feat(engine): wire IncidentDecision + the deterministic action menu into the live ledger (JEF-570)

[thejefflarson]

Closes JEF-570.

Summary

Lands ADR-0034 (the model names the compromised node(s); determinism resolves the narrowest cut) on top of the merged incident/ module (JEF-609, #296). This is the highest-risk ticket of the sprint — it wires the model's cut choice into the live containment/ledger path — so the change is deliberately conservative: every existing rail (shadow-default, ADR-0021 arming, blast-radius gate, reversible/additive-only + self-revert, zero-egress, ADR-0023 cache/gate/breaker) is left byte-for-byte intact, verified by tests, not just asserted.

Wiring

• prompt.rs — splices the deterministic containment-options menu (incident::Menu::render) LAST, immediately before a new output instruction asking for {assessment, reason, contain} instead of the old 4-value {verdict, reason} JSON. Evidence-framing sections are unchanged; the menu is part of the full-state prompt, so prompt_cache_key/the ADR-0023 delta gate cover it unchanged. build_delta_prompt_with_menu_asn is a new, additive entry point — build_delta_prompt_asn/build_judgment_prompt* keep their existing signatures (rendering an empty menu) so the ~60 existing prompt-content tests are untouched.
• model_call.rs — ModelAdjudicator::judge now parses via incident::parse_incident_decision (tolerant, skeptic default) against the caller-built menu, chains the D5 grounding guards, and reuses guard_unsupported_exploitable (the grandfathered zero-anchor backstop) via a round-trip through the legacy Verdict shape it operates on — no reimplementation.
• Adjudicator::judge now takes the entry's Menu and returns an IncidentDecision. IncidentDecision::to_verdict() bridges to the legacy Verdict so the ADR-0023 cache / re-judge gate / breaker+backoff / journal Breach line / notifier / dashboard keep consuming exactly what they already do, unchanged.
• adj_pass.rs — builds each entry's menu (unioned across its objective chains), dispatches judge() with it, and records this pass's DECISIVE IncidentDecision into a new Engine-owned map (never persisted — see scope note) that carries forward across a cache-hit/backoff pass: D7's retirement asymmetry (a fresh Uncertain retires nothing).
• respond/mod.rs::reconcile now takes that per-entry decision map. Desired set = model-chosen cuts whose entry still has a proven chain, plus the containment_for FALLBACK (stamped adjudicated=false, never auto-applied) for a breach-relevant entry with no decisive Attack-with-cuts decision. The deterministic quarantine_targets desired-set insertion is deleted for breach-relevant chains (kept, unchanged, for a non-breach-relevant chain's JEF-284 condition-2 targets — outside the north star's two lanes, ADR-0032 §6, untouched by this ticket).
• incident/menu.rs, incident/mod.rs — MenuLine/ChosenCut gain a cut: Link field (JEF-570 needed the concrete Link to build a ledger Mitigation; the pre-merged module only carried the signature string) and a shared normalize helper (build_menu and the new per-entry union both use it).

Rails verified (tested, not just asserted)

Shadow stays the DEFAULT posture; ADR-0021 per-class arming and enforceScope untouched (decide() unchanged); blast-radius/alive-collateral gate untouched; reversible/additive + self-revert untouched; zero-egress (no new outbound path); untrusted text in the menu stays fenced / fixed mechanism strings only; presentation still never gates (ADR-0016, untouched).

Tests

Unit tests for the fold (engine::tests, journal_tests — mechanical Adjudicator-signature updates across 8 existing test doubles), the reconcile desired-set (respond/decisions_tests.rs: fallback stamped non-auto even when corroborated, model cuts clear the gate, a confident NoAttack proposes nothing, D1 attack-with-empty-cuts still falls back, a non-member reply degrades end-to-end), retirement asymmetry and the shadow-default rail (engine::tests, two new integration tests), and the pre-existing containment/quarantine test suites updated for the new model-gated desired set (respond/tests.rs, pivot_quarantine_tests.rs).

1022 lib tests green; cargo fmt clean; cargo clippy --all-targets -- -D warnings clean (workspace: engine + behavior).

DECISION NEEDED (scope, per the ticket's own escape hatch)

1. Journal schema v2 is deferred. D8's typed IncidentDecision variant + the fingerprint/cut_signature double replay-lock is a follow-up ticket. This PR's per-entry decision map is Engine-local and NOT persisted, so a restart starts every entry with no decision — every breach-relevant entry falls back to the non-auto containment_for proposal until it is freshly re-judged. This is strictly MORE conservative than D8's target, never less safe: no cut can ever auto-apply on a replayed decision it never actually re-derived this run. The verdict CACHE (JEF-301) still re-seeds from the journal exactly as before, so a restart still skips a redundant model call for an unchanged entry — only the cuts require a fresh live decision, not the assessment.
2. The D6 fallback-trigger boundary. ADR-0034's text literally scopes the fallback to "no decisive decision," but D1 explicitly routes an Attack decision with an empty contain to the fallback too. Resolved by triggering the fallback whenever there is no decisive model-chosen cut (absent, Uncertain, or Attack-with-empty-contain) and NEVER for a decisive NoAttack (a confident clear proposes nothing at all) — implemented and covered by decisive_attack_with_empty_cuts_still_gets_the_fallback_proposal and decisive_no_attack_produces_no_proposal_at_all.

Test plan

• npm --prefix engine/web run build
• cargo fmt --check
• cargo clippy --all-targets -- -D warnings (workspace)
• cargo test --workspace — 1022 engine lib tests + behavior crate tests green
• Self-review against soundcheck:pr-review (no Critical/High findings)
• /simplify single-pass cleanup applied (deduped menu normalization)

Claude-Session: https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP

[thejefflarson]

Architect review — JEF-570 (ADR-0032/0034 wiring)

Independently re-verified on the diff (not the self-report). Approving for merge.

Safety-critical D7 re-verification (done, not trusted)

I brought the new D7 test onto the pre-fix commit 17af55f and ran it: respond::decisions_tests::a_downstream_cut_persists_across_a_pass_with_no_decision FAILS there (the standing downstream QuarantineWorkload cut is severed and rebuilt from containment_for, landing in retired → self-revert tears down the live NetworkPolicy), and PASSES on 190e3a0. The regression guard a_decisive_no_attack_still_retires_a_standing_cut passes on both — the carry-forward did not make cuts un-retirable. D7 asymmetry holds: fresh Uncertain / no-decision is inert; decisive NoAttack or chain-clear retires; decisive Attack-with-empty-cuts (D1) retires + offers the non-auto fallback.

An additional freshness check I ran down: adj_pass prunes the Engine-local decision map every pass (self.decisions.retain(|k,_| current_entries.contains(k)), adj_pass.rs:433), so a cleared-then-reappearing entry re-judges rather than replaying a stale decisive Attack. No stale-cut re-arm path.

Other invariants re-verified

• D6 desired-set: deterministic quarantine_targets auto-insert deleted for breach-relevant chains (kept only on the internal-only path); containment_for demoted to adjudicated=false fallback that never auto-applies; model cuts enter only on a decisive Attack with a still-proven breach-relevant chain. Confirmed in reconcile.
• Skeptic default: non-member contain degrades the whole decision to Uncertain/no-cut (tested end-to-end).
• Rails: decide.rs/arm.rs/PROTECTOR_MODE default untouched (zero diff); shadow-default rail test confirms a decisive model-chosen Attack only proposes — nothing armed, nothing applied. Zero new outbound path.
• Independently ran: cargo fmt --check clean, cargo clippy --all-targets -D warnings clean, cargo test -p protector --lib = 1024 passed. All changed files < 1000 lines (max 954).

DECISION — Journal schema v2 (D8) deferral: ACCEPTED

The per-entry decision map is Engine-local and not persisted. On restart every breach-relevant entry falls back to the non-auto containment_for proposal until freshly re-judged. This is strictly more conservative — no cut can auto-apply on a decision it never re-derived this run — and ADR-0034 D8 itself already accepts the ~20-min cold-start re-judge cost. It weakens no invariant and is moot under the shipped shadow-default posture. Merging as-is.

Recorded follow-up (required before enforce-mode arming is expected to survive a restart): journal schema v2 — the typed IncidentDecision journal variant + the fingerprint / cut_signature double replay-lock (ADR-0034 D8). Until it lands, a restart in enforce mode drops standing cuts to proposals (safe, but operationally reopens a contained path until re-judged).

[thejefflarson]

HOLD — required e2e check genuinely red (supersedes my prior approval)

My earlier comment approved on the Rust review; the e2e job then failed and changes the disposition. This is HELD, not merged.

What failed

e2e (a required check, branch protection is strict) fails deterministically at step 7/11 "HARD MODE":

timed out after 120s waiting for: engine cuts the corroborated entry web

Steps 1-6 pass, including the shadow propose-only rail. This is not infra flake and not introduced by the branch update — on main step 7 passes; this PR is what changes the behavior it asserts.

Root cause — the e2e encodes a contract this PR intentionally retires

scripts/e2e.sh step 7 asserts that in enforce mode, live corroboration alone, with no model, auto-cuts the entry web and pivot store (ADR-0009's asymmetric action bar):

wait_until "engine cuts the corroborated entry web" 120 managed_np_for web
pass "engine quarantined role=web — live corroboration met the asymmetric action bar (ADR-0009)"

ADR-0034 D6 — which this PR implements — deletes exactly that: the deterministic desired-set insertion for breach-relevant chains is removed, and the desired set becomes model-chosen cuts + non-auto (adjudicated=false) fallbacks. Step 7 injects no model (the model env is only added in phases 10-11; CI has no Ollama, so the model-driven phases E/F/G are skipped). So reconcile correctly applies nothing, and the assertion times out. The Rust tests were updated to the new contract; scripts/e2e.sh was not.

Architect determination (recorded)

ADR-0034 supersedes ADR-0009's corroboration-alone auto-cut: under enforce mode with no live model, determinism only proposes — nothing auto-cuts. The engine code here is faithful to ADR-0032/0034. The e2e is the stale artifact and must be brought into line. This is required scope for "wire the cut into the LIVE containment path" — the e2e is the live-path exercise.

Required to unblock (fix, don't bypass — no admin merge)

Rework scripts/e2e.sh steps 7-8 to the model-gated contract, e.g. one of:

1. Make the enforce-mode auto-cut assertions model-gated — inject a decisive-Attack model endpoint (or a CI stub judge) into step 7's deploy_protector, mirroring phases 10-11, and gate them like E/F/G when no model is reachable; or
2. Rewrite steps 7-8 to assert propose-only without a model (a managed NetworkPolicy is proposed, adjudicated=false, never applied), and move the actual auto-cut + self-revert assertions into the Ollama-gated model phases.

Option 1 preserves an end-to-end auto-cut+self-revert assertion (stronger) but needs a CI-reachable judge; option 2 keeps CI model-free but drops CI's only live auto-cut coverage. I'd prefer option 1 with a deterministic CI stub judge so the live containment path stays covered in CI. Add a one-line note to ADR-0034 Consequences that D6 retires ADR-0009's no-model corroboration-auto-cut.

Everything else on this PR verified clean (D6/D7 including the empirically-reproduced pre-fix D7 failure, skeptic default, rails untouched, 1024 lib tests / clippy / fmt green, all files < 1000 lines). Only the e2e blocks.