Status: Accepted (2026-07-13)
Date: 2026-07-13
Related: ADR-005, ADR-019, ADR-031
Decision: Retain policy threshold, but define it as a hard
clean-channel accountability gate evaluated before the blast/differ decision
table. A release whose effective_trust is below the active policy threshold
MUST NOT enter the clean channel under the baseline decision profile regardless
of blast score, differ availability, or compatibility evidence.
The deterministic baseline decision order is:
demote or inflate).The baseline threshold is T2. Before empirical validation of independent
agent review efficacy, T1 does not satisfy the portable baseline clean profile.
Policies may choose other thresholds, but conformance claims must bind the
threshold used.
Compatibility evidence, accountability evidence, and operational blast/risk policy are separate inputs. Trust levels order accountability only; they are not quality, security, safety, compatibility, or defect-probability scores. Provider-specific blast scoring is portable only when a named, versioned blast-scoring profile defines the mapping. Otherwise blast is local policy input recorded in attestations but not a cross-implementation conformance claim.
Release successor predicates must bind the threshold in the release decision so replay does not depend on ambient policy interpretation.
Rationale: The prior draft described threshold as the minimum clean-channel
trust level while the decision table and oracle allowed a T1 clean release in
one cell. That made conforming implementations disagree about the same
evidence. Making threshold an explicit precedence step restores the meaning of
the policy vocabulary and keeps the clean-channel decision reproducible.
Separating the inputs preserves ADR-019. Effective trust may be used as an accountability gate, but treating it as an inverse risk scalar would smuggle a quality/security claim into a level system that intentionally does not make one. Blast scoring remains useful, but only as policy evidence with explicit profile identity or local scope.
Keeping demote and inflate as rendering strategies preserves ADR-005 while
making clear that both strategies consume the same deterministic baseline
decision about whether the clean claim is supported.
Rejected: remove threshold entirely (would leave existing policy
vocabulary misleading and force every clean-channel choice into the table);
allow the table to override threshold (recreates the mismatch); define a
portable numeric blast-risk formula now (false precision and provider gaming);
allow T1 into the baseline clean channel before evidence exists for T1 efficacy
(would imply a risk/quality claim the spec does not have); treat provider-local
blast scores as cross-implementation conformance facts (unportable without a
profile).
Revisit trigger: empirical validation supports a different portable
baseline threshold; a versioned blast-scoring profile is adopted; or
implementation experience shows inflate requires a pinned escalation target
rather than a policy-local choice.