decionis / govern

What it does

The step becomes an execution intent, Decionis decides on exactly that intent, the command runs only on an ALLOW whose single-use grant the step claimed first, and what happened is finalized into a signed Decision Dossier. BLOCK ends the step with the command never started; ESCALATE can hold it while Decionis orchestrates a person's approval; mode: shadow starts the command at once and records the verdict beside it, never failing a build. Nothing is decided locally: a Decionis that cannot be reached is a refusal, and the command does not run.