feat(decide): surface cycles_evidence on the decide response (#108)

Completes the lifecycle binding loop (decide/reserve/commit/release): adds the
optional cycles_evidence field (CyclesEvidenceRef) to DecisionResponse. The decide
artifact attests a pre-execution decision (ALLOW/ALLOW_WITH_CAPS/DENY); it's already
modelled in drafts/cycles-evidence-v0.1.yaml (DecidePayload = {request, response}, no
reservation created) with golden fixtures 01-decide-allow / 09-decide-risk-points-allow.
Forbidden/validation failures on /v1/decide remain error-artifact territory. Added the
DecisionResponseMirror non-attestation note (consistent with the other mirrors).

v0.1.25.3 -> v0.1.25.4; changelog prepended; merged regenerated; spec-index runtime_base
editorial -> 0.1.25.4 (semantic_base stays 0.1.25); changelogs valid; spectral 0 errors.

Author: amavashev

changelogs/cycles-protocol-v0.md

@@ -6,6 +6,22 @@ New entries are added directly to this file. See `scripts/validate_changelogs.py
 
 ---
 
+## v0.1.25.4 — 2026-06-13
+
+_(revision 2026-06-13 — surface `cycles_evidence` on the decide response)_
+
+- Adds the optional `cycles_evidence` field (`CyclesEvidenceRef`) to
+  `DecisionResponse`, completing the lifecycle binding loop (decide / reserve /
+  commit / release). The `decide` artifact attests a pre-execution decision
+  (ALLOW / ALLOW_WITH_CAPS / DENY); it is already modelled in
+  `drafts/cycles-evidence-v0.1.yaml` (`DecidePayload` = `{request, response}`, no
+  reservation created) with golden fixtures `01-decide-allow` /
+  `09-decide-risk-points-allow`. Forbidden/validation failures on `/v1/decide`
+  remain `error`-artifact territory (e.g. fixture `12-decide-live-forbidden`).
+  Present unless emission is disabled; additive + non-breaking.
+
+---
+
 ## v0.1.25.3 — 2026-06-13
 
 _(revision 2026-06-13 — surface `cycles_evidence` on commit + release responses)_

cycles-protocol-v0.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: Cycles Budget Authority API
-  version: 0.1.25.3
+  version: 0.1.25.4
   license:
     name: Apache 2.0
     url: https://www.apache.org/licenses/LICENSE-2.0
@@ -879,6 +879,12 @@ components:
           items:
             type: string
           description: Canonical scope identifiers impacted by this decision, in canonical order.
+        cycles_evidence:
+          $ref: '#/components/schemas/CyclesEvidenceRef'
+          description: >-
+            Reference to the CyclesEvidence envelope emitted for this decision
+            (artifact_type `decide`, present on ALLOW / ALLOW_WITH_CAPS / DENY).
+            Absent only when evidence emission is disabled on the server.
 
     # ---- Reservations (core) ----
     CommitOveragePolicy:

cycles-spec-index.yaml

@@ -63,14 +63,14 @@ spec_family:
     isolation; SDK generators and validator pipelines need a merged artifact.
     The merge_recipes section below defines how to produce those artifacts.
   current_versions:
-    base_runtime: "0.1.25.3"              # + cycles_evidence ref on reserve/commit/release responses (additive)
+    base_runtime: "0.1.25.4"              # + cycles_evidence ref on reserve/commit/release responses (additive)
     base_runtime_semantic_base: "0.1.25"  # frozen wire baseline — evidence revisions are additive, 0.1.25 clients stay compatible
     base_governance: "0.1.25.33"          # + webhook lifecycle EventTypes and per-row Event emission on webhook operations
     base_governance_semantic_base: "0.1.25.9"  # frozen wire baseline
     extension_runtime: "0.1.26"           # untouched — no Event/ErrorResponse redeclaration
     extension_governance: "0.1.27"        # trace_id on redeclared ErrorResponse
     action_kinds: "0.1.27"                # trace_id on redeclared ErrorResponse
-    spec_index: "0.1.28"                  # runtime_base editorial → 0.1.25.3 + semantic_base 0.1.25
+    spec_index: "0.1.29"                  # runtime_base editorial → 0.1.25.4 (+ decide cycles_evidence)
 
 # ---------------------------------------------------------------------------
 # CANONICAL DOCUMENTS
@@ -85,7 +85,7 @@ documents:
 
   - id: runtime_base
     file: cycles-protocol-v0.yaml
-    version: "0.1.25.3"          # editorial: + cycles_evidence on reserve/commit/release responses
+    version: "0.1.25.4"          # editorial: + cycles_evidence on reserve/commit/release/decide responses
     semantic_base: "0.1.25"      # frozen wire baseline — evidence fields are additive/optional
     role: base
     conformance: normative

drafts/cycles-evidence-v0.1.yaml

@@ -804,6 +804,11 @@ components:
         — the body of `POST /v1/decide`. The `allOf` below
         encodes the canonical L752 rule: caps is present only when
         decision=ALLOW_WITH_CAPS and MUST be absent otherwise.
+
+        DELIBERATE OMISSION — `cycles_evidence`: as with the reserve/commit/release
+        mirrors, the canonical response's optional `cycles_evidence` ref is TRANSPORT
+        METADATA, NOT attested; `additionalProperties: false` forbids it here. The
+        `evidence_id` is computed over this pre-evidence-ref response.
       required: [decision]
       additionalProperties: false
       properties:

merged/cycles-openapi-protocol-merged.yaml

@@ -463,6 +463,11 @@ components:
           items:
             type: string
           description: Canonical scope identifiers impacted by this decision, in canonical order.
+        cycles_evidence:
+          $ref: '#/components/schemas/CyclesEvidenceRef'
+          description: Reference to the CyclesEvidence envelope emitted for this decision (artifact_type
+            `decide`, present on ALLOW / ALLOW_WITH_CAPS / DENY). Absent only when evidence emission is
+            disabled on the server.
     CommitOveragePolicy:
       type: string
       description: "How server handles commits where actual > reserved.\nREJECT: reject commit (client\