Architecture decisions
ADR 0002: Canonical evaluation contract
- Status: Accepted
- Date: 2026-10-03
Context
Gateway verdicts, detector observations, transformations, and execution failures are different concerns. Collapsing them into one status makes degraded coverage look clean and couples policy to detector implementations.
Decision
Use paired request/response events linked by a fresh step_id. The only core
decision values are allow and block. Findings, modifications, unjudged checks,
timings, policy digest, and detector versions are orthogonal fields. Detectors
produce findings and coverage; a deterministic composer alone decides.
Authenticated server context—not body fields—selects tenant and policy binding.
Consequences
- Flagging is represented by allow plus findings; redaction by modifications.
- Detector failure remains visible even if policy permits continuation.
- Gateways require adapters to map this richer result to local semantics.
- Workflow concepts such as warn or escalate can be added above the core wire decision without expanding its vocabulary.