ADR-0026: Every ticket transition is an Act; machine actions are decided under declared authority

Status

Accepted

Date

2026-07-03

Context

The ticket lifecycle (Open → Acknowledged → InProgress → Resolved → Closed) has two classes of actor: NOC humans (acknowledge, assign, confirm root cause, close) and the correlation engine itself (open tickets from alarm partitions, auto-resolve when a partition empties). Kernel precedent cuts both ways: the profiling job writes statements and world projections directly through ports with no Act, while the process plane’s action_request → action_decision pair exists precisely so that decisions have a uniform audit shape.

If the engine writes tickets directly, “who opened this ticket?” has two different answer mechanisms — a Decision record for humans, a derived_from chain for the machine — and an operator-grade audit (“every actor who touched this ticket”) becomes a union over two systems.

Decision

Every ticket transition goes through the Act door. Machine transitions are ActionRequests auto-decided under a declared machine authority (e.g. fault.correlation-engine/v1 plus the policy that grants it), recorded in the process plane exactly like human decisions. Human transitions are ActionRequests decided by the human actor.

This forces two pieces of kernel growth that the ticketing effort was already scoped to force: generic Act machinery (a registry of action kinds rather than one hardcoded syscall) and dynamic worker job dispatch. The invariant this buys: nothing in the system changes state without a decision record — including the system itself.

Alternatives Considered

Split model (humans through Acts, engine through direct port writes citing statements — the profiling-job precedent): rejected — less plumbing now, but two audit mechanisms forever, and the governance story stops at “mostly”.
Only ConfirmRootCause as an Act: rejected — the cheapest build, but the ticket lifecycle itself stays ungoverned and the process plane stays a single-purpose mechanism.

Consequences

One uniform audit trail over ticket history; the operator question “show me every actor and authority that touched this ticket” is a single query over the process plane.
Machine-actions-under-declared-authority becomes a named primitive — the same mechanism later agent-driven operations need (the malleable-software ladder’s L3/L4 rungs), arriving as policy vocabulary rather than new architecture.
Cost: every engine-side transition pays the ActionRequest/Decision write path. Acceptable at ticket cardinality (tickets are low-volume by design; alarms — the high-volume object — are Asserts, not Acts).
Auto-settling RCA verdicts above a confidence threshold, if ever wanted, arrives as a policy on the machine authority — not as engine behavior.