Module interaction_governance 

Interaction governance (Phase 6, DEONTIC_LOGIC_PLAN §15) — the final stage that maps an abstract DeonticVerdict to a concrete runtime action in the Webizen VM.

Once the deontic / spatial / argumentation logics yield a verdict, something must happen. This module is the pure decision layer: verdict (+ a little classification) → PolicyMode. The side effects each mode implies are performed by the caller:

• PolicyMode::PreventiveBlock → the VM injects a DenyRollback and halts the transaction before harm (non-derogable violations: child safety, the ICCPR core).
• PolicyMode::PermissiveAudit → the transaction proceeds but a BreachRecord is written to the WAL (super::meta_deontic::record_breach_to_wal) for the evidentiary trail (system utility preserved, conduct still recorded).
• PolicyMode::Prioritize → QoS / routing preference for hict:HumanitarianICT (peace infrastructure, medical access).
• PolicyMode::Interactive → halt and ask the human for a sense:HumanCorrection (ambiguous or uninterpretable mappings — agency over meaning stays human).
• PolicyMode::Allow → nothing special (in force / no longer binding).

Keeping the decision pure and separate from the effect is what makes the gate auditable and the same logic reusable by both the VM and the MCP cooperation interface (Track M).

Structs

Governance

The classification a verdict needs beyond its status to be governed: is the norm non-derogable (a Hohfeldian Immunity / MandatoryBaseline), humanitarian, and is its mapping ambiguous? These come from the graph (the values:nonDerogable overlay, hict:HumanitarianICT, and the resolver), not invented here.

Enums

PolicyMode

What the runtime should DO about a verdict.

Functions

apply_emergency_override

A humanitarian emergency may downgrade a PolicyMode::PreventiveBlock to PolicyMode::PermissiveAudit (proceed but record) — EXCEPT for the non-overridable hard core (torture, child safety, the non-derogable absolute prohibitions), which never bypasses. All other modes pass through unchanged. This is the structured emergency exception, not an open backdoor.

circuit_breaker

Trip the systemic circuit breaker when inconsistency saturation (from paraconsistent::local_saturation / global_saturation) reaches threshold: the system halts into PolicyMode::Interactive (ask a human) rather than act on a saturated, self-contradictory graph. Returns the override mode if tripped, else None.

govern_verdict

Govern a full verdict (convenience over map_policy).

map_policy

Map a deontic status + classification to the runtime PolicyMode.

permits_execution

Whether this mode lets the transaction proceed (audit/prioritize/allow) vs halts it (block/interactive). The VM uses this as the go/no-go bit.

policy_action

A short, stable label for logs / MCP responses.

restriction_proportionate

A governance action that restricts individual agency is justified only if proportionate — its marginal_harm to the person is strictly less than the advantage it secures. Binds algorithmic governance to the proportionality test of the human-rights instruments. A non-restricting action is always permitted.

threshold_authorized

A multi-stakeholder governance decision is authorized iff at least m stakeholders approved (an M-of-N threshold; approvals is the count of approving stakeholders). m == 0 is never authorized (a decision needs at least one approver).