Evidence: decisions knowledge task v24¶

Task: 53b35aa6-4716-4c8f-9ee9-255186ec787e, frozen version 24. Execution: 5812164a-d6c0-4804-bc9f-a22f48fd5990. Workflow: dd6bdeb3-036f-4471-a4f5-e568bd984f93, revision 3. Contract digest: 5085ecf7c20eb0513ee429c48e9603cab1c45e797ebe8bb7d62ba00218212baf. Repository: h8v6/heyaira; branch: heyaira/53b35aa6. Current execution base/source: b1a29d484f60414125101279f38866ab48e5c16e. The result commit contains this evidence; its SHA is in the task_result receipt.

Deliverables and scope¶

Criterion	Committed evidence
document	`docs/concepts/decisions-how-it-works.md`: Polish, 128 lines, proposals, Claude mod, Codex plugin, /decide, iPhone, passkeys, holds, in_force, logs; final Źródła section.
drift	The document's Rozjazdy table: R01–R17, each with file:line references on both sides.
linked	`docs/index.md`: direct link under “For people”; rendered link checked.

The base already contained the earlier task's document, index link and evidence. This execution read task_get(version=24), rechecked the server, migrations, clients and all 17 drift pairs, updated the document's source revision and made the physical-device verification boundary explicit. It replaces the v14 execution evidence with checks actually run for v24. The combined task diff from the earlier source 7d9d2ca58af13a8e82247cac82ddffa112ecee74 touches only these three docs files; the v24 delta changes only the concept document and this evidence. Application code, migrations and D0-spec.md are unchanged.

R01–R17 are follow-up tasks handed to the coordinator through the document and RESULT, not newly created MCP tasks. The execution tool set cannot create tasks, claim/change task status or read continuity_context. The frozen Bridge contract and Kontrakt pracy v4 explicitly use task_get/task_result for workers. Bridge performs the independent verification and publishes the accepted commit.

Confidence and operational boundary¶

server_identity matched the expected resource, instance and project. Running service revision: 3142bcccaf2ac768eb4041ecbed1e04076a9f881; this is distinct from the local source revision and is not a deployment claim. The working tree was clean at the start. Code, migration and client sources were read again; tests below were run in this execution.

Previous RESULT notes re-read by ID, without copying their bodies into Git:

c5e7a36f-794a-4066-a4ec-99adb26a5161: D3 and D2 follow-ups; D3 deliberately uses the canonical skill text rather than D2's renderer; Desktop and human passkey acceptance remained unverified in that receipt.
69024d45-7ba4-456f-b64a-145b552fa847: historical deployment of /decide; service revision matches startup identity; phone visual acceptance was not performed by DevOps.

The live docs.heyaira.eu read was rejected by this execution's domain allowlist (Network access to "docs.heyaira.eu" was blocked). Public-doc comparisons therefore use the committed publishing sources, not an asserted live-site snapshot. No real phone, Touch ID, Face ID, APNs delivery, production action or PostgreSQL integration run is claimed. PostgreSQL tests were read for their behavioral assertions; they were not rerun for this documentation change.

Actual verification output¶

Python 3.12.7; PYTHONDONTWRITEBYTECODE=1. Pytest additionally used PYTHONPATH=src and TMPDIR=$PWD/.venv/knowledge-checks (ignored local artifacts).

python3.12 scripts/export_mcp_contract.py --check
MCP contract is up to date

python3.12 scripts/check_docs_contract.py
documentation contract passed: 46 MCP tools covered

python3.12 -m pytest -q -p no:cacheprovider \
  tests/test_docs_contract.py tests/test_codex_plugin.py tests/test_decisions_webauthn.py
............................................                             [100%]
44 passed in 9.91s

python3.12 -m mkdocs build --strict --site-dir .venv/knowledge-checks/site
exit_code=0

Documentation checks passed: 128 lines; 231 valid file:line references; 17 drift entries with both sides; final sources section and index link exist.
Rendered page and published index link: PASS

/Library/Developer/CommandLineTools/usr/bin/git -c core.excludesfile=/dev/null diff --check
exit_code=0

The existing tests check the public contract, generated Codex skill and synthetic WebAuthn signatures, UV, action binding, link expiry and access-log filtering. Passing scope-table checks do not disprove R14: the generated contract aggregates conditional scopes. MkDocs reports unlisted sidebar pages at INFO level; the concept page is reachable through the index.

The structural/rendered-page check was run with python3.12 -c using the following code, and can be reproduced from the repository root after the build:

from pathlib import Path
import re
doc = Path('docs/concepts/decisions-how-it-works.md').read_text()
refs = re.findall(r'`([a-zA-Z0-9_./-]+):(\d+)`', doc)
for path, line in refs:
    assert Path(path).is_file(), path
    assert 1 <= int(line) <= len(Path(path).read_text().splitlines()), (path, line)
rows = [line for line in doc.splitlines() if re.match(r'^\| R\d{2} ', line)]
assert len(rows) == 17
for row in rows:
    sides = row.split('|')
    assert re.search(r':\d+`', sides[2]) and re.search(r':\d+`', sides[3]), row
assert len(doc.splitlines()) < 250
assert doc.rsplit('## ', 1)[1].startswith('Źródła')
assert '(concepts/decisions-how-it-works.md)' in Path('docs/index.md').read_text()
site = Path('.venv/knowledge-checks/site')
assert (site/'concepts/decisions-how-it-works/index.html').is_file()
assert 'concepts/decisions-how-it-works/' in (site/'index.html').read_text()
print(f'Documentation checks passed: {len(doc.splitlines())} lines; {len(refs)} valid file:line references; {len(rows)} drift entries with both sides; final sources section and index link exist.')
print('Rendered page and published index link: PASS')

Source spot-checks and reproducible drift¶

Statement / finding	Source confirmation
A proposal naming a waiting task creates a hold atomically.	`src/heyaira/decisions.py:533` calls insert_hold; `src/heyaira/decisions.py:405` starts its transaction.
A refusing option never enters in_force.	`src/heyaira/decision_answers.py:177` maps refusal to rejected; `migrations/054_decisions.sql:121` rejects confirmed with a non-authorizing option.
Passkey answers bind content, action, option and note.	`src/heyaira/decision_passkeys.py:40` defines the binding; `src/heyaira/decision_passkeys.py:160` compares it at answer.
Confirmation does not release a hold.	`src/heyaira/decision_answers.py:174` appends an event and notice; `tests/test_decisions_holds.py:69` asserts awaiting_decision after the answer.
Codex shows a browser link rather than answering in chat.	`clients/codex-plugin/skills/heyaira-decisions/SKILL.md:38` describes the browser; `clients/codex-plugin/skills/heyaira-decisions/SKILL.md:43` forbids writes.
R03: iPhone is logged as web.	Spec: `docs/specs/decisions/D0-spec.md:545` requires channel=ios. Code: `src/heyaira/decision_web.py:85` omits channel; `src/heyaira/decision_passkeys.py:167` defaults to web. `ios/HeyAiraBridge/HeyAiraBridge/DecisionModels.swift:263` adds return=ios only for callback navigation.
R06: generic Reject is conditional.	Spec: `docs/specs/decisions/D0-spec.md:359` says always. Code: `src/heyaira/decision_web.py:242` checks for an enabled refusing option before adding generic Reject.
R14: read permission is conditional.	Public text: `docs/reference/mcp-tools.md:12` and `docs/reference/mcp-tools.md:52` require both scopes. Code: `src/heyaira/server.py:3678` always checks read; `src/heyaira/server.py:3680` gates the write check on use=true.
R15: iPhone silently stops after page ten.	Spec list: `docs/specs/decisions/D0-spec.md:545`; all-cursor rule: `docs/specs/decisions/D0-skill.md:6`. Code: `ios/HeyAiraBridge/HeyAiraBridge/DecisionStore.swift:84` stops with a remaining cursor; `ios/HeyAiraBridge/HeyAiraBridge/DecisionStore.swift:88` clears the error without warning.

All R01–R17 source pairs remain stable: this task edits none of their source files. R09 names accepted D0 §12.2 exceptions separately from missing behavior. R04 is absence in this repository, not a claim about edge configuration.