arbora 0.1.8.dev4__tar.gz → 0.1.8.dev6__tar.gz

{arbora-0.1.8.dev4 → arbora-0.1.8.dev6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arbora
-Version: 0.1.8.dev4
+Version: 0.1.8.dev6
 Summary: The deployable MCP, REST, control-plane, fleet, WebUI, and operations composition for the Knuckles agent platform.
 Author-email: Repository Maintainers <maintainers@knuckles.team>
 License-Expression: MIT
@@ -14,16 +14,17 @@ Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: agent-utilities<4.0.0,>=3.1.0
+Requires-Dist: meristem<5.0.0,>=4.0.1
 Requires-Dist: eunomia-core>=0.3.10
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: pyjwt>=2.15.1
 Requires-Dist: joserfc>=1.7.5
 Requires-Dist: python-multipart>=0.0.32
-Requires-Dist: agent-connector-sdk[a2a,mcp]<0.6.0,>=0.5.5
+Requires-Dist: scion-sdk[a2a,mcp]<0.6.0,>=0.5.9
 Requires-Dist: aiohttp>=3.14.5
 Requires-Dist: anyio>=4.15.1
-Requires-Dist: epistemic-graph[server]<3.0.0,>=2.27.6
+Requires-Dist: medulla<3.0.0,>=2.27.10
+Requires-Dist: medulla-stem<3.0.0,>=2.27.10
 Requires-Dist: fastapi>=0.143.3
 Requires-Dist: filelock>=4.2.0
 Requires-Dist: msgpack>=1.2.1
@@ -34,10 +35,16 @@ Requires-Dist: starlette>=1.8.0
 Requires-Dist: fastmcp>=4.1.0
 Requires-Dist: mcp<3.0.0,>=2.3.0
 Requires-Dist: opentelemetry-api>=1.45.1
-Requires-Dist: pydantic-ai-slim[openai]==2.57.0
+Requires-Dist: pydantic-ai-slim[openai]==2.63.0
 Requires-Dist: universal-skills<2.0.0,>=1.3.11
+Requires-Dist: cryptography>=50.0.2
+Provides-Extra: acp
+Requires-Dist: agent-client-protocol==0.11.0; extra == "acp"
+Requires-Dist: pydantic-ai-harness[acp]==0.63.0; extra == "acp"
 Provides-Extra: test
-Requires-Dist: agent-terminal-ui>=2.3.1; extra == "test"
+Requires-Dist: agent-client-protocol==0.11.0; extra == "test"
+Requires-Dist: tuig==2.3.6; (sys_platform == "linux" and (platform_machine == "x86_64" or platform_machine == "aarch64")) and extra == "test"
+Requires-Dist: pyte==0.8.2; extra == "test"
 Requires-Dist: pytest>=9.1.1; extra == "test"
 Requires-Dist: pytest-asyncio>=1.4.0; extra == "test"
 Requires-Dist: pytest-cov>=7.1.0; extra == "test"
@@ -49,10 +56,10 @@ Requires-Dist: types-PyYAML>=6.0.12.20260906; extra == "test"
 Requires-Dist: python-telegram-bot>=22.8; extra == "test"
 Requires-Dist: setuptools>=84.0.0; extra == "test"
 Provides-Extra: webui
-Requires-Dist: agent-webui<3.0.0,>=2.8.2; extra == "webui"
+Requires-Dist: agent-webui<3.0.0,>=2.8.3; extra == "webui"
 Requires-Dist: uvicorn>=0.54.0; extra == "webui"
 Provides-Extra: gateway-widgets
-Requires-Dist: agent-connector-sdk[a2a,mcp]<0.6.0,>=0.5.5; extra == "gateway-widgets"
+Requires-Dist: scion-sdk[a2a,mcp]<0.6.0,>=0.5.9; extra == "gateway-widgets"
 Provides-Extra: vault
 Requires-Dist: hvac>=2.4.0; extra == "vault"
 Provides-Extra: messaging-telegram
@@ -153,7 +160,7 @@ the durable database, a connector implementation, or the browser UI.
 - Project the same governed operations through REST and unary A2A.
 - Discover, admit, supervise, and route the MCP connector fleet.
 - Apply identity, tenant, action-policy, idempotency, and provenance controls.
-- Host Agent Web UI and coordinate terminal, desktop, messaging, and attended
+- Host Overstory and coordinate terminal, desktop, messaging, and attended
   browser capabilities.
 - Generate deployment configuration and report live readiness through `/health`.
 
@@ -173,20 +180,20 @@ then use the task-oriented references:
 
 | Layer | Authority | Relationship to Arbora |
 |---|---|---|
-| [Agent Web UI](https://knuckles-team.github.io/agent-webui/) | Browser experience and local interaction state | Arbora hosts it and supplies governed application routes. |
-| Agent Terminal UI | Terminal and headless interaction | Uses the governed Arbora REST interface. |
-| Geniusbot | Desktop cockpit | Uses the governed Arbora gateway for its primary panels. |
+| [Overstory](https://knuckles-team.github.io/overstory/) | Browser experience and local interaction state | Arbora hosts it and supplies governed application routes. |
+| Tuig | Terminal and headless interaction | Uses the governed Arbora REST interface. |
+| Axil | Desktop GUI | Uses the governed Arbora gateway for its primary panels. |
 | Messaging channels | Chat and voice entrypoints | Arbora hosts and supervises them; agent-utilities owns adapters and routing. |
 | **Arbora** | MCP, REST, A2A, identity policy, fleet supervision | The running process and public door. |
-| [agent-utilities](https://knuckles-team.github.io/agent-utilities/) | Agents, workflows, evaluation, and skills | Arbora invokes its typed control-plane services. |
-| [epistemic-graph](https://knuckles-team.github.io/epistemic-graph/) | Durable graph, SQL, RDF, vector, time, reasoning, and provenance | Arbora uses its generated client contracts. |
-| [agent-connector-sdk](https://knuckles-team.github.io/agent-connector-sdk/) | Connector servers, source synchronization, and governed effects | Arbora discovers and routes SDK-based connector services. |
+| [Meristem](https://knuckles-team.github.io/meristem/) | In-run execution harness | Arbora supplies run plans through typed harness contracts. |
+| [Medulla](https://knuckles-team.github.io/medulla/) | Durable graph, SQL, RDF, vector, time, reasoning, and provenance | Arbora uses its generated client contracts. |
+| [Scion SDK](https://knuckles-team.github.io/scion-sdk/) | Connector servers, source synchronization, and governed effects | Arbora discovers and routes SDK-based connector services. |
 
 The boundary is deliberate: Arbora authenticates, composes, routes,
 supervises, and projects. Each sibling remains the source of truth for its own
 domain.
 
-[![Knuckles platform runtime architecture](https://raw.githubusercontent.com/Knuckles-Team/epistemic-graph/main/docs/assets/runtime-architecture.svg)](https://knuckles-team.github.io/.github/architecture/#arbora)
+[![Knuckles platform runtime architecture](https://raw.githubusercontent.com/Knuckles-Team/medulla/main/docs/assets/runtime-architecture.svg)](https://knuckles-team.github.io/.github/architecture/#arbora)
 
 [Explore the live architecture](https://knuckles-team.github.io/.github/architecture/#arbora)
 

{arbora-0.1.8.dev4 → arbora-0.1.8.dev6}/README.md

@@ -57,7 +57,7 @@ the durable database, a connector implementation, or the browser UI.
 - Project the same governed operations through REST and unary A2A.
 - Discover, admit, supervise, and route the MCP connector fleet.
 - Apply identity, tenant, action-policy, idempotency, and provenance controls.
-- Host Agent Web UI and coordinate terminal, desktop, messaging, and attended
+- Host Overstory and coordinate terminal, desktop, messaging, and attended
   browser capabilities.
 - Generate deployment configuration and report live readiness through `/health`.
 
@@ -77,20 +77,20 @@ then use the task-oriented references:
 
 | Layer | Authority | Relationship to Arbora |
 |---|---|---|
-| [Agent Web UI](https://knuckles-team.github.io/agent-webui/) | Browser experience and local interaction state | Arbora hosts it and supplies governed application routes. |
-| Agent Terminal UI | Terminal and headless interaction | Uses the governed Arbora REST interface. |
-| Geniusbot | Desktop cockpit | Uses the governed Arbora gateway for its primary panels. |
+| [Overstory](https://knuckles-team.github.io/overstory/) | Browser experience and local interaction state | Arbora hosts it and supplies governed application routes. |
+| Tuig | Terminal and headless interaction | Uses the governed Arbora REST interface. |
+| Axil | Desktop GUI | Uses the governed Arbora gateway for its primary panels. |
 | Messaging channels | Chat and voice entrypoints | Arbora hosts and supervises them; agent-utilities owns adapters and routing. |
 | **Arbora** | MCP, REST, A2A, identity policy, fleet supervision | The running process and public door. |
-| [agent-utilities](https://knuckles-team.github.io/agent-utilities/) | Agents, workflows, evaluation, and skills | Arbora invokes its typed control-plane services. |
-| [epistemic-graph](https://knuckles-team.github.io/epistemic-graph/) | Durable graph, SQL, RDF, vector, time, reasoning, and provenance | Arbora uses its generated client contracts. |
-| [agent-connector-sdk](https://knuckles-team.github.io/agent-connector-sdk/) | Connector servers, source synchronization, and governed effects | Arbora discovers and routes SDK-based connector services. |
+| [Meristem](https://knuckles-team.github.io/meristem/) | In-run execution harness | Arbora supplies run plans through typed harness contracts. |
+| [Medulla](https://knuckles-team.github.io/medulla/) | Durable graph, SQL, RDF, vector, time, reasoning, and provenance | Arbora uses its generated client contracts. |
+| [Scion SDK](https://knuckles-team.github.io/scion-sdk/) | Connector servers, source synchronization, and governed effects | Arbora discovers and routes SDK-based connector services. |
 
 The boundary is deliberate: Arbora authenticates, composes, routes,
 supervises, and projects. Each sibling remains the source of truth for its own
 domain.
 
-[![Knuckles platform runtime architecture](https://raw.githubusercontent.com/Knuckles-Team/epistemic-graph/main/docs/assets/runtime-architecture.svg)](https://knuckles-team.github.io/.github/architecture/#arbora)
+[![Knuckles platform runtime architecture](https://raw.githubusercontent.com/Knuckles-Team/medulla/main/docs/assets/runtime-architecture.svg)](https://knuckles-team.github.io/.github/architecture/#arbora)
 
 [Explore the live architecture](https://knuckles-team.github.io/.github/architecture/#arbora)
 

{arbora-0.1.8.dev4 → arbora-0.1.8.dev6}/arbora/__init__.py

@@ -16,7 +16,7 @@ The live package layout is:
 - `arbora.deployment` — configuration, diagnostics, canaries, and operations.
 
 The ``arbora`` console command serves
-``arbora.mcp_server.server:mcp_server`` over stdio or authenticated
+``arbora.console:main`` over stdio or authenticated
 streamable HTTP. Capability limits that depend on unfinished upstream
 contracts are documented in ``docs/status.md`` and fail closed; no legacy
 fallback is implied by this package description.

{arbora-0.1.8.dev4 → arbora-0.1.8.dev6}/arbora/_version.py

@@ -3,4 +3,4 @@
 Updated only by `bump-my-version` (see `.bumpversion.toml`) — never hand-edited.
 """
 
-__version__ = "0.1.8.dev4"
+__version__ = "0.1.8.dev6"

{arbora-0.1.8.dev4 → arbora-0.1.8.dev6}/arbora/a2a/authority.py

@@ -300,8 +300,12 @@ class WorkItemA2AAuthority:
     def _request_digest(
         message: A2AMessage, context_id: str, decision: A2ARouteDecision
     ) -> str:
+        from arbora.agent_runs import native_stream_protocol
+
+        protocol = native_stream_protocol()
         return _digest(
             {
+                **({"host_transport_protocol": protocol} if protocol else {}),
                 "context_id": context_id,
                 "decision": decision.model_dump(mode="json"),
                 "message": message.model_dump(mode="json", by_alias=True),
@@ -317,7 +321,11 @@ class WorkItemA2AAuthority:
         request_digest: str,
         decision: A2ARouteDecision,
     ) -> dict[str, Any]:
+        from arbora.agent_runs import native_stream_protocol
+
+        protocol = native_stream_protocol()
         return {
+            **({"host_transport_protocol": protocol} if protocol else {}),
             "a2a_schema": _A2A_METADATA_SCHEMA,
             "a2a_context_id": context_id,
             "a2a_message_ref": persistence_reference(
@@ -421,22 +429,40 @@ class WorkItemA2AAuthority:
 
         if self.task_plan_config is not None and self.hosted_invocation is None:
             raise RuntimeError("UPGRADE_REQUIRED: hosted task-plan invocation")
+        from contextlib import nullcontext
+
         from arbora.agent_runs import native_run_scope
+        from arbora.current_plan_publication import bind_admitted_claim
         from arbora.host_bindings import preloaded_agent_tools
 
-        with native_run_scope(
-            run_id=run_id or task_id,
-            task_id=task_id,
-            context_id=context_id,
-            work_item_id=item_id,
-            session=session,
-            claim=claim,
-            owner_graph=(
-                work_items.native_owner_graph(work_engine)
+        with (
+            native_run_scope(
+                run_id=run_id or task_id,
+                task_id=task_id,
+                context_id=context_id,
+                work_item_id=item_id,
+                session=session,
+                claim=claim,
+                owner_graph=(
+                    work_items.native_owner_graph(work_engine)
+                    if self.task_plan_config is not None
+                    else None
+                ),
+                hosted_invocation=self.hosted_invocation,
+            ),
+            (
+                bind_admitted_claim(
+                    work_engine,
+                    session=session,
+                    run_id=run_id or task_id,
+                    work_item_id=item_id,
+                    claim=claim,
+                    hosted_invocation=self.hosted_invocation,
+                    owner_graph=work_items.native_owner_graph(work_engine),
+                )
                 if self.task_plan_config is not None
-                else None
+                else nullcontext()
             ),
-            hosted_invocation=self.hosted_invocation,
         ):
             return await self._agent_executor().execute_agent(
                 AgentExecutionRequest(
@@ -555,6 +581,39 @@ class WorkItemA2AAuthority:
             raise A2AIdempotencyConflict("A2A native run identity conflicts")
         return item
 
+    async def _notify_admission_or_settle(
+        self, session: Any, *, task_id: str, run_id: str, context_id: str, item_id: str
+    ) -> None:
+        """Settle only notification failures, never rerun or undo admission."""
+        from arbora.agent_runs import NativeRunAdmission, notify_native_admission
+
+        try:
+            notify_native_admission(
+                session, NativeRunAdmission(task_id, run_id, context_id, item_id)
+            )
+        except (Exception, asyncio.CancelledError) as failure:
+            try:
+                async with asyncio.timeout(5):
+                    cancelled = await self.cancel(task_id)
+                    readback = await asyncio.to_thread(
+                        self._authorized_item, task_id, "kg:write"
+                    )
+                    if (
+                        cancelled.status.state != "canceled"
+                        or not isinstance(readback, dict)
+                        or readback.get("status") != "cancelled"
+                    ):
+                        raise RuntimeError("cancellation not confirmed")
+            except (Exception, asyncio.CancelledError):
+                raise RuntimeError(
+                    "native admission notification failed: settlement unavailable"
+                ) from None
+            if isinstance(failure, asyncio.CancelledError):
+                raise
+            raise RuntimeError(
+                "native admission notification failed: admitted task canceled"
+            ) from None
+
     async def dispatch(
         self,
         *,
@@ -612,6 +671,13 @@ class WorkItemA2AAuthority:
             request_digest=request_digest,
             run_id=run_id,
         )
+        await self._notify_admission_or_settle(
+            session,
+            task_id=task_id,
+            run_id=run_id,
+            context_id=context_id,
+            item_id=item_id,
+        )
         if not created and item.get("status") in _TERMINAL:
             recovered = await self.get(task_id)
             if recovered is None:
@@ -1072,10 +1138,15 @@ class WorkItemA2AAuthority:
         return tasks, next_cursor
 
     async def cancel(self, task_id: str) -> A2ATask:
+        from arbora.run_origin import revoke_run_origins
+
+        cancellation_session = self._session("kg:write")
         item = await asyncio.to_thread(self._authorized_item, task_id, "kg:write")
         if item is None:
             raise A2ATaskNotCancelable("A2A task is not cancelable")
+        run_id = str(item["metadata"].get("a2a_run_id") or task_id)
         if item.get("status") == "cancelled":
+            revoke_run_origins(cancellation_session, run_id)
             return self._project(item, task_id=task_id)
         if item.get("status") in _TERMINAL:
             raise A2ATaskNotCancelable("A2A task is not cancelable")
@@ -1087,6 +1158,7 @@ class WorkItemA2AAuthority:
             work_items.cancel_work_item, work_engine, item_id
         ):
             raise A2ATaskNotCancelable("A2A task is not cancelable")
+        revoke_run_origins(cancellation_session, run_id)
         current = await asyncio.to_thread(
             work_items.get_work_item, work_engine, item_id
         )

{arbora-0.1.8.dev4 → arbora-0.1.8.dev6}/arbora/access/action_policy.py

@@ -52,7 +52,7 @@ import threading
 import time
 import uuid
 from collections.abc import Callable, Mapping
-from dataclasses import dataclass, field
+from dataclasses import dataclass, field, replace
 from enum import StrEnum
 from pathlib import Path
 from typing import Any, ClassVar
@@ -612,6 +612,18 @@ class ActionPolicy:
             setting("ACTION_IRREVERSIBILITY_AVERSION", False, cast=bool)
         )
 
+    def qualified_source_revision(self) -> str:
+        """Read explicit source evidence; this revision grants no action."""
+        from arbora.access.action_policy_source import qualified_policy_source
+
+        return qualified_policy_source(self).revision
+
+    async def qualified_source_revision_async(self) -> str:
+        """Capture source evidence without switching the native client loop."""
+        from arbora.access.action_policy_source import qualified_policy_source_async
+
+        return (await qualified_policy_source_async(self)).revision
+
     # ── policy loading ──────────────────────────────────────────────
 
     def _load_file_policy(self) -> dict[str, Any]:
@@ -686,14 +698,22 @@ class ActionPolicy:
         rules.sort(key=lambda r: -r.priority)
         return rules
 
-    def _match(self, request: ActionRequest) -> tuple[ActionRule, dict[str, Any]]:
+    def _rule_inputs(self, source: Any) -> tuple[dict[str, Any], list[ActionRule]]:
+        """Select live policy inputs or the already captured qualified snapshot."""
+        if source is None:
+            return self._load_file_policy(), self._kg_rules()
+        return source.inputs()
+
+    def _match(
+        self, request: ActionRequest, *, source: Any = None
+    ) -> tuple[ActionRule, dict[str, Any]]:
         """First matching rule — KG overrides first, then file order — plus defaults."""
-        data = self._load_file_policy()
+        data, graph_rules = self._rule_inputs(source)
         raw_defaults = data.get("defaults")
         defaults: dict[str, Any] = (
             raw_defaults if isinstance(raw_defaults, dict) else {}
         )
-        for rule in self._kg_rules():
+        for rule in graph_rules:
             if rule.matches(request):
                 return rule, defaults
         for raw in data.get("rules") or []:
@@ -721,6 +741,13 @@ class ActionPolicy:
         if self.engine is None:
             return []
         try:
+            legacy = self.engine.query_cypher(
+                "MATCH (d {type: 'ActionDecision', kind: $kind}) "
+                "WHERE d.node_type IS NULL RETURN d.id AS id LIMIT 1",
+                {"kind": kind},
+            )
+            if legacy:
+                return None
             rows = self.engine.query_cypher(
                 "MATCH (d:ActionDecision {kind: $kind}) "
                 "RETURN d.id AS id, d.target AS target, d.decision AS decision, "
@@ -777,7 +804,7 @@ class ActionPolicy:
 
     # ── assurance verifier (CONCEPT:AU-OS.governance.assurance-state-machine-verifier) ──
 
-    def _verify(self, request: ActionRequest):
+    def _verify(self, request: ActionRequest, *, source: Any = None):
         """Run the deterministic invariant verifier for ``request``.
 
         The reference-existence check (invariant 4) is best-effort: it only
@@ -785,8 +812,14 @@ class ActionPolicy:
         ``known_tools``/``known_targets`` registries (empty/absent ⇒ skipped,
         never a false deny — CONCEPT:AU-OS.governance.fail-closed-claim-check).
         """
-        known_tools = self.option("known_tools")
-        known_targets = self.option("known_targets")
+        if source is None:
+            known_tools = self.option("known_tools")
+            known_targets = self.option("known_targets")
+        else:
+            document, _rules = source.inputs()
+            options = document.get("options") or {}
+            known_tools = options.get("known_tools")
+            known_targets = options.get("known_targets")
         return verify_action(
             request,
             known_tools=frozenset(known_tools) if known_tools else None,
@@ -930,6 +963,58 @@ class ActionPolicy:
                 reason=f"policy unavailable (fail closed): {e}",
                 rule_origin="unavailable",
             )
+        return self._finish_decision(decision)
+
+    def decide_qualified(
+        self, request: ActionRequest, *, expected_revision: str
+    ) -> ActionDecision:
+        """Evaluate one explicit source snapshot through the shared evaluator.
+
+        The exact request must bind its source revision. Source evidence is
+        rechecked after evaluation and audit, never inferred from shipped
+        defaults. The browser owner must still recheck after its own awaits.
+        """
+        from arbora.access.action_policy_source import qualified_policy_source
+
+        try:
+            digest = request.digest()
+            captured = replace(request, params=_canonical_policy_value(request.params))
+            source = qualified_policy_source(self)
+            if (
+                source.revision != expected_revision
+                or request.params.get("policy_source_revision") != expected_revision
+            ):
+                raise RuntimeError("Policy source revision changed")
+            self._check_qualified_request(request, captured, digest)
+            decision = self._decide_inner(captured, source=source)
+            self._check_qualified_request(request, captured, digest)
+            if self.qualified_source_revision() != expected_revision:
+                raise RuntimeError("Policy source changed during evaluation")
+            decision = self._finish_decision(decision)
+            if self.qualified_source_revision() != expected_revision:
+                raise RuntimeError("Policy source changed during audit")
+            self._check_qualified_request(request, captured, digest)
+            return decision
+        except Exception:  # noqa: BLE001 - qualified source absence never widens authority
+            return self._bind_decision_receipt(
+                ActionDecision(
+                    decision=DECISION_UNAVAILABLE,
+                    tier=TIER_FORBIDDEN,
+                    request=request,
+                    reason="qualified policy source unavailable or changed",
+                    rule_origin="unavailable",
+                )
+            )
+
+    @staticmethod
+    def _check_qualified_request(
+        request: ActionRequest, captured: ActionRequest, digest: str
+    ) -> None:
+        if request.digest() != digest or captured.digest() != digest:
+            raise RuntimeError("Qualified action request changed")
+
+    def _finish_decision(self, decision: ActionDecision) -> ActionDecision:
+        request = decision.request
         decision = self._bind_decision_receipt(decision)
         if decision.decision == DECISION_ALLOW_NOTIFY:
             self._notify(
@@ -981,13 +1066,27 @@ class ActionPolicy:
             return self._hold(base, "tier requires human approval")
         return None
 
-    def _decide_inner(self, request: ActionRequest) -> ActionDecision:
+    def _verify_selected_source(self, request: ActionRequest, source: Any):
+        """Preserve the legacy verifier call unless a snapshot was selected."""
+        if source is None:
+            return self._verify(request)
+        return self._verify(request, source=source)
+
+    def _selected_irreversibility_aversion(self, source: Any) -> bool:
+        """Read the selected setting only when evaluation reaches this guard."""
+        if source is None:
+            return self._irreversibility_aversion
+        return source.irreversibility_aversion
+
+    def _decide_inner(
+        self, request: ActionRequest, *, source: Any = None
+    ) -> ActionDecision:
         # CONCEPT:AU-OS.governance.assurance-state-machine-verifier — the deterministic
         # invariant verifier runs BEFORE the rule/tier pipeline: a payload that fails
         # role/schema/precondition/reference checks is denied outright (fail-closed),
         # regardless of what tier its kind/target would otherwise match. This is the
         # enforced half of the gate — the caller's action genuinely does not execute.
-        verify = self._verify(request)
+        verify = self._verify_selected_source(request, source)
         if not verify.ok:
             return ActionDecision(
                 decision=DECISION_DENY,
@@ -999,7 +1098,7 @@ class ActionPolicy:
                 verify_ms=verify.latency_ms,
             )
 
-        rule, defaults = self._match(request)
+        rule, defaults = self._match(request, source=source)
         base = ActionDecision(
             decision=DECISION_DENY,
             tier=rule.tier,
@@ -1033,7 +1132,8 @@ class ActionPolicy:
         # CONCEPT:AU-OS.safety.irreversibility-aversion — irreversibility aversion (opt-in). An irreversible
         # action that would otherwise auto-execute is routed to a human, since
         # policy-gating alone is brittle as autonomy rises.
-        if self._irreversibility_aversion:
+        aversion = self._selected_irreversibility_aversion(source)
+        if aversion:
             if is_irreversible(request.kind):
                 return self._hold(
                     base, "irreversible action — queued for approval (SAFE-1.5)"
@@ -1144,7 +1244,7 @@ class ActionPolicy:
         audit_id = f"action_decision:{uuid.uuid4().hex}"
         req = decision.request
         try:
-            create_record(
+            created = create_record(
                 self.engine,
                 audit_id,
                 "ActionDecision",
@@ -1164,10 +1264,10 @@ class ActionPolicy:
                     "decided_unix": _now(),
                 },
             )
-        except Exception as e:  # noqa: BLE001 — audit is best-effort, decision stands
+        except Exception as e:  # noqa: BLE001 — missing audit evidence cannot authorize
             logger.debug("action_policy: audit write failed: %s", e)
             return None
-        return audit_id
+        return audit_id if created else None
 
     def _notify(self, message: str) -> None:
         """Send ``message`` to the bound operator notifier, else log it."""