- Ya
- 4 Julai 2026, 09:58 UTC
- Mwandishi
- Kamo
- Ahadi ya
- d36f41c
The DecisionGate already carries a GLOBAL static force-steward @Value, but §5.C needs two things it cannot give: a kill switch flippable WITHOUT redeploy (so DB-backed) at GLOBAL/TENANT/TASK_TYPE granularity, and force-steward-until-N- calibration-samples per task-type (the cheap P0 the calibration machinery degenerates to at launch — doc 12 Theme C / §6.1). AutonomyGovernor (governance pkg) is an OPTIONAL Docstor (ObjectProvider, gated on mlos.governor.enabled) consulted synchronously by DecisionSpine.record() — the same shape as StewardAssigner. It is ADD-ONLY, exactly like the legal wall: it can only turn a would-be AUTO_EXECUTE into ROUTE_TO_HUMAN, never lift a routing, so the pure/stateless DecisionGate is untouched. Two force conditions: (a) an active AutonomyKillSwitch matching (orgId, aiFunction) — broadest scope wins the reason; a mutable/flippable entity, NOT WORM, audited via engagedBy/at; (b) calibration bootstrap — platform-wide non-test StewardFeedback count for the aiFunction below min-samples (default 50), counted by a new join query. When the governor is the cause of routing, its reason is appended to the WORM AiDecision so a high-confidence decision that went to a human is never inexplicable. New table autonomy_kill_switch (additive DDL — KI run). 30 tests green (7 governor logic + 3 spine add-only integration + 6 spine + 14 gate); all four DecisionSpine ctors preserved (existing callers unchanged).