[amabito]

Scope

Two isolated, opt-in components under extensions/decision-gateway:

1. The original provider-neutral advisory Decision Gateway.
2. An executing Document Autopilot: intake -> SQLite ledger -> preserved archive copy -> read-back verification -> durable completion report, without per-document confirmation inside explicit delegation.

Current head: 09b1d9c6c7177b58c0ddddc3e7eaa076ea0f2607.
Commits: advisory SDK 4dbff68d481ecca9fdc7560669a9bee4516a5958, initial autopilot a199c971fada5e17570e4f3d651639de3790db92, Windows portability fix 09b1d9c6c7177b58c0ddddc3e7eaa076ea0f2607.
No core/control-plane Planner, existing API, deployment, secrets or main-branch changes. PR remains draft; no merge or deployment requested.

Executing workflow

• Explicit expiring local workspace; exact issuer/kind allowlists, fixed operation permissions and bounded input/batch limits. Recheck immediately before tool effects. STOP file, expiry, changed policy or core denial stop subsequent actions.
• Strict JSON, labelled UTF-8 text and text-based template PDF extraction. Unknown/scanned/encrypted/ambiguous records require review, never fabricated extraction. PDF parser runs in a disposable process; CI pins pypdf 6.18.1.
• Real ExecutionContext across each batch; callback result captured separately from core Decision. No denial enables an unprotected fallback and model confidence grants no authority.
• Actual SQLite ledger, durable journal/audit and unique business key. Exact duplicates do not add ledger entries; conflicting values never overwrite.
• Non-destructive, no-clobber archives and reports. Reconcile committed registration and published files after real process death. Read back ledger/archive/source before completion.
• Foreground init, run, watch, demo CLI. Two actual demo passes with real files/DB, no live model or paid API. Original advisory documentation preserved as DECISION_GATEWAY.md.

Verified current-head CI

Workflow: https://github.com/amabito/veronica/actions/runs/35112202454
All four jobs and their demonstrations passed. This tests GitHub's temporary PR merge c7b079c5ca470e3d8b822ced97196c1791c74749, combining the current head with base 730f42830ac8ccee553d668b54aa950966b9dcbf, NOT a merge to main.

Test job	Verified result	Coverage
Autopilot / Ubuntu / Python 3.12.14	99 passed, 1 skipped; real-core demo passed	89.81% statement+branch combined
Autopilot / Windows Server 2025 / Python 3.12.10	95 passed, 5 skipped; real-core demo passed	89.81% statement+branch combined
Original gateway / Python 3.10	Test and demo steps passed	Existing 95% minimum gate passed
Original gateway / Python 3.12	Test and demo steps passed	Existing 95% minimum gate passed

The one common skip tests behavior when core is absent, whereas CI installs core. Windows additionally skips three symlink fixtures requiring optional privileges and one POSIX FIFO fixture. The seven actual-core Autopilot tests executed, not skipped. Both Autopilot job logs were retrieved and inspected. Codespell also passed; Claude review is skipped because the PR is draft.

Real core is 3.10.0 from exact source d03aa2fcba32dadcb9a8f22b52ab402af7829ef7.
Initial Windows CI exposed false source-change detection. The fix compares all identity/size/mode/link-count/timestamp observations through fstat on live handles, not mixed fstat/path-stat implementations. No identity validation was removed. Eight additional regression cases cover the portability fix, modified/replaced snapshots and FIFO rejection.

Local/source/package verification

• Python 3.13.5 and available local pypdf 5.9.0: 203 passed, 2 actual-core modules skipped (core unavailable locally). Repeat against installed wheel: 203 passed, 2 skipped.
• Locally recomputed extensions tree 3e2372b03aa548974fffc9b6411c7e32b3b73ffd exactly matches the committed tree.
• Python 3.10 grammar check passed; wheel build passed; all 11 packaged implementation files match tested source bytes.
• No claim of complete existing control-plane regression, arbitrary-document accuracy, security proof or commercial readiness.

Explicit limitations

Fixed service-owned local workflow, not an arbitrary-invoice AI or finished SaaS. No OCR/live model, Excel/external accounting writes, email/push, payment, hosted API, reviewer UI or commercial metering. Document issuer is a content filter, not authenticated sender proof.
Only local hardlink-capable filesystems are intended. Host code/adapters/policy/state are trusted; not a hostile same-user sandbox, multi-host coordinator or tamper-proof audit. File/DB effects are reconciled rather than globally atomic. Review conflicts need operator reconciliation. Audit/report retention caps are finite; archive disk quota management and installed background-service management are not implemented. See README for operational limits.

[amabito]

Verified CI receipt — implementation commit 4dbff68d481ecca9fdc7560669a9bee4516a5958

The real-kernel qualification that was pending in the initial PR description has now completed. Retrieved and inspected both job logs, not just the green status.

Workflow: https://github.com/amabito/veronica/actions/runs/35103922361

Environment	Result	Added-module coverage	Synthetic local demo
Python 3.10.21 + real veronica-core 3.10.0	115 passed, no skips, 0.53 s	290 statements / 90 branches; 100%	PASS
Python 3.12.14 + real veronica-core 3.10.0	115 passed, no skips, 0.43 s	290 statements / 90 branches; 100%	PASS

Jobs: 3.10, 3.12.

The workflow built the real kernel from exact commit d03aa2fcba32dadcb9a8f22b52ab402af7829ef7. GitHub tested the PR's temporary merge ref 4ddf65bf0cea4ffc48fbb47b730eb8f991d5f6ae (implementation head above + base 730f42830ac8ccee553d668b54aa950966b9dcbf), not a merge to main.

The five real-core tests cover answer capture, aborted-context denial, shared step-limit enforcement across fallback, pre-dispatch cost-estimate denial, and provider exception without fallback. Both demo cases returned review_required and authorization_granted=false; they use synthetic local classifiers, not live models.

Codespell run 35103922169 also completed successfully. Claude Code Review was skipped because this PR remains a draft.

Additional local verification against the built/installed wheel: Python 3.13.5, 110 passed / 1 module skipped, 100% added-module coverage. That local skip is still real: the offline environment lacks the kernel; the CI results above independently cover the five integration tests.

Limitations unchanged: no complete control-plane regression run, live vendor/model integration, durable audit or approvals, authenticated HTTP service, actual-usage billing, deployment, or merge. Coverage is not a security or correctness proof.