provenance/unknown/correction/deduplication but has no task application call site. reference.py reference_export is richer than task_execution.py export_task_store:1121-1165, which omits full identity/provenance, usage, checks/remediation and cancellation. Persisted PR receipt is historical observation, not current remote status. #7/#10 are foundations and expressly excluded analytics/telemetry. ## Scope Connect whole-task budget/outcomes and exact candidate/verdict/finding lineage to durable export, including failure/review/remediation/retry/tools/auxiliary/owner intervention. Publish compatibility/validation/redaction semantics after inspecting producer-consumer needs; retain local files/user storage by default. Sharing requires explicit destination/scope/rights consent and known licence constraints, not automatic upload. ## Acceptance Criteria 1. Offline scenario exports task/Attempt/session/route/call/candidate/spec/policy/verdict/provenance, the selected trust profile, original deadline decision, STOP/cancellation outcome and multidimensional consumption/unknowns for the whole journey; imported/consumer fixture reproduces facts without granting authority. Native effects during the termination interval are not exported as zero or rolled back, and no field/receipt claims strict native syscall expiry. 2. Duplicate/corrected receipts, missing identity/usage, abandoned attempts, failed checks, stale review and moved remote PR are represented honestly; no final-Attempt-only costs or historic receipt labelled current. 3. Unsupported schema, malformed/incomplete/corrupt export and restricted-source evidence fail safely; migrations retain immutable subject IDs and corrections without rewriting historical provenance. 4. Default produces no network upload. Explicit sharing tests prove destination/authority/redaction and refusal of secrets/private prompts/workload content outside consent; revocation stops future sharing. 5. Explain causal limitations, selection bias and conditional PASS/APPROVE; no automatic quality score/global benchmark, learned routing or public model claim. 6. Actual Router consumer conformance covers allowed local evidence and unknowns; optional MI contract is proved separately. Safe CLI diagnostics/docs, links and gates/exact-HEAD independent review. Do not add telemetry, prompt contents, a new service, or inferred provider usage. ## Reuse Adopt existing core outcomes, correction lineage and receipt dedupe; compare reference export and durable artifact manifest before adding types. Router #177 and MI #17 are counterparts, not authority to publish. Verify exact revisions/files/license/data rights/negative/privacy/dependency/maintenance before external telemetry or formats; OpenTelemetry is diagnostic candidate, not the durable source. ## Dependencies And Priority After whole-task cost collection, #54 review/remediation and #52 identity; can specify version/rights now. Router #177 owns consumption/calibration; MI #17 owns a privacy decision about optional evidence sharing. Required before claims about accepted-result efficiency, not a reason to delay safety repairs. ## Constraints And Permissions No central telemetry, causal certainty, model ranking, prompts in evidence by default, shared state DB or automatic publication. Synthetic/local export needs no inference; real evidence capture and any upload require separately approved inference/effect/service/privacy scope. Registration grants none. ## Links - Parent: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/46 - Existing domain: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/7 - Router consumer: https://forgejo.creatidy.com/BioMedical-IT/scarcity-router/issues/177 - MI privacy counterpart: https://forgejo.creatidy.com/Creatidy/model-intelligence/issues/17 - Product review: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/54 ## Non-Goals No analytics platform, automatic data redistribution, ranking or learning implementation.
Author
Member

The explicitly permitted local export/version/rights specification slice is committed as 20e7f3e50361d80115f3a892566103ac59bf1973 and submitted in PR #96: #96. It distinguishes the task schema-1 export, reference-only export and pure outcome model, preserves unknowns/corrections/provenance, and documents that local JSON is neither redacted nor sharing-authorized. No upload, MI intake or new format is implemented. make check and make package-check passed. This does not complete #58; issue remains open pending whole-task collection, correlation, consumer conformance and the remaining acceptance criteria.

The explicitly permitted local export/version/rights specification slice is committed as `20e7f3e50361d80115f3a892566103ac59bf1973` and submitted in PR #96: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/96. It distinguishes the task schema-1 export, reference-only export and pure outcome model, preserves unknowns/corrections/provenance, and documents that local JSON is neither redacted nor sharing-authorized. No upload, MI intake or new format is implemented. `make check` and `make package-check` passed. This does not complete #58; issue remains open pending whole-task collection, correlation, consumer conformance and the remaining acceptance criteria.
Author
Member

PR #96 is integrated in merge commit 98656f6e6ed5fed3d254405cf551665ebcb6c4ed, with first parent base f7db85188a0c20438f2b3e8ccbbeb28ada012425 and reviewed head 20e7f3e50361d80115f3a892566103ac59bf1973; Git confirms the reviewed head is an ancestor of current develop. Exact-head workflow #2919 succeeded, independent review ordinal 1/10 approved with no findings, and make check/make package-check passed on the approved tree. This integrates only the local export/version/rights specification. Full-cost collection, route/call correlation, consumer conformance and full #58 acceptance remain incomplete, so issue #58 stays open.

PR #96 is integrated in merge commit `98656f6e6ed5fed3d254405cf551665ebcb6c4ed`, with first parent base `f7db85188a0c20438f2b3e8ccbbeb28ada012425` and reviewed head `20e7f3e50361d80115f3a892566103ac59bf1973`; Git confirms the reviewed head is an ancestor of current `develop`. Exact-head workflow #2919 succeeded, independent review ordinal 1/10 approved with no findings, and `make check`/`make package-check` passed on the approved tree. This integrates only the local export/version/rights specification. Full-cost collection, route/call correlation, consumer conformance and full #58 acceptance remain incomplete, so issue #58 stays open.
Author
Member

Implementation PR #116 is open against develop at 57b3bb6ad81b3b6d2f6702af66e92124a6c15961 (base da9c736fe61ba33c3d1889f15949948928eb4dea). Sanitized make check passed (2479 tests, 89 optional skips, 106 subtests), make package-check and make audit passed. The explicit private metadata policy excludes raw source content and preserves unknown cost/route/settlement; local creation does not grant sharing or production authority. Fresh independent whole-PR review and exact-head CI remain pending. Prior #96 specification review remains ordinal 1/10.

Implementation PR #116 is open against `develop` at `57b3bb6ad81b3b6d2f6702af66e92124a6c15961` (base `da9c736fe61ba33c3d1889f15949948928eb4dea`). Sanitized `make check` passed (2479 tests, 89 optional skips, 106 subtests), `make package-check` and `make audit` passed. The explicit private metadata policy excludes raw source content and preserves unknown cost/route/settlement; local creation does not grant sharing or production authority. Fresh independent whole-PR review and exact-head CI remain pending. Prior #96 specification review remains ordinal 1/10.
Author
Member

Integrated via PR #116: merge 97fedb7e3c67026c5987a2806a419cef914fdad7, approved head 30dbf76f74d545037c4fb546d06293500dbcd660, reviewed base da9c736fe61ba33c3d1889f15949948928eb4dea. Exact-head independent review 10/10 APPROVE with no findings; exact-head CI #3518 succeeded. Full sanitized make check: 2501 passed, 89 optional skips, 106 subtests; make package-check passed including installed/reopened producer, privacy and historical decision evidence; make audit found no known vulnerabilities. Verified merge parents and identical tree against approved head. Evidence remains local/private and does not establish live inference, remote sharing, billing completeness, hostile-process containment or product GO. Earlier review and remediation history is preserved.

Integrated via PR #116: merge `97fedb7e3c67026c5987a2806a419cef914fdad7`, approved head `30dbf76f74d545037c4fb546d06293500dbcd660`, reviewed base `da9c736fe61ba33c3d1889f15949948928eb4dea`. Exact-head independent review 10/10 APPROVE with no findings; exact-head CI #3518 succeeded. Full sanitized `make check`: 2501 passed, 89 optional skips, 106 subtests; `make package-check` passed including installed/reopened producer, privacy and historical decision evidence; `make audit` found no known vulnerabilities. Verified merge parents and identical tree against approved head. Evidence remains local/private and does not establish live inference, remote sharing, billing completeness, hostile-process containment or product GO. Earlier review and remediation history is preserved.
kilo closed this issue 2026-11-04 06:23:12 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
Creatidy/creatidy-kernel#58
No description provided.