PizarraContexto de trabajoDocumentos y registrosControles críticosRegistrosPreparaciónCondiciones bloqueantesAutorización
Aseguramiento / Técnico
SecundarioEvidenciaGestión del cambioAseguramiento continuo (demo)Medición / valorAseguramiento ejecutivo
Readiness & operations (preserved)Shift ReadinessAssuranceField ModeAuthorityMeasurementIntegration & OpsConfigurationLocations & SIMOPS
Phases & gatesPhase 1 PrototypeAcceptance GateOption DecisionTechnical DefinitionControlled PilotPhase 6A ReadinessProduction ReadinessG-PH6A GateReadiness Closure
Architecture & baselinesArchitectureArchitecture HardeningIntegrated BaselineDesign SealInteraction ArchitectureH–AE Basis0C RegisterPreservation OverlayTemporal Compliance
Field pre-start engineeringField Pre-Start AIAPre-Start ContractsPre-Start InteractionMacro A EngineeringMacro B DemonstratorMacro C Industrialization
Evidence & closure workstreamsClosure WorkstreamMesa 1 EnablementMesa 1 Closure PackageMesa 1 ExecutionMesa 2 GovernanceMesa 3 FieldEvidence WorkstreamEvidence BoardRequest Execution PackWave 1 KickoffOER-03 BC-09 CaptureS1 Owner EngagementOwner Evidence IntakeBC / EXT Ledger
Phase 6 rev.2 · controlled pilot / MVP · option C operating model
Controlled Pilot Definition — Federated Operating Model Validation
Phase 6 Rev.2 must demonstrate that Option C works as a federated operating model in the field — not merely that software functions. This record defines the pilot scope, controls, measurement method, source participation boundary, journey protocol, failure conditions and acceptance register.
Phase 6 recommendation
HOLD — PILOT DEFINED, EXECUTION NOT AUTHORIZED
Phase 6 Rev.2 is returned as a Controlled Pilot Definition and Readiness Baseline. The pilot scope, controls, measurement method, source participation boundary, journey protocol, failure conditions and acceptance register are defined and executable. Field execution is not authorized because two governing preconditions are unmet: Phase 5 Technical Solution Definition has no formal disposition, and no enterprise interface has moved beyond NOT_YET_VALIDATED. No baseline metric, value claim or adoption finding is reported, because none has been measured.
GOVERNING INPUT NOT SATISFIED: §Governing Input requires formal Phase 5 acceptance before Phase 6 begins. Phase 5 was issued 2026-08-30 with a recommendation of ACCEPT WITH CONTROLLED CONDITIONS and remains awaiting disposition. Phase 6 execution therefore remains fail-closed by construction.
HOLD POINT PRESERVED: no production-wide deployment, no live integration, no authoritative write to any enterprise source. Next decision: Controlled Pilot Acceptance → Production Readiness Authorization — which cannot be reached until the pilot is actually executed against instrumented scope.
Execution preconditions
- P6-PRE-01 — Formal Phase 5 Technical Solution Definition disposition recorded.
- P6-PRE-02 — At least the mandatory-decision interfaces (Q4, controlled documents, competency, critical control) moved from NOT_YET_VALIDATED to an evidenced participation class.
- P6-PRE-03 — Named and staffed Location Stewards for every pilot Location (ADR-14 staffing).
- P6-PRE-04 — Baseline BEFORE measurement executed with the documented method, before pilot activation.
- P6-PRE-05 — ADR-15 (JobCard authority) and ADR-17 (TemporaryModification authority) either resolved or explicitly excluded from pilot scope in writing.
- P6-PRE-06 — Rule set (applicability, validity, Q4 mappings, CUM rules, no-compensation classification) approved under ADR-16 before it becomes executable.
APilot scope & controls
AREA-3100 · Concentrator — Conveyor CV-07 corridor
Selected because it is operationally non-trivial: it carries concurrent multi-discipline work in shared physical space, stored energy, working at height, a live SIMOPS pattern and a genuine interdisciplinary handover. A scope without these characteristics cannot exercise the accepted model.
| Required characteristic | Pilot provision | State |
|---|---|---|
| One clearly governed Area | AREA-3100 with a single accountable Area Superintendent and a defined stewardship boundary. | READY TO EXECUTE |
| Multiple Locations | LOC-3100-CONC-CV07-TT01 (transfer tower), -TT02, -DRIVE-HSE, -GALLERY-A. | READY TO EXECUTE |
| Mechanical + electrical + instrumentation work | Idler/pulley change-out, MCC termination and belt-weightometer/speed-sensor loop checks. | READY TO EXECUTE |
| Concurrent Job Cards | JC-7701 / JC-7702 / JC-7703 with overlapping windows in TT01. | READY TO EXECUTE |
| Real planning / lookahead | P6 3-week lookahead for the corridor; requires CONTROLLED_SNAPSHOT at minimum. | BLOCKED BY PRECONDITION |
| Equipment | Mobile elevating work platform, chain block, torque tooling, calibrated loop tester — placement context in TT01. | READY TO EXECUTE |
| Workforce competency | Height, LOTO, confined space, HV switching authorisations — one expiring inside the pilot window by design. | BLOCKED BY PRECONDITION |
| Controlled documentation | Isolation schematic, P&ID, loop drawing, lifting plan — version pinning required at decision time. | BLOCKED BY PRECONDITION |
| At least one Life Critical exposure | Working at height in TT01 and stored/electrical energy on the CV-07 drive. | READY TO EXECUTE |
| At least one SIMOPS case | Overhead mechanical work above an energised electrical termination in the same vertical envelope. | READY TO EXECUTE |
| At least one environmental / area condition | Wind threshold breach forecast inside the TT01 elevated-work window. | READY TO EXECUTE |
| At least one Location continuity handover | Mechanical completion in TT01 → electrical/instrumentation preparation reusing Location context. | READY TO EXECUTE |
Pilot controls
- Integrated Readiness performs no authoritative write to any enterprise source during the pilot. Permitted writes are limited to ReadinessDecision, EvidenceEvent, governed mappings and approved configuration.
- The pilot runs in parallel with the incumbent process. The incumbent process remains the process of record for any authorization until Pilot Acceptance.
- A readiness verdict never replaces a statutory permit, isolation certificate or PETAR issued in its authoritative system.
- Every pilot decision is recorded with resolved identity, authority basis, pinned source versions and rule version — or it is not recorded at all.
- Any observed false READY halts the affected journey immediately and is recorded as a Critical pilot finding.
- Architecture is not reopened by default; drift is recorded in the Architecture Drift Register (L), not silently absorbed.
BBaseline — before
NO BASELINE NUMBER IS INVENTED. Every metric below is NOT_YET_MEASURED. The measurement method is documented here BEFORE pilot execution, as required, so that the BEFORE capture is defensible and the AFTER comparison is attributable.
| Metric | Unit | Measurement method | Evidence source | State |
|---|---|---|---|---|
| PackagePreparationTime | hours per work package | Elapsed time from package initiation to supervisor-declared prepared, from work-control records for the same corridor over the preceding 8 weeks. | Work control / Q4 package history | NOT YET MEASURED |
| ApprovalLatency | hours from request to authorization | Timestamp delta between submission and authorization events in the authoritative work-control system. | Q4 transaction log | NOT YET MEASURED |
| RestrictionDetectionLeadTime | hours before planned start | Time between restriction becoming knowable and being recorded against the package; requires manual reconstruction where no event exists. | Manual reconstruction + restriction register | NOT YET MEASURED |
| BlockerResolutionTime | hours per blocker | Blocker raised → blocker closed, by blocker type and owner. | Work control / supervisor log | NOT YET MEASURED |
| Rework | count and hours per period | Reworked preparation activities counted from supervisor logs; only preparation rework is counted, not construction rework. | Supervisor log | NOT YET MEASURED |
| DuplicateDataEntry | entries per package | Structured observation of preparation sessions counting the same datum entered into more than one system. | Timed observation study | NOT YET MEASURED |
| DocumentSearchEffort | minutes per package | Timed observation of document location and version confirmation. | Timed observation study | NOT YET MEASURED |
| FieldClarificationRequests | count per shift | Count of field-to-office clarification contacts recorded during the observation window. | Shift log | NOT YET MEASURED |
| LateSIMOPSDetection | count and hours before start | SIMOPS interactions identified at or after mobilisation rather than during planning. | ES&H / shift records | NOT YET MEASURED |
| WorkStartDelay | minutes after planned start | Planned versus actual start at the workface, with primary delay cause recorded for later attribution. | Field supervision record | NOT YET MEASURED |
| ReadinessFirstPass | % of packages ready without rework | Packages authorized on first submission divided by total submitted. | Q4 transaction log | NOT YET MEASURED |
| AuthorizationQueueTime | hours waiting on an authority holder | Time a package spends awaiting an authority decision, separated from time awaiting a technical condition. | Q4 transaction log | NOT YET MEASURED |
Measurement method (documented before execution)
- BEFORE capture runs for a minimum of four full production weeks on the pilot corridor, ending before pilot activation.
- Metrics with no existing evidence source are captured by timed observation and are labelled OBSERVED_BASELINE, never estimated.
- Where no defensible BEFORE value can be captured, the metric is reported as UNMEASURABLE_BASELINE and is excluded from all value claims.
- The same measurement definitions, observer protocol and shift pattern are used for AFTER capture.
CIntegration / source participation register
NO SOURCE IS DESCRIBED AS INTEGRATED WHERE IT IS ONLY SIMULATED. Critical Control participation is SIMULATED and Smart Completions, Labor Relations and analytics are NOT_CONNECTED. Object-level authority is preserved in every class: the readiness layer reads, observes, derives, snapshots and writes evidence — it never becomes the master.
| System | Objects | Participation | Authority preserved | Note |
|---|---|---|---|---|
| Q4 (work control) | Permit, Isolation, SanctionToTest, PETAR, native lifecycle states | CONTROLLED MANUAL FEDERATION | Q4 remains authoritative and transactional; readiness layer observes only | Interface NOT_YET_VALIDATED. Pilot proceeds by governed manual federation with dual-person state transcription and SourceNativeState preserved verbatim. |
| Aconex (controlled documents) | ControlledDocument, revision, transmittal | CONTROLLED SNAPSHOT | Aconex authoritative; readiness layer pins document version at decision time | Snapshot cadence and staleness window must be agreed per document class before activation. |
| P6 / Project Controls | P6Activity, WBS, lookahead | CONTROLLED SNAPSHOT | P6 authoritative for schedule; readiness never writes dates | Weekly snapshot; readiness consumes demand signal only. |
| Smart Completions / BCSTools | System, subsystem, completion status | NOT CONNECTED | Unchanged | Out of pilot scope. Must not be described as integrated. |
| Engineering information | P&ID, loop drawing, schematic references | CONTROLLED SNAPSHOT | Engineering systems authoritative | Version reference only; no derived engineering content. |
| HR | Person, assignment | CONTROLLED SNAPSHOT | HR authoritative for identity and assignment | Minimum necessary attributes only. |
| Training | Competency, authorisation validity | CONTROLLED SNAPSHOT | Training authoritative | Expiry inside the execution window must be visible to Forecast Readiness; snapshot staleness is decision-relevant and must be shown. |
| Occupational Health | Fitness, Restriction | CONTROLLED MANUAL FEDERATION | Occupational Health authoritative; readiness sees fitness state, never clinical data | Restriction semantics governed by ADR-03 / CA-03. Unmapped states fail closed. |
| Labor Relations | Restriction, eligibility | NOT CONNECTED | Unchanged | Excluded from pilot; any such restriction is handled outside the governed flow and recorded as a scope exclusion. |
| Critical Control platform (Forwood or equivalent) | CriticalControl, verification | SIMULATED | Platform remains authoritative | SIMULATED. This is NOT integration and must not be reported as such; Life Critical journeys therefore carry a declared evidence limitation. |
| Enterprise IAM | Identity, role, group | LIVE READ | IAM authoritative for identity; readiness layer owns operational authority attributes | Required for any real authorization record — no resolved identity, no authorization. |
| Analytics / Power BI | Read-only projections | NOT CONNECTED | Unchanged | Deferred until after pilot acceptance to avoid publishing unvalidated readiness data. |
DOperational journey results
All twenty journeys are defined, scripted and exercisable, and every one of them has been demonstrated against the prototype. NONE has been executed under real project conditions. SIMULATED_ONLY is therefore recorded as the field state — prototype demonstration is not pilot evidence and is not reported as such.
| ID | Journey | Expected behaviour | Prototype evidence | Field state |
|---|---|---|---|---|
| J-01 | Clean Job Card preparation | All mandatory conditions satisfied; verdict READY with pinned versions and named confirmer. | SIMULATED — JC-7702 path in /p1 | SIMULATED ONLY |
| J-02 | Missing enabling condition | HOLD attributed to the specific condition, owner and action; not averaged away. | SIMULATED — ECE blocker path | SIMULATED ONLY |
| J-03 | Incomplete competency | HOLD on the affected person/activity only; crew-level compensation refused. | SIMULATED — competency register | SIMULATED ONLY |
| J-04 | Equipment / readiness conflict | Equipment placement conflict surfaces in Location context with attribution. | SIMULATED — TT01 placement | SIMULATED ONLY |
| J-05 | Document revision change | Pinned version superseded → selective reassessment of dependent decisions only. | SIMULATED — revision event | SIMULATED ONLY |
| J-06 | PETAR / work-control requirement | PETAR routing to the correct authority; readiness never issues the PETAR. | SIMULATED — routing path | SIMULATED ONLY |
| J-07 | Life Critical / Critical Control blocker | Non-compensable STOP; no aggregate score can clear it. | SIMULATED — Critical Control platform is SIMULATED, so this journey cannot be field-evidenced in pilot as scoped | BLOCKED BY PRECONDITION |
| J-08 | Pairwise SIMOPS | Interaction between two Job Cards identified with both parties attributed. | SIMULATED — JC-7701 × JC-7702 | SIMULATED ONLY |
| J-09 | Cumulative SIMOPS | CUM rule fires even where every pair passes. | SIMULATED — CUM-2 / CUM-5 / CUM-7 in /p1 | SIMULATED ONLY |
| J-10 | Overlapping execution windows | Concurrency computed on windows, not on calendar day. | SIMULATED — TT01 window overlap | SIMULATED ONLY |
| J-11 | Forecast expiry inside work window | CurrentReadiness READY while ForecastReadiness HOLD; intervention lead time recorded. | SIMULATED — competency expiry + wind breach | SIMULATED ONLY |
| J-12 | Location continuity between disciplines | Context reused, applicability re-evaluated, authorization objects not inherited. | SIMULATED — mechanical → electrical handover | SIMULATED ONLY |
| J-13 | Crew or equipment change | Change trigger → selective reassessment of affected conditions. | SIMULATED — crew swap event | SIMULATED ONLY |
| J-14 | Selective reassessment | Only dependent decisions reassessed; unrelated Job Cards untouched. | SIMULATED — event scoping | SIMULATED ONLY |
| J-15 | Unbounded change | Scope of impact indeterminable → broad reassessment or fail closed. | SIMULATED — rule version change | SIMULATED ONLY |
| J-16 | Source unavailable | Dependency marked STALE/UNVERIFIABLE; permitted decision use restricted per object. | SIMULATED — degraded mode | SIMULATED ONLY |
| J-17 | Offline capture | Capture permitted with BaseVersion; authorization refused offline. | SIMULATED — field mode | SIMULATED ONLY |
| J-18 | Reconciliation after reconnect | Deterministic conflict detection; no last-write-wins on critical objects. | SIMULATED — pending queue replay | SIMULATED ONLY |
| J-19 | Authority-denied action | Server-side denial with denied-action evidence; UI hiding is not the control. | SIMULATED — /p1/authority console (Phase 2A F-05 closure) | SIMULATED ONLY |
| J-20 | Stewardship unavailable | AuthorityResolutionState UNRESOLVED; dependent capabilities DISABLED_SAFE. | SIMULATED — G-01 vacant stewardship scenario | SIMULATED ONLY |
ELocation / SIMOPS evidence
| Element | Validation | State |
|---|---|---|
| LocationConcurrentWorkSet | TT01 carries JC-7701 (mechanical, height), JC-7702 (electrical termination), JC-7703 (instrumentation loop) with overlapping windows. | SIMULATED ONLY |
| PairwiseSIMOPS | Each of the three pairs assessed independently for interaction type and severity. | SIMULATED ONLY |
| CumulativeSIMOPS | CUM-1…CUM-7 evaluated across the full concurrent set after pairwise assessment completes. | SIMULATED ONLY |
| LocationCriticalRiskContext | Height + stored energy + live electrical exposure aggregated as Location-level critical risk context. | SIMULATED ONLY |
| JobCardBlockerAttribution | Every Location blocker names Job Card, discipline, blocker type, owner, action and evidence reference (Phase 2A F-02 closure). | SIMULATED ONLY |
| SharedIsolationContext | One isolation boundary serving multiple Job Cards; removal by one party affects all — must be visible to all. | BLOCKED BY PRECONDITION |
| ExclusionZoneInteraction | Elevated-work drop zone intersecting the electrical work position. | SIMULATED ONLY |
| EnergyStateInteraction | Mechanical work requiring de-energised state versus commissioning work requiring energisation. | SIMULATED ONLY |
PAIRWISE PASS NEVER IMPLIES LOCATION PASS. The pilot must produce at least one observed case where every pairwise assessment passes and a cumulative rule still returns a Location-level restriction. If the pilot cannot produce such a case, the cumulative model is unproven and Phase 6 cannot recommend production readiness on that dimension.
FContinuity evidence
TT01 mechanical idler change-out completes → Location context (access route, exclusion zone geometry, isolation boundary, area conditions, equipment placement, hazard inventory) persists → electrical termination and instrumentation loop check prepare in the same Location → valid contextual information is reused → applicability is re-evaluated for the new discipline → permits, isolations, PETAR and competency authorisations are NOT inherited.
INHERIT CONTEXT — NEVER INHERIT AUTHORIZATION.
| Measure | Method | State |
|---|---|---|
| Repeated information collection avoided | Count context items reused versus re-collected in the successor discipline's preparation. | NOT YET MEASURED |
| Unnecessary document search avoided | Timed observation of successor preparation versus BEFORE baseline for the same document classes. | NOT YET MEASURED |
| Duplicate verification avoided | Count of verifications reused under a still-valid basis versus repeated. | NOT YET MEASURED |
AVOIDED MANDATORY REVALIDATION IS NOT A PRODUCTIVITY BENEFIT. Any revalidation that governance requires per discipline, per authorization or per shift is excluded from the benefit calculation even where the system could technically have reused it.
GCurrent / forecast readiness
The pilot must show a Job Card that is CurrentReadiness = READY and ForecastReadiness = HOLD for its planned execution window — conditions valid now but insufficient at the time of work.
| Case | Expected behaviour |
|---|---|
| Competency authorisation expires between now and the planned window | Forecast HOLD with expiry date and named holder; current state unaffected. |
| Wind threshold breach forecast inside the elevated-work window | Forecast HOLD on the height-dependent activity only; unrelated activities unaffected. |
| Document revision scheduled to supersede a pinned version before execution | Forecast HOLD pending re-pin and reassessment. |
| Isolation validity expires before the planned window closes | Forecast HOLD; extension routed to the isolation authority, never inferred. |
Lookahead lead-time question
Is forecast information produced early enough to support lookahead intervention? Measured as the interval between forecast HOLD publication and the planned execution window start, compared against the practical lead time required by the responsible owner to resolve that condition class.
NOT YET MEASURED
HOffline / reconciliation evidence
| Element | Check | State |
|---|---|---|
| OfflineCapture | Field observations, verification results and condition evidence captured without connectivity, against a declared MinimumSafeInformationSet. | SIMULATED ONLY |
| PendingQueue | Immutable ordered queue; entries cannot be edited or deleted before reconciliation. | SIMULATED ONLY |
| BaseVersion | Every offline capture records the source versions it was based on. | SIMULATED ONLY |
| Reconnect | Reconnection triggers replay, not silent overwrite. | SIMULATED ONLY |
| ConflictDetection | BaseVersion mismatch detected deterministically; no last-write-wins on critical objects. | SIMULATED ONLY |
| Reconciliation | Conflicts routed to a named authority for disposition with evidence retained on both sides. | SIMULATED ONLY |
| RecoveryVerification | Explicit operational verification step before work resumes on affected decisions. | SIMULATED ONLY |
OFFLINE CAPTURE IS PERMITTED WHERE GOVERNED. OFFLINE AUTHORIZATION IS NOT PERMITTED. The pilot must attempt an offline authorization and record the refusal as evidence.
SERVICE_RESTORED ≠ OPERATIONALLY_RECOVERED. Restoration of connectivity does not restore decision validity; reconciliation and recovery verification must complete first.
IField acceptance findings
| Dimension | Method | State |
|---|---|---|
| Supervisor usability | Task-based observation with think-aloud during real preparation; time-on-task and error events recorded. | NOT YET MEASURED |
| Superintendent confidence | Structured interview on whether the verdict is trusted enough to act on without independent re-checking. | NOT YET MEASURED |
| Field comprehension | Comprehension check at the workface: can the crew state why the card is READY/CONDITIONAL/HOLD and what would change it. | NOT YET MEASURED |
| ES&H usability | Observation of SIMOPS and Critical Control review tasks. | NOT YET MEASURED |
| Project Controls usability | Observation of lookahead and forecast interaction. | NOT YET MEASURED |
| Blocker visibility | Can the responsible owner locate their own blockers unaided within a defined interval. | NOT YET MEASURED |
| Ownership clarity | Percentage of blockers where the named owner agrees they are the owner. | NOT YET MEASURED |
| Decision latency | Time from all conditions satisfied to confirmed authorization. | NOT YET MEASURED |
| Cognitive burden | Observed steps, screens and re-reads per decision; supplemented by subjective workload rating. | NOT YET MEASURED |
| Bypass / workaround behaviour | Every observed attempt to work outside the governed flow is logged with context and root cause. | NOT YET MEASURED |
| Workaround root cause | Meaning | Governed response |
|---|---|---|
| Usability | The governed path is available and correct but too slow, unclear or hard to complete. | Interface or interaction change; architecture unaffected. |
| Process | The governed path does not match how the work is actually sequenced. | Process alignment or scope correction; may generate a controlled action. |
| Authority | The person who must act does not hold the capability, or the holder is absent. | Authority model or delegation/staffing correction (ADR-14). |
| Performance | The governed path is too slow to be usable at the point of decision. | Technical remediation; recorded in the incident register. |
| Governance | The rule itself is wrong, over-applied or unapproved. | ADR-16 rule change through governed approval — never a local override. |
| ChangeResistance | The governed path works and is understood but is not adopted. | P3-TRN-01 organizational change action. |
A WORKAROUND IS NEVER CLASSIFIED AS A TRAINING PROBLEM BY DEFAULT. Root cause must be determined and recorded against one of the six classes above. ChangeResistance may only be concluded after Usability, Process, Authority, Performance and Governance have been excluded with evidence.
JStewardship & support findings
| Responsibility | Exercised by | Measure | State |
|---|---|---|---|
| Federation mapping | Data Steward | Mapping exceptions raised per week; time to governed validation; proportion left UNRESOLVED. | NOT YET MEASURED |
| Rule configuration | Rule Owner | Rule change requests per week; approval turnaround; unapproved-config attempts blocked. | NOT YET MEASURED |
| Location stewardship | Named Location Steward per Location | Steward availability across shifts; time in UNRESOLVED state; decisions blocked by vacancy. | BLOCKED BY PRECONDITION |
| User support | L1 Support | Contacts per user per week; first-contact resolution rate. | NOT YET MEASURED |
| Integration incidents | L2 Application / Integration Support | Incidents per week by source; mean time to detect and restore; decisions affected. | NOT YET MEASURED |
| Authority questions | Business Product Owner + Area Superintendent | Escalations per week; time to resolution; recurrence. | NOT YET MEASURED |
| Evidence questions | Business Product Owner | Reconstruction requests served; time to reconstruct a decision end-to-end. | NOT YET MEASURED |
AN ARCHITECTURE THAT ONLY WORKS WHILE THE DESIGN TEAM IS PRESENT IS NOT OPERATIONALLY SUSTAINABLE. The pilot must run at least two full weeks with the design team explicitly withdrawn from operational duty. Any responsibility that silently reverts to the design team is recorded as a stewardship failure, not as a support call.
KValue measurement
| Chain stage | Meaning | Rule |
|---|---|---|
| TimeSaved | Measured reduction in time spent on a defined preparation task. | Measured only, never inferred. |
| TimeReleased | Saved time that actually becomes available capacity for the same resource. | Requires evidence that the resource was not immediately reabsorbed by another constraint. |
| ProductiveTimeCaptured | Released time demonstrably converted into productive work. | Requires observed downstream productive output. Absent that evidence, the chain stops at TimeReleased. |
EfficiencyNOT YET MEASURED
- Reduced document search
- Reduced re-entry
- Reduced preparation rework
- Reduced preparation effort
Operational EffectivenessNOT YET MEASURED
- Earlier blocker detection
- Earlier SIMOPS intervention
- Better forecast lead time
- Fewer late readiness surprises
AssuranceNOT YET MEASURED
- Improved evidence completeness
- Decision reconstruction success rate
- Authority traceability
- Control integrity
StrategicNOT YET MEASURED
- Reusability across areas
- Cross-system integration maturity
- Governance maturity
NO SAVING IS INVENTED. Zero value is claimed in this record because no measurement has occurred. Efficiency, Operational Effectiveness, Assurance and Strategic value are reported separately and are never summed into a single headline figure.
LCausal attribution
| Field | Definition |
|---|---|
| PrimaryConstraint | The constraint that actually governed the start of work in the observed case. |
| ConcurrentConstraints | All other constraints active at the same time that would have delayed work independently. |
| Intervention | The specific Integrated Readiness behaviour claimed to have changed the outcome. |
| Counterfactual | What the evidence indicates would have happened without that intervention. |
| ObservedOutcome | What actually happened, with timestamps. |
| AttributableEffect | The portion of the outcome defensibly attributable to the intervention after concurrent constraints are removed. |
PROHIBITED INFERENCE: WorkStartedEarlier ⇒ DigitalSolutionSavedAllDelay. Where several constraints were concurrently binding, the attributable effect is limited to the constraint the intervention actually relieved. Where the primary constraint was not addressed by Integrated Readiness, the attributable effect is zero even if the outcome improved.
MArchitecture drift register
| ID | Drift watched | Detection | Control | State |
|---|---|---|---|---|
| P6-DR-01 | Silent simplification of Option C into Option B | Any proposal to centralize an authoritative object into the readiness layer, or to hold a source master locally. | Requires an explicit architecture decision per the Phase 4 fallback rule. No implementation team may simplify silently. | OPEN |
| P6-DR-02 | Manual federation hardening into a shadow master | CONTROLLED_MANUAL_FEDERATION entries being edited in the readiness layer rather than re-federated from source. | Manual federation records are transcriptions with SourceNativeState preserved; they carry no authority and expire. | OPEN |
| P6-DR-03 | Compensation creeping in through scoring or dashboards | Any aggregate indicator that can display green while a non-compensable condition fails. | No-compensation classification is enforced in the engine, not in presentation. | OPEN |
| P6-DR-04 | Authorization inherited through Location continuity | Successor discipline proceeding on a predecessor's permit, isolation or PETAR. | Continuity carries context only; authorization objects are re-evaluated and re-issued. | OPEN |
| P6-DR-05 | Offline authorization introduced under field pressure | Any request to confirm, approve or authorize while disconnected. | Fail closed. Change requires competent governance disposition, not a pilot decision. | OPEN |
| P6-DR-06 | SIMULATED sources reported as integrated | Any status report describing Critical Control participation as integration. | Source Participation Register (C) is the single source of truth for integration claims. | OPEN |
NTechnical / operational incident register
| ID | Failure condition | Severity | Handling | State |
|---|---|---|---|---|
| P6-FC-01 | False READY | CRITICAL | Immediate journey halt, root cause, and automatic Phase 6 failure of §17 condition 1. | NOT YET MEASURED |
| P6-FC-02 | False HOLD | HIGH | Recorded with rule version and inputs; drives rule correction under ADR-16. | NOT YET MEASURED |
| P6-FC-03 | Late SIMOPS detection | HIGH | Recorded with detection point relative to mobilisation. | NOT YET MEASURED |
| P6-FC-04 | Unresolved authority | HIGH | Recorded with duration in UNRESOLVED and decisions blocked. | NOT YET MEASURED |
| P6-FC-05 | Stale source use | CRITICAL | Any decision made on a source beyond its permitted staleness is a critical finding. | NOT YET MEASURED |
| P6-FC-06 | Incorrect federation mapping | HIGH | Recorded with mapping method, suggester, validator and blast radius. | NOT YET MEASURED |
| P6-FC-07 | Evidence gap | CRITICAL | Any decision that cannot be reconstructed end-to-end is a critical finding. | NOT YET MEASURED |
| P6-FC-08 | Offline reconciliation conflict | MODERATE | Expected and acceptable if detected and dispositioned; unacceptable if silently resolved. | NOT YET MEASURED |
| P6-FC-09 | Excessive manual workaround | HIGH | Root-caused against the six classes; not defaulted to training. | NOT YET MEASURED |
| P6-FC-10 | Unacceptable latency | MODERATE | Recorded against the decision point where it occurred. | NOT YET MEASURED |
| P6-FC-11 | Stewardship overload | HIGH | Recorded as demand versus staffed capacity; feeds ADR-14 staffing. | NOT YET MEASURED |
THESE ARE LEARNING EVIDENCE AND ARE NOT HIDDEN. Every occurrence is recorded with inputs, rule version, identity and timestamp, and is reported in the Phase 6 output whether or not it is favourable.
OOption C sustainability assessment
| Dimension | Measure | Sustainability threshold | State |
|---|---|---|---|
| FederationMaintenanceEffort | Steward hours per week maintaining mappings across the nine governed keys. | Sustainable if absorbable by the ADR-14 staffed roles without design-team support. | NOT YET MEASURED |
| MappingExceptions | Exceptions raised per 100 federated objects per week, and proportion needing human validation. | Sustainable if exception rate is stable or declining and validation keeps pace with demand. | NOT YET MEASURED |
| IntegrationFailureRate | Source unavailability and contract failures per source per week, and decisions affected. | Sustainable if failures stay localized to the dependent decision, as designed. | NOT YET MEASURED |
| StewardshipDemand | Location steward decisions per shift and time in vacancy. | Sustainable if coverage exists across all operating shifts. | BLOCKED BY PRECONDITION |
| SupportDemand | L1/L2 contacts per user per week and escalation rate to L3. | Sustainable if L3 demand trends down after the first four weeks. | NOT YET MEASURED |
| OperationalBenefit | Evidence-based Efficiency, Operational Effectiveness and Assurance findings. | Federation burden must be proportionate to measured benefit. | NOT YET MEASURED |
Option C verdict
NOT_YET_DETERMINABLE
Option C operational sustainability cannot be assessed without executed pilot measurement. No OPTION_C_REASSESSMENT_FINDING is raised, because there is no evidence to raise one on — and equally, no confirmation is claimed. If executed measurement later shows federation burden materially undermining benefit, an OPTION_C_REASSESSMENT_FINDING is raised. Migration to Option B is never automatic and requires an explicit architecture decision.
PResidual risk register
| ID | Risk | Severity | State | Control |
|---|---|---|---|---|
| P6-R-01 | Phase 5 has no formal disposition; Phase 6 governing input is unsatisfied. | HIGH | OPEN | Pilot execution is fail-closed until disposition is recorded. |
| P6-R-02 | All enterprise interfaces remain NOT_YET_VALIDATED; participation classes are intentions, not evidence. | HIGH | OPEN | P6-PRE-02 must complete before activation; unvalidated sources degrade to CONTROLLED_MANUAL_FEDERATION or NOT_CONNECTED. |
| P6-R-03 | Critical Control participation is SIMULATED, so the Life Critical journey cannot be field-evidenced as scoped. | HIGH | OPEN | Either evidence the interface or declare J-07 out of pilot evidence scope explicitly. |
| P6-R-04 | Location Stewards not yet named or staffed across shifts (ADR-14). | HIGH | OPEN | P6-PRE-03. Vacancy produces UNRESOLVED and DISABLED_SAFE by design, but a pilot spent in vacancy proves nothing. |
| P6-R-05 | ADR-15 JobCard and ADR-17 TemporaryModification authority remain UNRESOLVED. | HIGH | OPEN | Resolve or exclude in writing before activation (P6-PRE-05). |
| P6-R-06 | Manual federation introduces transcription error into decision-critical state. | MODERATE | OPEN | Dual-person transcription, SourceNativeState preserved verbatim, expiry on manual records. |
| P6-R-07 | Parallel running doubles preparation effort and may itself suppress adoption. | MODERATE | OPEN | Measure separately; parallel-running overhead is excluded from adoption root-cause analysis. |
| P6-R-08 | Pressure to report benefit before measurement completes. | MODERATE | OPEN | Value rule: no saving is invented; the value chain stops where evidence stops. |
| P6-R-09 | Organizational change load (P3-TRN-01) confounds adoption findings. | MODERATE | OPEN | Six-class workaround root cause prevents defaulting to training or resistance. |
QPilot acceptance register & go / hold recommendation
| ID | §17 acceptance condition | Verdict | Basis |
|---|---|---|---|
| P6-AC-01 | No false READY observed for mandatory conditions | NOT YET MEASURED | No field execution. Non-compensation is enforced in the engine and demonstrated in Phase 0C/2A, but that is design evidence, not pilot evidence. |
| P6-AC-02 | No critical authority bypass occurs | NOT YET MEASURED | Server-side enforcement demonstrated (Phase 2A F-05); no field attempt observed. |
| P6-AC-03 | Evidence remains reconstructable | NOT YET MEASURED | Reconstruction demonstrated on synthetic decisions only. |
| P6-AC-04 | Cumulative SIMOPS behaves correctly | NOT YET MEASURED | CUM-1…7 exercised synthetically (G-02); no real concurrent work set assessed. |
| P6-AC-05 | Continuity does not inherit authorization | NOT YET MEASURED | Invariant enforced in the model; no real handover observed. |
| P6-AC-06 | Offline / reconciliation operates safely | NOT YET MEASURED | Simulated only; no real network loss under field conditions. |
| P6-AC-07 | Federation burden is manageable | NOT YET MEASURED | Requires executed measurement of maintenance effort and exception rate. |
| P6-AC-08 | Support / stewardship model is viable | OPEN | Stewards not yet staffed; design-team-withdrawn period not yet run. |
| P6-AC-09 | Field users can understand decisions | NOT YET MEASURED | No comprehension check has been performed with real crews. |
| P6-AC-10 | No Critical unresolved pilot finding exists | NOT YET MEASURED | No pilot findings exist at all. |
| P6-AC-11 | Value claims are evidence-based | PASS | Satisfied by construction: no value is claimed, because none is measured. |
Go / hold recommendation
HOLD
Phase 6 cannot recommend Production Readiness. Ten of eleven acceptance conditions are NOT_YET_MEASURED or OPEN because the pilot has not been executed, and the governing input (formal Phase 5 acceptance) is unsatisfied. This is a fail-closed outcome, which is the correct behaviour of the accepted model — not a defect.
To proceed
- Record the Phase 5 Technical Solution Definition disposition.
- Close P6-PRE-01 … P6-PRE-06.
- Authorize Controlled Pilot Execution as a separate disposition against this defined scope, controls and measurement method.
- Execute the four-week BEFORE baseline, then the pilot with the design team withdrawn for at least two weeks.
- Return Phase 6 Execution Results populating sections B, D–K and N–Q with measured evidence.