ADR-0001: Machine-testable, deny-by-default authority

• Status: accepted for proposal
• Date: 2026-08-10
• Spec: SPEC-000

Context

Authority currently exists across AGENTS.md, rubrics, runbooks, workflows, and user instructions. That is auditable by a person but cannot produce a deterministic authorization decision for future commands, workers, and repository events.

Decision

Use a versioned YAML constitution with a small exact-match policy engine. Actors, actions, resource classes, and conditions are enumerated. Missing vocabulary and missing conditions deny. Explicit deny rules override allow rules. Only human_maintainer can receive an allow decision for merge or production activation.

The generated Markdown view is derived from the same policy. effective_commit: "$SELF" identifies the commit containing the constitution without introducing an impossible self-referential Git hash. Runtime consumers pin the file SHA-256.

Alternatives considered

• Keep prose as the only authority. Rejected because command-time enforcement and exhaustive tests would be impossible.
• Embed policy in Python conditionals. Rejected because authority changes would be difficult to review as a coherent matrix.
• Adopt a general policy service now. Deferred because the current repository needs deterministic local checks, not a hosted dependency.
• Infer intent from branch names, prompts, or role labels. Rejected because those are claims, not authenticated authority.

Consequences

• Every future privileged interface must call the policy evaluator or document why it is read-only.
• Policy changes modify a protected surface and require human review and merge.
• The initial engine intentionally supports only exact conditions. New operators require a constitution schema change and tests.
• Identity authentication and external enforcement remain adapter responsibilities; this layer decides authority after a trusted actor class is supplied.
• A later GitHub lifecycle spec must evaluate protected changes under the prior effective policy. A policy PR cannot establish its own external branch protection or satisfy its own human review requirement.
• Policy-decision persistence will use the immutable event journal in SPEC-004. Until that lands, --decision provides the normalized record but the pure evaluator performs no hidden write.

Verification

CI validates the policy, decision fixtures, deny-overrides behavior, digest pinning, path classification, and the full actor/action/resource cross-product. A generated authority table is checked byte-for-byte.