H
Controlled Requirement Catalogue
Single governed, versioned catalogue of every requirement able to influence a readiness decision. Classification is configuration, never code.
- Owner
- Project ES&H Governance Lead
- Fail-closed
- Catalogue absent or unparseable applicability → hard block, never silent pass.
- Dependencies
- CA-04ADR-16
I
Controlled Record Catalogue
Governed inventory of record types: what each proves, who masters it, identity keys, version semantics and admissibility.
- Owner
- Document & Information Control Lead
- Fail-closed
- Unreachable, conflicted or SEMANTIC_PROPOSAL-linked records are inadmissible for critical requirements.
- Dependencies
- CA-01ADR-03
J
Functional Enabling Conditions
Contextual pre/execution/continuous conditions inherited down the location hierarchy, distinct from requirement satisfaction.
- Owner
- Area Owner · Permit Coordinator
- Fail-closed
- UNKNOWN is never HELD; stale continuous feeds degrade to NOT_HELD.
- Dependencies
- CA-02
K/L
Q4 Transaction Model & State Mapping
Projected, non-authoritative Q4 transaction context with a versioned mapping table from native states to readiness semantics.
- Owner
- Work Control Manager
- Fail-closed
- UNMAPPED_STATE blocks; approval is never inferred; Q4 loss degrades to UNKNOWN with no fallback.
- Dependencies
- CA-03
M
IPERC Continuo — Assisted Generation
Composes candidate hazards and controls from governed content; the crew explicitly accepts, rejects or adds. Silence is never acceptance.
- Owner
- Crew Supervisor · Area ES&H Advisor
- Fail-closed
- Control library unreachable → assistance suppressed and path blocked, never a partial hazard set.
- Dependencies
- CA-04
N
PETAR Generation & Authorization Lifecycle
Assisted composition with strictly human authorization; authority resolved by role, scope, location and time-boxed delegation.
- Owner
- Permit / Area Authority
- Fail-closed
- Unresolved authority or any UNKNOWN critical input → authorization unavailable, zero side effects.
- Dependencies
- CA-01CA-03ADR-15
O
Readiness / Blocking / No-Compensation Rules
IRDE verdicts READY · CONDITIONAL · HOLD · STOP by deterministic severity order, with a full reason tree and no numeric score anywhere.
- Owner
- Project Governance Board
- Fail-closed
- Engine failure emits no verdict — EVALUATION_UNAVAILABLE is treated operationally as blocked.
- Dependencies
- CA-04
P/Q
Entry Baseline & Authorization Baseline
Immutable pinned baselines at admission and at authorization, with deviation classification driving re-assessment.
- Owner
- Work Control Manager · Permit Authority
- Fail-closed
- Unpinnable input blocks baseline creation; mutation attempts are rejected as integrity events.
- Dependencies
- CA-01
R/S/T
Validity, Forecast Readiness & Smart Alerts
Three-dimensional validity (time · context · scope), non-decisional forecast readiness, and attributable preventive alerts.
- Owner
- ES&H Governance · Planning · Work Control
- Fail-closed
- Unknown expiry is treated as expired; no synthetic forecast; STOP-class alerts cannot be suppressed.
- Dependencies
- ADR-18CA-02
U/V/W
Awareness, Sign On/Off, Isolation & Temporary Modification
Individual awareness acknowledgement, presence-only sign-on, projected isolation state and hard-expiring temporary modifications.
- Owner
- Permit Authority · Isolation Authority · Engineering Authority
- Fail-closed
- Isolation change invalidates dependent authorization; overdue temporary modification is STOP with no override.
- Dependencies
- ADR-19ADR-20ADR-03
X
Location Continuity & Interdisciplinary Handover
One custodian per location band at all times; restrictions and conditions survive handover unless authoritatively removed.
- Owner
- Area Owner · Commissioning Manager
- Fail-closed
- Hierarchy ambiguity is CONFLICTED and fails closed; no fuzzy location matching for critical links.
- Dependencies
- CA-02ADR-23
Y
Governance & Assurance Gap Engine
Detects systemic gaps — unclassified, unmapped, unresolved mastership or authority — with named owners and consequence-based severity.
- Owner
- Project Governance Board · Assurance
- Fail-closed
- Gap detection failure is itself raised as a top-severity integrity gap.
- Dependencies
- CA-01CA-02CA-03CA-04
Z
Offline, Reconciliation & Recovery
Field operation without connectivity that can never manufacture authority, freshness or approval; deterministic event replay on sync.
- Owner
- Work Control Manager · Field Systems
- Fail-closed
- Expired offline validity blocks; conflicts never auto-merge; untrusted clocks exclude critical evidence.
- Dependencies
- ADR-17ADR-22
AA/AB
Evidence, Measurement & Value Capture
Append-only evidence with exact decision reconstruction, plus observational measurement that never feeds a decision.
- Owner
- Assurance · Project Controls
- Fail-closed
- No action completes without its evidence; reconstruction mismatch flags decisions UNVERIFIABLE.
- Dependencies
- ADR-21
AC
Role-Based UI Architecture
Field sees the decision and the next action; supervision sees blockers and ownership; governance sees architecture.
- Owner
- Product/UX Lead with role sponsors
- Fail-closed
- Unavailable data is stated explicitly and never rendered as a permissive state.
- Dependencies
- Role catalogue
AD
Architecture Decision Register
ADR-17 to ADR-24 raised by H–AE, each with an explicit fail-closed behaviour until resolved. A–G is not reopened.
- Owner
- Enterprise Architecture
- Fail-closed
- No ADR resolution is assumed by any section.
- Dependencies
- ADR-17…ADR-24
AE
Assumptions & Open Questions
Seven assumptions requiring confirmation and eight open business questions (Q1–Q8) before prototype acceptance.
- Owner
- Project Director
- Fail-closed
- No structural contradiction with A–G found during H–AE development.
- Dependencies
- Q1–Q8