Admit MARY's governance read surface as a read-only petrova.host console route

---

rank: decision outranks: []

Admit MARY’s governance read surface as a read-only petrova.host console route

Date: 2026-10-07 Status: closed Supersedes: none Superseded-by: none — current MR-compliance: MR-4, MR-7, MR-9

Context

mary-wiki ratified mary-wiki:docs/decisions/2026-10-03-governance-read-surface-siting-proposed.md on 2026-10-07 (FLIGHT-signed 17d26e7, fast-forwarded to mary-wiki main, ratification gate VERIFIED). It sites MARY’s governance read surface off the public apex, on an authenticated internal host (R-1), read-only (R-3), with derived, dated figures (R-4), fed by a snapshot that mary-wiki’s own CI emits (R-6). At ratification FLIGHT chose host (a) under R-5: “petrova.host console, a new read-only route (e.g. /console/repo/mary-wiki/governance)”.

That choice is petrova-codes’ write. The mary-wiki doc says so (“it is petrova-codes’ write and needs petrova-codes’ own decision”) and its Consequences name this document as the next act: “If ratified with (a), the next act is a petrova-codes decision admitting the route.” Nothing on petrova.host may be built for it until this document is countersigned.

What the console is today, read at petrova e2d6ae13:

• /console/** is gated by the Airlock session middleware, admin role only (dashboard/src/middleware.ts:10-11, :124-128). /console itself is an exact-match 308 to the apex (:110-112).
• The console carries act affordances elsewhere: eight verb forms under dashboard/src/pages/console/acts/new/*.astro, all built on dashboard/src/components/ActFormShell.astro, which POSTs to /api/act (ActFormShell.astro:165-169). /api/sweeps/** and /api/irina/** dispatch workflows (middleware.ts:116-122).
• A per-repo page already exists at /console/repo/[slug] (dashboard/src/pages/console/repo/[slug].astro). It reads the host over RPC (petrova.state.get, :139) and carries no form.
• /console/governance already exists and is a different thing: the fleet MR audit (dashboard/src/pages/console/governance.astro:23, petrova.governance.audit).
• The dashboard reaches the host with PETROVA_HOST_BEARER (dashboard/src/lib/rpc.ts:35-43). The host reads GitHub through the petrova-act App installation token (host/src/github-auth.ts:5-27).

Decision

petrova-codes admits one new console route, /console/repo/mary-wiki/governance, as MARY’s governance read surface, on these terms. Each term restates a mary-wiki rule as a petrova-side obligation. None widens it.

1. Scope is mary-wiki’s R-2 and nothing else. Five panels (Needs a human, Convergence, Gates, Drift, Surfaces) as R-2 defines them. Estate-plane telemetry, Tier 1’s FDR browser and Tier 2’s controls are out. The route exists for the mary-wiki slug only. It is not a per-slug template, and other slugs do not get a /governance child by this decision.
2. Gated like the rest of /console/**. Airlock session, admin role (middleware.ts:124-128). No soft-auth or public prefix entry is added for it. It is never served from the apex, a preview URL or any unauthenticated origin (mary-wiki R-1).
3. Read-only on the route, structurally (mary-wiki R-3). The route’s page and anything it imports carry no <form>, no POST handler, no ActFormShell, and no fetch to /api/act, /api/sweeps/** or /api/irina/**. Every place an act would sit is a link to the mary-wiki PR or document where a human acts. Because the console has act forms elsewhere, the page states on its face that this route is read-only and that the read-only property is local to the route.
4. The feed is mary-wiki’s CI snapshot (mary-wiki R-6). The host reads a snapshot that mary-wiki’s own scheduled CI emits by running its existing instruments (register-count, countersign-queue, countersign-census, checks-registry, run results). The host never reads mary-wiki docs/ at request time and never reaches the decks. The read is exposed to the dashboard as one read-only host RPC method. The snapshot’s shape is mary-wiki’s to define in its own workflow PR; petrova consumes it as published.
5. Provenance on every figure (mary-wiki R-4). Each figure shows its source, the sha or run id it was read from, and its read time. A source that fails renders as UNREAD, with the reason and the last good read, never as a stale value. The snapshot’s age is shown relative to the viewer’s clock. No figure is typed into the page or the host.
6. Distinct from /console/governance. The page title and nav label name it as MARY’s governance plane, so it cannot be read as the fleet MR audit.

This decision builds nothing. It admits the route so the two build acts below may proceed.

Alternatives considered

• Generalise to /console/repo/[slug]/governance for every slug — rejected: mary-wiki R-2 defines panels from mary-wiki’s own instruments, which no other repo carries. A per-slug template would render empty or invented panels elsewhere, which PRODUCT.md principle 5 forbids (“no decorative states that could be mistaken for live signal”).
• Mount it under the existing /console/governance — rejected: that page is the fleet MR audit (governance.astro:23). Mixing one repo’s governance plane into the fleet audit would blur two different scopes under one label.
• Read mary-wiki docs/ live from the host at request time — rejected: mary-wiki R-6 forbids it. Schedule-time snapshots keep every number traceable to one commit.
• Put a panel on the existing /console/repo/mary-wiki page instead of a new route — rejected: that page is shared by every slug through [slug].astro. A mary-only panel there would mean slug-specific branching in a shared template, and R-3’s read-only statement would have to cover a page that may gain other affordances later.

Consequences

For code: none from this document. Two follow-on acts, in order:

• mary-wiki: a snapshot workflow PR (mary-wiki R-6) that emits the panel data on a schedule. Its own PR, under mary-wiki’s rules.
• petrova-codes: a route build PR adding the read-only host RPC method and dashboard/src/pages/console/repo/mary-wiki/governance.astro. That PR adds a test asserting term 3 (no form, no POST, no act import in the route’s module graph) so the read-only property cannot drift silently.

For docs: none beyond this record. If built, the route is listed wherever the console’s routes are documented.

For in-flight phases: none. mary-wiki Phase 9 (M9.2 status surface) stays unopened. This route does not discharge or widen M9.2 (mary-wiki R-5 row (b)).

For invariants: none added, modified or repealed. Terms 2–5 restate mary-wiki R-1, R-3, R-4 and R-6 as petrova-side obligations (MR-9: each traces to a ratified line).

For downstream consumers: eva.consumption.v1 is unchanged. It covers the EVA prompt catalogue the host consumes from eva-hq (cli/src/contract.ts, cli/src/probes/eva.ts). A console route and one new read-only host RPC method touch neither the prompt schema nor that profile. The RPC tool list gains one read method when the build PR lands.

Open for FLIGHT at countersign

1. Read credential. The host’s GitHub reads use the petrova-act App installation (host/src/github-auth.ts:15-24), which can write to mary-wiki: it opens PRs there (mary-wiki #768 was authored by petrova-act[bot]). R-3 says the route carries “no token that can write to this repository”. The route itself holds none, since the dashboard only holds PETROVA_HOST_BEARER, but the host would read the snapshot with a write-capable credential. Choose one at countersign: (i) acceptable, because the route holds no token and the host’s read path is read-only in code; or (ii) the snapshot read uses a separate read-only credential (a fine-grained token with contents: read on mary-wiki only). The drafting agent recommends (ii); it is a small cost against a literal reading of R-3.
2. Where the snapshot lives is mary-wiki’s to decide in its workflow PR. One constraint from this side: mary-wiki is profile: strict, fleets_allowed: [] (registry.yaml:1169-1175), so a scheduled CI commit to mary-wiki main would be an unattended write to a human-merge repo. A workflow artifact or a dedicated non-main ref avoids that. The host pins its read to a run id or sha either way (term 5).

References

• mary-wiki:docs/decisions/2026-10-03-governance-read-surface-siting-proposed.md (ratified 17d26e7; R-1–R-6, R-5 host (a), Consequences)
• mary-wiki:docs/decisions/2026-08-31-apex-admin-surface-disposition-1-tier-0.md (Tier 0; R-3’s “Disposition 2 — refused for now” partially voided by the siting decision for the governance plane only)
• mary-wiki:docs/decisions/2026-10-04-ratification-via-countersign-app-proposed.md (ratified a3fbc92; not relied on here, cited because it landed the same day)
• eva-hq:docs/reports/2026-10-03-mary-operator-dashboard-scoping.md (the scoping report that surfaced the siting question)
• dashboard/src/middleware.ts:10-11, :110-128 (console gating)
• dashboard/src/components/ActFormShell.astro:165-169 (act POST path)
• dashboard/src/pages/console/governance.astro:23 (existing fleet audit page)
• dashboard/src/pages/console/repo/[slug].astro:139 (per-repo page, RPC read)
• dashboard/src/lib/rpc.ts:35-43 (dashboard → host bearer)
• host/src/github-auth.ts:5-27 (host GitHub credential resolution)
• dashboard/PRODUCT.md:40 (principle 5, no decorative states)
• registry.yaml:1169-1175 (mary-wiki profile: strict)

Sign-off

• Subagent: Claude Opus 5.5, 2026-10-07 (drafted; code read at e2d6ae13)
• Human: flight@arno.host — admits /console/repo/mary-wiki/governance as a read-only route on terms 1–6, and rules open question 1 (i or ii).

Countersigned by human:flight@arno.host on 2026-10-07 — box ticked in commit 39c4886, authored by the human. Open question 1 ruled (ii) by FLIGHT in session on 2026-10-07 (“ii - go”): the snapshot read uses a separate read-only credential (fine-grained token, contents: read on mary-wiki only), not the petrova-act App installation. Recorded by an agent as scribe. Status flipped open→closed on 2026-10-07 by an agent as scribe (MR-7).