ADR-0017: Proposals — one governed advice record; autonomy is earned in bands

Status

Accepted

Date

2026-07-03

Context

Three proposal-shaped things already exist in canon: Acts carry a Pending(approval) outcome (LLD: the kernel owns the approval outcome); branch merges emit “ordered proposed Acts + a conflict report”; and bounded-auto policy “demotes to a proposal” when an adjustment exceeds its declared envelope. Meanwhile the product thesis and the BSNL tender both demand a fourth: AI advice that is decision-support, never automation — ranked hypotheses with confidence and XAI narratives, human-confirmed, with measured accuracy (false-positive-rate SLAs, quarterly precision/recall, published model cards) and accountability shared between the system and the human (the “AI co-signature” that de-risks defensive over-rejection — see the trust machine).

Left alone, these become three or four divergent implementations of “someone suggested an Act and someone decided.” The agreement telemetry the tender prices — and the autonomy expansion the product philosophy promises only where accuracy has earned it — need one substrate.

Decision

One Proposal record, on the Process plane, for every source of proposed action.

Shape. A Proposal is a proposed Act plus: proposer identity (human · agent · service, with model/version where applicable), confidence, an input-snapshot content-hash (what the proposer saw, hashed per ADR-0023’s canonical-serialization machinery — replayable in disputes and XAI audits), and an optional explanation narrative. Merge-proposals, bounded-auto demotions, agent suggestions, and human-drafted-for-approval actions all take this shape.
Decisions are Acts. Accept, edit-then-accept, and reject are governed Acts with actor and (for reject) reason. Acceptance commits the underlying Act; the proposal reference rides the committed act record — which is exactly the machine attestation of ADR-0023 when the proposer was a service. Rejection is recorded, never discarded: it is half the training signal.
Proposals never touch the World plane. No fusion input, no ResolvedValue influence, until a decision commits an Act. Advice is not evidence.
Agreement telemetry is built-in, not bolted on. Every (proposal, decision) pair accumulates per proposer × act-type × confidence-band: acceptance rate, edit distance, rejection reasons, downstream reversal rate. This is the substrate for FP-rate SLAs, model cards, and drift detection.
Autonomy is a declarative policy in bands, earned and revocable. Per act-type × proposer × confidence: manual (human decides) → co-sign (human decides, system’s attestation rides the record) → bounded-auto (auto-accept inside a declared envelope; beyond it, demote — generalizing the LLD’s existing knob) → auto-with-sampling (auto-accept with a sampled human-review rate). Band promotion/demotion is a governed configuration change (versioned, announced — no silent rule changes), informed by the agreement telemetry.

Alternatives Considered

Metadata on Pending(approval) only. Least churn; rejected — leaves merge proposals and bounded-auto demotions unreconciled and provides no telemetry substrate for agreement-rate SLAs.
Proposals as a userland pattern (like ADR-0016’s clocks). Rejected — unlike clocks, the approval outcome is already kernel-owned (LLD), machine attestations must ride the sealed act record (ADR-0023, kernel), and autonomy bands gate what the kernel auto-commits. The enforcement lives at the seam, so the record must too.
Proposals as statements. Rejected — a Statement is the payload shape of an Assert (an evidence claim about the world); a Proposal is a suggested intervention. Conflating advice with evidence would let unaccepted suggestions leak into fusion.
Defer to agent-runtime evolution. Rejected — co-signatures (ADR-0023) and merge proposals ship earlier than full agent autonomy; deferring guarantees divergent implementations.

Consequences

Pending(approval), merge-proposal output, and bounded-auto demotion converge on one record; their current shapes become views of it. Migration is nomenclature, not behavior.
ADR-0023 interaction: an accepted service proposal is the machine attestation on the sealed act — the AI co-signature falls out of this unification rather than being a separate feature.
We owe: the Proposal schema and decision-act taxonomy; the telemetry projection (per proposer × act-type × band) on the Serving plane; the autonomy-band policy shape in the definition system; a sampling mechanism for auto-with-sampling.
Human posture is preserved by construction: nothing closes, commits, or pays on a proposal alone — a decision Act (or an explicitly configured auto band with sampling) always stands between advice and effect.
Sensitive to: capability-token semantics (a proposer’s capability to propose must be attenuable separately from the capability to act — verify against P14 when the token design lands), and the ADR-0011 fusion implementation (proposals must remain invisible to it).