Macro B — Field Pre-Start Demonstration Engineering & Acceptance
PH6A-FPSO-MPB-REV0 · demonstrate correctly without modifying the verified application baseline
Architecture
PH6A-IADA-REV1
ArchitectureSeal
PH6A-IADA-REV1-SEAL-01
CorporateInteractionArchitecture
PH6A-BXIA-REV0
FunctionalBaseline
PH6A-FPSO-FUNCTIONAL-BASELINE-REV1
InteractionDesign
PH6A-FPSO-IAD-REV2
BechtelizedApplicationBaseline
PH6A-FPSO-BAC-REV0
Prototype
PH6A-FPSO-PROTOTYPE-REV0
ImplementationConformance
PH6A-FPSO-ICV-REV0
FunctionalVerification
PH6A-FPSO-FVT-REV0
ApplicationEngineeringBaseline
PH6A-FPSO-APPLICATION-ENGINEERING-BASELINE-REV0 (VERIFIED)
ExternalDependencyCount
15 (all open, controlled)
Evidence class & global prohibitions
§2–3
Produces
- SCENARIO_DESIGN_EVIDENCE
- SCENARIO_ASSURANCE_EVIDENCE
- SIMULATION_EVIDENCE
- DEMONSTRATOR_ASSURANCE_EVIDENCE
Does not produce
- OperationalClosureEvidence
- PilotEvidence
- ProductionEvidence
Prohibited acts
- MODIFY_FUNCTIONAL_BASELINE
- MODIFY_ARCHITECTURE
- MODIFY_DECISION_RIGHTS
- MODIFY_SOURCE_AUTHORITY
- CREATE_NEW_FUNCTIONAL_STATE
- CHANGE_PROTOTYPE_BEHAVIOUR_TO_FIT_SCENARIO
- ALTER_SCENARIO_AFTER_FREEZE_TO_FORCE_PASS
- CLAIM_OPERATIONAL_EVIDENCE
- CLAIM_LIVE_INTEGRATION
- CLAIM_PILOT_RESULTS
- CLAIM_REAL_PRODUCTIVITY_SAVINGS
B1 — Scenario context · PH6A-FPSO-DEMO-SCENARIO-REV0
§5–7
| Element | Value |
|---|---|
| ProjectContext | SYN-PRJ-ANDES — brownfield process plant, commissioning window (SYNTHETIC) |
| Shift | SYN-SHIFT-D1 · Day shift 06:00–18:00 (SYNTHETIC) |
| Area | SYN-AREA-3200 · Utilities & Piperack (SYNTHETIC) |
| CanonicalLocation | LOC-3200-TT01 · Tank Terrace 01 (SYNTHETIC value, governed Location object) |
| GPSCandidate | LOC-3200-TT02 initially proposed by AD-08 (SYNTHETIC) |
| WorkPackage | SYN-WP-3200-014 · Line reinstatement (SYNTHETIC) |
| JobCard | SYN-JC-3200-014-02 · Flange break & valve replacement (SYNTHETIC) |
| Discipline | Mechanical (primary) with Electrical interface |
| Crew | 4 role-slots: Supervisor, Fitter, Rigger, Fire Watch (SYNTHETIC persons) |
| Supervisor | SYN-PER-114 · Field Supervisor (SYNTHETIC) |
| Tools | SYN-TOOL-TQ-08 torque wrench, calibration validTo T16 boundary (SYNTHETIC) |
| Equipment | SYN-EQP-CR-02 · 25t crane, certificate valid across window (SYNTHETIC) |
| ApplicableDocuments | DOC-ISO-3200-014 Rev C and Rev D both APPROVED (deliberate election ambiguity) |
| PETS | SYN-PETS-MEC-07 flange breaking (SYNTHETIC) |
| ATS | SYN-ATS-3200-014 (SYNTHETIC) |
| IPERCContinuo | SYN-IPERC-2026-0901-14, continuous validity window (SYNTHETIC) |
| PETAR | Applicable — hot work adjacency at T12 (SYNTHETIC) |
| CriticalControls | CC-ENERGY-ISOLATION, CC-DROPPED-OBJECT (governed classes, synthetic instances) |
| SIMOPS | Pairwise mechanical↔electrical PASS at T12; third activity introduces cumulative conflict at T16 |
| Restrictions | Wind limit 12 m/s for lifting (SYNTHETIC threshold) |
| DecisionRights | DR-AUTHORIZE-PRESTART held by SYN-PER-201; SYN-PER-114 has UI access only |
| SignatureRequirement | Pre-Start authorization signature bound to object version |
| TemporalFacts | TF: tool calibration, competency, permit, decision right, IPERC (governed classes) |
| ExternalDependencies | EXT-07 (stewardship assignment) touched — SafeInterimBehaviour only |
Synthetic data boundary
§6
| Item | Classification | Note |
|---|---|---|
| Project / Area / Location codes | SYNTHETIC_SCENARIO_DATA | Structure is governed; values are invented. |
| Persons (supervisor, crew, approver) | SYNTHETIC_SCENARIO_DATA | No real worker, no real authorization. |
| Document codes and revisions | SYNTHETIC_SCENARIO_DATA | No live Aconex retrieval. |
| Permit / PETAR references | SYNTHETIC_SCENARIO_DATA | No real permit issued or consumed. |
| DecisionRight grants | SYNTHETIC_SCENARIO_DATA | No real IAM; AD-06 remains CONTROLLED_STUB. |
| Tool / equipment certificates | SYNTHETIC_SCENARIO_DATA | No real register (AD-09 MOCK_ADAPTER). |
| GPS candidate responses | SYNTHETIC_SCENARIO_DATA | AD-08 SYNTHETIC_SOURCE_RESPONSE. |
| Verdict / reason-code vocabulary | GOVERNED_REFERENCE_STRUCTURE | From FUNCTIONAL-BASELINE-REV1 — not synthetic. |
| State machines and gates | GOVERNED_REFERENCE_STRUCTURE | From FC-FPSO-01…08 — not synthetic. |
| EvaluationTimestamp values T0…T21 | SYNTHETIC_SCENARIO_DATA | Governed input, never wall-clock. |
Governed time model — T0…T21
§12 · no wall-clock
| Step | EvaluationTimestamp | Note |
|---|---|---|
| T0 | 2026-09-01T05:00:00.000Z | Pre-Start opened |
| T1 | 2026-09-01T05:04:00.000Z | Shift context |
| T2 | 2026-09-01T05:07:00.000Z | GPS candidate acquired |
| T3 | 2026-09-01T05:11:00.000Z | Canonical location confirmed by human |
| T4 | 2026-09-01T05:15:00.000Z | Work / JobCard selected |
| T5 | 2026-09-01T05:18:00.000Z | Operational context loaded |
| T6 | 2026-09-01T05:22:00.000Z | Contextual source retrieval |
| T7 | 2026-09-01T05:27:00.000Z | Applicability evaluated |
| T8 | 2026-09-01T05:31:00.000Z | Preventive package composed |
| T9 | 2026-09-01T05:36:00.000Z | Crew confirmation |
| T10 | 2026-09-01T05:41:00.000Z | IPERC Continuo validation |
| T11 | 2026-09-01T05:46:00.000Z | Checklists / tools / equipment |
| T12 | 2026-09-01T05:51:00.000Z | PETAR / critical controls / SIMOPS |
| T13 | 2026-09-01T05:55:00.000Z | Authority verification |
| T14 | 2026-09-01T05:58:00.000Z | Signature commit |
| T15 | 2026-09-01T06:00:00.000Z | Resulting operational state |
| T16 | 2026-09-01T08:05:00.000Z | Material change — tool calibration expiry + SIMOPS cumulative conflict |
| T17 | 2026-09-01T08:09:00.000Z | Dependency re-evaluation (document Rev E, object version change) |
| T18 | 2026-09-01T08:12:00.000Z | Governed non-progress state |
| T19 | 2026-09-01T08:40:00.000Z | Corrective action |
| T20 | 2026-09-01T08:52:00.000Z | Revalidation |
| T21 | 2026-09-01T09:00:00.000Z | New governed decision |
Material disturbance & external dependency treatment
§9–11
Disturbance
TemporalExpiry (tool calibration) + SIMOPSChange (cumulative conflict) + DocumentRevisionChange (Rev D → Rev E, material)
Injected at
T16 / T17
Governed consequence
HOLD (package) + STOP (SIMOPS aggregate probe) + SIGNATURE_NOT_VALID_FOR_CURRENT_VERSION
Recovery
T19 corrective → T20 re-signature → T21 new governed decision
ScenarioCanProduceNonPassState
TRUE
ActiveWorkAtInjection
FALSE
| ID | Dependency | Touched at | Representation | SafeInterimBehaviour |
|---|---|---|---|---|
| EXT-07 | Location stewardship assignment authority (organizational, unassigned) | T18 | CONTROLLED_EXTERNAL_DEPENDENCY | Package escalates to HOLD with RC-EXT-VALIDATION-DEPENDENCY-UNRESOLVED; no synthetic owner approval is created to progress. |
| EXT-15 | Offline reconciliation authority | Not touched — scenario executes online | NOT_EXERCISED | Declared out of primary scenario scope; offline journey remains NOT_EXECUTABLE_IN_CURRENT_PILOT. |
Scenario expectation table — declared before execution
§14
| Step | Time | Input facts | Trigger | Expected state | Expected reason code | Required action | Owner | Event |
|---|---|---|---|---|---|---|---|---|
| T0 | T0 | Shift SYN-SHIFT-D1, device online | PreStartOpened | PRESTART_OPEN | RC-PS-OPENED | Establish shift context | Field Supervisor | PreStartOpened |
| T1 | T1 | Shift + Area | ShiftContextEstablished | SHIFT_CONTEXT_ESTABLISHED | RC-CTX-SHIFT-ESTABLISHED | Acquire location | Field Supervisor | ShiftContextEstablished |
| T2 | T2 | GPS candidate LOC-3200-TT02, canonical unset in session | LocationCandidateAcquired | LOCATION_CANDIDATE_PROPOSED | RC-LOC-CANDIDATE-AWAITING-HUMAN-CONFIRMATION | Human confirmation of canonical location | Field Supervisor | LocationCandidateProposed |
| T3 | T3 | Human confirms LOC-3200-TT01 against candidate TT02 | LocationConfirmed | LOCATION_CONFIRMED | RC-LOC-HUMAN-OVERRIDE-RECORDED | Select work | Field Supervisor | LocationHumanOverrideRecorded |
| T4 | T4 | WP-014 / JC-02 at confirmed location | WorkSelected | WORK_SELECTED | RC-WORK-SELECTED | Load operational context | Field Supervisor | WorkSelected |
| T5 | T5 | Discipline, crew slots, restrictions | OperationalContextLoaded | OPERATIONAL_CONTEXT_LOADED | RC-CTX-OPERATIONAL-LOADED | Retrieve corporate information | Work Control | OperationalContextLoaded |
| T6 | T6 | AD-01 mock returns Rev C and Rev D, both APPROVED | CorporateInformationRetrieved | REVISION_ELECTION_REQUIRES_HUMAN | RC-DOC-MULTIPLE-PLAUSIBLE-REVISIONS | Human revision election (no auto-election) | Document Control / Supervisor | RevisionElectionRequired |
| T7 | T7 | Human elects Rev D; applicability configured | ApplicabilityEvaluated | REVISION_ELECTED | RC-DOC-HUMAN-ELECTED | Compose preventive package | Supervisor | RevisionElected |
| T8 | T8 | Location + doc + facts; crew NOT yet confirmed | PreventivePackageComposed | REASSESS | RC-CREW-CONFIRMATION-INCOMPLETE | Complete crew confirmation | Supervisor | PackageEvaluated |
| T9 | T9 | 4/4 role-slots confirmed; IPERC not yet valid | CrewConfirmed | HOLD | RC-TEMP-MANDATORY-FACT-NOT-TEMPORALLY-VALID | Validate IPERC Continuo | Supervisor / ES&H | CrewConfirmed |
| T10 | T10 | IPERC fact effective from T10 window | IPERCValidated | READY | RC-TEMP-ALL-MANDATORY-FACTS-VALID | Complete checklists / tools | Supervisor | IPERCValidated |
| T11 | T11 | Tool TQ-08 calibration valid until T16 boundary | ApplicableChecksCompleted | VALID | RC-TEMP-ALL-MANDATORY-FACTS-VALID | PETAR / SIMOPS review | Supervisor | ToolReadinessConfirmed |
| T12 | T12 | Pairwise mech↔elec PASS; cumulative conflicts = 0 | PETARReviewedWhereRequired | PASS | RC-SIMOPS-NO-CUMULATIVE-CONFLICT | Verify decision right | ES&H Supervisor | SIMOPSAggregateEvaluated |
| T13a | T13 | SYN-PER-114 has UI access, no valid DecisionRight | DecisionRightVerified (unauthorized actor) | HOLD | RC-SIG-DECISION-RIGHT-NOT-VALID-AT-EVALUATION | Route to holder of DR-AUTHORIZE-PRESTART | SYN-PER-201 | AuthorityDenied |
| T13b | T13 | SYN-PER-201 holds valid DecisionRight | DecisionRightVerified | READY | RC-SIG-APPLICABLE | Commit signature | SYN-PER-201 | AuthorityVerified |
| T14 | T14 | Command baseVersion 4, idempotency key K1 | SignatureCommitted | COMMITTED | RC-CONC-COMMITTED | None — authorization recorded | SYN-PER-201 | SignatureCommitted |
| T14r | T14 | Same idempotency key K1 replayed | SignatureCommitted (replay) | IDEMPOTENT_REPLAY | RC-IDEMP-REPLAY | None — no duplicate authorization | System | IdempotentReplayDetected |
| T15 | T15 | All determinants satisfied, signature v5 = object v5 | ResultingOperationalState | READY | RC-TEMP-ALL-MANDATORY-FACTS-VALID | Proceed under governed conditions | SYN-PER-201 | PreStartReady |
| T16 | T16 | EvaluationTimestamp advanced past tool validTo; third activity introduces cumulative conflict; work NOT active | MaterialChange / TemporalExpiry | HOLD | RC-TEMP-MANDATORY-FACT-NOT-TEMPORALLY-VALID | Suspend pre-start authorization; re-evaluate dependencies | Supervisor / ES&H | TemporalExpiryDetected |
| T16s | T16 | Pairwise all PASS, cumulative conflicts = 1 | SIMOPSAggregateRecomputed | STOP | RC-SIMOPS-CUMULATIVE-CONFLICT | Aggregate location state governs — pairwise PASS is not sufficient | ES&H Supervisor | SIMOPSCumulativeConflict |
| T17 | T17 | Rev E material change → object version 6; signature evidence v5 immutable | DependencyReevaluation | SIGNATURE_NOT_VALID_FOR_CURRENT_VERSION | RC-SIG-OBJECT-VERSION-CHANGED | Re-authorization required; historical evidence preserved | SYN-PER-201 | SignatureApplicabilityLost |
| T17m | T17 | Rev D → Rev E, material = true | MaterialityAssessed | MATERIAL_REASSESS | RC-DOC-MATERIAL-CHANGE | Reassess package against Rev E | Engineering / Supervisor | MaterialChangeDetected |
| T18 | T18 | Expired tool, cumulative SIMOPS conflict, signature not applicable, EXT-07 unresolved | GovernedNonProgress | HOLD | RC-EXT-VALIDATION-DEPENDENCY-UNRESOLVED | Corrective action across all determinants | Supervisor | PreStartHeld |
| T19 | T19 | Tool replaced (new calibration from T19), SIMOPS third activity rescheduled, crew re-confirmed | CorrectiveAction | HOLD | RC-SIG-OBJECT-VERSION-CHANGED | Re-signature against object version 6 | SYN-PER-201 | CorrectiveActionRecorded |
| T20 | T20 | New signature SIG-SYN-0002 at object version 6 | Revalidation | SIGNATURE_VALID_FOR_CURRENT_VERSION | RC-SIG-APPLICABLE | Recompute governed decision | SYN-PER-201 | ReauthorizationCommitted |
| T21 | T21 | All determinants recovered; EXT-07 SafeInterimBehaviour applied (no synthetic owner approval) | NewGovernedDecision | READY | RC-TEMP-ALL-MANDATORY-FACTS-VALID | Proceed under governed conditions | SYN-PER-201 | PreStartReadyAfterRecovery |
| AI | T13 | Advisory engine asked to AUTHORIZE_WORK | AIRequest | REJECTED_OUT_OF_BOUNDARY | RC-AI-MATERIAL-DECISION-REFUSED | Human decision required | SYN-PER-201 | AIRequestRefused |
B2 — Scenario bias review (independent reviewer mode)
§15–16
| Probe | Finding | Verdict |
|---|---|---|
| HappyPathBias | REJECTED — T8, T9, T13a, T16, T16s, T17, T18, T19 are non-READY governed outcomes. | CLEAR |
| PreSolvedDependency | EXT-07 remains unresolved and is exercised at T18 via SafeInterimBehaviour only. | CLEAR |
| PreAuthorizedUser | T13a executes with an actor holding UI access but no valid DecisionRight. | CLEAR |
| HiddenAssumption | All inputs are declared in SCENARIO_CONTEXT and the time model; no implicit defaults are used by the harness. | CLEAR |
| ArtificiallyValidDocument | Two APPROVED revisions are deliberately supplied, forcing human election; Rev E is material. | CLEAR |
| ArtificiallyValidTemporalFact | Tool calibration validTo is inside the scenario window; IPERC is NOT_YET_EFFECTIVE at T9. | CLEAR |
| UnavailableFailurePath | HOLD, REASSESS and STOP are all reachable in the frozen sequence. | CLEAR |
| ExpectedOutcomeEncodedInInput | Expectations are declarative strings; observed values are produced only by prototype function calls. | CLEAR |
| ScenarioSpecificSoftwareBehaviour | No scenario identifier, actor, location or document is referenced inside fpso-prototype.ts. | CLEAR |
Representativeness
§17
| Capability | Exercised at | Basis |
|---|---|---|
| Location | T2, T3 | Candidate proposal and human override recorded. |
| Work | T4, T5 | Work/JobCard selection bound to confirmed location. |
| Documents | T6, T7, T17m | Election ambiguity, human election, material revision change. |
| Applicability | T7, T8 | Applicability configured; UNKNOWN semantics available in core. |
| Package | T8–T21 | Non-compensable aggregation across all determinants. |
| Crew | T8, T9 | Incomplete confirmation produces REASSESS. |
| IPERC | T9, T10 | NOT_YET_EFFECTIVE → VALID transition across governed time. |
| Tool/Equipment | T11, T16, T19 | Calibration validity crossed and recovered. |
| PETAR | T12 | Reviewed where required alongside critical controls. |
| SIMOPS | T12, T16s | Pairwise vs aggregate distinction demonstrated. |
| Authority | T13a, T13b | Permission ≠ Authority. |
| Signature | T14, T14r, T17, T20 | Commit, idempotent replay, applicability loss, re-authorization. |
| Temporal Validity | T9, T16, T19 | XR-TEMP-01 across two boundaries. |
| Delta | T16, T17, T17m | Field delta and materiality assessment. |
| History/Provenance | PROVENANCE_CHAIN | WHY_IS_THIS_HERE reconstruction at T16. |
| Offline / reconciliation | NOT_MATERIAL_TO_PRIMARY_SCENARIO | EXT-15 offline authority unresolved; offline journey remains NOT_EXECUTABLE_IN_CURRENT_PILOT and is excluded by declaration, not by omission. |
Demo-to-implementation independence
§18
PrototypeCodeChangeForScenario
0
ScenarioSpecificImplementation
0
| Probe | Result |
|---|---|
| hard-coded Scenario_ID in prototype | NONE |
| special-case user | NONE |
| special-case Location | NONE |
| special-case document | NONE |
| special-case PASS branch | NONE |
| hidden default values in core | NONE — all inputs are explicit parameters; EvaluationTimestamp is a required input |
Scenario assurance tests — SAR-R01…R16 · 16/16 PASS
§20
| ID | Statement | Result | Basis |
|---|---|---|---|
| SAR-R01 | No scenario-specific implementation | PASS | Prototype contains no scenario identifiers or special cases. |
| SAR-R02 | No forced PASS | PASS | Expectations include HOLD, REASSESS and STOP declared before execution. |
| SAR-R03 | Normal path adequately represented | PASS | T0–T15 covers the full required progression to READY. |
| SAR-R04 | Negative / reassessment path represented | PASS | T8 REASSESS, T9/T16/T18 HOLD, T16s STOP. |
| SAR-R05 | Temporal validity exercised | PASS | Two governed validity boundaries crossed (IPERC effectivity, tool expiry). |
| SAR-R06 | Authority exercised | PASS | T13a denies a UI-capable actor without DecisionRight. |
| SAR-R07 | Signature version/applicability exercised | PASS | T17 applicability loss with immutable evidence; T20 re-authorization. |
| SAR-R08 | Document/applicability dependency represented | PASS | T6 multiple plausible revisions; T17m material change. |
| SAR-R09 | SIMOPS material interaction represented | PASS | T12 aggregate PASS vs T16s cumulative conflict. |
| SAR-R10 | External dependencies remain open | PASS | EXT-07 exercised via SafeInterimBehaviour; 15 remain open, none closed. |
| SAR-R11 | Synthetic data explicitly identified | PASS | SYNTHETIC_DATA_BOUNDARY classifies every demonstration-specific element. |
| SAR-R12 | Expected results defined before execution | PASS | SCENARIO_EXPECTATIONS is a static table; observed values are computed separately. |
| SAR-R13 | Timestamps governed | PASS | TIME_MODEL supplies EvaluationTimestamp; core contains no now(). |
| SAR-R14 | No ROI / productivity overclaim | PASS | Timing classified as SIMULATED_MEASUREMENT; value items are VALUE_HYPOTHESIS. |
| SAR-R15 | Evidence taxonomy correct | PASS | Only scenario/simulation/assurance evidence produced. |
| SAR-R16 | Verified application baseline unchanged | PASS | fpso-prototype.ts and all A-stage baselines untouched by Macro B. |
Verdict: SCENARIO_ASSURANCE_PASS
B3 — Scenario freeze · PH6A-FPSO-SCENARIO-BASELINE-REV0
§21–22 · G-FPSO-06
SCENARIO BASELINE FROZENG-FPSO-06 PASS
- · Scenario data (context, persons, documents, tools, equipment)
- · Trigger sequence T0…T21 including AI probe
- · Expected states
- · Expected events
- · Expected reason codes
- · Expected evidence classification
- · EvaluationTimestamps
Input values, triggers, timing and expected outcomes shall not be altered to achieve PASS. A revealed defect is recorded, not silently repaired.
B4 — End-to-end demonstrator execution · PH6A-FPSO-E2E-DEMO-REV0
§23–25 · controlled demonstrator, not a live pilot
| Step | Observed screen | Domain decision | Observed state | Observed reason code | Event | Source / mock boundary | EvaluationTimestamp |
|---|---|---|---|---|---|---|---|
| T0 | S01 Pre-Start Home | session opened (no material decision) | PRESTART_OPEN | RC-PS-OPENED | PreStartOpened | APP | 2026-09-01T05:00:00.000Z |
| T1 | S01 Shift Context | context binding (AD-02 SYNTHETIC_SOURCE_RESPONSE) | SHIFT_CONTEXT_ESTABLISHED | RC-CTX-SHIFT-ESTABLISHED | ShiftContextEstablished | MOCK: AD-02 (P6) | 2026-09-01T05:04:00.000Z |
| T2 | S02 Location Acquisition | decideLocation() | LOCATION_CANDIDATE_PROPOSED | RC-LOC-CANDIDATE-AWAITING-HUMAN-CONFIRMATION | LocationCandidateProposed | MOCK: AD-08 (GPS) | 2026-09-01T05:07:00.000Z |
| T3 | S02 Location Confirmation | decideLocation() | LOCATION_CONFIRMED | RC-LOC-HUMAN-OVERRIDE-RECORDED | LocationHumanOverrideRecorded | HUMAN | 2026-09-01T05:11:00.000Z |
| T4 | S03 Work Selection | work binding to confirmed location | WORK_SELECTED | RC-WORK-SELECTED | WorkSelected | MOCK: AD-02 | 2026-09-01T05:15:00.000Z |
| T5 | S04 Operational Context | context assembly (no authority effect) | OPERATIONAL_CONTEXT_LOADED | RC-CTX-OPERATIONAL-LOADED | OperationalContextLoaded | MOCK: AD-02/AD-09 | 2026-09-01T05:18:00.000Z |
| T6 | S05 Document Register | electRevision() | REVISION_ELECTION_REQUIRES_HUMAN | RC-DOC-MULTIPLE-PLAUSIBLE-REVISIONS | RevisionElectionRequired | MOCK: AD-01 (Aconex) | 2026-09-01T05:22:00.000Z |
| T7 | S06 Applicability | electRevision() with human election | REVISION_ELECTED | RC-DOC-HUMAN-ELECTED | RevisionElected | HUMAN | 2026-09-01T05:27:00.000Z |
| T8 | S07 Preventive Package | evaluatePackage() | REASSESS | RC-CREW-CONFIRMATION-INCOMPLETE | PackageEvaluated | PURE_CORE | 2026-09-01T05:31:00.000Z |
| T9 | S08 Crew Confirmation | evaluatePackage() — IPERC fact NOT_YET_EFFECTIVE at T9 | HOLD | RC-TEMP-MANDATORY-FACT-NOT-TEMPORALLY-VALID | CrewConfirmed | PURE_CORE | 2026-09-01T05:36:00.000Z |
| T10 | S09 IPERC Continuo | evaluatePackage() | READY | RC-TEMP-ALL-MANDATORY-FACTS-VALID | IPERCValidated | MOCK: AD-03 | 2026-09-01T05:41:00.000Z |
| T11 | S11 Tool Readiness | temporalGate([tool]) | VALID | RC-TEMP-ALL-MANDATORY-FACTS-VALID | ToolReadinessConfirmed | MOCK: AD-09 | 2026-09-01T05:46:00.000Z |
| T12 | S12 SIMOPS / PETAR | simopsAggregate() | PASS | RC-SIMOPS-NO-CUMULATIVE-CONFLICT | SIMOPSAggregateEvaluated | MOCK: AD-03/AD-04 | 2026-09-01T05:51:00.000Z |
| T13a | S13 Authority | evaluatePackage() with invalid DecisionRight | HOLD | RC-SIG-DECISION-RIGHT-NOT-VALID-AT-EVALUATION | AuthorityDenied | MOCK: AD-06 (IAM stub) | 2026-09-01T05:55:00.000Z |
| T13b | S13 Authority | evaluatePackage() with valid DecisionRight | READY | RC-SIG-APPLICABLE | AuthorityVerified | MOCK: AD-06 | 2026-09-01T05:55:00.000Z |
| T14 | S15 Signature Assurance | commit() | COMMITTED | RC-CONC-COMMITTED | SignatureCommitted | MOCK: AD-07 | 2026-09-01T05:58:00.000Z |
| T14r | S15 Signature Assurance | commit() replay | IDEMPOTENT_REPLAY | RC-IDEMP-REPLAY | IdempotentReplayDetected | PURE_CORE | 2026-09-01T05:58:00.000Z |
| T15 | S16 Governed State | evaluatePackage() | READY | RC-TEMP-ALL-MANDATORY-FACTS-VALID | PreStartReady | PURE_CORE | 2026-09-01T06:00:00.000Z |
| T16 | S10 Field Delta | evaluatePackage() at advanced EvaluationTimestamp | HOLD | RC-TEMP-MANDATORY-FACT-NOT-TEMPORALLY-VALID | TemporalExpiryDetected | PURE_CORE | 2026-09-01T08:05:00.000Z |
| T16s | S12 SIMOPS | simopsAggregate() — pairwise PASS, cumulative conflict | STOP | RC-SIMOPS-CUMULATIVE-CONFLICT | SIMOPSCumulativeConflict | MOCK: AD-04 | 2026-09-01T08:05:00.000Z |
| T17 | S15 Signature Assurance | evaluateSignature() vs object version 6 | SIGNATURE_NOT_VALID_FOR_CURRENT_VERSION | RC-SIG-OBJECT-VERSION-CHANGED | SignatureApplicabilityLost | PURE_CORE | 2026-09-01T08:09:00.000Z |
| T17m | S10 Field Delta | assessRevisionMateriality() | MATERIAL_REASSESS | RC-DOC-MATERIAL-CHANGE | MaterialChangeDetected | MOCK: AD-01 | 2026-09-01T08:09:00.000Z |
| T18 | S16 Governed State | evaluatePackage() with all disturbance determinants | HOLD | RC-EXT-VALIDATION-DEPENDENCY-UNRESOLVED | PreStartHeld | PURE_CORE + CONTROLLED_EXTERNAL_DEPENDENCY | 2026-09-01T08:12:00.000Z |
| T19 | S11 / S12 Corrective Action | evaluatePackage() after tool replacement and SIMOPS rescheduling | HOLD | RC-SIG-OBJECT-VERSION-CHANGED | CorrectiveActionRecorded | MOCK: AD-09/AD-04 | 2026-09-01T08:40:00.000Z |
| T20 | S15 Signature Assurance | evaluateSignature() new signature at version 6 | SIGNATURE_VALID_FOR_CURRENT_VERSION | RC-SIG-APPLICABLE | ReauthorizationCommitted | MOCK: AD-07 | 2026-09-01T08:52:00.000Z |
| T21 | S16 Governed State | evaluatePackage() after recovery | READY | RC-TEMP-ALL-MANDATORY-FACTS-VALID | PreStartReadyAfterRecovery | PURE_CORE | 2026-09-01T09:00:00.000Z |
| AI | S16 Assurance View | aiRequest() | REJECTED_OUT_OF_BOUNDARY | RC-AI-MATERIAL-DECISION-REFUSED | AIRequestRefused | AI_FIREWALL | 2026-09-01T05:55:00.000Z |
Provenance demonstration — WHY_IS_THIS_HERE
§26
WHY_IS_THIS_HERE — why is the package in HOLD at T16?
| Layer | Value |
|---|---|
| CurrentValue | PackageVerdict = HOLD at EvaluationTimestamp 2026-09-01T08:05:00.000Z |
| Rule | XR-TEMP-01 — no material decision may rely on a temporally expired fact (temporalGate) |
| Fact | TF-TOOL-SYN-TOOL-TQ-08 (TOOL_INSPECTION, mandatory) state = EXPIRED (validTo 2026-09-01T07:00:00.000Z) |
| SourceRecord | SYN-TOOL-TQ-08 calibration certificate record (SYNTHETIC_SCENARIO_DATA) |
| SourceAdapter | AD-09 Tool & equipment register — MOCK_ADAPTER, live = false |
| Owner / ExternalDependency | Tool register data owner unassigned — related organizational dependency EXT-07 remains open and controlled |
Expected vs observed reconciliation — 27/27 PASS
§35
| Step | Expected state | Observed state | Expected reason | Observed reason | Result |
|---|---|---|---|---|---|
| T0 | PRESTART_OPEN | PRESTART_OPEN | RC-PS-OPENED | RC-PS-OPENED | PASS |
| T1 | SHIFT_CONTEXT_ESTABLISHED | SHIFT_CONTEXT_ESTABLISHED | RC-CTX-SHIFT-ESTABLISHED | RC-CTX-SHIFT-ESTABLISHED | PASS |
| T2 | LOCATION_CANDIDATE_PROPOSED | LOCATION_CANDIDATE_PROPOSED | RC-LOC-CANDIDATE-AWAITING-HUMAN-CONFIRMATION | RC-LOC-CANDIDATE-AWAITING-HUMAN-CONFIRMATION | PASS |
| T3 | LOCATION_CONFIRMED | LOCATION_CONFIRMED | RC-LOC-HUMAN-OVERRIDE-RECORDED | RC-LOC-HUMAN-OVERRIDE-RECORDED | PASS |
| T4 | WORK_SELECTED | WORK_SELECTED | RC-WORK-SELECTED | RC-WORK-SELECTED | PASS |
| T5 | OPERATIONAL_CONTEXT_LOADED | OPERATIONAL_CONTEXT_LOADED | RC-CTX-OPERATIONAL-LOADED | RC-CTX-OPERATIONAL-LOADED | PASS |
| T6 | REVISION_ELECTION_REQUIRES_HUMAN | REVISION_ELECTION_REQUIRES_HUMAN | RC-DOC-MULTIPLE-PLAUSIBLE-REVISIONS | RC-DOC-MULTIPLE-PLAUSIBLE-REVISIONS | PASS |
| T7 | REVISION_ELECTED | REVISION_ELECTED | RC-DOC-HUMAN-ELECTED | RC-DOC-HUMAN-ELECTED | PASS |
| T8 | REASSESS | REASSESS | RC-CREW-CONFIRMATION-INCOMPLETE | RC-CREW-CONFIRMATION-INCOMPLETE | PASS |
| T9 | HOLD | HOLD | RC-TEMP-MANDATORY-FACT-NOT-TEMPORALLY-VALID | RC-TEMP-MANDATORY-FACT-NOT-TEMPORALLY-VALID | PASS |
| T10 | READY | READY | RC-TEMP-ALL-MANDATORY-FACTS-VALID | RC-TEMP-ALL-MANDATORY-FACTS-VALID | PASS |
| T11 | VALID | VALID | RC-TEMP-ALL-MANDATORY-FACTS-VALID | RC-TEMP-ALL-MANDATORY-FACTS-VALID | PASS |
| T12 | PASS | PASS | RC-SIMOPS-NO-CUMULATIVE-CONFLICT | RC-SIMOPS-NO-CUMULATIVE-CONFLICT | PASS |
| T13a | HOLD | HOLD | RC-SIG-DECISION-RIGHT-NOT-VALID-AT-EVALUATION | RC-SIG-DECISION-RIGHT-NOT-VALID-AT-EVALUATION | PASS |
| T13b | READY | READY | RC-SIG-APPLICABLE | RC-SIG-APPLICABLE | PASS |
| T14 | COMMITTED | COMMITTED | RC-CONC-COMMITTED | RC-CONC-COMMITTED | PASS |
| T14r | IDEMPOTENT_REPLAY | IDEMPOTENT_REPLAY | RC-IDEMP-REPLAY | RC-IDEMP-REPLAY | PASS |
| T15 | READY | READY | RC-TEMP-ALL-MANDATORY-FACTS-VALID | RC-TEMP-ALL-MANDATORY-FACTS-VALID | PASS |
| T16 | HOLD | HOLD | RC-TEMP-MANDATORY-FACT-NOT-TEMPORALLY-VALID | RC-TEMP-MANDATORY-FACT-NOT-TEMPORALLY-VALID | PASS |
| T16s | STOP | STOP | RC-SIMOPS-CUMULATIVE-CONFLICT | RC-SIMOPS-CUMULATIVE-CONFLICT | PASS |
| T17 | SIGNATURE_NOT_VALID_FOR_CURRENT_VERSION | SIGNATURE_NOT_VALID_FOR_CURRENT_VERSION | RC-SIG-OBJECT-VERSION-CHANGED | RC-SIG-OBJECT-VERSION-CHANGED | PASS |
| T17m | MATERIAL_REASSESS | MATERIAL_REASSESS | RC-DOC-MATERIAL-CHANGE | RC-DOC-MATERIAL-CHANGE | PASS |
| T18 | HOLD | HOLD | RC-EXT-VALIDATION-DEPENDENCY-UNRESOLVED | RC-EXT-VALIDATION-DEPENDENCY-UNRESOLVED | PASS |
| T19 | HOLD | HOLD | RC-SIG-OBJECT-VERSION-CHANGED | RC-SIG-OBJECT-VERSION-CHANGED | PASS |
| T20 | SIGNATURE_VALID_FOR_CURRENT_VERSION | SIGNATURE_VALID_FOR_CURRENT_VERSION | RC-SIG-APPLICABLE | RC-SIG-APPLICABLE | PASS |
| T21 | READY | READY | RC-TEMP-ALL-MANDATORY-FACTS-VALID | RC-TEMP-ALL-MANDATORY-FACTS-VALID | PASS |
| AI | REJECTED_OUT_OF_BOUNDARY | REJECTED_OUT_OF_BOUNDARY | RC-AI-MATERIAL-DECISION-REFUSED | RC-AI-MATERIAL-DECISION-REFUSED | PASS |
DEMONSTRATOR_DEVIATIONS: none
B5 — Drift review
§33–34
ScenarioDataDrift
0
ExpectedOutcomeDrift
0
TriggerSequenceDrift
0
EvaluationTimestampDrift
0
PrototypeCodeChangeDuringDemo
0
FunctionalBaselineChange
0
InteractionBaselineChange
0
ArchitectureChange
0
ParentSealChanged
false
Traceability extension
§36
| Architecture requirement | Contract | Interaction | Implementation | Verification | Scenario step | Evidence |
|---|---|---|---|---|---|---|
| IADA §Location authority | FC-FPSO-01 | S02 | decideLocation() | ICV-R07 / FVT-01…03 | T2, T3 | SIMULATION_EVIDENCE |
| IADA §Source authority | FC-FPSO-02 | S05 | electRevision() | ICV-R08 / FVT-04,05 | T6, T7 | SIMULATION_EVIDENCE |
| IADA §Applicability | FC-FPSO-03 | S06 | evaluatePackage() | ICV-R09 / FVT-06 | T7, T8 | SIMULATION_EVIDENCE |
| IADA §Human-in-the-loop | FC-FPSO-04 | S08 | evaluatePackage() crew determinant | ICV-R11 / FVT-09 | T8, T9 | SIMULATION_EVIDENCE |
| IADA §Provenance | FC-FPSO-05 | S09 | commit() | ICV-R12 / FVT-23 | T10, T14r | SIMULATION_EVIDENCE |
| IADA §Change materiality | FC-FPSO-06 | S10 | assessRevisionMateriality() | FVT-07,08,15,16 | T17m | SIMULATION_EVIDENCE |
| XR-TEMP-01 | FC-FPSO-07 | S11 | temporalGate() | ICV-R13,R17 / FVT-11,12 | T11, T16, T19 | SIMULATION_EVIDENCE |
| IADA §Signature | FC-FPSO-08 | S15 | evaluateSignature() | ICV-R16 / FVT-19…22 | T14, T17, T20 | SIMULATION_EVIDENCE |
| ADR-14 SIMOPS | FC-FPSO-03 | S12 | simopsAggregate() | ICV-R14 / FVT-14 | T12, T16s | SIMULATION_EVIDENCE |
| IADA §AI firewall | FC-FPSO-03 | S16 | aiRequest() | ICV-R20 / FVT-29,30 | AI | SIMULATION_EVIDENCE |
Chain terminates at SIMULATION_EVIDENCE. It is NOT extended to OperationalClosureEvidence.
Demonstrator acceptance tests — DAA-R01…R16 · 16/16 PASS
§37
| ID | Statement | Result | Basis |
|---|---|---|---|
| DAA-R01 | Scenario baseline unchanged | PASS | Frozen data, triggers, timing and expectations re-read at review. |
| DAA-R02 | Application baseline unchanged | PASS | Demonstrator imports the prototype read-only; no prototype edits in Macro B. |
| DAA-R03 | Expected-vs-observed reconciled | PASS | 27/27 steps reconciled. |
| DAA-R04 | Normal path works | PASS | Progression to READY at T15 observed. |
| DAA-R05 | Controlled HOLD / REASSESS works | PASS | Governed non-progress produced by the disturbance. |
| DAA-R06 | Authority boundary visible | PASS | Permission ≠ Authority demonstrated. |
| DAA-R07 | Temporal expiry works | PASS | Governed timestamp advance across validity boundary. |
| DAA-R08 | Signature applicability works | PASS | Historical evidence immutable; applicability lost at version change. |
| DAA-R09 | Source / mock boundary explicit | PASS | Every step records adapter mode or PURE_CORE. |
| DAA-R10 | Provenance reconstructable | PASS | WHY_IS_THIS_HERE chain reconstructed to adapter and owner. |
| DAA-R11 | Concurrency / idempotency not violated | PASS | Replay returns IDEMPOTENT_REPLAY without a second authorization. |
| DAA-R12 | AI containment maintained | PASS | AUTHORIZE_WORK refused as out of boundary. |
| DAA-R13 | No scenario-specific implementation | PASS | Independence probes all NONE. |
| DAA-R14 | No simulation → operational evidence promotion | PASS | Evidence taxonomy fixed; OperationalClosureEvidence remains NOT_YET_ACQUIRED. |
| DAA-R15 | Timing correctly classified | PASS | Four timing classes captured separately as SIMULATED_MEASUREMENT. |
| DAA-R16 | All external dependencies remain controlled | PASS | 15 open; EXT-07 exercised via SafeInterimBehaviour only; none closed or renumbered. |
G-FPSO-07 — Demonstrator acceptance
§38
G-FPSO-07 PASS
CriticalDemoFindings
0
HighUncontrolledDemoFindings
0
ScenarioDrift
0
ApplicationDrift
0
UnexplainedMaterialExpectedObservedDifference
0
AuthorityViolations
0
ReachableIllegalMaterialStates
0
TraceabilityComplete
true
DAA-R01…R16
16/16 PASS
DemonstratorAssurance
PH6A-FPSO-DAA-REV0 = ACCEPTED
Executive demonstrator package
§39 · no marketing claims
| Panel | Content | Audience |
|---|---|---|
| Start Context | Day shift, Area 3200, canonical location TT01 (GPS proposed TT02 and was overridden by a human). | Construction · ES&H |
| Pre-Start Assembly | Work, documents, applicability, preventive package, crew, IPERC assembled in one governed context. | Construction · Project Controls |
| Readiness Evolution | REASSESS (crew) → HOLD (IPERC not yet effective) → READY once every mandatory condition is simultaneously valid. | ES&H · Construction |
| Authorization | Actor with screen access but no DecisionRight cannot authorize; the right-holder signs against a specific object version. | ES&H · IT/IM |
| Material Disturbance | Tool calibration expires, a third activity creates a cumulative SIMOPS conflict, and a material document revision lands. | ES&H · Enterprise Architecture |
| HOLD / REASSESS | The package leaves READY and names the blocking determinants — a correctly produced HOLD is evidence of control. | All |
| Recovery | Tool replaced, activity rescheduled, re-authorization signed against the new object version. | Construction · ES&H |
| Final Governed State | READY re-established only on new evidence, not by overriding the previous decision. | All |
| Traceability | Any current value reconstructs to rule, fact, source record, adapter and owner. | IT/IM · Enterprise Architecture · Transformation |
| Simulated Timing | Process, response, human-step and wait durations captured as simulated measurement only. | Transformation · Project Controls |
Simulated timing & value measurement boundary
§13 · §40
| Metric | Value | Classification |
|---|---|---|
| SimulatedProcessDuration | T0 → T21 = 4 h 00 min of governed scenario time | SIMULATED_MEASUREMENT |
| SystemResponseDuration | Deterministic PureCore evaluation, sub-millisecond per step (synthetic harness) | SIMULATED_MEASUREMENT |
| HumanInteractionSteps | 9 human confirmations/decisions (location, revision, crew ×1 batch, IPERC, checks, PETAR, authority, signature, re-signature) | SIMULATED_MEASUREMENT |
| WaitStateDuration | T15 → T19 = 2 h 40 min in governed HOLD awaiting corrective action | SIMULATED_MEASUREMENT |
| Candidate | Basis | Claim |
|---|---|---|
| ManualStepsReduced | Document retrieval and applicability assembly performed once in-context | VALUE_HYPOTHESIS |
| RepeatedEntryAvoided | Location/work context inherited by package, crew and IPERC objects | VALUE_HYPOTHESIS |
| RetrievalStepsReduced | Contextual source retrieval replaces manual document search | VALUE_HYPOTHESIS |
| DecisionLatencyCandidate | Blocking determinant named at the moment of HOLD | VALUE_HYPOTHESIS |
| PotentialTimeReleased | Re-authorization scoped to affected determinants only | VALUE_HYPOTHESIS |
Prohibited claims: ACTUAL_TIME_SAVED · PRODUCTIVE_TIME_CAPTURED · COST_SAVINGS · ROI
Master gate register
§41 · prior history preserved
| Gate / stage | Scope | Result | Baseline |
|---|---|---|---|
| G-FPSO-01 | Architecture Impact Assessment | PASS | PH6A-FPSO-AIA-REV0 |
| G-FPSO-02 | Functional Contract Definition | PASS | 8 contracts FC-FPSO-01…08 |
| G-FPSO-03 | Contract Assurance & Baseline Freeze | PASS | FUNCTIONAL-BASELINE-REV0 |
| G-FPSO-03R | Independent Retest & Re-Freeze | PASS WITH CONTROLLED EXTERNAL DEPENDENCIES | FUNCTIONAL-BASELINE-REV1 |
| G-FPSO-04 | Interaction & Application Design | PASS | IAD-REV2 |
| G-FPSO-04B | Bechtelized Application Conformance | PASS | BAC-REV0 |
| G-FPSO-05 | Implementation Conformance | PASS | ICV-REV0 |
| B1 | Demo Scenario Engineering | COMPLETE | PH6A-FPSO-DEMO-SCENARIO-REV0 |
| B2 | Scenario Assurance | PASS | SAR 16/16 |
| G-FPSO-06 | Scenario Baseline Freeze | PASS | PH6A-FPSO-SCENARIO-BASELINE-REV0 |
| B4 | End-to-End Demonstrator | EXECUTED | PH6A-FPSO-E2E-DEMO-REV0 |
| G-FPSO-07 | Demonstrator Acceptance | PASS | PH6A-FPSO-DAA-REV0 |
Macro B final acceptance
§42–43
MACRO_PROMPT_B
ACCEPTED
MacroID
PH6A-FPSO-MPB-REV0
ScenarioDefinition
PH6A-FPSO-DEMO-SCENARIO-REV0
ScenarioBaseline
PH6A-FPSO-SCENARIO-BASELINE-REV0
ScenarioBaselineStatus
FROZEN
G-FPSO-06
PASS
Demonstrator
PH6A-FPSO-E2E-DEMO-REV0
DemonstratorStatus
EXECUTED
DemonstratorAssurance
PH6A-FPSO-DAA-REV0
G-FPSO-07
PASS
CriticalOpen
0
HighUncontrolledOpen
0
ScenarioDrift
0
ApplicationDrift
0
AuthorityViolations
0
ReachableIllegalMaterialStates
0
SimulationEvidence
ACCEPTED
ValueMeasurement
SIMULATED_ONLY
ExternalDependencyCount
15
MacroPromptC_Authorized
true
Preserved programme boundary
Macro B closes nothing in Phase 6A
OperationalClosureEvidence
NOT_YET_ACQUIRED
Phase6A
HOLD
Phase6B
NOT_AUTHORIZED
Phase7
NO_GO
BC09Protection
ACTIVE
PilotExposure
PROHIBITED
FunctionalBaselineChangeRequired
false
ArchitectureReopenRequired
false
ParentSealChanged
false