decidefyi/decide

> Deterministic Decision API engine powering workflow applications, stable MCP notary remotes, decision memo packets, and execution gates
**Positioning:** Decide Runtime is the general deterministic decision engine. Decide Services are standalone specialized checks built on it; Policy Notaries is the existing family. Krafthaus owns workflow applications built on Decide, including intake, review, and execution handoff. MCP, REST, and SDK interfaces belong to the product they expose, not automatically to Krafthaus.
See the ecosystem ownership contract. Direct
service and runtime integrations do not require a Krafthaus app. Policy checks
are one service family, not the definition of the general Decision API.
Gate agent tool calls before execution
Use Decide to evaluate an agent-proposed action against a deterministic rulebook
before the tool receives authority to change state. The caller gets a replayable
Decision Record and routes yes, no, or review while retaining control of
credentials and execution.
See the AI agent action gate guide
Production Determinism Boundary
Binding production verdicts should use a versioned declarative rulebook:
Runtime architecture: see docs/RULEBOOK_RUNTIME_ARCHITECTURE.md.
Machine-readable schema: https://api.decide.fyi/schemas/rulebook-v1.schema.json.
Active runtime manifest: https://api.decide.fyi/manifests/rulebook-runtime-v1.json.
Downstream application binding: decide_application_binding_v1.
The production core is hybrid_declarative_rulebook_with_trusted_adapters:
direct declarative rulebooks are supported, registered first-party trusted
adapters may supply bounded facts, and customer executable rulebooks are
rejected. In both supported binding modes, Rulebook v1 remains the only binding
verdict selector.
mode: "rulebook" does not call an LLM. It validates the request rulebook
against the published JSON Schema, hashes the rulebook, evaluates bounded
conditions, and returns yes, no, or review alongside the application
verdict, action, reason code, matched rule, and evaluator_version. Responses
also include rulebook_contract with the enforced schema URL/hash,
runtime_binding with the direct or trusted-adapter binding mode, input_hash,
a SHA-256 hash of the canonical inputs or adapter facts consumed by the
declarative evaluator, plus a rulebook_attestation_v1 bundle hash over the
deterministic execution tuple.
Production deployments can sign that bundle hash with a
rulebook_attestation_signature_v1 Ed25519 envelope; verification keys are
published at /.well-known/rulebook-attestation-keys.json. Set
DECIDE_RULEBOOK_ATTESTATION_SIGNATURE_REQUIRED=true in production to fail
closed instead of returning unsigned Rulebook decisions. Publish retired public
verification keys with DECIDE_RULEBOOK_ATTESTATION_KEY_HISTORY_JSON so older
Decision Records remain verifiable after rotation.
Rulebook requests cannot preload Decide-generated Decision Record material.
Fields such as runtime_binding, trusted_adapter, adapter_facts,
rulebook_attestation, application_verdict, and action are response-only at
the request body, context.inputs, and adapter-facts boundaries; attempts return
RULEBOOK_OUTPUT_MATERIAL_FORBIDDEN.
Legacy single, multi, and runtime requests remain available for
AI-assisted exploration, but they are not binding production verdicts. Those
responses include decision_contract with authority: "advisory_only" and
production_verdict: false, plus production_binding_required: true and the
supported production binding modes; callers that need deterministic execution
must use mode: "rulebook" and capture rulebook_contract, runtime_binding,
and the Rulebook attestation material.
At the public Decision Record boundary, successful evaluations are registered
as immutable tenant-scoped snapshots. Historical replay restores the original
canonical input and stored rulebook snapshot rather than trusting a caller
override or the current application deployment.
Rulebook v1 also supports registered first-party trusted adapters for bounded
fact normalization. Adapter requests pin an exact semantic version and manifest
hash; responses attest the bundled implementation source hash plus canonical
input/output hashes and the enforced execution contract. Each invocation runs
once in an empty-environment worker with hard time/resource limits and denied
common ambient capabilities. The declarative rulebook remains the only binding
verdict selector. See docs/TRUSTED_ADAPTERS_V1.md.
The current reference applications prove both production patterns: Solana