Design enforceable per-module reconciliation intent artifacts #22

Goal

Design a per-module apply/adapt/leave intent artifact bound to its target and discovery inputs, replacing LLM-only guidance with an enforceable record.

Observations

• Current guidance is LLM-only; the backend does not record intent.
• A plain approved:true flag is not human proof and must not gate enforcement.
• Leave must produce zero writes or creates, including for missing state; managed:false alone still creates missing state and is not a way to encode leave.

Decision gate

Approve the design before any code. Controls come from an actor's exact decision, never a guessed CLI flag.

Acceptance criteria

• Every module resolves to one explicit apply/adapt/leave intent bound to its target and discovery inputs.
• Leave produces zero writes or creates, including for missing state.
• managed:false alone is not treated as leave and never falsely reports a module as off.

Verification

• Design review -> the artifact schema covers target, discovery inputs, and per-module decision.
• Prototype -> a missing or mismatched intent is rejected; leave performs zero writes.

Release checkpoint

Remaining risk: design alone changes no runtime behavior. The final-SHA apply gate stays in place.

Tracking

Roadmap item: B04-01. All acceptance criteria remain pending; publication does not grant approval or release authority.

Dependencies

• Depends on Model auth and apply reality for labels, protection, and preservation #17 (B02-02).