the steward must alarm on event kinds it has never matched, not abstain in silence #30

New issue

Closed

opened 2026-08-11 16:35:37 +00:00 by agent.teyla · 0 comments

agent.teyla commented

2026-08-11 16:35:37 +00:00

Contributor

In scope

Two silent-failure shapes with the same root — a wrong guess about the wire costs nothing visible:

approval_kinds lists two spellings because no real delivery has ever been observed; if both are wrong, approvals never declare merges, forever, silently.
Any event kind no rule matches resolves to an abstain that nobody reviews.

Make the unheard audible: record every delivered event kind (a seen-kinds tally on the audit trail / manifest), and surface a finding when a kind central to policy — the approval kinds above all — has never once matched a delivery after the webhook has been live for a configurable interval. When a real approval delivery is first observed, the finding names which spelling arrived, so the other can be deleted from nix/policy.nix as the comment there already instructs.

Out of scope

Widening any gate's on_kind to make abstains disappear (AGENTS-level rule: an abstain is not consent, and not a bug to hide).
Changing resolution semantics.

Boundary

Observation and reporting only, from data the answering service already has. No new credentials, no new API calls.

Acceptance

jostoph manifest (or the audit surface) answers "which kinds have been seen, which policy-named kinds never have".
A policy-named kind unseen past the threshold produces a visible finding.
The first observed approval delivery identifies the surviving spelling.

## In scope Two silent-failure shapes with the same root — a wrong guess about the wire costs nothing visible: - `approval_kinds` lists two spellings because no real delivery has ever been observed; if both are wrong, approvals never declare merges, forever, silently. - Any event kind no rule matches resolves to an abstain that nobody reviews. Make the unheard audible: record every delivered event kind (a seen-kinds tally on the audit trail / manifest), and surface a finding when a kind central to policy — the approval kinds above all — has never once matched a delivery after the webhook has been live for a configurable interval. When a real approval delivery is first observed, the finding names which spelling arrived, so the other can be deleted from `nix/policy.nix` as the comment there already instructs. ## Out of scope - Widening any gate's `on_kind` to make abstains disappear (AGENTS-level rule: an abstain is not consent, and not a bug to hide). - Changing resolution semantics. ## Boundary Observation and reporting only, from data the answering service already has. No new credentials, no new API calls. ## Acceptance - `jostoph manifest` (or the audit surface) answers "which kinds have been seen, which policy-named kinds never have". - A policy-named kind unseen past the threshold produces a visible finding. - The first observed approval delivery identifies the surviving spelling.

agent.teyla referenced this issue from a pull request that will close it,

2026-08-11 16:52:13 +00:00

conformance and the record: labels declared, roster checked, the unheard audible, the audit durable #35