feat(runtime): add decision policy governance types

.env.example

@@ -109,6 +109,14 @@ POWERCONTEXT_SERVER_RUNTIME_DREAM_MAX_PENDING_PER_SCOPE=32
 # Memory write gate: opt-in evidence-sufficiency check before a write commits. Disabled by
 # default; when unset no gate runs and no extra model call is made.
 # POWERCONTEXT_SERVER_RUNTIME_MEMORY_WRITE_GATE_ENABLED=true
+# `disabled` does not construct a gate. `shadow` records an internal observation but always lets
+# the Memory write proceed. `advisory` turns an insufficient-evidence result into FLAG, while
+# `enforcing` preserves the visible ACCEPT/FLAG/HOLD outcomes.
+# POWERCONTEXT_SERVER_RUNTIME_MEMORY_WRITE_GATE_MODE=shadow
+# The default makes no decision-model call. Set `local_only` only for an in-process or loopback
+# decision backend controlled by this deployment. `hosted_redacted` is rejected until a shared
+# PowerContext content sanitizer is separately reviewed.
+# POWERCONTEXT_SERVER_RUNTIME_MEMORY_WRITE_GATE_PRIVACY_BOUNDARY=local_only
 # Direction only (which verdict means the cited evidence is insufficient): "yes" or "no".
 # POWERCONTEXT_SERVER_RUNTIME_MEMORY_WRITE_GATE_HOLD_ON=yes
 # Optional confidence floor below which a hold becomes a written-but-annotated change.

src/powercontext/builtin/artifacts/memory/protocols.py

@@ -110,6 +110,10 @@ class MemoryWriteGateRequest:
     candidates: tuple[str, ...]
     evidence: tuple[str, ...]
     expected_revision: int | None = None
+    scope_id: str = "unscoped"
+    operation_id: str | None = None
+    subject_refs: tuple[str, ...] = ()
+    evidence_refs: tuple[str, ...] = ()
 
 
 class MemoryWriteGate(Protocol):

src/powercontext/builtin/artifacts/memory/service.py

@@ -259,6 +259,7 @@ def __init__(
         artifact_resolver: _ArtifactResolver | None = None,
         id_factory: IdFactory | None = None,
         prompt_context: ScopedPrompts | None = None,
+        scope_id: str = "unscoped",
         write_gate: MemoryWriteGate | None = None,
         capacity_budget: MemoryCapacityBudget | None = None,
         compaction: MemoryCompactionPolicy | None = None,
@@ -268,6 +269,7 @@ def __init__(
         self._prompt_context = prompt_context
         self._candidate_pipeline = candidate_pipeline
         self._write_gate = write_gate
+        self._scope_id = scope_id
         self._embedding_model = embedding_model
         if rerank_candidate_limit < 1:
             raise _InvalidMemoryOperationError("search-limit")
@@ -1384,6 +1386,10 @@ async def _assess_write(
                     candidates=tuple(candidate.text for candidate in candidates),
                     evidence=projection.entries,
                     expected_revision=None if base is None else base.revision,
+                    scope_id=self._scope_id,
+                    operation_id=_gate_operation_id(base),
+                    subject_refs=_gate_subject_refs(candidates),
+                    evidence_refs=tuple(_gate_evidence_ref(entry) for entry in projection.entries),
                 )
             )
         except Exception:
@@ -1839,6 +1845,25 @@ def _candidate_gate_identity(candidate_index: int, identity: str) -> str:
     return f"candidate:{candidate_index} {identity}"
 
 
+def _gate_operation_id(base: Memory | None) -> str:
+    if base is None:
+        return "memory-write:new"
+    return f"memory-write:{base.artifact_id}@{base.revision + 1}"
+
+
+def _gate_subject_refs(candidates: tuple[MemoryEntryInput, ...]) -> tuple[str, ...]:
+    return tuple(
+        f"candidate:{index}"
+        if candidate.entry is None
+        else f"entry:{candidate.entry.entry_id}@{candidate.entry.entry_version_id}"
+        for index, candidate in enumerate(candidates, start=1)
+    )
+
+
+def _gate_evidence_ref(value: str) -> str:
+    return value.partition("\n")[0]
+
+
 def _source_gate_content(source: Source, resolver: _SourceResolver | None) -> str | None:
     content = getattr(source, "content", None)
     if isinstance(content, str):

src/powercontext/builtin/runtime/__init__.py

@@ -112,6 +112,18 @@
     DecisionResult,
     StructuredDecisionModel,
 )
+from powercontext.builtin.runtime.decision_policy import (
+    DecisionAssessment,
+    DecisionAssessmentSource,
+    DecisionCoverage,
+    DecisionFailurePolicy,
+    DecisionObservation,
+    DecisionPolicy,
+    DecisionPolicyMode,
+    DecisionPrivacyBoundary,
+    DecisionVerdict,
+    assess_decision_result,
+)
 from powercontext.builtin.runtime.errors import InvalidRuntimeRequestError, TopicMemoryProcessingUnavailableError
 from powercontext.builtin.runtime.memory_write_gate import (
     DecisionMemoryWriteGate,
@@ -241,15 +253,24 @@
     "ContextAssemblySection",
     "CreateDreamRunRequest",
     "DatabaseConfig",
+    "DecisionAssessment",
+    "DecisionAssessmentSource",
+    "DecisionCoverage",
+    "DecisionFailurePolicy",
     "DecisionKind",
     "DecisionMemoryWriteGate",
     "DecisionModel",
     "DecisionModelOption",
     "DecisionModelRequest",
     "DecisionModelResult",
+    "DecisionObservation",
     "DecisionOutcome",
+    "DecisionPolicy",
+    "DecisionPolicyMode",
+    "DecisionPrivacyBoundary",
     "DecisionRequest",
     "DecisionResult",
+    "DecisionVerdict",
     "DreamApplication",
     "DreamRun",
     "DreamRunPage",
@@ -392,6 +413,7 @@
     "TopicMemoryProcessingUnavailableError",
     "UsageStatistics",
     "WorkApplication",
+    "assess_decision_result",
     "build_memory_write_gate",
     "dependency_readiness_probe",
     "open_builtin_contexts",

src/powercontext/builtin/runtime/composition.py

@@ -349,6 +349,8 @@ def _configured_memory_write_gate(
         enabled=True,
         hold_on=runtime.memory_write_gate_hold_on,
         threshold=runtime.memory_write_gate_threshold,
+        mode=runtime.memory_write_gate_mode,
+        privacy_boundary=runtime.memory_write_gate_privacy_boundary,
     )
     if gate is None:
         log_safely(

src/powercontext/builtin/runtime/config.py

@@ -47,6 +47,7 @@
 from powercontext.builtin.persistence.seekdb import SeekDBConfig
 from powercontext.builtin.persistence.sqlite import SQLiteConfig
 from powercontext.builtin.runtime._scope_cache import DEFAULT_SCOPE_CACHE_SIZE
+from powercontext.builtin.runtime.decision_policy import DecisionPolicyMode, DecisionPrivacyBoundary
 
 _HTTP_FIELD_NAME_PATTERN = re.compile(r"[!#$%&'*+\-.^_`|~0-9A-Za-z]+")
 _RECALL_GATE_BASE_MIN_SEMANTIC_SIMILARITY = 0.3
@@ -143,6 +144,8 @@ def reject_boolean_worker_quota(cls, value: Any) -> Any:
     memory_rerank_candidate_limit: int = Field(default=30, ge=1, le=100)
     decision_assistance_enabled: bool = False
     memory_write_gate_enabled: bool = False
+    memory_write_gate_mode: DecisionPolicyMode = DecisionPolicyMode.ENFORCING
+    memory_write_gate_privacy_boundary: DecisionPrivacyBoundary = DecisionPrivacyBoundary.NO_EXTERNAL_CALL
     # Direction only: which verdict means "evidence is insufficient". The strength threshold
     # stays unset until a calibration probe establishes it, so a hold never depends on a made-up
     # number.
@@ -159,6 +162,8 @@ def reject_boolean_worker_quota(cls, value: Any) -> Any:
     def validate_memory_capacity_order(self) -> RuntimeConfig:
         if self.memory_max_active_entries > self.memory_max_manifest_entries:
             raise ValueError("memory_max_active_entries cannot exceed memory_max_manifest_entries")  # noqa: TRY003
+        if self.memory_write_gate_privacy_boundary is DecisionPrivacyBoundary.HOSTED_REDACTED:
+            raise ValueError("memory_write_gate_privacy_boundary does not support hosted_redacted without a sanitizer")  # noqa: TRY003
         return self
 
     recall_gate_enabled: bool = False