{"slug":"canonical/adr/ADR-2026-09-04-11-execution-closure-reconciliation","title":"ADR-2026-09-04-11 — Execution closes only through re-ingestion, verification and reconciliation","section":"canonical","sectionLabel":"Canon","status":"canon","type":"adr","path":"canonical/adr/ADR-2026-09-04-11-execution-closure-reconciliation.md","bytes":2047,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** ACCEPTED — 2026-09-04 (Founder Canon §21; Book of Record closure rule)\n\n## Context\n\nProvider `200 OK`s, tool success flags and agent completion messages are observed outputs, not\nverified business outcomes. Treating them as completion leaves the organization reasoning from\nunverified state — the quiet version of the stale-copy failure.\n\n## Decision\n\n- A provider result is an **Outcome Event**, never automatically verified business truth.\n- The canonical closure chain is frozen:\n\n```text\nIntent → Proposal/Command → Governance Decision → Authorized Execution Plan → Hermes Execution\n→ Provider Outcome → Outcome Event → Re-ingestion → Verification → Expected-vs-Actual\n→ Reconciliation → Governed Canonical Commit → Projection Invalidation\n→ Human + AI Workbench Rehydration → Next Work\n```\n\n- Every continuity run retains traceability: `trace_id, correlation_id, causation_id, event_id,\n  approval_id, capability_run_id, execution_id, idempotency_key, verification_id,\n  reconciliation_id, continuity_run_id`.\n- Writes remain incomplete until the external outcome is observed, re-ingested, reconciled and\n  reflected in a refreshed projection with evidence.\n- Host-native execution outcomes enter the same closure path as IntegrateWise-native outcomes —\n  one reconciliation substrate across routes.\n\n## Alternatives considered\n\n- Trust the provider receipt as completion (optimize latency) — rejected: the platform's defining\n  property is that humans and AI continue from verified state, not from a success message.\n- Reconcile lazily/asynchronously only — rejected: reconciliation state must be explicit and\n  queryable; lazy reconciliation is how silent divergence begins.\n\n## Consequences\n\nVerification and reconciliation are first-class schemas and services, not logging conventions\n(register G-20/G-23). A capability is \"available\" only when its reconciliation behavior is\ndeclared.\n"}