50 lines
2.3 KiB
Markdown
50 lines
2.3 KiB
Markdown
# Formal Decisions Domain
|
|
|
|
## Ownership And Reconstruction
|
|
|
|
Decisions stores immutable formal-outcome revisions. Each outcome retains the
|
|
responsible human or service actor, represented function/party, effective
|
|
Mandate and jurisdiction, approvals, fact evidence, legal bases, rule versions,
|
|
reasoning, operative result, requested and observed effects, delivery,
|
|
publication, remedy, and review references.
|
|
|
|
The ordinary read projection withholds protected reasoning and operative
|
|
content. A separate sensitive-read permission is required to disclose it.
|
|
|
|
Unversioned list and detail reads follow the platform temporal-data context.
|
|
Valid time determines when the outcome applied; recorded time reconstructs
|
|
which revision the system knew then. Exact revision references bypass that
|
|
projection. Permissions and mutation targets always use current state.
|
|
|
|
## Lifecycle
|
|
|
|
Writes use the shared Decision transition matrix and optimistic concurrency.
|
|
Correction and revocation create linked revisions; they never edit the previous
|
|
outcome in place. Replaying an identical tenant/decision/revision is idempotent,
|
|
while a different payload under that revision fails.
|
|
|
|
## Recovery
|
|
|
|
Database restore is the persistence recovery unit. Requested effects remain
|
|
separate from observed effects and keep audit/evidence references, allowing an
|
|
operator to reconcile an outcome whose external effect was uncertain. Domain
|
|
effect providers retain their own compensation and recovery behavior.
|
|
|
|
## Records Filing
|
|
|
|
Decisions publishes the optional `records.source.decisions` capability. It
|
|
resolves only an exact immutable `decision_revision` in the acting tenant and
|
|
requires both ordinary and protected Decision read authority because the
|
|
filing digest represents the complete formal outcome, including protected
|
|
reasoning and operative content. Records stores a bounded label, lifecycle
|
|
metadata, and SHA-256-bound source reference; Decisions remains authoritative
|
|
and current access is checked again whenever the source is reconstructed.
|
|
|
|
## Search
|
|
|
|
When Search is enabled, `decisions.decisions` indexes only bounded Decision
|
|
metadata, subject identifiers, legal-basis references, effect references, and
|
|
the linked Case route. Operative results, reasoning, and conditions are never
|
|
copied into the search index. Every result is tenant-bound and rechecked against
|
|
the current Decision read permission before disclosure.
|