2.3 KiB
Formal Decisions Domain
Ownership And Reconstruction
Decisions stores immutable formal-outcome revisions. Each outcome retains the responsible human or service actor, represented function/party, effective Mandate and jurisdiction, approvals, fact evidence, legal bases, rule versions, reasoning, operative result, requested and observed effects, delivery, publication, remedy, and review references.
The ordinary read projection withholds protected reasoning and operative content. A separate sensitive-read permission is required to disclose it.
Unversioned list and detail reads follow the platform temporal-data context. Valid time determines when the outcome applied; recorded time reconstructs which revision the system knew then. Exact revision references bypass that projection. Permissions and mutation targets always use current state.
Lifecycle
Writes use the shared Decision transition matrix and optimistic concurrency. Correction and revocation create linked revisions; they never edit the previous outcome in place. Replaying an identical tenant/decision/revision is idempotent, while a different payload under that revision fails.
Recovery
Database restore is the persistence recovery unit. Requested effects remain separate from observed effects and keep audit/evidence references, allowing an operator to reconcile an outcome whose external effect was uncertain. Domain effect providers retain their own compensation and recovery behavior.
Records Filing
Decisions publishes the optional records.source.decisions capability. It
resolves only an exact immutable decision_revision in the acting tenant and
requires both ordinary and protected Decision read authority because the
filing digest represents the complete formal outcome, including protected
reasoning and operative content. Records stores a bounded label, lifecycle
metadata, and SHA-256-bound source reference; Decisions remains authoritative
and current access is checked again whenever the source is reconstructed.
Search
When Search is enabled, decisions.decisions indexes only bounded Decision
metadata, subject identifiers, legal-basis references, effect references, and
the linked Case route. Operative results, reasoning, and conditions are never
copied into the search index. Every result is tenant-bound and rechecked against
the current Decision read permission before disclosure.