cloud-itonami-isic-4922

Open Business Blueprint for ISIC Rev.5 4922: other passenger land transport -- long-distance/intercity coach, chartered bus, and similar passenger services (distinct from sibling ISIC 4921's urban and suburban passenger land transport).

This repository publishes an intercity/chartered-coach SCHEDULING/DISPATCH LOGISTICS COORDINATION actor -- trip/ridership/ incident-report data logging, vehicle/route/timetable dispatch scheduling, fleet maintenance procurement coordination with registered providers, and vehicle-defect/driver-fitness/route-hazard safety-concern flagging -- as an OSS business that any qualified operator can fork, deploy, run, improve and sell, so an independent intercity/chartered coach operator never surrenders its dispatch/operations data to a closed back-office SaaS.

Built on this workspace's langgraph StateGraph runtime (portable .cljc, supervised superstep loop, interrupts, in-mem/Datomic checkpoints) -- the same actor pattern as every prior actor in this fleet -- here it is IntercityCoachAdvisor ⊣ IntercityCoachGovernor. This blueprint's own :itonami.blueprint/governor keyword, :intercity-coach-governor, is a distinct, independent build (no naming-collision precedent question -- distinct from sibling ISIC 4921's own governor, which is that actor's own separate build for urban/suburban transit).

Why an actor layer at all? An LLM is great at drafting a trip/ridership summary, a dispatch-scheduling proposal, or a maintenance-order request -- but it has no license to actually finalize a dispatch-safety-clearance determination or a driver-fitness-to-drive determination, no way to independently confirm a vehicle/route/ operator-license or a maintenance provider is actually a registered/ verified counterparty, and no notion of when a "flag this concern" op quietly turns into a claim to have already acted on it. Letting it act directly invites an unverified vehicle's data entering the ledger, an unverified provider receiving a maintenance order, or -- worst of all -- a fabricated claim to have cleared a vehicle to dispatch despite a known defect or certified a driver fit to drive despite a fatigue concern, exposing passengers, drivers and the operator to real harm and liability. This project seals the IntercityCoachAdvisor into a single node and wraps it with an independent IntercityCoachGovernor, a human approval workflow, and an immutable audit ledger.

Scope: coordination only, not vehicle operation or safety authority

This actor is SCHEDULING/DISPATCH LOGISTICS COORDINATION ONLY. It never directly operates a vehicle and never overrides a safety judgment. It never performs or authorizes:

• directly operating a vehicle
• directly finalizing a dispatch-safety-clearance determination (clearing a vehicle to depart despite a known defect or open safety hold)
• directly finalizing a driver-fitness-to-drive determination (certifying a driver medically/legally fit to drive, overriding a fatigue/fitness concern)

The governor's scope-exclusion-violations check re-scans every proposal for this failure mode independently of the advisor's own framing, and treats it as a HARD, permanent block regardless of confidence or how clean everything else is. Flagging a vehicle-defect/driver-fitness/route-hazard safety concern for a human to triage is exactly this actor's job -- :flag-safety-concern is never excluded by this check, only FINALIZING/clearing/determining that concern is.

Actuation

Every proposal this actor generates is :effect :propose, never a direct actuation. Two independent layers enforce this (intercitycoachops.governor's effect-not-propose-violations HARD check and intercitycoachops.phase's phase table, which never puts :flag-safety-concern in any phase's :auto set). A human dispatch/ fleet coordinator is always the one who actually acts on a flagged concern or confirms a high-cost maintenance order.

The core contract

vehicle/route/operator-license + provider registration + dispatch-coordination request
        |
        v
   ┌───────────────────────┐   proposal      ┌────────────────────────────┐
   │ IntercityCoach-       │ ─────────────▶ │ IntercityCoachGovernor       │  (independent system)
   │ Advisor (sealed)      │  + citations    │ vehicle-unverified ·        │
   └───────────────────────┘                 │ provider-unverified ·       │
          │                 commit ◀┼ effect-not-propose ·               │
          │                         │ scope-excluded (dispatch-safety-    │
    record + ledger        escalate ┼ clearance / driver-fitness-to-      │
          │              (ALWAYS for│ drive determination) ·              │
          │       :flag-safety-     │ op-not-allowed                      │
          │       concern/high-cost └────────────────────────────┘
          │       maintenance-order)
          ▼
      human approval / safety authority

The IntercityCoachAdvisor never commits a proposal the IntercityCoachGovernor would reject, and a safety-concern flag or a high-cost maintenance order never commits without a human sign-off. Hard violations (an unregistered/unverified vehicle; an unregistered/ unverified maintenance provider; a non-:propose effect; content touching dispatch-safety-clearance or driver-fitness-to-drive finalization; an op outside the closed allowlist) force hold and cannot be approved past.

以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗