Plan for G-2: Every operation has a verify step and every decision an audit entry; cloudfall why answers from the record alone #190

Goal

G-2: Every operation has a verify step and every decision an audit entry; cloudfall why answers from the record alone

Trigger: no-work
Measure: none yet

Work

• W-1 fix: docs/fleet-goals.md rows 12 and 13 say there is "no declared verify step" and "no query", and ARCHITECTURE.md (Record, Verify) says receipts are written "one per decision or operation" and verify is generalised to every operation, though the operations catalog requires verify for mutating operations, cloudfall why exists, and several receipts are overwritten per subject; they should say what is built and what is not
• W-2 feature: Every command that changes a host (deploy, rollback, restart, backup run, data copy, domains apply, the MCP converge_* and build_artifact tools, and the project-mode MCP tools) writes its own entry in the decision record, kept beside the earlier ones instead of overwriting the last receipt for the same subject, naming who asked, what ran, on which hosts, and the outcome
• W-3 feature: A decision not to act is recorded too: a person rejects a proposal, an approval is refused, the gate refuses a proposal, and the operator withholds or grants autonomy, each with its reason
• W-4 fix: A catalog operation's preconditions (health:ok) are parsed and shown to the agent but never checked, so a run is not refused while its precondition fails, as roadmap M15's exit says it is
• W-5 feature: Each operation of W-2 records a verify step that proves its result after it runs: backup run its restore check, domains apply an HTTP probe through the reloaded proxy, the converge tools a re-observation of the hosts they changed, with the verify's outcome in the operation's entry (after W-2)
• W-6 feature: cloudfall why answers about any entry of the record (operator proposals, release approvals, the operations of W-2 and the refusals of W-3), names the hosts behind a group target, and says when a cited diff or log no longer matches its recorded hash (after W-2, W-3)

Order

The docs fix comes first because agents and readers plan from them. Recording every operation (W-2) and every refusal (W-3) makes the record complete, which the verify step (W-5) and the query (W-6) both build on; the precondition check (W-4) is small and stands alone. Once done, on a proving host an agent deploys, rolls back, restarts, backs up, copies data, applies a domain and converges, a person rejects one proposal and the operator withholds autonomy on another, and cloudfall why answers for each of them, with its verify outcome, from the record folder alone, with the hosts, the inventory, and git out of reach.

Milestone

none

Notes

Left out: the hosted record and autonomy earned from the record (roadmap M17), which the roadmap keeps until a workload needs them. ARCHITECTURE.md's "None of this is implemented" on the brownfield build order belongs to the G-4 plan's docs fix (#188, W-1). S-008-13 chose to let rollback run without an approval; W-2 records it, it does not gate it. D-1 holds: a rejection uses its own status, rejected, which exists in the model and nothing writes today.