From 2234f84982f63263c93d5731d583e07410a41591 Mon Sep 17 00:00:00 2001 From: Codex Date: Sun, 5 Jul 2026 01:11:02 +0530 Subject: [PATCH] Add architecture control plane --- README.md | 11 ++ .../PREMIUM_REARCHITECTURE_2026.md | 106 ++++++++++++ docs/product/DISHA_V6_6_PRODUCT_SPEC.md | 11 ++ web/app/api/v1/architecture/route.ts | 10 ++ web/lib/unified/architecture-control-plane.ts | 159 ++++++++++++++++++ web/tests/architecture-control-plane.test.ts | 41 +++++ 6 files changed, 338 insertions(+) create mode 100644 docs/architecture/PREMIUM_REARCHITECTURE_2026.md create mode 100644 web/app/api/v1/architecture/route.ts create mode 100644 web/lib/unified/architecture-control-plane.ts create mode 100644 web/tests/architecture-control-plane.test.ts diff --git a/README.md b/README.md index 7f96c67e..d4df68e2 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,7 @@ The product contract is simple: receive a mission, normalize it into a typed sig - `web/tests/unified-os.test.ts`: product-spine tests. - `docs/product/DISHA_V6_6_PRODUCT_SPEC.md`: product specification. - `docs/architecture/UNIFIED_INTELLIGENCE_OS.md`: architecture. +- `docs/architecture/PREMIUM_REARCHITECTURE_2026.md`: 2026 premium re-architecture and product control-plane doctrine. - `docs/security/POLICY_GATE.md`: policy and safety boundary. - `docs/data_governance/OPEN_AND_CONTROLLED_DATA.md`: source and controlled-data rules. - `docs/api/API_REFERENCE.md`: API v1 reference. @@ -55,6 +56,16 @@ Archived code must be promoted through the v6.6 contracts before it becomes prod - evidence work through the evidence ledger, - data work through open or controlled connector contracts. +## Architecture Control Plane + +DISHA exposes its product architecture as data: + +```text +GET /api/v1/architecture +``` + +This endpoint identifies the active runtime, governed promotion zones, archived code, source-truth boundaries, agentic readiness, premium USP, and remaining production gaps. It is the product map for keeping DISHA one clean system instead of a mixed repository of demos. + ## Accuracy Rule DISHA must not invent facts, statistics, legal claims, government references, incidents, or dates. If a claim is not verified from repository material or a source connector, it must be shown as `[VERIFY REQUIRED]`. diff --git a/docs/architecture/PREMIUM_REARCHITECTURE_2026.md b/docs/architecture/PREMIUM_REARCHITECTURE_2026.md new file mode 100644 index 00000000..58378750 --- /dev/null +++ b/docs/architecture/PREMIUM_REARCHITECTURE_2026.md @@ -0,0 +1,106 @@ +# DISHA Premium Re-Architecture 2026 + +DISHA should not compete as another AI dashboard. That category is already crowded and easy to imitate. DISHA's defensible architecture is a constitutional evidence operating system: a product that treats every claim, source, model output, policy decision, and dashboard value as something that must be proven or explicitly withheld. + +## Product Thesis + +DISHA is an evidence-governed national intelligence workbench. + +It should: + +- register official and public sources before showing analytics, +- parse records only when source terms and schema are understood, +- route every mission through typed contracts, +- allow models to assist reasoning without becoming the authority, +- block unsupported claims instead of decorating them, +- preserve a hash-linked evidence trail for every mission. + +The premium edge is not visual styling. The premium edge is auditability. + +## Core Architecture + +The active product spine is: + +```text +source registry -> DishaSignal -> lenses -> fusion -> policy gate -> evidence ledger -> dashboard/API response +``` + +The active runtime lives in: + +- `web/app` +- `web/app/api/v1` +- `web/lib/unified` +- `web/lib/server` +- `web/tests` + +Everything else must be treated as archive, adapter material, packaging, or governed promotion candidate until it passes the v6.6 contracts. + +## Product Control Plane + +The repo now exposes a machine-readable architecture control plane: + +```text +GET /api/v1/architecture +``` + +This endpoint reports: + +- active runtime entry points, +- canonical contracts, +- evidence and policy boundaries, +- registered source counts and source domains, +- agentic readiness, +- active, archive, adapter, and promotion zones, +- premium USP, +- production gaps. + +This prevents the product from drifting into mixed demo code, imported experiments, or unsupported claims. + +## Re-Architecture Decisions + +1. Active runtime is the Next.js product only. + Legacy folders are not production until promoted through an adapter with tests. + +2. Source registry is the first data layer. + A dashboard may show registered sources, parser status, live probe readiness, and verified records. It must not show fake crime counts, fake heat maps, or invented government statistics. + +3. Agentic AI is a governed client. + Claude, OpenAI, or any model can reason through API v1. They cannot bypass policy, controlled data rules, evidence logging, redaction, or human review. + +4. Evidence ledger is the trust layer. + Every mission and decision must be reconstructable from evidence events. Production must move this from process memory to durable storage. + +5. Promotion firewall protects the repo. + Cyber, Yudh View, quantum, geospatial, OS packaging, and integration code can be valuable, but they must enter production one capability at a time through typed interfaces. + +## Premium USP + +- Constitutional Evidence Graph: decisions are bound to source provenance and event hashes. +- Policy-Gated Agentic AI: models assist but do not become the authority. +- Source-First Dashboard: BI views show what is registered, parsed, probed, blocked, and verified. +- Lens Fusion With Uncertainty: cyber, geospatial, governance, strategy, Yudh View, and simulation use one result contract. +- Promotion Firewall: legacy code cannot silently become product code. + +## Production Gaps + +These gaps must not be hidden: + +- mission and evidence ledger persistence, +- scheduled source monitors, +- parser jobs for CAG, finance, NCRB, CERT-In, Gazette, LGD, WRIS, NDMA, and other official sources, +- claim-level provenance tables, +- provider prompt-injection regression tests, +- durable memory retention and redaction policy, +- dependency and security advisory resolution, +- deployment health checks for Docker, Vercel, and OS packaging. + +## Final Direction + +DISHA should feel like a serious public-interest intelligence institution in software form. It should not be sold as magic. It should be trusted because it refuses to fake certainty. + +The design goal is simple: + +```text +If DISHA cannot prove a claim, DISHA must say so. +If DISHA can prove it, DISHA must show the chain. +``` diff --git a/docs/product/DISHA_V6_6_PRODUCT_SPEC.md b/docs/product/DISHA_V6_6_PRODUCT_SPEC.md index 4cf4c109..0fad74dc 100644 --- a/docs/product/DISHA_V6_6_PRODUCT_SPEC.md +++ b/docs/product/DISHA_V6_6_PRODUCT_SPEC.md @@ -20,6 +20,7 @@ Active runtime path: - `web/lib/unified/policy-gate.ts` - `web/lib/unified/evidence-ledger.ts` - `web/lib/unified/data-integration.ts` +- `web/lib/unified/architecture-control-plane.ts` - `web/app/api/v1/*` ## Mission Flow @@ -37,6 +38,16 @@ Active runtime path: No lens executes actions directly. No controlled data query bypasses policy and evidence logging. +## Architecture Control Plane + +DISHA exposes the architecture itself as an API-backed product contract: + +```text +GET /api/v1/architecture +``` + +The control plane defines the active runtime, archived research zones, governed promotion paths, evidence and policy boundaries, source-truth rule, agentic readiness, premium USP, and production gaps. This is the guardrail that keeps DISHA from becoming a loose mix of dashboard UI, legacy imports, and unverified data claims. + ## Lenses - Cyber: defensive monitoring, threat indicators, telemetry interpretation. diff --git a/web/app/api/v1/architecture/route.ts b/web/app/api/v1/architecture/route.ts new file mode 100644 index 00000000..0a994016 --- /dev/null +++ b/web/app/api/v1/architecture/route.ts @@ -0,0 +1,10 @@ +import { NextRequest, NextResponse } from "next/server"; + +import { withContext } from "@/lib/unified/api"; +import { getArchitectureControlPlane } from "@/lib/unified/architecture-control-plane"; + +export async function GET(req: NextRequest) { + return withContext(req, "agent:read", async (ctx) => + NextResponse.json(getArchitectureControlPlane(), { headers: { "X-Request-ID": ctx.requestId } }), + ); +} diff --git a/web/lib/unified/architecture-control-plane.ts b/web/lib/unified/architecture-control-plane.ts new file mode 100644 index 00000000..60f90c59 --- /dev/null +++ b/web/lib/unified/architecture-control-plane.ts @@ -0,0 +1,159 @@ +import { getAgenticReadinessReport } from "./agentic-readiness"; +import { getConstitutionalCore } from "./constitutional-core"; +import { listSourceRegistry } from "./source-registry"; + +export type ArchitectureZoneStatus = "active" | "governed_promotion" | "archive" | "external_adapter"; + +export type ArchitectureZone = { + id: string; + title: string; + status: ArchitectureZoneStatus; + paths: string[]; + purpose: string; + promotionRule: string; + productionRisk: string; +}; + +export type ArchitectureControlPlane = { + product: string; + thesis: string; + operatingDoctrine: string[]; + activeRuntime: { + entrypoints: string[]; + contracts: string[]; + evidenceBoundary: string; + policyBoundary: string; + }; + dataTruth: { + registeredSources: number; + constitutionalPillars: number; + sourceDomains: string[]; + noClaimRule: string; + }; + agenticReadiness: ReturnType["readiness"]; + zones: ArchitectureZone[]; + premiumUSP: string[]; + productionGaps: string[]; +}; + +export function getArchitectureControlPlane(): ArchitectureControlPlane { + const sources = listSourceRegistry(); + const core = getConstitutionalCore(); + const readiness = getAgenticReadinessReport().readiness; + const sourceDomains = Array.from(new Set(sources.map((source) => source.domain))).sort(); + + return { + product: "DISHA 6.6 Constitutional Evidence Operating System", + thesis: + "DISHA should be architected as an evidence-governed national intelligence workbench: source first, policy gated, model assisted, and audit provable. The unique value is not a prompt, theme, or dashboard; it is the governed chain from public source to lens reasoning to policy decision to evidence hash.", + operatingDoctrine: [ + "No claim without source provenance.", + "No action before policy gate.", + "No model output promoted as fact without evidence.", + "No legacy module enters production until it implements a v6.6 contract.", + "No controlled data path runs without authorization, redaction, retention, and audit export.", + ], + activeRuntime: { + entrypoints: [ + "/dashboard", + "/api/v1/mission", + "/api/v1/agentic/mission", + "/api/v1/lenses/{lens}/analyze", + "/api/v1/sources/registry", + "/api/v1/sources/probe", + "/api/v1/data/open/query", + "/api/v1/policy/evaluate", + "/api/v1/evidence/export", + "/api/v1/architecture", + ], + contracts: [ + "DishaSignal", + "DishaLensResult", + "PolicyDecision", + "EvidenceEvent", + "OpenDataRecord", + "ControlledDataQuery", + ], + evidenceBoundary: "Every mission, lens result, policy decision, source probe, and model advisory must become an evidence event or stay non-production.", + policyBoundary: "The policy gate is the only production path from reasoning to action state.", + }, + dataTruth: { + registeredSources: sources.length, + constitutionalPillars: core.length, + sourceDomains, + noClaimRule: "The product may show registry counts, source status, parser readiness, and verified connector records. It must not show invented incident totals, district heat, legal facts, or government figures.", + }, + agenticReadiness: readiness, + zones: [ + { + id: "runtime-web", + title: "Active Web Product", + status: "active", + paths: ["web/app", "web/lib/unified", "web/lib/server", "web/tests"], + purpose: "Single production runtime for UI, API v1, contracts, policy, evidence, source registry, and mission orchestration.", + promotionRule: "Changes must pass npm run verify and preserve evidence/policy contracts.", + productionRisk: "Next canary dependency and in-memory mission/evidence stores need production hardening.", + }, + { + id: "connectors", + title: "Open Source Connector Mesh", + status: "active", + paths: ["web/lib/unified/source-registry.ts", "web/lib/unified/data-integration.ts", "web/lib/*-connector.ts"], + purpose: "Maintain official/public source manifests and provenance-bearing access paths.", + promotionRule: "Each connector needs source terms, parser tests, freshness metadata, and claim-level provenance.", + productionRisk: "Many sources are manifests today; dataset-specific parsers and scheduled monitors remain incomplete.", + }, + { + id: "agentic-skills", + title: "Agentic Skill Layer", + status: "active", + paths: ["web/lib/unified/agentic-readiness.ts", "web/app/api/v1/agentic"], + purpose: "Expose Claude/model orchestration as a governed client of DISHA rather than a privileged data plane.", + promotionRule: "Every new skill must bind to a contract, policy boundary, evidence boundary, and explicit learning mode.", + productionRisk: "Provider credentials, prompt-injection regression tests, and durable memory controls must be configured per deployment.", + }, + { + id: "legacy-research", + title: "Legacy and Research Archive", + status: "archive", + paths: ["legacy", "disha/legacy-root-src", "disha/ai", "disha/services/integrations"], + purpose: "Retain research code and imported experiments without treating them as the production product.", + promotionRule: "Promote one capability at a time through lens, connector, evidence, or policy interfaces.", + productionRisk: "Bulk imports can create dependency, security, licensing, and stale-code debt if merged into runtime directly.", + }, + { + id: "os-packaging", + title: "Sovereign OS Packaging", + status: "governed_promotion", + paths: ["os", "docker", "infra", "packaging"], + purpose: "Package DISHA for kiosk, edge, and controlled deployment scenarios.", + promotionRule: "Deployment artifacts must target the active web product and pass release checklist validation.", + productionRisk: "Service files and Docker paths can drift from the active Next runtime unless release checks pin them.", + }, + { + id: "defense-skills", + title: "Defensive Vyuha Skill Archive", + status: "governed_promotion", + paths: ["skills/vyuha-defense-engine", "policies"], + purpose: "Provide strategic formation/rule material for defensive analysis under governance boundaries.", + promotionRule: "Only defensive, non-targeting outputs can enter cyber or Yudh View lenses.", + productionRisk: "Terminology can be misread as operational instruction unless policy tests keep it bounded.", + }, + ], + premiumUSP: [ + "Constitutional Evidence Graph: a mission is judged by evidence chain quality, not model confidence alone.", + "Source Registry Before Dashboard: dashboards expose what is registered, parsed, probed, and blocked instead of decorating missing data.", + "Policy-Gated Agentic AI: Claude/OpenAI-style models can reason only through DISHA contracts and cannot bypass controlled-data rules.", + "Lens Fusion With Uncertainty: cyber, geospatial, governance, strategy, Yudh View, and simulation outputs share one typed result model.", + "Promotion Firewall: legacy, OS, cyber, and integration code cannot silently become product code without adapter tests.", + ], + productionGaps: [ + "Persist missions and evidence ledger outside process memory.", + "Add scheduled source monitors and parser jobs for CAG, finance, NCRB, CERT-In, Gazette, LGD, WRIS, and NDMA sources.", + "Add claim-level provenance tables so dashboard values can link to exact source records.", + "Add prompt-injection and model-output quarantine tests for provider adapters.", + "Add deployment health checks for Docker, Vercel, and OS packaging paths.", + "Resolve dependency/security advisories before claiming production deployment readiness.", + ], + }; +} diff --git a/web/tests/architecture-control-plane.test.ts b/web/tests/architecture-control-plane.test.ts new file mode 100644 index 00000000..8d2d7f07 --- /dev/null +++ b/web/tests/architecture-control-plane.test.ts @@ -0,0 +1,41 @@ +import { describe, expect, it } from "vitest"; + +import { getArchitectureControlPlane } from "../lib/unified/architecture-control-plane"; +import { listSourceRegistry } from "../lib/unified/source-registry"; + +describe("DISHA architecture control plane", () => { + it("exposes the active runtime and architecture endpoint", () => { + const plane = getArchitectureControlPlane(); + expect(plane.activeRuntime.entrypoints).toEqual(expect.arrayContaining(["/dashboard", "/api/v1/architecture", "/api/v1/mission"])); + expect(plane.activeRuntime.contracts).toEqual(expect.arrayContaining(["DishaSignal", "DishaLensResult", "EvidenceEvent"])); + }); + + it("keeps source truth separate from invented statistics", () => { + const plane = getArchitectureControlPlane(); + expect(plane.dataTruth.registeredSources).toBe(listSourceRegistry().length); + expect(plane.dataTruth.noClaimRule).toContain("invented incident totals"); + expect(plane.dataTruth.noClaimRule).toContain("government figures"); + }); + + it("classifies legacy and integration code outside the active product runtime", () => { + const plane = getArchitectureControlPlane(); + const legacy = plane.zones.find((zone) => zone.id === "legacy-research"); + expect(legacy?.status).toBe("archive"); + expect(legacy?.promotionRule).toContain("Promote one capability at a time"); + }); + + it("defines a premium USP around evidence, policy, and promotion boundaries", () => { + const plane = getArchitectureControlPlane(); + expect(plane.premiumUSP.join(" ")).toContain("Constitutional Evidence Graph"); + expect(plane.premiumUSP.join(" ")).toContain("Policy-Gated Agentic AI"); + expect(plane.premiumUSP.join(" ")).toContain("Promotion Firewall"); + }); + + it("does not claim production completion where gaps remain", () => { + const plane = getArchitectureControlPlane(); + expect(plane.productionGaps).toEqual(expect.arrayContaining([ + "Persist missions and evidence ledger outside process memory.", + "Add claim-level provenance tables so dashboard values can link to exact source records.", + ])); + }); +});