…rigger

A refused write is correct but delivered badly: it is decided late (at flush),
invisible to the actor (the API server already returned 200), and — under the
selfHeal:false config bi-directional editing requires — never reverted, since
selfHeal is the only thing that reverts live drift.

This design turns the refusal into a conversation, extending the tier-1/2/3 model
in unreflectable-edits-and-write-gating.md in two directions its tier 3 does not
cover:

  - CONSENT. Split refusals into correctness (the render oracle — never
    negotiable) and policy (fan-in>1 blast radius — the user may just not realize).
    Consent lifts only the policy kind, and it is modelled as DECLARED INTENT, not
    a bypass: acknowledging "this changes prod and staging" promotes the sibling
    object from the oracle's must-be-untouched set into its intended set, and the
    same oracle re-verifies the larger intent. No second code path; correctness is
    never waved through. The token is scoped to a computed consequence-hash, and it
    lifts "did you realize", never "are you allowed" (cross-RBAC base edits stay
    refused). This is what opens the door to a deliberate shared-base edit.

  - THE RECONCILE TRIGGER. One new outward action — ask Flux/Argo to reconcile now
    — used two ways. (1) Revert a refused edit promptly: with selfHeal off it is
    the ONLY thing that ever reverts it, and at refusal time the operator has the
    authorized-vs-unauthorized-drift signal Argo lacks, so it is the targeted
    substitute for the self-heal it had to disable. (2) An ordering barrier on
    origin drift: reconcile Git->cluster first, then process events, so the
    orchestrator's own apply is absorbed as a resync no-op instead of mirrored back
    (the reconcile echo).

Grounded in the code: the oracle's WriteIntent set (render_verify.go), the
CAS+rebase-by-replay that already handles a moved remote (git_atomic_push.go,
branch_worker.go), and the existing replay barrier (target_watch.go). Honest about
the prerequisites it does not have: the reconcile trigger is the FIRST write action
on the orchestrator-ownership model, which is designed-but-unbuilt
(orchestrator-knowledge-boundary.md) — the operator cannot name the Flux/Argo
object for a path today.

Direction-setting; ships no code.

…two docs

They are two topics that shared a document. Split into:

  - admission-consent.md — turning a blast-radius refusal into a yes at the edit.
    The correctness-vs-policy split, consent as declared intent (promote the
    sibling into the oracle's WriteIntent set — never a bypass), the
    consequence-hash token, and the authorization edge consent must not cross.

  - orchestrator-reconcile-trigger.md — the operator's one new outward action,
    used two ways: revert a refused edit promptly (the only revert under
    selfHeal-off), and an ordering barrier on origin drift.

Each carries its own mermaid diagrams. The trigger doc's are built from the
diagrams in docs/bi-directional.md — the triggered-applier loop and sequence —
and expanded to show where the trigger sits: the two arrows that guide does not
draw (revert-on-refusal, and the origin-drift barrier), plus the refusal and
barrier sequences. The two docs cross-reference each other as the two halves of
one escalation.

Direction-setting; ships no code.

An orientation note on where Kpt and KRM functions fit the reverse-GitOps model:
packages as render roots, setters as an explicit inverse contract, function
pipelines as a renderer extension point (not an inverse API), and a per-capability
support ladder. It reuses the same oracle the Kustomize work established — a render
result is not a source map, and causation is not governance.

Indexed under "Renderers & provenance" in the folder README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>