Decisions · Architecture records

The decisions that shape the platform.

Civitas Compliance is a platform of architectural decisions. Every load-bearing choice is a decision someone made, and that the platform now enforces in code. Append-only audit. Type-system separation between read and write. Statute-bound action enums. The cure-period procedure that cannot skip a phase.

This page is the formal record of those decisions. Each entry follows the canonical Architecture Decision Record (ADR) format: the situation that required the decision, the decision itself, and the consequences. Procurement architecture teams can deep-link to any individual record. The collection grows over time and is append-only; superseded records remain visible alongside their replacements.

Records
9 architectural decisions
Status
All accepted
First published
2026-04-29
Last updated
2026-04-29
  1. 001

    Append-only decision ledger

    Compliance determinations are written as new rows; never updated in place. Storage-layer integrity, enforced by row-level triggers, not by policy.

    Accepted
  2. 002

    Deterministic replayability

    Same inputs against the same versioned rules produce the same outcome at any future point. Auditors replay 2026 determinations in 2030.

    Accepted
  3. 003

    Fail-closed audit transaction

    Audit-log write and business mutation share one database transaction. Audit-write failure rolls back the mutation. No silent state changes.

    Accepted
  4. 004

    View / mutation type separation

    Read endpoints can only call read-tagged functions; write endpoints can only call mutation-tagged functions. Compile-time refusal of code that crosses the boundary.

    Accepted
  5. 005

    Closed-set actions

    Every admissible action and status is a typed enum constrained at the database layer. No `OTHER`, no `misc`, no free-text fields where the law does not recognize one.

    Accepted
  6. 006

    Phased noncompliance procedure

    Statutory due process enforced as a 15-phase procedure that cannot be skipped or reordered. Disenrollment-deadline violation throws in code, not in policy.

    Accepted
  7. 007

    Capacity-shortage tolling

    When the state lacks volunteer capacity, the cure-period countdown legally suspends. Informed by the body of federal court precedent on Medicaid work-requirement waivers.

    Accepted
  8. 008

    AI auto-approve only

    Compliance determination engine has no AI input path. CivicAI is read-only by architecture; cannot import, call, or mutate compliance functions.

    Accepted
  9. 009

    Public / NDA disclosure split

    Public-facing pages route capability claims through the MechanismCard primitive. Source citations and code-level evidence are reserved for NDA-gated channels.

    Accepted