Decisions · Architecture records
The decisions that shape the platform.
Civitas Compliance is a platform of architectural decisions. Every load-bearing choice is a decision someone made, and that the platform now enforces in code. Append-only audit. Type-system separation between read and write. Statute-bound action enums. The cure-period procedure that cannot skip a phase.
This page is the formal record of those decisions. Each entry follows the canonical Architecture Decision Record (ADR) format: the situation that required the decision, the decision itself, and the consequences. Procurement architecture teams can deep-link to any individual record. The collection grows over time and is append-only; superseded records remain visible alongside their replacements.
- Records
- 9 architectural decisions
- Status
- All accepted
- First published
- 2026-04-29
- Last updated
- 2026-04-29
- 001
Append-only decision ledger
Compliance determinations are written as new rows; never updated in place. Storage-layer integrity, enforced by row-level triggers, not by policy.
Accepted - 002
Deterministic replayability
Same inputs against the same versioned rules produce the same outcome at any future point. Auditors replay 2026 determinations in 2030.
Accepted - 003
Fail-closed audit transaction
Audit-log write and business mutation share one database transaction. Audit-write failure rolls back the mutation. No silent state changes.
Accepted - 004
View / mutation type separation
Read endpoints can only call read-tagged functions; write endpoints can only call mutation-tagged functions. Compile-time refusal of code that crosses the boundary.
Accepted - 005
Closed-set actions
Every admissible action and status is a typed enum constrained at the database layer. No `OTHER`, no `misc`, no free-text fields where the law does not recognize one.
Accepted - 006
Phased noncompliance procedure
Statutory due process enforced as a 15-phase procedure that cannot be skipped or reordered. Disenrollment-deadline violation throws in code, not in policy.
Accepted - 007
Capacity-shortage tolling
When the state lacks volunteer capacity, the cure-period countdown legally suspends. Informed by the body of federal court precedent on Medicaid work-requirement waivers.
Accepted - 008
AI auto-approve only
Compliance determination engine has no AI input path. CivicAI is read-only by architecture; cannot import, call, or mutate compliance functions.
Accepted - 009
Public / NDA disclosure split
Public-facing pages route capability claims through the MechanismCard primitive. Source citations and code-level evidence are reserved for NDA-gated channels.
Accepted