Decision records

Every piece of the governance system traces back to a numbered document that says what was decided, why, and what the alternatives were. “Why is it like this?” always has an answer on file.

The paper trail lives in docs/ — ADRs (one decision each), RFCs (designs big enough to argue about), and PRDs (what a whole program of work is for). They matter here for one reason: they are how the system stays legible. An enforcement layer nobody understands gets worked around; one whose reasoning is on file gets maintained.

The operator-authority decision chain

The enforcement plane this site documents was built as a sequence of recorded decisions. Read in order, they are the system’s biography:

Record	Decision
`ADR 0105`	Secrets move to a broker on a separate machine (`prontera`), in three phases. The anchor for HARD RULE 10 and INV-024 — see secret handling.
`ADR 0110`	One canonical machine-readable rulebook: `AGENT_POLICY.yaml`. Every check reads it; none keeps a private copy of the rules.
`ADR 0111`	One shared pre-flight gate for all agents, with the exit-code contract (0 allow / 2 deny) and a latency budget — the gate must stay fast enough that nobody is tempted to remove it (stdlib-only, no heavy imports).
`ADR 0112`	A Landlock floor under every agent, installed by the shims: default-deny writes, plus a pre-launch scan for secret files.
`ADR 0113`	Codex loses its bypass — it runs under the same walls, with snapshot-and-sweep standing in for the per-action hook it lacks.
`ADR 0114`	The Morpheus drain migrates onto the shared policy, keeping a back-compat shim so the migration couldn’t break the nightly runs.
`ADR 0115`	The worker-moth agent is read-only, permanently — enforced by a CI scanner (`moth-no-write`).
`ADR 0116`	GitHub becomes an enforcement layer: branch protection, CODEOWNERS, and the required checks.
`ADR 0117`	The operator gets a live control surface — the Agent Authority dashboard and its database schema.
`ADR 0118`	Every invariant gets a fitness test — a rule without a failing test is a wish.

The wider program

RFC 0079 — the operator-authority architecture as one design: the five layers and how they compose. The blueprint the ADRs above implement.
PRD 0042 — the master program (goals G1–G10). Its stated target is a posture shift: from roughly 40% prevention / 40% detection / 20% paperwork to 70% prevention, 20% detection, 10% paperwork — stop things before they happen instead of noticing afterwards.
PRD 0041 — the access-request waitlist rebuilt after the 2026-05-23 incident, this time with broker-resolved secrets from the start. The first project run under the new rules, and the reason several of them exist.
docs/schemas/morpheus-pending-approval.schema.json — the formal shape of an approval ticket (appr-YYYYMMDD-NN, with a full lifecycle from pending through approved/denied/expired to executed), so approvals are data, not chat messages.

The honest mirror: audits and the changelog

Two more document types keep the record honest in the other direction — what the system actually looks like, including where it falls short:

CHANGELOG.md — every merged change, in Keep-a-Changelog format with semantic versions. Maintained because HARD RULE 8 requires it and the changelog-updated guard blocks merges without it.
docs/audits/ — dated forensic audits. The 2026-05-28 rules audit measured the codebase against the standards and recorded eight blocking violations by name — including a 10,806-line god class (runtime.py) and 535 type-system escape hatches (as any) in the dashboard. None of it hidden, all of it numbered, so progress against it is measurable.