Repository navigation
Source revision observations for durable policy sync and governed action admission #295
Description
Track Gateway responsibilities from Judgment-Pack/judgment-pack-spec#211 / draft PR #212. Reuse existing provider connections and credential custody. Start from an actual supported document reader/revision source; retain original bytes, extraction identity, opaque provider revision and raw lifecycle evidence when genuinely exposed.
Gateway supplies observations; Desk owns recurring sync state/cursors, authority interpretation and policy lifecycle. Same content with changed lifecycle metadata must remain observable. Deletion, permission loss and fetch failure must not be inferred as withdrawal. Explicitly report snapshot-only/gap/completeness; do not claim a file reader is a change feed or an approval integration.
At implemented external-action adapters, consume scoped current governance admission in addition to existing action authorization. Bind exact release/payload/attempt/executor identity, reconcile uncertain dispatch and never execute from a recovered audit receipt. Gateway does not become the policy authority.
Acceptance and exact provider/transport contracts to follow reviewed interfaces. Cross-provider tests should cover duplicate/out-of-order observations, changed metadata with identical bytes, failed reads, unavailable admission, and action-after-policy-withdrawal. No new identity provider or credential store is proposed.
Concrete first-provider assessment (2026-10-18)
Google Drive is the initial implementation candidate, reusing the existing provider connection and document reader. Inspection of Gateway main at e1a15d027aabbbc4037f95b9856e069d70f8b30e confirms the acquisition adapter retains an exact provider version and checks metadata before/after reading, but consumes a one-use selection grant. Existing storage reads are revision/context-bound; neither is a durable subscription or source lifecycle assertion. Do not silently reuse picker consent as recurring-read authorization.
Before Desk can advertise automatic policy sync:
- Add explicitly consented, resource-scoped recurring reads bound to the current provider account/connection epoch and revocable independently of chat. Keep credentials in Gateway. Disconnect/reconnect must invalidate or require review of old bindings.
- Return bounded retained observations with exact original/exported bytes, extraction identity, provider revision, availability and
snapshot-onlycoverage for scheduled reconciliation. A polling implementation must not imply every intermediate revision was captured. - Preserve unknown/unavailable separately from deleted. Drive's changes
removedcan mean deletion OR loss of access; it is not proof of policy withdrawal. A permission failure cannot withdraw a Desk-managed publication. - The current adapter exposes no verified policy-approval/publication/withdrawal authority. Mark lifecycle
not-exposed; external publication would require a separately reviewed authority mapping and actual lifecycle evidence. - If later adopting
changes.list, retain account/shared-drive-scoped cursors with observation commit, reconcile gaps and keep current snapshot semantics. Provider revision is a string, not a JavaScript number or a cross-provider ordering convention. - Prove revocation, restart, changed connection epoch, unchanged bytes/new version, read-during-change, provider failure and oversized source behavior before Desk wires recurring work.
Sources: current Drive adapter, Google File version semantics, Google Change removal semantics, Google change retrieval.
Desk's next manual import/shared-chat slice is Judgment-Pack/judgment-pack-desk#459. It deliberately does not satisfy the automatic-sync requirement in Desk#455.
Activity
kikashy commentedon Oct 18, 2026
The recurring connected-source portion is implemented in Draft #297, with green full CI and passing exact producer→Desk contract CI. Consumer: Judgment-Pack/judgment-pack-desk#462.
This covers explicit per-resource recurring consent, durable revocation/recovery, account/authority checks, exact original/extraction identities and snapshot-only capability disclosure. It does not claim external approval/withdrawal authority or implement the separate governing-adoption/action-admission portion of this issue. Keep #295 open for that boundary. Required independent review and a supported release are still pending.
Add revocable recurring Drive source observations (#297)
kikashy commentedon Oct 18, 2026
Reopening the remaining scope of this issue. The recurring Google Drive snapshot-observation portion shipped in #297 and Gateway v0.20.0; Desk adopted it in Judgment-Pack/judgment-pack-desk#463. That delivery is complete.
The issue also requires current governance admission for external actions, exact release/payload/attempt/executor binding, uncertain-dispatch reconciliation, and action-after-withdrawal checks. Those are not implemented by the source-observation work. The earlier progress comment explicitly retained this boundary as open.
Broader lifecycle evidence/event coverage also remains distinct from the shipped
snapshot-onlyand lifecyclenot-exposedcontract. Current publication/source-sync completion does not establish policy-withdrawal enforcement. Dependencies remain Spec #211 / Draft #212, Desk #455 and Runner #147 in their respective repositories. This status correction does not add a provider action capability or adopt the draft contract.kikashy commentedon Oct 18, 2026
Accepted source-status decision — 2026-10-18
Use a capability-driven boundary across supported providers. When a source exposes lifecycle status, Gateway retains the actual resource/revision/status evidence; Desk applies an administrator-reviewed mapping. When that lifecycle capability is absent, Desk uses an explicitly administrator-configured fallback, initially Draft, with
admin-configuredprovenance.Missing capability is different from a failed fetch, inaccessible resource, revoked grant, deleted file or unknown state from a capable provider. Those cases do not invoke the fallback or overwrite the last known lifecycle. They must retain their availability/freshness failure separately. A status supplied by administrative configuration must never be represented as external approval or verified sign-off.
The current Google Drive path remains
snapshot-only/ lifecyclenot-exposed. No new source provider or lifecycle adapter is claimed by this decision. Desk #469 supplies a separate local lifecycle foundation; externally managed publication and authority mapping remain open under Desk #455 and this issue. Existing job pins and execution admission are unchanged.kikashy commentedon Oct 19, 2026
Cross-repository progress: Runner #161 and Desk #525 now provide the explicitly opt-in private
local-admin-manual-pack/1start-admission slice, with passing actual Desk → Runner → Runtime withdrawal/lost-reply acceptance. Current Policy lifecycle and manual dispatch consult the same anchored Desk authority; this does not turn Gateway source observations into publication or approval authority.No Gateway contract or release changes are part of this slice. This issue remains open for source-specific lifecycle evidence, recurring synchronization/consent and governed external-action admission. Manual Pack start commitment does not authorize later external actions, acquisition, workflows or provider operations; unsupported paths are held in enabled workspaces. Installed Desk and held Runtime publication remain unchanged.
Final Desk merge:
c4e6ef5c6170e7d134c8c3960adc7a9c909bc2bb; treead65c7b1921c9edad46c103d00b9e289d1bf9e61equals the reviewed head. Final required CI and all seven actual manual-admission results passed.