Governed Repoint Design — the three refused boss tools

Status: PROPOSED (design only — landing this document changes no behavior) Date: 2026-08-25 Owner approval context: authored under the 2026-08-25 "fix 2, 3 and 4" directive as item 4: the standing note on every refusal says "lifting requires a governed repoint, never a bare revert" — this document is that repoint design. Refusal mechanism: _RETIRED_BACKEND_REASONS / _RETIRED_BACKEND_SERVICES in miz-oki-adk-agents/boss/boss_agent_core.py, pinned by tests/test_kg_write_perimeter.py and exercised by tests/services/test_mcp_external_services.py. Register rows: docs/reports/MIGRATION_CLOSURE_REGISTER_2026-09-02.md MC-07…MC-11 (Wave 1, 2026-09-02) — closure tests in tests/test_migration_closure_register.py.

1. What is refused, and why (measured)

All three registrations are retained (tool catalog and counts unchanged) — only the execution path is closed.

2. Where each capability already lives (no rebuild required)

The platform did not lose these capabilities when the tools were refused; the governed paths that replaced the Neo4j family already serve them:

• Journey/profile writes → the canonical ingestion door (MAPPERS[source] → ingest_gate) for events, and the governed Cell 3/24 writer path for KG mutations via the authenticated /api/v1/kg/* routes (Firestore-backed KG). There is deliberately no second write door — rebuilding graph_writer as-is would recreate the parallel-ingress class the estate closed.
• Journey path analysis → eshkg_path_metrics_api (live, inventory row) and path_metrics_api_bq (BigQuery-backed path analytics). The boss decision matrix and keyword routing now point there.
• Next-step prediction / recommendations → customer_intelligence_api (live) for segment/churn/LTV-grounded recommendation reads; graph-context retrieval via graphrag_integrated / gemini_kg_pipeline.
• Risk scoring → no journey- or event-level score exists, on purpose. A risk score that gates an action is a decision input: it belongs behind the DCP/DEL decision path, not a bare /process endpoint. Implemented 2026-08-25 (owner-approved): the governed risk input is the boss tool get_risk_signal — a fail-closed read of the LIVE customer-level churn risk from customer_intelligence_api (Cell 2), with the estimand named in the envelope so it can never masquerade as journey-level risk. The decision matrix consumes it; the three invoke refusals stay; journey-level scoring remains absent until a successor per §3/§4.

3. If a dedicated successor service is ever wanted

A real successor (for any of the three) must satisfy, in order:

1. Backing store is the governed one. Firestore-backed KG via the Cell 3/24 writer path, or BigQuery unified — never a new store, never neo4j-* anything (the config guard comments in services/mizoki-journey-kg/cloudbuild.yaml and boss/cloudbuild.v5.yaml are load-bearing).
2. One ingress, registered. The service gets a production/service-registry.yaml row with measured auth:/status: values and a CI deploy path before any claim of "live" (rule 04: a service missing from the registry cannot be reviewed; deployed-ci means a workflow actually deploys it).
3. IAM-first ordering. If its only auth is IAM, the perimeter is closed before the endpoint deploys (rule 04 ordering).
4. Writes are consent-gated and PII-scoped. Raw email/phone never enter the KG; identifiers are hashed at the door (the retired graph_writer forwarded raw contact fields — the successor must not).
5. Scores carry labels. Any performance figure a scoring successor emits carries a TRUTH.md label; iROAS/causal claims only through cells 36→26→27.

4. Lift procedure (per tool, single commit)

Lifting a refusal is one atomic change set — a bare deletion of the id is exactly the "bare revert" the refusal messages forbid:

1. The successor service is deployed, registered (step 2 above), and its health verified from a credentialed principal (CI job log or operator probe — an unauthenticated 403 proves nothing, per rule 01).
2. In boss_agent_core.py, remove the id from _RETIRED_BACKEND_REASONS and repoint the AGENT_REGISTRY entry + MCP tool descriptor url/description to the successor in the same commit.
3. Update the guidance surfaces the retirement edited (service list, decision matrix row, keyword routing, numbered tool list) back to recommending the tool.
4. Move the test baselines with intent: tests/test_kg_write_perimeter.py (reasons-dict key pins, registration labels) and tests/services/test_mcp_external_services.py (the exploding-client refusal test for that id becomes a success-path test against the successor's response shape).
5. Update docs/mcp_tool_catalog.md's row and, if the Node adapter is wanted back, re-add the mcp/service_registry.yaml block pointing at the successor (the removed blocks' comments name this document).
6. Re-run the perimeter + transport suites and the deploy verify battery; the boss deploy's registry count must hold.

5. What this document does NOT authorize

• No flag flips, no deploys, no IAM changes, no new services (PROPOSED means proposed).
• No re-adding neo4j-* mounts anywhere, ever.
• No treating this design as evidence a successor exists — capability statements about successors stay [PROPOSED] until the lift procedure above has actually run.