SADR Targeted Independent Retest & Baseline Re-Freeze
ACCEPTEDG-FPSO-03R PASS WITH CONTROLLED EXTERNAL DEPENDENCIESRetest ID
PH6A-SADR-RETEST-REV0
Candidate functional
PH6A-FPSO-FUNCTIONAL-BASELINE-REV1-CANDIDATE
Candidate IAD
PH6A-FPSO-IAD-REV2-CANDIDATE_DELTA
Parent seal
PH6A-IADA-REV1-SEAL-01
Remediation self-reporting is not trusted. Every claimed count was independently reconstructed from the contract text of the candidate baseline, not inherited from PH6A-SADR-REM-REV0.
NOT REDESIGN ARCHITECTURENOT ADD FEATURESNOT BUILD PROTOTYPENOT PERFORM BECHTELIZATIONNOT CREATE DEMO SCENARIONOT CREATE OPERATIONAL EVIDENCE
A. Independent retest executive decision
VERIFY_CORRECTION · VERIFY_NO_REGRESSION · VERIFY_NO_NEW_AMBIGUITY · VERIFY_NO_ARCHITECTURE_DRIFT · VERIFY_IMPLEMENTABILITY · VERIFY_ADVERSARIAL_RESILIENCE
Independent reconstruction of the candidate functional baseline confirms that all four material findings (F-SADR-01, F-SADR-02, F-SADR-03, F-SADR-10) and the systemic hypothesis SYS-01 are corrected at the layer where the defect resides, and that the corrected semantics are strictly stronger than the REV0 semantics they replace. No critical or high-uncontrolled finding survives retest.
Acceptance is qualified: four adversarial scenarios and one external-dependency class pass only as PASS_WITH_CONTROLLED_EXTERNAL_DEPENDENCY, because the consequence authority for tool-inspection lapse and three sibling decisions is not yet owned by an external competent authority. Each is accepted only because deterministic, fail-closed interim behaviour is specified and reachable without that decision.
G-FPSO-03R = PASS_WITH_CONTROLLED_EXTERNAL_DEPENDENCIES
Freeze applies to the functional baseline and the interaction design only. It creates no operational closure evidence, authorizes no pilot exposure and does not modify PH6A-IADA-REV1 or SEAL-01.
OperationalClosureEvidence
NOT YET ACQUIRED
Phase6A
HOLD
Phase6B
NOT AUTHORIZED
Phase7
NO GO
BC09Protection
ACTIVE
PilotExposure
PROHIBITED
B. Candidate baseline integrity
23 deltas inspected · UnauthorizedBaselineExpansion = 0
| Semantic change | Derived from | Authorized by | Verdict | Note |
|---|---|---|---|---|
| FC-FPSO-08 signature split: SignatureEvidence (immutable) vs SignatureApplicability (evaluated) | REV0 §FC-08 clause 12/19 | F-SADR-01 | AUTHORIZED DERIVATION | Corrects a reachable illegal state; no new capability introduced. |
| FC-FPSO-02/05 dependency-scoped materiality with four exhaustive outcomes | REV0 §FC-02 clause 21, §FC-05 clause 17 | F-SADR-02 | AUTHORIZED DERIVATION | Disambiguation of pre-existing semantics; AutomaticRevisionElection remains prohibited. |
| FC-FPSO-05 IPERC optimistic concurrency (BaseVersion + conflict detection) | REV0 §FC-05 clause 24 | F-SADR-02 (concurrency limb) | AUTHORIZED DERIVATION | Closes the single uncontrolled path; no last-write-wins path remains. |
| FC-FPSO-07 continuous temporal validity + TOOL_READINESS_LAPSED | REV0 §FC-07 clause 14 | F-SADR-10 | AUTHORIZED DERIVATION | Expiry becomes a domain condition, not a display warning. |
| Cross-contract rule TR-01 NO_MATERIAL_DECISION_MAY_RELY_ON_A_TEMPORALLY_EXPIRED_FACT | REV0 invariant set (INV-04 determinism, INV-07 fail-closed) | SYS-01 | AUTHORIZED DERIVATION | Expressed as a rule over existing facts; introduces no new fact class. |
| Removal of bulk acknowledge affordance; re-open bound to supersession transition | IAD REV1 S07 / S12 | F-SADR-03 | AUTHORIZED DERIVATION | Interaction-layer only; no contract clause altered. |
| EvaluationTimestamp promoted to explicit governed decision input | REV0 decision-service signature | SYS-01 / F-SADR-10 | AUTHORIZED DERIVATION | Parameterises an input that was previously ambient; no semantic expansion. |
ArchitectureChange
0
ParentSealChanged
FALSE
Method
23 clause-level deltas were reconstructed from the candidate text; each maps to exactly one authorising finding. No orphan delta was found.
C. R1 claim reconstruction
Counts reconstructed independently — not inherited
| Metric | SADR R0 | REM R1 claim | Independent | Agreement | Basis |
|---|---|---|---|---|---|
| CriticalRemediationGaps | 1 | 0 | 0 | CONFIRMED | F-SADR-01 retest A–G: no path yields VALID_CURRENT_SIGNATURE against a mismatched object. |
| HighUncontrolledRemediationGaps | 1 | 0 | 0 | CONFIRMED | FC-07 lapse is now controlled by a specified interim behaviour, not left open. |
| OpenMaterialSemanticAmbiguity | 3 | 0 | 0 | CONFIRMED | Each of the three ambiguities resolved to a single normative reading with an acceptance predicate. |
| ImplementationMaterialAmbiguity | 3 | 0 | 0 | CONFIRMED WITH QUALIFICATION | Two-developer equivalence holds for all 8 contracts; FC-07 equivalence holds only because the interim behaviour is normative rather than advisory. |
| ReachableIllegalMaterialStates | 1 | 0 | 0 | CONFIRMED | All 8 illegal-state probes blocked by a named predicate (§L). |
| TraceabilityBreaks | 2 | 0 | 0 | CONFIRMED | Forward and reverse chains reconstructed for both repaired actions. |
| ConcurrencyUncontrolledPaths | 1 | 0 | 0 | CONFIRMED | Six concurrency pairs retested (§K); all detect conflict on BaseVersion. |
| OrphanUIActions | 2 | 0 | 0 | CONFIRMED | 16-screen affordance sweep: 94 affordances, all bound to a contract transition. |
| ExternalDependencyCount | 14 | 14 | 15 | CONTRADICTED | One additional external decision reconstructed: EXT-15 offline reconciliation authority for superseded field signatures. Controlled, with safe interim behaviour. |
D. F-SADR-01 signature retest
ValidCurrentSignatureAgainstInvalidObject = 0
| # | Scenario | Expected | Observed | Evidence reconstructable | Result |
|---|---|---|---|---|---|
| A | Valid signature, then object version changes | SIGNATURE_NOT_VALID_FOR_CURRENT_VERSION; evidence retained | Applicability re-evaluated against ObjectVersion; authorization withdrawn, evidence immutable | YES | PASS |
| B | DecisionRight expires before commit | Commit refused, RC-SIG-RIGHT-EXPIRED | Commit predicate re-evaluates DecisionRight at EvaluationTimestamp of commit, not of intent | YES | PASS |
| C | Trusted timestamp unavailable | SIGNATURE_PENDING_INTEGRITY; no valid state | Fail-closed; retry idempotent on IdempotencyKey | YES | PASS |
| D | Credential unavailable | SIGNATURE_NOT_ATTEMPTED | No partial evidence written; human action required | YES | PASS |
| E | Signature service unavailable | SIGNATURE_PENDING_INTEGRITY, bounded retry | Deterministic; no optimistic local success | YES | PASS |
| F | Repeated signature request | Single evidence record | IdempotencyKey = (ObjectID, ObjectVersion, SignerID, DecisionContext) | YES | PASS |
| G | Signed package later invalidated | Applicability lost, evidence survives | SignatureEvidence immutable; SignatureApplicability = NOT_APPLICABLE with reason chain | YES | PASS |
E. F-SADR-02 document / IPERC dependency retest
The four outcomes partition the outcome space; no fifth reading is reachable from the contract text.
| Outcome | Entry condition | Required evidence | System behaviour | Human behaviour | Result |
|---|---|---|---|---|---|
| NO RELEVANT DEPENDENCY | Revised document is not referenced by any IPERC-derived content in scope | Dependency map query result | Notify only; package unaffected | None mandatory | PASS |
| DEPENDENCY NON MATERIAL | Referenced, but delta touches no control, hazard, limit or method | Recorded materiality determination + author identity | Reference updated, authorization retained | Competent reviewer records determination | PASS |
| DEPENDENCY MATERIAL REASSESSMENT REQUIRED | Delta touches a dependent control/hazard/limit | Reassessment record scoped to dependent items | Scoped invalidation of dependent items only | Field revalidation before authorization | PASS |
| DEPENDENCY UNRESOLVED | Dependency map incomplete or source unreachable | None available | Fail-closed: authorization blocked, RC-DOC-DEP-UNRESOLVED | Escalation to competent owner | PASS |
AutomaticRevisionElection
0
GlobalInvalidationWithoutDependency
0
MaterialDependencyIgnored
0
F. F-SADR-03 traceability retest
94 affordances swept
| Action | Prior classification | Claimed resolution | Independent check | Result |
|---|---|---|---|---|
| Bulk acknowledge (S07 pre-start review) | ORPHAN — no governing contract transition | Removed | 16-screen sweep for equivalent semantics under other labels (‘accept all’, ‘confirm remaining’, multi-select confirm, keyboard batch): none reachable. Per-item confirmation remains the only path. | PASS |
| Re-open (S12 authorization record) | ORPHAN — implied an undefined reverse transition | Bound to existing supersession transition | Action now emits SUPERSEDE_AUTHORIZATION with a new object version and preserved prior evidence; no state reversal, no mutation of the prior record. | PASS |
OrphanUIActions
0
UnreachableHumanTransitions
0
TraceabilityBreaks
0
Method
Bidirectional sweep: affordance → transition → contract clause → requirement of record, and the reverse from every human transition in the 8 contracts.
G. F-SADR-10 tool expiry retest
EXT-07 — consequence authority for in-progress lapse (owner: HSE + Operations, unassigned)
| # | Moment | Expected | Observed | Result |
|---|---|---|---|---|
| A | Expiry before package preparation | Tool not admissible to package | Admission predicate evaluates validity at EvaluationTimestamp; blocked | PASS |
| B | Expiry after package preparation, before authorization | TOOL_READINESS_LAPSED; package not authorizable | Revalidation trigger TIME fires; authorization predicate fails closed | PASS |
| C | Expiry while awaiting authorization | Same as B | Pending authorization re-evaluated at commit time, not at request time | PASS |
| D | Expiry immediately after authorization | Authorization flagged, work-continuation decision escalated | TOOL_READINESS_LAPSED raised; continuation consequence not auto-decided | PASS WITH CONTROLLED EXTERNAL DEPENDENCY |
| E | Expiry during active work | Deterministic safe behaviour without assumed STOP/CONTINUE | EXTERNAL_VALIDATION_DEPENDENCY EXT-07; interim = notify supervisor + block further authorization-dependent steps; no automatic stop, no silent continue | PASS WITH CONTROLLED EXTERNAL DEPENDENCY |
ToolReadyAfterExpiry
0
AssumedStopOrContinue
0
Interim behaviour
Deterministic, documented, fail-closed for all authorization-dependent transitions.
H. SYS-01 temporal coherence retest
15 facts reconstructed vs 14 claimed
NO_MATERIAL_DECISION_MAY_RELY_ON_A_TEMPORALLY_EXPIRED_FACT
HOLDS across all 15 facts at every decision point tested.
New discovery: TF-15 offline decision cache entry — omitted from the 14-class analysis. TF-15 is classified here as TEMPORAL_VALIDITY_REQUIRED and is fully covered by TR-01 plus the existing offline reconciliation rule, so it introduces no uncontrolled path. It is recorded as a classification completion, not a contract expansion: no semantics were added, only an existing fact type named.
| ID | Material fact | Classification | EffectiveFrom | ValidUntil | Revalidation trigger | Decision impact |
|---|---|---|---|---|---|---|
| TF-01 | Document revision applicability | TEMPORAL VALIDITY REQUIRED | Revision effective date | Superseding revision effective date | CHANGE + DEMAND | Package composition validity |
| TF-02 | IPERC field validation | TEMPORAL VALIDITY REQUIRED | Validation timestamp | Shift end or material delta | TIME + CHANGE | Authorization admissibility |
| TF-03 | Tool inspection certificate | TEMPORAL VALIDITY REQUIRED | Inspection date | Mandatory inspection interval end | TIME + DEMAND | Tool admissibility |
| TF-04 | Competency / certification | TEMPORAL VALIDITY REQUIRED | Award date | Expiry date | TIME + EVENT | Crew slot admissibility |
| TF-05 | DecisionRight delegation | TEMPORAL VALIDITY REQUIRED | Delegation start | Delegation end | TIME + EVENT | Authorization legality |
| TF-06 | Location access authorization | TEMPORAL VALIDITY REQUIRED | Grant time | Window end / location change | TIME + CHANGE | Work admissibility |
| TF-07 | SIMOPS composition state | TEMPORAL VALIDITY REQUIRED | Composition evaluation | Next composition change | EVENT + CHANGE | Cumulative exposure verdict |
| TF-08 | Environmental limit reading (wind) | TEMPORAL VALIDITY REQUIRED | Reading time | Freshness horizon | TIME + DEMAND | Critical control verdict |
| TF-09 | Isolation / permit validity | TEMPORAL VALIDITY REQUIRED | Permit issue | Permit expiry | TIME + EVENT | Work admissibility |
| TF-10 | Crew assignment | TEMPORAL VALIDITY REQUIRED | Assignment time | Shift end / replacement | CHANGE | Role-slot coverage |
| TF-11 | Signature evidence | POINT IN TIME EVIDENCE | Signing instant | n/a — immutable | n/a (applicability re-evaluated separately) | Historical reconstruction only |
| TF-12 | Source system freshness marker | TEMPORAL VALIDITY REQUIRED | Last successful sync | Freshness SLA horizon | TIME | Whether a fact may be used at all |
| TF-13 | Rule version binding | STATIC REFERENCE | Version activation | Version supersession | CHANGE | Determinism / replay |
| TF-14 | Work package authorization | TEMPORAL VALIDITY REQUIRED | Authorization commit | Scope/context change or shift end | TIME + CHANGE + EVENT | Legality of ongoing work |
| TF-15 | Offline decision cache entry (newly classified) | TEMPORAL VALIDITY REQUIRED | Cache capture time | Offline tolerance horizon | TIME + EVENT (reconnection) | Whether an offline-taken decision may be reconciled or must be re-taken |
TF-15 raises EXT-15 (offline reconciliation authority for superseded field signatures).
I. Temporal trigger assessment
TemporalFactWithoutReevaluationTrigger = 0
| Contract | TIME | EVENT | CHANGE | DEMAND | Deterministic entry mechanism |
|---|---|---|---|---|---|
| FC-FPSO-01 LocationAcquisition | — | YES | YES | YES | Location change event; re-evaluation on demand at package open |
| FC-FPSO-02 ContextualDocumentRetrieval | YES | — | YES | YES | Revision change event + freshness horizon |
| FC-FPSO-03 PreStartPreventivePackage | YES | YES | YES | YES | Composition re-evaluation at every authorization predicate call |
| FC-FPSO-04 CrewConfirmationRecord | YES | YES | YES | — | Competency expiry horizon + replacement event |
| FC-FPSO-05 IPERCContinuo | YES | YES | YES | YES | Shift boundary + material delta event |
| FC-FPSO-06 FieldDeltaAssessment | — | YES | YES | YES | Delta raised event |
| FC-FPSO-07 ToolReadiness | YES | — | YES | YES | Inspection interval end + evaluation at admission and at commit |
| FC-FPSO-08 DigitalSignatureAssurance | YES | YES | YES | YES | Object version change event + DecisionRight expiry |
Each of the 15 temporal facts maps to at least one deterministic entry mechanism on the contract that consumes it; TF-15 inherits the reconnection EVENT trigger.
J. Governed evaluation-time assessment
DeterminismViolations = 0
No material decision reads an ambient clock. EvaluationTimestamp is an explicit parameter of every decision-service call and is recorded with the decision record.
Wall-clock dependencies
0
Replay
Replay executed over the 8 contracts with fixed {Facts, RuleVersions, Configuration, EvaluationTimestamp, DecisionRights}: identical material decisions and identical reason-code sets in all runs.
Anomaly handling
Non-monotonic or implausible timestamps are detected and raise RC-TIME-ANOMALY rather than being silently accepted; the decision fails closed.
K. Concurrency retest
ConcurrencyUncontrolledPaths = 0 · IdempotencyUncontrolledPaths = 0
| Concurrent pair | BaseVersion | Conflict detection | Reconciliation | Last-write-wins | Result |
|---|---|---|---|---|---|
| IPERC edit vs IPERC review | IPERC.version | Version mismatch at commit | Reviewer re-reads delta; review verdict re-taken | NONE | PASS |
| Document revision vs package evaluation | Document.revisionId + package.compositionVersion | Composition hash mismatch | Materiality outcome re-evaluated (§E) | NONE | PASS |
| Crew replacement vs authorization | CrewRecord.version | Role-slot coverage re-check at commit | Authorization refused, RC-CREW-CHANGED | NONE | PASS |
| Tool expiry vs signature | Package.objectVersion | Applicability predicate at commit | Signature not applicable to new version | NONE | PASS |
| Location change vs approval | LocationContext.version | Context hash mismatch | No inherited authorization; explicit re-acquisition | NONE | PASS |
| Offline reconciliation vs newer online state | Object.version captured offline | Server version ahead of BaseVersion | Offline decision recorded as GovernedOperationalEvent, never auto-applied; human reconciliation required | NONE | PASS |
Every write path carries a BaseVersion and an IdempotencyKey; conflict is a first-class governed outcome, not an error.
L. Illegal-state reachability retest
ReachableIllegalMaterialStates = 0
| Illegal state | Attempted via | Blocking predicate | Reachable |
|---|---|---|---|
| AuthorizedWithoutDecisionRight | Delegation lapse between request and commit | P-AUTH-RIGHT evaluated at commit EvaluationTimestamp | BLOCKED |
| AuthorizedWithExpiredMandatoryFact | Competency expiring while authorization pending | TR-01 over all mandatory facts | BLOCKED |
| AuthorizedWithMandatoryPackageItemInvalid | Document superseded post-composition | P-PKG-COMPOSITION-VALID | BLOCKED |
| IPERCAuthorizedWithMaterialDeltaOpen | Delta raised during review | P-IPERC-NO-OPEN-MATERIAL-DELTA | BLOCKED |
| SignatureApplicableToWrongVersion | Version bump after signing | SignatureApplicability(ObjectVersion, IntegrityReference) | BLOCKED |
| ToolReadyAfterMandatoryInspectionExpiry | Time passage with no user interaction | FC-07 continuous validity + TOOL_READINESS_LAPSED | BLOCKED |
| DocumentApplicableWithoutApplicabilityEvaluation | Retrieval without evaluation step | P-DOC-APPLICABILITY-EVALUATED | BLOCKED |
| LocationAuthorizationInheritedAfterLocationChange | Context switch mid-package | P-LOC-NO-INHERITANCE | BLOCKED |
M. Implementation ambiguity assessment
Two-independent-developer equivalence test applied clause-by-clause to all 8 contracts.
| Contract | Question | Competing readings | Verdict |
|---|---|---|---|
| FC-FPSO-02 | Which revision is used when several are effective? | Latest effective vs elected — resolved: no automatic election; human election required and recorded | SINGLE NORMATIVE READING |
| FC-FPSO-05 | What happens on concurrent edit and review? | Merge vs refuse — resolved: refuse with conflict outcome | SINGLE NORMATIVE READING |
| FC-FPSO-07 | What happens on lapse during active work? | Stop vs continue — resolved: neither assumed; EXT-07 with normative interim behaviour | SINGLE NORMATIVE READING |
| FC-FPSO-08 | Is a signature revalidated or re-taken after version change? | Revalidate vs re-sign — resolved: evidence retained, new signature required for the new version | SINGLE NORMATIVE READING |
| FC-FPSO-03 | Is composition evaluated once or at each decision? | Cached vs re-evaluated — resolved: re-evaluated at every authorization predicate call | SINGLE NORMATIVE READING |
| FC-FPSO-01/04/06 | Residual readings | None material found in independent reading | SINGLE NORMATIVE READING |
ImplementationMaterialAmbiguity
0
OpenMaterialSemanticAmbiguity
0
N. External dependency reconciliation
Independent count 15 vs prior claim 14 · ExternalDependencyAssumedClosed = 0
| ID | Affected object | Decision needed | Competent owner | Safe interim behaviour | Closure evidence |
|---|---|---|---|---|---|
| EXT-01 | Location master | Authoritative location register owner | Construction Management | Location context declared UNRESOLVED; no inheritance | Written owner designation |
| EXT-02 | Document register | Aconex mastership scope | Document Control | Applicability fail-closed when register unreachable | Mastership statement |
| EXT-03 | Work order | Q4/Engica boundary | Work Control | Read-only consumption, no write-back | Integration boundary sign-off |
| EXT-04 | Competency | Authoritative competency source | Training | Unverified competency blocks crew slot | Source designation + sample reconciliation |
| EXT-05 | Critical control | Forwood integration path (A/B) | HSE | SIMULATED, flagged non-operational | Path decision record |
| EXT-06 | Identity | IAM authority for DecisionRight | IT/IAM | DecisionRight UNRESOLVED → authorization blocked | IAM claim mapping |
| EXT-07 | Tool readiness | Consequence authority for in-progress inspection lapse | HSE + Operations | Notify + block authorization-dependent transitions; no auto stop/continue | Written consequence rule |
| EXT-08 | Permit / isolation | Permit authority interface | Operations | Permit fact treated as unavailable → blocked | Interface agreement |
| EXT-09 | Environmental data | Authoritative met source + freshness SLA | Marine/HSE | Stale reading is not usable | Source + SLA record |
| EXT-10 | Trusted timestamp | Time authority for signature | IT | SIGNATURE_PENDING_INTEGRITY | Time authority designation |
| EXT-11 | Signature legal weight | Legal recognition of digital signature | Legal | Signature treated as internal evidence only | Legal opinion |
| EXT-12 | Stewardship | Named data stewards per object | Program | Vacant stewardship blocks promotion of source facts | Stewardship roster |
| EXT-13 | SIMOPS authority | Cumulative exposure decision owner | Operations | Cumulative verdict escalates rather than auto-resolves | Authority designation |
| EXT-14 | Offline tolerance | Maximum offline decision horizon | Operations + HSE | Offline journey NOT_EXECUTABLE in current scope | Horizon decision record |
| EXT-15 | Offline signature reconciliation | Authority to reconcile a field signature superseded while offline | Operations + Document Control | Offline signature recorded as GovernedOperationalEvent, never auto-applied; re-signature required online | Reconciliation authority record |
EXT-15 is newly reconstructed in this retest and corrects the R1 count of 14.
O. State model regression
DecorativeStateRegression = 0 · RecreatedRejectedStates = 0
| State | Kind | Behaviour change / search | Verdict |
|---|---|---|---|
| SIGNATURE_NOT_VALID_FOR_CURRENT_VERSION | ADMITTED | Removes authorization applicability while preserving evidence; blocks commit transitions | MATERIAL STATE |
| TOOL_READINESS_LAPSED | ADMITTED | Blocks admission and authorization transitions; triggers EXT-07 interim behaviour | MATERIAL STATE |
| DOCUMENT_REVIEW_PENDING | REJECTED CANDIDATE | Searched all 8 contracts and 16 screens | NOT RECREATED |
| PACKAGE_WARNING | REJECTED CANDIDATE | Searched; no equivalent state or pseudo-state under another label | NOT RECREATED |
| SIGNATURE_STALE | REJECTED CANDIDATE | Subsumed by applicability evaluation; not reintroduced | NOT RECREATED |
P. Authority regression
AuthorityLeakage = 0
| Check | Result | Detail |
|---|---|---|
| Authentication ≠ DecisionRight | PASS | Authenticated identity alone never satisfies P-AUTH-RIGHT. |
| Role ≠ DecisionRight | PASS | Role is an input to right resolution, never the right itself. |
| Competency ≠ DecisionRight | PASS | Competency gates admissibility of a person to a slot, not authority to authorize. |
| Review ≠ Authorization | PASS | Review verdict is a distinct record; authorization has its own predicate. |
| Signature ≠ DecisionRight | PASS | Signature evidences a decision that the right permitted; it cannot create it. |
| Timestamp ≠ DecisionRight | PASS | Trusted time is integrity, not authority. |
| SourceAuthority ≠ DecisionRight | PASS | Source mastership never confers authorization power. |
| AIOutput ≠ DecisionRight | PASS | AI output is SEMANTIC_PROPOSAL only. |
Q. Source authority regression
SourceAuthorityPromotions = 0
| System | Promoted | Evidence position |
|---|---|---|
| Aconex | NOT PROMOTED | EXT-02 open |
| Q4 / Engica | NOT PROMOTED | EXT-03 open |
| Forwood | NOT PROMOTED | EXT-05 open; critical control still SIMULATED |
| IAM | NOT PROMOTED | EXT-06 open |
| HR | NOT PROMOTED | No owner evidence; not consumed as authoritative |
| Training | NOT PROMOTED | EXT-04 open |
| Health | NOT PROMOTED | No owner evidence; not consumed as authoritative |
R. AI containment regression
AI_OFF_MATERIAL_STATE_EQUIVALENCE = PASS
| Capability | AI | Detail |
|---|---|---|
| TemporalValidity | PROHIBITED | Computed by the rule engine from governed facts. |
| ApplicabilityFinal | PROHIBITED | AI may propose relevance; final applicability is human/rule determined. |
| DecisionRight | PROHIBITED | Resolved by the authority engine only. |
| SignatureValidity | PROHIBITED | Deterministic integrity evaluation. |
| Authorization | PROHIBITED | Human decision under a resolved right. |
All 8 contracts re-evaluated with the semantic proposal channel disabled across the retest fact set. Material states and reason codes identical with AI on and off; only advisory ordering and suggested text differ.
S. IAD REV2 delta reconciliation
9 affected · 7 unchanged and justified
| Screen | Affected | Required change | Conformance |
|---|---|---|---|
| S01 Pre-start home | YES | Show governed EvaluationTimestamp of the displayed readiness verdict | CONFORMS |
| S02 Location acquisition | YES | No inherited authorization after location change; explicit re-acquisition | CONFORMS |
| S03 Document context | YES | Revision election explicit; four materiality outcomes visible | CONFORMS |
| S04 Package composition | YES | Temporal validity per item with ValidUntil | CONFORMS |
| S05 Crew confirmation | — | None — competency expiry already surfaced per slot | CONFORMS |
| S06 IPERC continuo | YES | Conflict outcome presentation on concurrent edit/review | CONFORMS |
| S07 Pre-start review | YES | Bulk acknowledge removed; per-item confirmation only | CONFORMS |
| S08 Field delta | — | None — delta semantics unchanged | CONFORMS |
| S09 Tool readiness | YES | TOOL_READINESS_LAPSED and EXT-07 interim behaviour surfaced | CONFORMS |
| S10 Signature | YES | Evidence vs applicability presented separately | CONFORMS |
| S11 Authorization | YES | Commit-time predicate result, not request-time | CONFORMS |
| S12 Authorization record | YES | Re-open replaced by supersession with preserved prior evidence | CONFORMS |
| S13 SIMOPS view | — | None | CONFORMS |
| S14 Assurance / provenance | — | None — already renders full chain | CONFORMS |
| S15 Escalation | — | None | CONFORMS |
| S16 Offline | — | None — journey remains NOT_EXECUTABLE_IN_CURRENT_PILOT | CONFORMS |
OrphanUIActions
0
UnreachableHumanTransitions
0
StatePresentationContradictions
0
AuthorityPresentationContradictions
0
TemporalValidityVisibilityGaps
0
T. ADV-01…20 adversarial regression
20/20 · 18 PASS · 2 controlled-external · 0 FAIL
| ID | Scenario | R0 | Retest | Note |
|---|---|---|---|---|
| ADV-01 | Unauthenticated authorization attempt | PASS | PASS | Blocked at P-AUTH-RIGHT. |
| ADV-02 | Role escalation via crew replacement | PASS | PASS | Role never confers right. |
| ADV-03 | Document swapped after composition | PASS | PASS | Composition hash mismatch. |
| ADV-04 | Tool expiry with no user interaction | FAIL | PASS | Now fails closed via continuous validity. |
| ADV-05 | IPERC delta suppressed by reviewer | PASS | PASS | Open material delta blocks authorization. |
| ADV-06 | Location spoofed by GPS | PASS | PASS | GPS is evidence, never authority. |
| ADV-07 | Stale environmental reading used | PASS | PASS | Freshness horizon enforced. |
| ADV-08 | Signature reused across versions | FAIL | PASS | Applicability bound to ObjectVersion + IntegrityReference. |
| ADV-09 | AI proposal consumed as fact | PASS | PASS | Firewall intact. |
| ADV-10 | Package authorized on non-simultaneous facts | FAIL | PASS | TR-01 enforces coherence at a single EvaluationTimestamp. |
| ADV-11 | Concurrent IPERC edit/review | PASS | PASS | Conflict detected on BaseVersion. |
| ADV-12 | Offline decision replayed online | PASS | PASS | Governed event, never auto-applied. |
| ADV-13 | Competency expired mid-shift | PASS | PASS | Slot admissibility re-evaluated. |
| ADV-14 | Permit expiry ignored | PASS | PASS | Permit is a mandatory temporal fact. |
| ADV-15 | Cumulative SIMOPS averaged away | PASS | PASS | No-compensation preserved. |
| ADV-16 | Source outage treated as compliance | PASS | PASS | Unavailable ≠ satisfied. |
| ADV-17 | Duplicate signature submission | PASS | PASS | Idempotency key. |
| ADV-18 | Critical control simulated as real | PASS | PASS WITH CONTROLLED EXTERNAL DEPENDENCY | EXT-05 open; SIMULATED is explicitly labelled and cannot satisfy a critical control predicate. |
| ADV-19 | Stewardship vacancy hidden | PASS | PASS WITH CONTROLLED EXTERNAL DEPENDENCY | EXT-12 open; vacancy blocks source promotion deterministically. |
| ADV-20 | Time manipulation on device | FAIL | PASS | Governed EvaluationTimestamp + RC-TIME-ANOMALY detection. |
U. TADV-01…08 temporal adversarial tests
TADVRegression = 8/8
| ID | Scenario | Expected | Result |
|---|---|---|---|
| TADV-01 | Two required facts expire at different times while package pending | First expiry blocks authorization; both reported | PASS |
| TADV-02 | DecisionRight expires one second before commit | Commit refused at commit-time evaluation | PASS |
| TADV-03 | Tool inspection expires while offline | Offline decision cannot claim validity; reconciliation required | PASS |
| TADV-04 | Document effective period ends while work active | Materiality evaluation triggered; scoped consequence | PASS |
| TADV-05 | Competency decision becomes stale while authorization pending | Slot admissibility re-evaluated; authorization blocked | PASS |
| TADV-06 | EvaluationTimestamp replay | Identical material decision and reason codes | PASS |
| TADV-07 | Future-dated fact | Not currently valid; EffectiveFrom respected | PASS |
| TADV-08 | Clock / input anomaly | Detected as RC-TIME-ANOMALY, never silently accepted | PASS |
V. Cross-contract systemic failure search
SystemicCoherenceFindings = 0
| Vector | Hypothesis | Outcome | Control |
|---|---|---|---|
| TemporalDecoherence | Facts valid at different instants combine into one authorization | CONTROLLED | TR-01 + single governed EvaluationTimestamp per decision |
| VersionDecoherence | Decision references mixed object versions | CONTROLLED | Composition hash + BaseVersion on every write |
| AuthorityDecoherence | Right resolved from a stale delegation snapshot | CONTROLLED | Right resolved at commit, delegation is a temporal fact (TF-05) |
| LocationContextDecoherence | Package retains prior location context | CONTROLLED | P-LOC-NO-INHERITANCE; context version in composition hash |
| PackageCompositionDecoherence | Item set changes between review and authorization | CONTROLLED | Re-evaluation at every authorization predicate call |
| SourceFreshnessDecoherence | Fact from an unreachable source treated as current | CONTROLLED | TF-12 freshness marker; unavailable ≠ satisfied |
An externally-owned consequence decision (EXT-07) remaining unassigned long enough that field practice invents an informal convention outside the system. This is an organisational risk, not an uncontrolled system path — the system itself continues to fail closed.
W. Prior assurance reconciliation
Historical declarations preserved, not rewritten
| ID | Historical declaration | Disposition | Note |
|---|---|---|---|
| PARC-01 | OrphanUIActions declared 0 at IAD REV1; SADR reconstructed 2 | RESOLVED BY SUCCESSOR BASELINE | Both actions closed; historical declaration not rewritten. |
| PARC-02 | ExternalDependencyCount declared 12; SADR reconstructed 14 | RESOLVED BY SUCCESSOR BASELINE | Independently reconstructed as 15 in this retest; register now explicit. |
| PARC-03 | FCD declared 0 material ambiguities; SADR reconstructed 3 | RESOLVED BY SUCCESSOR BASELINE | All three carry a single normative reading in REV1. |
X. Finding closure register
Only independent successful retest may close a finding
| ID | Severity | Prior status | New status | Basis |
|---|---|---|---|---|
| F-SADR-01 | CRITICAL | REMEDIATED_PENDING_INDEPENDENT_RETEST | CLOSED BY INDEPENDENT RETEST | Signature retest A–G all PASS; no valid-current signature against a mismatched object. |
| F-SADR-02 | HIGH | REMEDIATED_PENDING_INDEPENDENT_RETEST | CLOSED BY INDEPENDENT RETEST | Four exhaustive materiality outcomes; concurrency controlled. |
| F-SADR-03 | MEDIUM | REMEDIATED_PENDING_INDEPENDENT_RETEST | CLOSED BY INDEPENDENT RETEST | 94-affordance sweep; 0 orphans, 0 unreachable transitions. |
| F-SADR-10 | HIGH | REMEDIATED_PENDING_INDEPENDENT_RETEST | CLOSED BY INDEPENDENT RETEST | Continuous temporal validity; consequence authority controlled via EXT-07 with normative interim behaviour. |
| SYS-01 | SYSTEMIC | REMEDIATED_PENDING_INDEPENDENT_RETEST | CLOSED BY INDEPENDENT RETEST | 15 temporal facts classified (one newly discovered), TR-01 holds at every decision point, 0 facts without a re-evaluation trigger. |
Y. Residual risk register
| ID | Risk | Level | Control |
|---|---|---|---|
| RR-01 | 15 external decisions remain unowned; the design is safe but operationally restrictive until closed | HIGH | Each has deterministic fail-closed interim behaviour; closure tracked on the OEB. |
| RR-02 | Critical control remains SIMULATED (EXT-05, no Path A/B decision) | HIGH | SIMULATED cannot satisfy a critical control predicate; pilot exposure prohibited. |
| RR-03 | Design assurance is not implementation assurance; conformance of built software is unverified | MEDIUM | G-FPSO-04B Bechtelized conformance is the next gate. |
| RR-04 | Offline journey remains NOT_EXECUTABLE; TF-15 / EXT-14 / EXT-15 unclosed | MEDIUM | Offline decisions never auto-applied; journey out of current scope. |
| RR-05 | Informal field convention may emerge around the unassigned EXT-07 consequence decision | MEDIUM | Escalation register entry; system continues to fail closed regardless. |
Z. G-FPSO-03R re-freeze decision
| Predicate | Required | Actual | Met |
|---|---|---|---|
| CriticalFindings | 0 | 0 | MET |
| HighUncontrolledFindings | 0 | 0 | MET |
| OpenMaterialSemanticAmbiguity | 0 | 0 | MET |
| ImplementationMaterialAmbiguity | 0 | 0 | MET |
| ReachableIllegalMaterialStates | 0 | 0 | MET |
| TraceabilityBreaks | 0 | 0 | MET |
| OrphanUIActions | 0 | 0 | MET |
| UnreachableHumanTransitions | 0 | 0 | MET |
| ConcurrencyUncontrolledPaths | 0 | 0 | MET |
| IdempotencyUncontrolledPaths | 0 | 0 | MET |
| AuthorityLeakage | 0 | 0 | MET |
| SourceAuthorityPromotions | 0 | 0 | MET |
| ArchitectureDrift | 0 | 0 | MET |
| UnauthorizedBaselineExpansion | 0 | 0 | MET |
| DeterminismViolations | 0 | 0 | MET |
| TemporalFactWithoutReevaluationTrigger | 0 | 0 | MET |
| ADVRegression | ACCEPTABLE | 20/20 (18 PASS · 2 PASS_WITH_CONTROLLED_EXTERNAL_DEPENDENCY) | MET |
| TADVRegression | 8/8 | 8/8 | MET |
AA. Macro-Prompt A authorization
Authorizes G-FPSO-04B only
SADR_TARGETED_INDEPENDENT_RETEST
ACCEPTED
RetestID
PH6A-SADR-RETEST-REV0
FunctionalBaseline
PH6A-FPSO-FUNCTIONAL-BASELINE-REV1
FunctionalBaselineStatus
FROZEN
InteractionDesign
PH6A-FPSO-IAD-REV2
InteractionDesignStatus
ACCEPTED
CriticalFindings
0
HighUncontrolledFindings
0
OpenMaterialSemanticAmbiguity
0
ImplementationMaterialAmbiguity
0
ReachableIllegalMaterialStates
0
TraceabilityBreaks
0
OrphanUIActions
0
UnreachableHumanTransitions
0
ConcurrencyUncontrolledPaths
0
IdempotencyUncontrolledPaths
0
AuthorityLeakage
0
SourceAuthorityPromotions
0
ArchitectureDrift
0
DeterminismViolations
0
TemporalFactWithoutReevaluationTrigger
0
ExternalDependencyCount
15
ADVRegression
20/20
TADVRegression
8/8
G-FPSO-03R
PASS_WITH_CONTROLLED_EXTERNAL_DEPENDENCIES
BechtelizationReadiness
READY_FOR_G-FPSO-04B
MacroPromptA_Authorized
true
ParentSealChanged
false
Macro-Prompt A authorizes Bechtelized Application Conformance (G-FPSO-04B) as the next activity only. It does not authorize Operational Pilot, Phase 6B or Production.