Decision Gate scenarios are immutable dependency DAGs. A run begins with empty progress; roots are ready but unopened. Operators explicitly choose which ready stages to open and evaluate.
1. Author a raw scenario
{
"scenario_id": "release",
"namespace_id": 1,
"spec_version": "dag-v3",
"value_limits": { "selection": "InheritOperator" },
"stages": [
{
"stage_id": "verify",
"prerequisite": { "kind": "root" },
"entry_packets": [],
"completion_requirement": { "Condition": "checks_green" }
}
],
"conditions": [
{
"condition_id": "checks_green",
"observation_domain": { "domain": "Boolean" },
"predicate": {
"predicate": "Equals",
"expected": { "value_type": "Boolean", "value": true }
},
"evidence_use_policy": {
"allowed_channels": ["caller_submission"],
"required_assurance": ["content_integrity", "scope", "schema_compatibility"],
"integrity": "canonical_content_only",
"authorization": "embedding_authority",
"scope": "exact_condition",
"freshness": { "freshness": "NotRequired" },
"independence": "distinct_acquisition",
"combination": { "combination": "AllQualifyingAgree" },
"retention": "retain_canonical_value",
"replay": "full_semantic"
}
}
],
"acquisition_bindings": [],
"completion_requirement": { "Condition": "verify" },
"policies": [],
"schemas": []
}
Call scenario_define. Success returns scenario_law_identity and
graph_identity; keep the exact law identity for run creation.
2. Start an independent run
Call scenario_start with namespace, scenario, run ID, exact law identity,
stable operation ID, and explicit timestamp. The response contains revision 0,
the exact accepted-record digest, verify as ready_unopened, and no opened
stage or entry intent.
3. Open a ready stage
Call scenario_open_stage with the explicit stage ID, the exact accepted head
returned by start, and a stable operation ID. Opening means work began on this
shared run. It does not assign an agent or change ready siblings.
4. Evaluate the open stage
Call scenario_evaluate_stage with the new exact head, explicit stage ID,
stable evaluation-attempt ID, stable commit operation ID, timestamp, and one
hostile caller-evidence value for checks_green. The transport derives caller
provenance; the caller supplies neither trust nor comparator status.
- semantic false or unknown appends a retryable attempt;
- semantic true completes the stage once and reevaluates scenario completion;
- acquisition, authorization, integrity, or evaluator failure creates no semantic proposal.
5. Observe and coordinate
Use scenario_status for the exact head, run status, four stage
classifications, frontier, attempts, and intent identities. Use
scenario_history for bounded accepted-order records. On a stale-head conflict,
read status/history and re-derive; do not retry the stale proposal blindly.
Precheck
scenario_precheck_stage accepts hostile caller evidence and predicts one stage
result without opening, attempts, intents, or progress mutation.
Branching and multiple agents
A completed parent may make several children ready. All remain valid. Operators
may open any subset, including several simultaneously. Separate runs over one
law are independent; principals intentionally sharing one RunKey coordinate
through exact heads and typed conflicts. Assignment and leases belong to an
external coordination layer.