Compatibility

Kernite follows semantic versioning and a compatibility policy for execute response fields. Stable v1 execute surface:

Contract Invariants (v1)

Required response fields: ctx_id, message, data, data.decision, data.reason_codes, data.reasons, data.policy_selection_reason_code, data.policy, data.trace_hash, data.idempotency_key.
data.decision enum values are only approved or denied.
message is human-readable (best-effort). Integrations should branch on data.* fields, not message text.
data.reason_codes and data.reasons may be empty arrays when data.decision is approved.
When data.decision is denied, at least one data.reason_codes entry is present.
data.trace_hash is stable across v1.x for the same canonicalized input and policy context.
Canonicalization rule: Kernite deterministically canonicalizes all hash-participating arrays (for example sorted reason_codes and canonical policy-match entries used for hashing). Order-only differences in selected_policies and rules must not change data.trace_hash.