decision ledger

{
  "schema_version": "actionist.decision-ledger.v1",
  "part": "P14",
  "run_id": "2026-08-27-sprint-1-fable",
  "recorded": "2026-08-27",
  "owner": "ACTIONIST-S1-L5-RUNTIME",
  "boundary": {
    "research_only": true,
    "execution_status": "UNEXECUTED",
    "admission_status": "NOT_ADMITTED",
    "admitted_blocks": 0,
    "implementation_authorized": false,
    "promotion": "unpromoted"
  },
  "decisions": [
    {
      "id": "D-P14-01",
      "statement": "RollbackPlan is multi-object, never a boolean",
      "state": "accepted",
      "support": "Independent derivation from vendor docs (Vercel omits env/config; Fly omits fly.toml/secrets/migrations) and operated local practice (donor standard: data rollback is separate; plus a third surface-route object)",
      "falsifier": "A rehearsed multi-object rollback leaves an object unrestored, or a single-object rollback proves sufficient across representative compositions",
      "evidence_class": "observed_behavior"
    },
    {
      "id": "D-P14-02",
      "statement": "Each rollback object carries its own recovery horizon; the minimum governs",
      "state": "accepted",
      "support": "PlanetScale schema revert bounded ~30min dual-write vs unbounded artifact rollback",
      "falsifier": "A composition recovered after its shortest horizon expired",
      "evidence_class": "first_party_docs"
    },
    {
      "id": "D-P14-03",
      "statement": "Pin by content digest and own artifact retention",
      "state": "accepted",
      "support": "Render re-pulls by tag and may get a different image; Fly may prune images not recently deployed",
      "falsifier": "A pinned digest proves unresolvable at rollback time despite owned retention",
      "evidence_class": "first_party_docs"
    },
    {
      "id": "D-P14-04",
      "statement": "Five runtime profiles derived from packaging mode",
      "state": "accepted",
      "support": "Reuse shapes already decided; sidecar is the only profile where a third party owns migrations",
      "falsifier": "A representative capability fits none of the five",
      "evidence_class": "inference",
      "note_wave2": "S1-L4 contributes tiered per-action isolation selection (isolate/gVisor/microVM) as an open extension to the five profiles"
    },
    {
      "id": "D-P14-05",
      "statement": "Minimum instrumentation contract belongs in HostContract",
      "state": "accepted",
      "support": "Requirements intersection across Grafana OTel attributes, Datadog Unified Service Tagging, Elastic traceparent, Harness SII, incident.io routing attribute",
      "falsifier": "Attribution achieved at dependency level without one of the five items",
      "evidence_class": "first_party_docs"
    },
    {
      "id": "D-P14-06",
      "statement": "Capability identity must be deliberately plural",
      "state": "accepted",
      "support": "New Relic warns multi-entity reporting causes duplicate groups and recommends consolidation — the opposite of what a composed app needs",
      "falsifier": "Per-capability attribution achieved under a single consolidated entity",
      "evidence_class": "first_party_docs"
    },
    {
      "id": "D-P14-07",
      "statement": "App-level release correlation is actively misleading for independently-deployed capabilities",
      "state": "accepted",
      "support": "Rollbar suspect deploy is the last deploy before first occurrence — a temporal heuristic; Sentry release health scores a whole release",
      "falsifier": "Temporal heuristics attribute correctly under independent capability deploys",
      "evidence_class": "first_party_docs"
    },
    {
      "id": "D-P14-08",
      "statement": "Instrumentability is a capability admission criterion",
      "state": "accepted",
      "support": "An uninstrumentable capability caps system attribution at the call boundary; failure is silent",
      "falsifier": "A capability that cannot be instrumented is nonetheless attributable in production",
      "evidence_class": "inference"
    },
    {
      "id": "D-P14-09",
      "statement": "ComputeSDK cannot be the load-bearing sandbox abstraction; it cannot express memory-preserving pause",
      "state": "accepted",
      "support": "Wave-2 source read: universal-sandbox.ts declares no pause/resume/suspend and its status enum ('running'|'stopped'|'error') cannot represent a paused sandbox; the E2B provider never passes keepMemory so the memory path is unreachable; a provider author's own comment calls getInstance() an escape hatch to the stateful API 'that ComputeSDK's core surface does not model'",
      "falsifier": "ComputeSDK's core interface gains pause/resume with a paused state, or memory-preserving pause proves unnecessary for warm previews",
      "evidence_class": "observed_behavior",
      "limitations": "static read of the interface at main on 2026-08-27; no execution against a live provider"
    },
    {
      "id": "D-P14-10",
      "statement": "Workflow acceptance gates above build gate",
      "state": "accepted",
      "support": "Local donor standard's required-proof list is workflow-shaped and operated; P14 known that a passing build is not workflow proof",
      "falsifier": "Acceptance suites prove too brittle or slow to run per release",
      "evidence_class": "first_party_docs"
    },
    {
      "id": "D-P14-11",
      "statement": "Do not quote Northflank one-click rollback; Statsig has no automatic rollback",
      "state": "correction",
      "support": "First-party docs describe only re-triggering a prior run; Statsig docs describe alerting only",
      "falsifier": "First-party documentation of a dedicated rollback control",
      "evidence_class": "first_party_docs"
    },
    {
      "id": "D-P14-12",
      "statement": "Denominators unmet: commercial 49, OSS incomplete",
      "state": "recorded_gap",
      "support": "Account-wide quota killed wave-1; wave-2 recovered observability and rebuilt OSS",
      "falsifier": "A completed continuation wave closes it",
      "evidence_class": "observed_behavior"
    },
    {
      "id": "D-P14-13",
      "statement": "K long-lived schema versions is an extension of validated prior art, not a configuration option",
      "state": "accepted",
      "support": "Verified from project docs: pgroll and reshape each hold exactly two versions live, and that window is transient by design (exists only between start and complete; completing drops the old version and rollback becomes impossible). pgroll propagates writes to 'its counterpart', singular. Actionist needs K versions long-lived across independently-upgrading clients — a gap in both count and duration.",
      "falsifier": "A tool or technique sustains K>2 long-lived concurrent schema versions, or lockstep client upgrades prove acceptable",
      "evidence_class": "first_party_docs",
      "limitations": "documentation read, not benchmarked at scale"
    }
  ]
}