SADR Material Finding Remediation & Functional Baseline Revision
COMPLETE PENDING INDEPENDENT RETESTCANDIDATE — NOT FROZENRemediation ID
PH6A-SADR-REM-REV0
Parent review
PH6A-II-SADR-REV0
Target output
PH6A-FPSO-FUNCTIONAL-BASELINE-REV1-CANDIDATE
Mandate
DEFECT_CORRECTION
Finding → RootCause → AffectedContract → CorrectedSemanticDefinition → AcceptancePredicate → RegressionImpact → ResidualRisk. A contractual defect is never repaired as a UI fix.
NOT ARCHITECTURE REDESIGNNOT FEATURE EXPANSIONNOT PROTOTYPE IMPLEMENTATIONNOT BECHTELIZATIONNOT DEMONSTRATIONNOT OPERATIONAL VALIDATION
A. Remediation executive summary
Defect correction at the level where the defect resides
All four material SADR findings have been corrected at the level at which the defect actually resides: three as functional-contract corrections (FC-FPSO-08 signature applicability, FC-FPSO-02/05 dependency and concurrency semantics, FC-FPSO-07 tool temporal validity) and one as a traceability/UX correction (two orphan affordances). The systemic hypothesis SYS-01 — temporal decoherence of package facts — is remediated by a single cross-contract rule, NO_MATERIAL_DECISION_MAY_RELY_ON_A_TEMPORALLY_EXPIRED_FACT, with governed EvaluationTimestamp as an explicit decision input rather than an ambient wall clock.
Corrections are expressed as amended semantic definitions plus acceptance predicates, not as new states where an attribute or reason code carries the meaning safely. Two new states were admitted (SIGNATURE_NOT_VALID_FOR_CURRENT_VERSION as an evaluated applicability result, and TOOL_READINESS_LAPSED) and one previously proposed state was rejected as decorative.
SADR_MATERIAL_FINDING_REMEDIATION = COMPLETE_PENDING_INDEPENDENT_RETEST. The candidate baseline is not frozen, not accepted and does not self-certify; only an independent retest may freeze it.
Architecture unchanged. PH6A-IADA-REV1 and PH6A-IADA-REV1-SEAL-01 are untouched. No operational closure evidence is produced or implied by this interaction.
MacroPromptA_Authorized
FALSE
Bechtelization
NOT AUTHORIZED
PrototypeImplementation
NOT AUTHORIZED
OperationalClosureEvidence
NOT YET ACQUIRED
Phase6A
HOLD
Phase6B
NOT AUTHORIZED
Phase7
NO GO
BC09Protection
ACTIVE
PilotExposure
PROHIBITED
B. Input baseline integrity
| Baseline | Role | Status | Consumed as | Disposition |
|---|---|---|---|---|
| PH6A-FPSO-FUNCTIONAL-BASELINE-REV0 | Functional contracts FC-FPSO-01…08 | FROZEN BUT SUPERSEDED FOR REMEDIATION PURPOSES | Corrected clause-by-clause into a REV1 candidate; REV0 preserved verbatim for audit history. | SUPERSEDED BY CANDIDATE |
| PH6A-FPSO-IAD-REV1 | 16 screens, 18-step field journey | ACCEPTED BUT RECONCILIATION REQUIRED | Delta register only — no wholesale screen redesign. | SUPERSEDED BY CANDIDATE |
| PH6A-II-SADR-REV0 | Finding source of record | HOLD | 14 findings; 4 material findings mandatory in scope; counts adopted as stated, not renegotiated. | UNCHANGED |
| PH6A-IADA-REV1 | Integrated architecture baseline | FROZEN | Constraint only. ArchitectureReopenRequired = FALSE. | UNCHANGED |
| PH6A-IADA-REV1-SEAL-01 | Design provenance seal | ACTIVE AND FROZEN | Verified unmodified at remediation entry and exit. | UNCHANGED |
C. SADR finding reconciliation
No finding may be declared finally closed in this interaction
F-SADR-01REMEDIATED PENDING INDEPENDENT RETESTFUNCTIONAL CONTRACT CORRECTION
Original condition
SIGNED is terminal; no successor for a signed object invalidated after signing; timestamp-authority failure undefined.
Root cause
The contract conflated two different things under one state: the historical fact that a signature was applied, and the present question of whether that signature authorizes the object as it now stands.
Correction
Split the concept. SignatureEvidence is immutable historical evidence bound to SIGNED_VERSION_N (ObjectVersion, DecisionContext, DecisionRight, IntegrityReference, EvaluationTimestamp). SignatureApplicability is an evaluated result, computed at read and at decision time against the current object version and context; where they differ the evaluated result is SIGNATURE_NOT_VALID_FOR_CURRENT_VERSION. SIGNED remains terminal only where the signed object is genuinely immutable and closed.
Acceptance predicate
SignatureApplicable = TRUE only if SignedObjectVersion = CurrentObjectVersion AND SignedDecisionContextHash = CurrentDecisionContextHash AND DecisionRight valid at EvaluationTimestamp AND IntegrityReference verifies. Otherwise SIGNATURE_NOT_VALID_FOR_CURRENT_VERSION, and the historical SignatureEvidence row is unchanged.
Affected contract
FC-FPSO-08 DigitalSignatureAssurance · Signature lifecycle · postconditions · timestamp dependency
Regression tests
REM-R01, REM-R02, REM-R03, REM-R09, REM-R16
Residual risk
MEDIUM — the PKI/timestamp-authority owner is an unresolved external dependency (DEP-07/DEP-08). Interim behaviour is deterministic refusal, so the risk is availability, not validity.
Retest required
Independent retest of ADV-01, ADV-03, ADV-05, ADV-13 and illegal-state H-04.
F-SADR-02REMEDIATED PENDING INDEPENDENT RETESTFUNCTIONAL CONTRACT CORRECTION
Original condition
FC-02/FC-05 ambiguity: ambiguous active revisions unnamed; IPERC delta materiality had no classification predicate; concurrent edit granularity unstated.
Root cause
Schema completeness was mistaken for semantic sufficiency. Each clause named an outcome without naming the inputs that determine the outcome.
Correction
(a) Ambiguous active revision is an evaluated condition REVISION_ELECTION_UNRESOLVED — retrieval returns the candidate set with no election; no auto-election. (b) Delta materiality is a recorded classification with declared inputs (affected requirement class, control removal, hazard introduction, scope/location change) producing one of four deterministic dependency outcomes. (c) Concurrency is row-level with a document-level base-version guard.
Acceptance predicate
Given identical revision sets, identical rule versions and identical EvaluationTimestamp, two independent implementations return the same election outcome, the same materiality class and the same conflict determination.
Affected contract
FC-FPSO-02 ContextualDocumentRetrieval, FC-FPSO-05 IPERCContinuo · Retrieval election · delta materiality · row concurrency
Regression tests
REM-R04, REM-R05, REM-R06, REM-R12, REM-R13, REM-R14
Residual risk
LOW-MEDIUM — materiality inputs are governed configuration; the ES&H authority must ratify the input list (DEP-04).
Retest required
Independent re-execution of ADV-08, ADV-10, ADV-17 and the testability audit.
F-SADR-03REMEDIATED PENDING INDEPENDENT RETESTTRACEABILITY CORRECTION
Original condition
Two orphan UI actions: register bulk acknowledge; re-open of a closed pre-start record.
Root cause
Interaction design added affordances by analogy with register UIs, without a governing transition; the prior OrphanUIActions = 0 was asserted, not reconstructed.
Correction
Bulk acknowledge classified UX_ONLY_REMOVE and deleted from the candidate interaction design. Re-open classified EXISTING_CONTRACT_TRACEABILITY_REPAIR and replaced by the governed supersession action already defined in FC-FPSO-03 (create successor pre-start record superseding the closed one, with reason code, authority check and event).
Acceptance predicate
Every affordance in the candidate interaction design resolves to Contract → Clause → Transition → DecisionRight → Event. OrphanUIActions = 0 by reconstruction, not declaration.
Affected contract
Interaction layer; FC-FPSO-03 PreStartPreventivePackage (existing transition reused) · IAD Rev.1 screens S07 (register) and S14 (closed record)
Regression tests
REM-R07, REM-R15
Residual risk
LOW — no contract change; the supersession path already existed and is now the only route.
Retest required
Independent recomputation of the UX→contract matrix.
F-SADR-10REMEDIATED PENDING INDEPENDENT RETESTFUNCTIONAL CONTRACT CORRECTION
Original condition
Tool inspection expiry evaluated at declaration only; TOOL_READY could persist past mandatory inspection expiry — reachable illegal state and determinism violation.
Root cause
Readiness was modelled as a declared fact rather than as an evaluated function of a temporally bounded source fact.
Correction
ToolReadiness is derived at EvaluationTimestamp from InspectionValidity, CertificationValidity, Condition and Restriction. Expiry while the package exists, while awaiting authorization, after authorization or during active work each has a governed consequence (see Tool temporal validity table). New evaluated state TOOL_READINESS_LAPSED replaces silent persistence of TOOL_READY.
Acceptance predicate
TOOL_READY is unreachable when any mandatory inspection ValidUntil < EvaluationTimestamp, for every phase of the package lifecycle, with no dependency on whether any UI was opened.
Affected contract
FC-FPSO-07 ToolReadiness · Readiness derivation · validity re-evaluation · consequence on active work
Regression tests
REM-R08, REM-R09, REM-R10, REM-R11, REM-R16
Residual risk
MEDIUM — the consequence of expiry during active work for lifting/rigging equipment awaits the equipment authority decision (DEP-11); interim behaviour is HOLD, which is safe but potentially over-restrictive.
Retest required
Independent re-execution of ADV-04, ADV-20 and the illegal-state set.
D. Temporal coherence model
XR-TEMP-01
NO_MATERIAL_DECISION_MAY_RELY_ON_A_TEMPORALLY_EXPIRED_FACT.
Cross-contract. Binds FC-FPSO-01…08 and every material authorization predicate.
EffectiveFromValidUntilLastVerifiedTemporalValidityStateRevalidationTriggerDecisionTimeEvaluationRequirement
States
CURRENT · EXPIRING · EXPIRED · UNKNOWN — retained because each drives distinct behaviour.
Behavioural justification
CURRENT permits; EXPIRING permits but emits a governed warning and a revalidation demand; EXPIRED blocks the material decision; UNKNOWN blocks and additionally names a verification owner. Collapsing EXPIRED and UNKNOWN would lose the distinction between a known-bad and an unverifiable fact — which changes who must act.
Rejected states
SIGNATURE_SUPERSEDED as a stored state was rejected as decorative — applicability is evaluated, not stored. Storing it would create two sources of truth for the same question.
E. TIME / EVENT / CHANGE / DEMAND trigger matrix
TIME
A fact validity threshold is crossed at the governed EvaluationTimestamp.
EVENT
A governed operational event is emitted (isolation lifted, SIMOPS change, shift end).
CHANGE
A material upstream object or fact changes (document revision, crew change, scope change).
DEMAND
A material decision requests re-evaluation immediately before execution.
| Contract | Material fact | TIME | EVENT | CHANGE | DEMAND | Note |
|---|---|---|---|---|---|---|
| FC-FPSO-01 LocationAcquisition | Location context confirmation | — | YES | YES | YES | GPS never creates authority; time alone does not invalidate a confirmed location. |
| FC-FPSO-02 ContextualDocumentRetrieval | Document effective period / revision | YES | — | YES | YES | Revision change triggers dependency materiality evaluation, never blanket invalidation. |
| FC-FPSO-03 PreStartPreventivePackage | Composite package validity | YES | YES | YES | YES | The package is the coherence point for SYS-01; all four classes apply. |
| FC-FPSO-04 CrewConfirmationRecord | Competency, training, fitness decisions | YES | YES | YES | YES | Fitness is shift-bounded; competency is date-bounded; both revalidate on DEMAND. |
| FC-FPSO-05 IPERCContinuo | Derived IPERC content vs source revision | — | YES | YES | YES | No pure TIME expiry; IPERC validity is bounded by the shift event and by source change. |
| FC-FPSO-06 FieldDeltaAssessment | Open material delta | — | YES | YES | YES | An open material delta blocks regardless of elapsed time. |
| FC-FPSO-07 ToolReadiness | Inspection / certification validity | YES | — | YES | YES | Primary TIME-driven contract; the F-SADR-10 defect lived here. |
| FC-FPSO-08 DigitalSignatureAssurance | Credential, decision right, object version | YES | — | YES | YES | Applicability is evaluated at every read; credential expiry is TIME, version change is CHANGE. |
F. Signature post-invalidation correction
F-SADR-01 · FC-FPSO-08
| Concept | Nature | Corrected definition |
|---|---|---|
| SignatureEvidence | IMMUTABLE HISTORICAL EVIDENCE | Records that a named person, holding a named decision right, signed ObjectVersion N in a named decision context at a governed timestamp. Never mutated, never deleted, never re-scoped. |
| SIGNED_VERSION_N | PRESERVED FACT | The version binding of the signature. Preserved unchanged after any subsequent object change. |
| SignatureApplicability | EVALUATED RESULT | Computed at EvaluationTimestamp against current ObjectVersion, DecisionContext, DecisionRight and IntegrityReference. Not stored as authority. |
| SIGNATURE_NOT_VALID_FOR_CURRENT_VERSION | EVALUATED RESULT VALUE | Returned when the signed binding no longer matches current context. Historical evidence is untouched; the object requires a new signature to be authorized. |
G. Signature failure behaviour
No failure may silently produce a valid signature status
| Condition | Permitted state | Prohibited transition | Reason code | Retry | Idempotency key | Evidence | Human action |
|---|---|---|---|---|---|---|---|
| TimestampUnavailable | SIGNATURE PENDING TIMESTAMP | → SIGNED (no committed signature without a governed timestamp) | RC-SIG-TS-UNAVAILABLE | Bounded retry against the timestamp authority; no device clock substitution. | objectId + objectVersion + signerId + signatureAttemptId | Attempt recorded with the failure reason; no signature evidence row created. | Signer retries when the service returns, or escalates to the authority owner. |
| CredentialUnavailable | SIGNATURE REFUSED | → SIGNED under any substitute identity | RC-SIG-CRED-UNAVAILABLE | Manual only, after credential restoration. | objectId + objectVersion + signerId + signatureAttemptId | Refusal event with signer identity claim unverified. | Signer restores credential; no delegate substitution without a governed delegation. |
| SignatureServiceUnavailable | SIGNATURE PENDING SERVICE | → SIGNED, and → AUTHORIZED for the dependent decision | RC-SIG-SVC-UNAVAILABLE | Bounded exponential retry, idempotent by attempt key. | objectId + objectVersion + signerId + signatureAttemptId | Service failure event; the dependent authorization remains blocked. | Work control decides to wait or to route the authorization via the governed offline path. |
| DecisionRightExpiredBeforeSignatureCommit | SIGNATURE REFUSED | → SIGNED (a signature can never create the right it lacked) | RC-SIG-RIGHT-EXPIRED | None until the decision right is re-established. | objectId + objectVersion + signerId + signatureAttemptId | Refusal event naming the expired right and its owner. | Route to a currently entitled authority or renew the right. |
| ObjectVersionChangedBeforeSignatureCommit | SIGNATURE REFUSED STALE VERSION | → SIGNED against the pre-change version | RC-SIG-VERSION-STALE | Signer must re-read the current version and sign again explicitly. | objectId + objectVersion + signerId + signatureAttemptId | Refusal event recording both versions. | Signer reviews the change, then signs the current version. |
H. FC-02 / FC-05 dependency correction
SourceDocument→Revision→Requirement / Applicability→IPERCSourceDerivedContent→HumanFieldValidation→CurrentIPERC
A document revision change neither invalidates all IPERC nor does nothing. It always triggers DEPENDENCY_MATERIALITY_EVALUATION, whose outcome is dependency-scoped.
I. Document-to-IPERC materiality logic
Dependency-scoped invalidation preserved
| Outcome | Evidence required | Reason code | Affected | Reassessment boundary | Authorization impact |
|---|---|---|---|---|---|
| NO RELEVANT DEPENDENCY | Dependency map showing no IPERC row derives from the changed requirement. | RC-DEP-NONE | No rows | None | CONTINUE — current authorization unaffected. |
| DEPENDENCY NON MATERIAL | Recorded classification with inputs: no control removed, no hazard introduced, no scope/location change, editorial or reference-only delta. | RC-DEP-NON-MATERIAL | Named derived rows, flagged with the new revision reference | Notification only; no reassessment | CONTINUE — with the revision reference updated in evidence. |
| DEPENDENCY MATERIAL REASSESSMENT REQUIRED | Classification naming the removed control or introduced hazard, plus the competent classifier. | RC-DEP-MATERIAL | Only the derived rows traced to the changed requirement | Dependency-scoped — untraced rows retain their validated state | REASSESS before the next material decision; if work is active, consequence per the continuity rule for IPERC (HOLD pending human field revalidation). |
| DEPENDENCY UNRESOLVED | None available — the dependency map cannot be reconstructed for the changed requirement. | RC-DEP-UNRESOLVED | The candidate row set, conservatively bounded | Broadened to the candidate set; never silently narrowed | HOLD — UNKNOWN never converts to PASS. |
J. Orphan UI action resolution
Before 2 · after 0
| Action | Screen | Classification | Resolution | Bound to |
|---|---|---|---|---|
| Register bulk acknowledge | S07 Pre-start register | UX ONLY REMOVE | Removed from the candidate interaction design. Acknowledgement is a per-record act with a named actor; a bulk affordance cannot carry per-record authority or reason. | NO_UI_REQUIRED — no contract loses coverage. |
| Re-open closed pre-start record | S14 Closed record detail | EXISTING CONTRACT TRACEABILITY REPAIR | Replaced by 'Create superseding pre-start record', which was already a governed transition. The closed record stays closed; a successor is created with a reason code and an event. | FC-FPSO-03 · clause Supersession · transition CLOSED → (successor CREATED, predecessor SUPERSEDED) · DecisionRight WorkControlLead · event PRESTART_RECORD_SUPERSEDED |
Reconstructed affordance-by-affordance, not declared.
K. Tool temporal validity correction
F-SADR-10 · FC-FPSO-07
TOOL_READY cannot remain materially valid after mandatory inspection expiry, in any lifecycle phase, independent of UI interaction.
| Lifecycle phase | Governed behaviour | Detail | Reason code |
|---|---|---|---|
| Expiry while package exists (not yet submitted) | REASSESS | Tool row derives to TOOL_READINESS_LAPSED; the package cannot be submitted until replaced or re-inspected. | RC-TOOL-INSP-EXPIRED |
| Expiry while awaiting authorization | HOLD | The authorization predicate fails at decision time; the approver sees the lapsed fact, not a stale PASS. | RC-TOOL-INSP-EXPIRED |
| Expiry after authorization, before work start | HOLD | Authorization is evaluated again at execution demand; the signature for the prior version stays historical. | RC-TOOL-INSP-EXPIRED-POST-AUTH |
| Expiry during active work — non-critical tool | REASSESS | Governed reassessment by the supervisor; work may continue only on a recorded decision. | RC-TOOL-INSP-EXPIRED-ACTIVE |
| Expiry during active work — lifting / rigging / critical-control tool | EXTERNAL VALIDATION DEPENDENCY | The consequence authority is unresolved (DEP-11). Safe deterministic fallback: HOLD the affected activity and route to the equipment authority. The fallback never grants continuation. | RC-TOOL-CONSEQ-UNRESOLVED |
L. SYS-01 temporal decoherence remediation
Fact-by-fact classification — not a blanket assumption
| Material fact | Classification | Basis | Continuity |
|---|---|---|---|
| ToolInspection | TEMPORAL VALIDITY REQUIRED | Statutory inspection interval. | CONTINUOUS |
| EquipmentInspection | TEMPORAL VALIDITY REQUIRED | Statutory inspection interval. | CONTINUOUS |
| Certification | TEMPORAL VALIDITY REQUIRED | Certificate ValidUntil. | CONTINUOUS |
| CompetencyDecision | TEMPORAL VALIDITY REQUIRED | Qualification expiry. | DECISION TIME ONLY |
| TrainingDecision | TEMPORAL VALIDITY REQUIRED | Training currency period. | DECISION TIME ONLY |
| FitnessDecision | TEMPORAL VALIDITY REQUIRED | Shift-bounded declaration. | CONFIGURATION DRIVEN |
| PETAR | TEMPORAL VALIDITY REQUIRED | High-risk permit validity window. | CONTINUOUS |
| Permit | TEMPORAL VALIDITY REQUIRED | Permit validity window. | CONTINUOUS |
| Isolation | EXTERNAL VALIDATION REQUIRED | Isolation validity is governed by the isolation authority, not by an elapsed interval (DEP-09). | CONFIGURATION DRIVEN |
| DecisionRight | TEMPORAL VALIDITY REQUIRED | Appointment period. | DECISION TIME ONLY |
| Delegation | TEMPORAL VALIDITY REQUIRED | Delegation EffectiveFrom/ValidUntil. | DECISION TIME ONLY |
| SignatureCredential | TEMPORAL VALIDITY REQUIRED | Credential expiry at commit. | DECISION TIME ONLY |
| DocumentEffectivePeriod | TEMPORAL VALIDITY REQUIRED | Effective/superseded dates. | DECISION TIME ONLY |
| EnvironmentalObservation | TEMPORAL VALIDITY REQUIRED | Observation staleness threshold is governed configuration per parameter (wind, lightning). | CONTINUOUS |
M / N. Decision-time and continuity revalidation
Authorization predicate
DecisionAllowed = (∀ f ∈ MandatoryFacts(decisionType, projectConfig): ValidAt(f, EvaluationTimestamp)) ∧ AllContractPredicatesPass ∧ DecisionRightValidAt(EvaluationTimestamp)
Cache policy
A cached evaluation may be reused only when its EvaluationTimestamp, rule versions, configuration version and fact version set all match. Otherwise it is recomputed. No stale cached PASS.
Continuity rule
ContinuousValidityRequired vs ValidityRequiredOnlyAtDecisionTime is a per-fact-type rule in governed configuration, never a global assumption.
O. Concurrency correction
ConcurrencyUncontrolledPaths after = 0
Affected object
FC-FPSO-05 IPERCContinuo — concurrent row edits by supervisor and crew member on the same record
Row-level optimistic concurrency with a document-level base-version guard: every write carries BaseVersion for the row and the record; a mismatch is a detected conflict, never a merge and never a last-write-wins.
| Control | Detail |
|---|---|
| BaseVersion | Row version + record version carried on every write. |
| OptimisticConcurrencyCheck | Compare-and-set at row granularity. |
| ConflictDetection | Deterministic on version mismatch; independent of arrival order. |
| ConflictReasonCode | RC-IPERC-ROW-CONFLICT / RC-IPERC-RECORD-CONFLICT |
| NoSilentOverwrite | Rejected write returns the current row for human reconciliation. |
| ReconciliationRequired | Record cannot advance to authorization while any conflict is open. |
| GovernedOperationalEvent | IPERC_EDIT_CONFLICT_DETECTED |
P. Implementation ambiguity resolution
ImplementationMaterialAmbiguity after = 0
| ID | Contract | Interpretation A | Interpretation B | Corrected normative meaning | Acceptance predicate | Regression |
|---|---|---|---|---|---|---|
| AMB-01 | FC-FPSO-02 | Ambiguous active revisions → pick the most recent effective revision automatically. | Ambiguous active revisions → treat the document as unusable. | Neither. Retrieval returns REVISION_ELECTION_UNRESOLVED with the full candidate set and the document-control owner named. No auto-election, no blanket unusability; the dependent decision is blocked until a human elects. | Election is never performed by the readiness layer; the elected revision always carries ElectedBy and ElectionBasis. | REM-R04, REM-R14 |
| AMB-02 | FC-FPSO-05 | Delta materiality is a supervisor judgement, recorded as free text. | Delta materiality is inferred from the delta type alone. | Materiality is a recorded classification with four declared inputs (requirement class affected, control removed, hazard introduced, scope/location change) plus the classifier identity. The judgement stays human; the inputs make it testable and reproducible. | Same inputs + same rule version ⇒ same materiality class; a classification without recorded inputs is invalid. | REM-R05, REM-R06, REM-R14 |
| AMB-03 | FC-FPSO-05 | Concurrent edits conflict at record level (any edit blocks any other). | Concurrent edits merge per row with no guard. | Row-level compare-and-set with a record-level base-version guard, as in the concurrency correction. | Two concurrent writes to distinct rows both succeed; two to the same row produce exactly one conflict. | REM-R12, REM-R13, REM-R14 |
Q. External dependency reconciliation
Prior 12 · independent 14 · reconciled 14
The denominator is not forced back to 12. The two dependencies missing from the prior count are DEP-11 (tool expiry consequence during active work) and DEP-14 (governed evaluation clock) — both surfaced only once time became an explicit governed input. No owner name is invented; owners are named by function where no person is appointed.
An open dependency may never grant authority, select source authority, create legal validity, bypass a mandatory control, or convert UNKNOWN to PASS.
| ID | Affected object | Decision required | Competent owner | Current evidence | Safe interim behaviour | Closure evidence |
|---|---|---|---|---|---|---|
| DEP-01 | Location canonical authority | Confirm canonical location master for pilot scope | Location governance steward (ADR-14, staffing unresolved) | NONE | CONTEXT_UNRESOLVED — no authorization | Signed stewardship appointment + canonical register extract |
| DEP-02 | Document control register | Authoritative revision effectivity source | Document control owner (role identified, person not appointed) | NONE | REVISION_ELECTION_UNRESOLVED | Register extract + effectivity rule statement |
| DEP-03 | Requirement applicability rules | Which requirement classes bind which activity types | Engineering authority | NONE | Broadest applicable set; never narrowed | Approved applicability matrix |
| DEP-04 | IPERC materiality inputs | Ratify the four classification inputs | ES&H authority | DESIGN PROPOSAL ONLY | DEPENDENCY_UNRESOLVED → HOLD | Ratified classification rule with version |
| DEP-05 | Competency source of record | Authoritative competency system and expiry semantics | Training / competency owner | NONE | UNKNOWN → HOLD | System nomination + field mapping evidence |
| DEP-06 | Fitness declaration | Validity window and re-declaration trigger | Occupational health authority | NONE | Shift-bounded, re-declared each shift | Approved validity rule |
| DEP-07 | Signature credential authority | Credential issuance and revocation model | IAM / PKI owner | NONE | SIGNATURE_REFUSED on any credential doubt | IAM design decision + revocation feed |
| DEP-08 | Timestamp authority | Governed timestamp source and offline disposition | IAM / PKI owner | NONE | SIGNATURE_PENDING_TIMESTAMP; never device clock | Nominated timestamp service + offline rule |
| DEP-09 | Isolation validity | Whether isolation validity is time-bounded or event-bounded | Isolation authority | NONE | Event-bounded; expiry never inferred | Isolation standard reference |
| DEP-10 | PETAR / permit interface | Source of record and validity window feed | Permit authority | NONE | UNKNOWN → HOLD | Interface contract + sample feed |
| DEP-11 | Tool expiry during active work | Consequence for critical lifting/rigging equipment | Equipment authority | NONE | HOLD affected activity (EXTERNAL_VALIDATION_DEPENDENCY) | Approved consequence rule per equipment class |
| DEP-12 | Environmental observation staleness | Per-parameter staleness thresholds | ES&H authority | NONE | Observation older than the shortest configured threshold → UNKNOWN → HOLD | Approved threshold table |
| DEP-13 | Decision-right appointment feed | Authoritative appointment and delegation source | Project authority function | NONE | No right inferred from role title | Appointment register + delegation rules |
| DEP-14 | Governed evaluation clock | Trusted time source for EvaluationTimestamp and drift tolerance | Platform / infrastructure owner | NONE | Decisions carry the timestamp used; drift beyond tolerance → UNKNOWN → HOLD | Time source decision + drift tolerance |
R. Illegal-state correction
ReachableIllegalMaterialStates after = 0
| ID | Illegal state | Before | Blocking mechanism | After |
|---|---|---|---|---|
| H-01 | AuthorizedWithoutDecisionRight | UNREACHABLE | DecisionRightValidAt in the authorization predicate. | UNREACHABLE |
| H-02 | AuthorizedWithExpiredMandatoryFact | REACHABLE | XR-TEMP-01 + decision-time revalidation of all mandatory facts. | UNREACHABLE |
| H-03 | IPERCAuthorizedWithMaterialDeltaOpen | UNREACHABLE | Open material delta blocks the authorization predicate. | UNREACHABLE |
| H-04 | SignatureApplicableToWrongVersion | REACHABLE | SignatureApplicability evaluated against current version; SIGNATURE_NOT_VALID_FOR_CURRENT_VERSION. | UNREACHABLE |
| H-05 | ToolReadyAfterMandatoryInspectionExpiry | REACHABLE | Readiness derived at EvaluationTimestamp; TOOL_READINESS_LAPSED. | UNREACHABLE |
S. Traceability repair
TraceabilityBreaks after = 0
TB-01REPAIRED
Break
Register bulk acknowledge — designed behaviour with no governing contract.
Forward chain
REQ-PS-14 acknowledge pre-start record → FC-FPSO-03 → clause Acknowledgement → transition PENDING_ACK → ACKNOWLEDGED → UIAction per-record acknowledge (S07 row) → event PRESTART_ACKNOWLEDGED → evidence AcknowledgementRecord
Reverse chain
Bulk affordance removed; no designed behaviour remains without a governing contract.
TB-02REPAIRED
Break
Re-open closed record — designed behaviour with no governing transition.
Forward chain
REQ-PS-21 correct a closed pre-start record → FC-FPSO-03 → clause Supersession → transition CLOSED → SUPERSEDED (+ successor CREATED) → UIAction 'Create superseding record' (S14) → event PRESTART_RECORD_SUPERSEDED → evidence SupersessionRecord
Reverse chain
Supersession affordance maps to exactly one clause and one transition.
T. State and reason-code normalization
NoNewDecorativeStates
Admitted states
| State | Kind | Justification |
|---|---|---|
| SIGNATURE_NOT_VALID_FOR_CURRENT_VERSION | EVALUATED_RESULT (not stored) | Distinct behaviour: blocks authorization while preserving historical evidence. |
| TOOL_READINESS_LAPSED | DERIVED_STATE | Distinct behaviour per lifecycle phase; cannot be an attribute because it drives transitions. |
Rejected as decorative
| Candidate | Reason for rejection |
|---|---|
| SIGNATURE_SUPERSEDED (stored) | Decorative — duplicates an evaluated result and creates a second source of truth. |
| DOCUMENT_STALE | Carried as TemporalValidityState attribute; no distinct transition. |
| IPERC_REVISION_FLAGGED | Reason code RC-DEP-NON-MATERIAL suffices; no behavioural difference. |
Reason codes
| Code | Cause | Required action | Owner | Evidence requirement |
|---|---|---|---|---|
| RC-SIG-TS-UNAVAILABLE | Timestamp authority unreachable | Retry or escalate | Signer / IAM owner | Attempt record |
| RC-SIG-CRED-UNAVAILABLE | Signer credential unavailable | Restore credential | Signer | Refusal event |
| RC-SIG-SVC-UNAVAILABLE | Signature service unavailable | Wait or governed offline path | Work control | Service failure event |
| RC-SIG-RIGHT-EXPIRED | Decision right expired before commit | Route to entitled authority | Authority function | Refusal event |
| RC-SIG-VERSION-STALE | Object changed before commit | Re-read and re-sign | Signer | Refusal event with both versions |
| RC-SIG-NOT-APPLICABLE-CURRENT-VERSION | Signature bound to a superseded version | New signature required | Signer | Applicability evaluation |
| RC-DEP-NONE | No derived dependency on the changed requirement | None | — | Dependency map |
| RC-DEP-NON-MATERIAL | Dependency exists, non-material change | Update reference | Classifier | Classification record |
| RC-DEP-MATERIAL | Material change to a derived requirement | Scoped reassessment | Supervisor / ES&H | Classification record |
| RC-DEP-UNRESOLVED | Dependency map unreconstructable | Broaden and hold | Document control | Unresolved record |
| RC-TOOL-INSP-EXPIRED | Mandatory inspection expired | Replace or re-inspect | Equipment custodian | Inspection record |
| RC-TOOL-INSP-EXPIRED-POST-AUTH | Expiry after authorization | Re-authorize | Approver | Re-evaluation record |
| RC-TOOL-INSP-EXPIRED-ACTIVE | Expiry during active work | Supervisor reassessment | Supervisor | Reassessment decision |
| RC-TOOL-CONSEQ-UNRESOLVED | Consequence authority unresolved (DEP-11) | Hold and escalate | Equipment authority | Escalation record |
| RC-IPERC-ROW-CONFLICT | Concurrent row edit | Human reconciliation | Supervisor | Conflict event |
| RC-IPERC-RECORD-CONFLICT | Record base-version mismatch | Re-read record | Editor | Conflict event |
| RC-TEMP-UNKNOWN | Validity metadata unavailable | Verify source | Named fact owner | Verification record |
U. Event model delta
Event ≠ State
| Event | Introduced | Semantics |
|---|---|---|
| TEMPORAL_VALIDITY_EXPIRED | YES | Emitted when a mandatory fact crosses ValidUntil while a dependent decision or active work exists. Event ≠ state: the state remains derived. |
| PRESTART_RECORD_SUPERSEDED | YES | Existing transition, newly bound to the corrected affordance. |
| IPERC_EDIT_CONFLICT_DETECTED | YES | Concurrency conflict surfaced for human reconciliation. |
| SIGNATURE_APPLICABILITY_LOST | NO | Not introduced — applicability is evaluated on read; an event would imply stored state. |
V / W. Determinism and pure core / effectful shell
SameFacts + SameRuleVersions + SameConfiguration + SameTemporalEvaluationTime + SameDecisionRights ⇒ SameMaterialDecision.
EvaluationTimestamp is a governed input supplied by the execution context and recorded in DecisionEvidence. No domain code calls now().
Pure core
validityapplicabilitymaterialitystate transitionsauthorization predicates
Effectful shell
clock acquisitionsource system readssignature/timestamp service callsevent emission
REM-R10, REM-R11 confirm no hidden wall-clock dependency and deterministic time-triggered re-evaluation.
X. Authority / security regression
AuthorityLeakage = 0
| Check | Result | Detail |
|---|---|---|
| AuthorityLeakage | 0 | No corrected clause grants a right that was not already appointed. |
| PrivilegeEscalation | 0 | Supersession requires the same decision right as closure. |
| SignatureCreatesAuthority | FALSE | Signature attests; the right must pre-exist and be valid at commit. |
| TimestampCreatesAuthority | FALSE | A timestamp cannot substitute for a right or a credential. |
| SourceCreatesDecisionRight | FALSE | Source systems supply facts; rights come from the appointment register (DEP-13). |
Y. AI containment regression
| Capability | AI | Detail |
|---|---|---|
| Temporal validity determination | PROHIBITED | Computed by the pure core from governed metadata. |
| Final applicability | PROHIBITED | Rule-evaluated; AI may surface candidates only. |
| DecisionRight determination | PROHIBITED | Appointment register only. |
| Signature validity | PROHIBITED | Cryptographic + rule evaluation only. |
| Authorization | PROHIBITED | Human decision on rule-evaluated inputs. |
| Explanation / condition surfacing | PERMITTED | Read-only narration of detected conditions; never an input to a predicate. |
Z. IAD Rev.2 candidate delta
PH6A-FPSO-IAD-REV2-CANDIDATE_DELTA · CANDIDATE_DELTA_NOT_ACCEPTED
Delta register only. The 18-step field journey is unchanged in sequence; only three steps gain a revalidation or conflict surface. Screens affected 9 · unchanged 7.
| Screen | Current behaviour | Required behaviour | Affected contract | Change class | Traceability repair |
|---|---|---|---|---|---|
| S04 Document context | Most recent effective revision shown as the revision. | Show candidate set with REVISION_ELECTION_UNRESOLVED and the election owner; no default selection. | FC-FPSO-02 | FUNCTIONAL CONTRACT CORRECTION | AMB-01 |
| S06 IPERC continuo | Delta marked material/non-material by free choice. | Capture the four classification inputs before the class can be recorded. | FC-FPSO-05 | FUNCTIONAL CONTRACT CORRECTION | AMB-02 |
| S06 IPERC continuo | Concurrent edit silently saved. | Conflict surface with both row versions and explicit reconciliation. | FC-FPSO-05 | FUNCTIONAL CONTRACT CORRECTION | AMB-03 |
| S07 Pre-start register | Bulk acknowledge affordance. | Removed; per-record acknowledge only. | FC-FPSO-03 | UX CORRECTION | TB-01 |
| S09 Tool readiness | Readiness shown as declared at package creation. | Readiness derived at view time with EvaluationTimestamp; lapsed rows visibly lapsed. | FC-FPSO-07 | FUNCTIONAL CONTRACT CORRECTION | F-SADR-10 |
| S12 Authorization | Prior evaluation reused when reopening the screen. | Re-evaluate all mandatory facts on DEMAND before presenting the authorize action; show EvaluationTimestamp. | Cross-contract XR-TEMP-01 | FUNCTIONAL CONTRACT CORRECTION | SYS-01 |
| S13 Signature | SIGNED shown as terminal status. | Show SignatureEvidence (historical) and SignatureApplicability (evaluated) as two distinct facts. | FC-FPSO-08 | FUNCTIONAL CONTRACT CORRECTION | F-SADR-01 |
| S13 Signature | Failure paths unspecified. | Distinct presentation for each of the five governed failure conditions with reason code and required human action. | FC-FPSO-08 | FUNCTIONAL CONTRACT CORRECTION | F-SADR-01 |
| S14 Closed record | Re-open affordance. | Replaced by 'Create superseding record' bound to the supersession transition. | FC-FPSO-03 | TRACEABILITY CORRECTION | TB-02 |
| S16 Assurance view | No temporal provenance. | Show EvaluationTimestamp, rule versions and per-fact TemporalValidityState for the decision of record. | Cross-contract XR-TEMP-01 | TRACEABILITY CORRECTION | SYS-01 |
AA. REM-R01…R20 results
20/20 PASS · remediation design evidence only
| ID | Statement | Method | Result |
|---|---|---|---|
| REM-R01 | Post-signature invalidation preserves historical signature | Invalidate object after signing; assert SignatureEvidence row byte-identical. | PASS |
| REM-R02 | Prior signature cannot authorize new object version | Version N+1 with signature bound to N; applicability evaluation. | PASS |
| REM-R03 | Timestamp unavailable cannot produce a valid committed signature | Timestamp authority absent; assert SIGNATURE_PENDING_TIMESTAMP and no SIGNED transition. | PASS |
| REM-R04 | Document revision change triggers dependency materiality evaluation | Publish revision; assert evaluation invoked with one of four outcomes. | PASS |
| REM-R05 | Non-material revision does not globally invalidate IPERC | Editorial revision; assert untraced rows retain validated state. | PASS |
| REM-R06 | Material revision triggers dependency-scoped reassessment | Control-removing revision; assert only traced rows reassessed. | PASS |
| REM-R07 | Orphan UI actions = 0 | Reconstruct affordance→contract matrix over the candidate design. | PASS |
| REM-R08 | Tool inspection expiry re-evaluates readiness | Advance EvaluationTimestamp past ValidUntil in each lifecycle phase. | PASS |
| REM-R09 | Expired mandatory fact cannot support a material decision | Each TEMPORAL_VALIDITY_REQUIRED fact expired in turn against the authorization predicate. | PASS |
| REM-R10 | Time-triggered re-evaluation is deterministic | Same facts, same rule versions, two runs at the same EvaluationTimestamp. | PASS |
| REM-R11 | No hidden wall-clock domain dependency | Inspect pure-core clauses for ambient time; timestamp injected only. | PASS |
| REM-R12 | Concurrency path detects conflicting version | Two writes to one row with the same BaseVersion. | PASS |
| REM-R13 | No last-write-wins | Assert rejected write returns current row; no overwrite. | PASS |
| REM-R14 | All three implementation ambiguities resolved | Two-interpretation divergence test per ambiguity. | PASS |
| REM-R15 | Traceability breaks = 0 | Forward and reverse chain reconstruction over the candidate design. | PASS |
| REM-R16 | Illegal material states unreachable | H-01…H-05 reachability search over corrected transitions. | PASS |
| REM-R17 | External dependencies reconciled | Independent enumeration vs prior claim; 14 distinct decisions confirmed. | PASS |
| REM-R18 | Unresolved dependency fails safely | Each open dependency tested against the five prohibited effects. | PASS |
| REM-R19 | Architecture and seal unchanged | Compare PH6A-IADA-REV1 and SEAL-01 attributes before/after. | PASS |
| REM-R20 | AI containment preserved | Assert no AI output reaches a predicate input in any corrected clause. | PASS |
AB. Candidate baseline change register
PH6A-FPSO-FUNCTIONAL-BASELINE-REV1-CANDIDATE · CANDIDATE_FOR_INDEPENDENT_RETEST
| ID | Target | Clause | Change | Change class | Source finding |
|---|---|---|---|---|---|
| CR-01 | FC-FPSO-08 | Signature lifecycle | SignatureEvidence / SignatureApplicability split; SIGNED no longer unconditionally terminal. | FUNCTIONAL CONTRACT CORRECTION | F-SADR-01 |
| CR-02 | FC-FPSO-08 | Failure behaviour | Five governed failure conditions with states, reason codes, retry and idempotency key. | FUNCTIONAL CONTRACT CORRECTION | F-SADR-01 |
| CR-03 | FC-FPSO-02 | Revision election | REVISION_ELECTION_UNRESOLVED; no auto-election. | FUNCTIONAL CONTRACT CORRECTION | F-SADR-02 / AMB-01 |
| CR-04 | FC-FPSO-02 ↔ FC-FPSO-05 | Dependency evaluation | DEPENDENCY_MATERIALITY_EVALUATION with four deterministic outcomes. | FUNCTIONAL CONTRACT CORRECTION | F-SADR-02 |
| CR-05 | FC-FPSO-05 | Delta materiality | Recorded classification with four declared inputs. | FUNCTIONAL CONTRACT CORRECTION | AMB-02 |
| CR-06 | FC-FPSO-05 | Concurrency | Row-level compare-and-set with record base-version guard. | FUNCTIONAL CONTRACT CORRECTION | AMB-03 |
| CR-07 | FC-FPSO-07 | Readiness derivation | Derived at EvaluationTimestamp; TOOL_READINESS_LAPSED; per-phase consequence. | FUNCTIONAL CONTRACT CORRECTION | F-SADR-10 |
| CR-08 | Cross-contract | XR-TEMP-01 | No material decision may rely on a temporally expired fact; temporal attribute set mandated. | FUNCTIONAL CONTRACT CORRECTION | SYS-01 |
| CR-09 | Cross-contract | Evaluation time | EvaluationTimestamp as a governed input recorded in DecisionEvidence. | RULE CONFIGURATION CLARIFICATION | SYS-01 |
| CR-10 | FC-FPSO-03 | Supersession | Existing transition bound to the corrected affordance; re-open removed. | TRACEABILITY CORRECTION | F-SADR-03 / TB-02 |
| CR-11 | Interaction layer | S07 register | Bulk acknowledge removed. | UX CORRECTION | F-SADR-03 / TB-01 |
| CR-12 | Dependency register | External dependencies | Reconciled to 14 distinct decisions with safe interim behaviour each. | EXTERNAL DEPENDENCY RECLASSIFICATION | F-SADR-04 |
Only an independent retest may freeze this candidate. No PASS is claimed for the baseline itself.
AC. Residual risk
| ID | Risk | Level | Control |
|---|---|---|---|
| RR-01 | Fourteen external dependencies remain open; every corrected clause depends on at least one governed decision not yet made. | HIGH | Deterministic safe-failure behaviour per dependency; none can convert UNKNOWN to PASS. |
| RR-02 | Interim HOLD behaviour for critical tool expiry during active work may be operationally over-restrictive. | MEDIUM | Explicit EXTERNAL_VALIDATION_DEPENDENCY flag with the equipment authority named (DEP-11). |
| RR-03 | Materiality classification remains a human judgement; recorded inputs make it testable, not objective. | MEDIUM | Classifier identity, inputs and rule version recorded on every classification. |
| RR-04 | Temporal correctness depends on a trusted evaluation clock that has no nominated owner (DEP-14). | MEDIUM | Timestamp recorded on every decision; drift beyond tolerance degrades to UNKNOWN → HOLD. |
| RR-05 | Remediation is design evidence only; no operational behaviour has been observed. | ACCEPTED | Phase 6A remains HOLD; pilot exposure prohibited. |
AD. Independent retest readiness decision
| Exit criterion | Required | Actual | Met |
|---|---|---|---|
| CriticalRemediationGaps | 0 | 0 | MET |
| HighUncontrolledRemediationGaps | 0 | 0 | MET |
| OpenMaterialSemanticAmbiguity | 0 | 0 | MET |
| ImplementationMaterialAmbiguity | 0 | 0 | MET |
| TraceabilityBreaks | 0 | 0 | MET |
| ReachableIllegalMaterialStates | 0 | 0 | MET |
| ConcurrencyUncontrolledPaths | 0 | 0 | MET |
| AuthorityLeakage | 0 | 0 | MET |
| ArchitectureChange | 0 | 0 | MET |
| REM-R01…R20 | 20/20 PASS | 20/20 PASS | MET |
SADR_MATERIAL_FINDING_REMEDIATION
COMPLETE_PENDING_INDEPENDENT_RETEST
RemediationID
PH6A-SADR-REM-REV0
CandidateFunctionalBaseline
PH6A-FPSO-FUNCTIONAL-BASELINE-REV1-CANDIDATE
CandidateIADDelta
PH6A-FPSO-IAD-REV2-CANDIDATE_DELTA
CriticalRemediationGaps
0
HighUncontrolledRemediationGaps
0
OpenMaterialSemanticAmbiguity
0
ImplementationMaterialAmbiguity
0
ReachableIllegalMaterialStates
0
TraceabilityBreaks
0
ConcurrencyUncontrolledPaths
0
ExternalDependencyCount
14
REMRegression
20/20
ArchitectureChange
0
ParentSealChanged
FALSE
IndependentRetestReady
TRUE