Independent Integrated Software Architecture & Design Assurance Review

HOLDMACRO-PROMPT A NOT AUTHORIZED

Review ID

PH6A-II-SADR-REV0

Review type

INDEPENDENT_INTEGRATED_SOFTWARE_ASSURANCE

Objective

FIND DEFECTS — NOT CONFIRM PRIOR RESULTS

Evidence class

INDEPENDENT_DESIGN_ASSURANCE_EVIDENCE

Prior acceptance is evidence to review, not proof of correctness.

A. Independent assurance executive decision

Defect discovery over prior-result confirmation

The baseline chain is architecturally coherent and, in the majority of inspected domains, structurally sound: authority is separated from authentication, source authority is object-specific, unknown never degrades to not-required, and cumulative SIMOPS cannot be satisfied by pairwise pass. The review nevertheless falsifies the claim that the design is implementation-safe. One CRITICAL and four HIGH defects were reconstructed independently, of which two HIGH remain uncontrolled and one requires a targeted functional-baseline change. Macro-Prompt A is therefore not authorized.

FalsificationThree prior declarations did not survive independent reconstruction: the orphan-UI-action count, the external-dependency denominator treated as fully enumerated, and the claim that ImplementationMaterialAmbiguity = 0 across FC-FPSO-01…08.

Design-level analysis only. No prototype, no scenario execution, no live integration, no operational evidence. Parent architecture PH6A-IADA-REV1 remains sealed and unmodified.

OperationalClosureEvidence

NOT YET ACQUIRED

Phase6A

HOLD

Phase6B

NOT AUTHORIZED

Phase7

NO GO

BC09Protection

ACTIVE

PilotExposure

PROHIBITED

Review shall not

BUILD PROTOTYPEDESIGN NEW UICREATE NEW FEATURESCREATE DEMO SCENARIORUN OPERATIONAL DEMOCREATE OPERATIONAL EVIDENCEMODIFY PARENT BASELINE SILENTLYCREATE NEW CONTRACT SILENTLYCLOSE EXTERNAL DEPENDENCIES BY ASSUMPTION

B. Baseline integrity reconstruction

Prior declarations independently re-derived

Baseline	Declared	Independent reconstruction	Verdict
PH6A-IADA-REV1	FROZEN_AND_SEALED (SEAL-01)	Seal identifiers, four logical locks and provenance lineage PRV-01…PRV-18 re-derived; no downstream module mutates sealed semantics.	CONFIRMED
PH6A-BXIA-REV0	ACCEPTED	12 modules and 13-tab detail models re-counted and consistent; corporate vocabulary gap F-IAD-03 persists unresolved into the field layer.	CONFIRMED WITH NOTEF-SADR-09
PH6A-FPSO-AIA-REV0	ACCEPTED / PROCEED_WITH_CONTROLLED_FUNCTIONAL_EXTENSION	26 capability classifications re-derived; 8 New Functional Contract candidates map 1:1 onto FC-FPSO-01…08. Arithmetic holds.	CONFIRMED
PH6A-FPSO-FCD-REV0	COMPLETE (38-element schema × 8)	Schema completeness is structural, not semantic: every element is populated, but three elements (concurrency, version behaviour, failure behaviour) are populated at a level two independent teams could not converge on.	CONTRADICTIONF-SADR-02
PH6A-FPSO-FCA-REV0	G-FPSO-03 = PASS_WITH_CONTROLLED_EXTERNAL_DEPENDENCIES	10 of 11 findings closed by controlled correction as declared. External-dependency denominator declared as 12 distinct owner decisions; reconstruction identifies 14 — two dependencies (trusted-timestamp authority, IAM session-revocation propagation) are implied but never enumerated as owner decisions.	CONTRADICTIONF-SADR-04
PH6A-FPSO-FUNCTIONAL-BASELINE-REV0	FROZEN — requirements of record	Freeze is intact and no retroactive edit detected. One clause (signature-to-decision binding) is internally under-specified rather than mutated.	CONFIRMED WITH NOTEF-SADR-01
PH6A-FPSO-IAD-REV1	G-FPSO-04 = PASS · OrphanUIActions = 0	Independent UX→contract recalculation yields 2 actions with no governing transition (bulk acknowledge on the register, and re-open of a closed pre-start record), not 0.	CONTRADICTIONF-SADR-03

Prior assurance result contradictions

ID	Prior declaration	Reconstructed	Consequence	Finding
PARC-01	PH6A-FPSO-IAD-REV1: OrphanUIActions = 0	OrphanUIActions = 2	UX→contract traceability break; two material affordances have no transition, authority or event.	F-SADR-03
PARC-02	PH6A-FPSO-FCA-REV0: external-dependency denominator = 12 owner decisions	14 owner decisions	Two external dependencies are carried implicitly and would be closed by assumption at implementation.	F-SADR-04
PARC-03	PH6A-FPSO-FCD-REV0: ImplementationMaterialAmbiguity = 0	ImplementationMaterialAmbiguity = 3 (FC-02, FC-05, FC-08)	Two competent teams would produce materially different behaviour on retrieval election, delta materiality and signature invalidation.	F-SADR-02

C. Architecture coherence assessment

Check	Objects inspected	Result	Detail
DuplicateDomainObject	Location, WorkPackage, JobCard	CLEAN	JobCard remains the execution unit; WorkPackage the planning aggregate; no shadow copy of Location identity in the field layer.
HiddenDuplicateResponsibility	PreStartPreventivePackage vs IPERCContinuo	FINDINGF-SADR-05	Both objects carry a notion of 'control still required'. Package completeness and IPERC control adequacy overlap semantically without a stated precedence rule.
CircularDependency	FieldDelta ↔ IPERC ↔ Package	FINDINGF-SADR-06	FieldDelta invalidates IPERC; IPERC delta raises FieldDelta. Termination is asserted but no cycle-breaking rule (delta generation number) is specified.
BidirectionalAuthorityDependency	DecisionRight ↔ DigitalSignatureAssurance	CLEAN	Signature consumes DecisionRight; DecisionRight never derived from a signature. Direction is enforced structurally.
UnclearOwnership	ToolReadiness	FINDINGF-SADR-07	Business meaning, source data and configuration owners are not distinguishable for tool inspection validity.
SemanticOverlap	Applicability vs ContextualDocumentRetrieval	CLEAN	Retrieval yields candidates; applicability is a separate governed evaluation. Separation holds in both contracts.
ArchitectureDrift	Full chain vs PH6A-IADA-REV1	CLEAN	No change to object authority, mastership, offline authorization, no-compensation, Location governance, SIMOPS semantics or source/write boundaries.
LayerViolation / CrossLayerStateMutation	IAD screen specs	CLEAN	No screen mutates state outside a declared transition.
PresentationLayerBusinessLogic	Register + Pre-Start Board	FINDINGF-SADR-08	Aggregate SIMOPS verdict presentation collapses to a single chip; the collapse rule is defined only in the interaction layer.
ImplementationSpecificSemanticsInContract	FC-FPSO-01 (GPS)	CLEAN	Positioning technology is referenced as a confidence input, not as a contract obligation.
ContractSemanticsInUXOnly	IAD reason codes	CLEAN	All 55 reason codes originate in FCD, none introduced by IAD.

D. Capability governance assessment

No names or organizational assignments invented

Capability	Business meaning	Source data	Rule	Configuration	Execution	Verdict
Location acquisition & canonical mapping	Readiness layer	Positioning + canonical Location register	Readiness layer	PENDING_OWNER_VALIDATION	Field human	GOVERNED
Contextual document retrieval	Document control function	Aconex (candidate source)	Readiness layer	PENDING_OWNER_VALIDATION	System, human-reviewed	GOVERNED
Applicability evaluation	ES&H / discipline authority	Applicability configuration	Readiness layer rule engine (versioned)	PENDING_OWNER_VALIDATION	System proposes / human confirms	GOVERNED
Pre-start preventive package	Readiness layer	Federated	No-compensation composition	PENDING_OWNER_VALIDATION	Supervisor prepares	GOVERNED
Crew decision facts	People / competency authority	Training / Health / HR (decision facts only)	Source-owned validity	PENDING_OWNER_VALIDATION	Supervisor confirms crew	GOVERNED
Tool inspection validity	UNDISTINGUISHED	UNDISTINGUISHED	UNDISTINGUISHED	UNDISTINGUISHED	Field human declares	CAPABILITY GOVERNANCE GAP
IPERC Continuo control adequacy	ES&H authority	Prepopulated + field observed	Readiness layer	PENDING_OWNER_VALIDATION	Crew + supervisor	GOVERNED
Trusted timestamp for signature	UNDISTINGUISHED	UNDISTINGUISHED	UNDISTINGUISHED	UNDISTINGUISHED	Signature service	CAPABILITY GOVERNANCE GAP

E. Functional contract implementability

ImplementationMaterialAmbiguity = 3 (required 0)

Contract	Name	Two teams converge?	Defects
FC-FPSO-01	LocationAcquisitionService	YES	—
FC-FPSO-02	ContextualDocumentRetrieval	NO	· ImplementationAmbiguity — behaviour on two plausible active revisions is 'do not auto-elect' but the resulting object state is unnamed · UndefinedVersionBehaviour — retrieval timestamp vs revision effective date precedence unspecified
FC-FPSO-03	PreStartPreventivePackage	YES	—
FC-FPSO-04	CrewConfirmationRecord	YES	—
FC-FPSO-05	IPERCContinuo	NO	· MissingRule — materiality threshold of a field delta is left to human judgement with no recorded classification predicate · UndefinedConcurrency — row-level concurrent edit resolution stated as 'conflict' without base-version granularity (row vs document)
FC-FPSO-06	FieldDeltaAssessment	YES	—
FC-FPSO-07	ToolReadiness	YES	· Governance owner undefined (D-domain), but behaviour is unambiguous
FC-FPSO-08	DigitalSignatureAssurance	NO	· MissingPostcondition — state of a signature whose object is invalidated after signing is not named · UndefinedFailureBehaviour — timestamp authority unavailable: proceed-with-degraded-timestamp vs refuse is unspecified

F. Cross-contract dependency graph

10 edges · 1 cycle · 1 unversioned · 1 without owner · 0 bypassing authority

From	To	Versioned	Failure behaviour	Owner	Defect
LocationAcquisition (FC-01)	LocationContext (parent)	YES	Fail-closed to human confirmation	Readiness layer	—
LocationContext	ContextualDocumentRetrieval (FC-02)	YES	SOURCE_UNAVAILABLE → no package readiness	Document control	—
ContextualDocumentRetrieval (FC-02)	Applicability (parent)	NO	Defined	Readiness layer	UnversionedDependency — applicability consumes retrieved set without binding the retrieval snapshot id
Applicability	PreStartPreventivePackage (FC-03)	YES	UNKNOWN → REQUIRES_HUMAN_CONFIRMATION	ES&H	—
CrewConfirmation (FC-04)	Package (FC-03)	YES	Invalid competency → package incomplete	People authority	—
IPERC (FC-05)	Package (FC-03)	YES	Open material delta → not authorizable	ES&H	—
FieldDelta (FC-06)	IPERC (FC-05)	YES	Reassess	ES&H	Cycle with FC-05 → FC-06; no generation/termination rule
FieldDelta (FC-06)	Package (FC-03)	YES	Dependency-scoped invalidation	Readiness layer	—
ToolReadiness (FC-07)	Readiness (parent)	YES	Expired inspection → not ready	UNDEFINED	DependencyWithoutOwner
DigitalSignature (FC-08)	Decision / State (parent)	YES	Signature failure → no state change	Authority function	Post-signature invalidation outcome unnamed

G. State model sanity assessment

Machine	Defect class	Detail	Severity
PreStartPreventivePackage	None	60 states / 33 transitions reconstructed; every state has an entry condition, an exit and an authority.	NONE
ContextualDocumentRetrieval	StateWithNoEntryCondition	Ambiguous-revision outcome has no named state; retrieval remains in RETRIEVED while being non-consumable — a decorative status distinction only.	HIGH
DigitalSignatureAssurance	TerminalStateThatShouldNotBeTerminal	SIGNED is terminal; an object invalidated after signing has no governed successor state (e.g. SIGNED_SUPERSEDED).	HIGH
IPERCContinuo	TransitionWithoutReasonCode	Row-level revert of a human modification back to the source value emits no reason code.	MEDIUM
FieldDeltaAssessment	UncontrolledCycle	Delta → reassess → delta cycle lacks a generation counter.	MEDIUM
CrewConfirmationRecord	None	No dead, unreachable or duplicate states detected.	NONE
ToolReadiness	None	Expiry is a computed attribute, correctly not modelled as a state.	NONE
LocationAcquisition	None	GPS confidence is an attribute; confirmation is a state entered only by human or governed fallback.	NONE

· State — governed lifecycle position with entry condition, exit and authority

· StatusLabel — presentation of a state, never a state itself

· Attribute — computed or sourced property (e.g. inspection expiry, GPS confidence)

· ReasonCode — the governed justification of a transition

· Event — the emitted, immutable record that a transition occurred

H. Illegal-state reachability

9/10 blocked · ReachableIllegalMaterialStates = 1

Target illegal state	Attempt path	Blocked by	Reachable
AuthorizedWithoutDecisionRight	Authenticated supervisor with role but expired delegation	DecisionRight resolved independently of role; UNRESOLVED → fail-closed	BLOCKED
AuthorizedWithMandatoryPackageItemIncomplete	Complete-then-authorize with one mandatory item UNKNOWN	No-compensation predicate; UNKNOWN ≠ NOT_REQUIRED	BLOCKED
IPERCAuthorizedWithMaterialDeltaOpen	Delta raised after review, before authorization	Package invalidation on material delta	BLOCKED
SignedCurrentStateAgainstOldObjectVersion	Object revised between signature request and submission	Base-version binding in FC-08	BLOCKED
CrewAcceptedWithInvalidMandatoryCompetency	Stale competency decision fact accepted at confirmation	Validity timestamp check	BLOCKED
ToolReadyWithExpiredRequiredInspection	Inspection expires mid-shift after readiness computed	Nothing — readiness is not recomputed on time passage; expiry is evaluated at declaration only	REACHABLEF-SADR-10
DocumentApplicableWithoutApplicabilityEvaluation	Retrieved document presented as applicable	Retrieved ≠ Applicable separation	BLOCKED
LocationConfirmedByGPSWithoutHumanOrGovernedFallback	High-confidence auto-confirm	GPS ≠ Authority invariant	BLOCKED
PairwiseSIMOPSPassWithAggregateConflictHidden	Three activities, all pairs PASS	CUM-1…CUM-7 evaluated independently; pairwiseImpliesLocationPass = false	BLOCKED
AuthorizationInheritedAfterLocationChange	Location change on an authorized package	Location change invalidates authorization scope	BLOCKED

I–AL. Domain assessments

Each assessment independently reconstructed

Authority / privilege escalation

PASS

Eleven escalation vectors attempted (authentication, role, system permission, competency, document review, evidence acceptance, signature, supervisor presence, UI availability, AI recommendation, previous authorization). None produces DecisionRight. Delegation, expired role, shift change, Location change, risk change, activity change, stale cached permission and offline all fail closed to AuthorityResolutionState = UNRESOLVED.

Segregation of duties

PASS WITH FINDINGF-SADR-11

Preparation, review and authorization are separated for the package. For the IPERC Continuo, a single supervisor may author a field-observed row, confirm it and then review it where no independent cross-review is triggered; architecture requires materially independent authority for control adequacy.

Source authority

PASS

Aconex, Q4/Engica, Forwood, IAM, HR, Training, Health and Project Controls are all carried as CandidateSource or FederatedSource pending owner validation. No object claims SystemOfRecord without owner evidence. IntegratedSystem ≠ AuthoritativeSystem is preserved. SourceAuthorityPromotions = 0.

Document governance

PASS WITH FINDINGF-SADR-02

Automatic revision election is prohibited (closed by F-FCA-02). Supersession, effective date and retrieval timestamp are modelled. Multiple-active-revision ambiguity has correct prohibition but no named state, and document removal after package preparation is dependency-scoped but its reason code is generic.

Applicability engine

PASS

Retrieved / PotentiallyApplicable / Applicable / NotApplicable / RequiresHumanConfirmation are distinct. No path was found where MissingRule, MissingConfiguration or MissingMetadata degrades to NOT_APPLICABLE; all three route to REQUIRES_HUMAN_CONFIRMATION. UNKNOWN ≠ NOT_REQUIRED holds.

Preventive package

PASS

PACKAGE_EXISTS ≠ COMPLETE ≠ AUTHORIZED is structurally enforced. Invalidation on document revision, crew replacement, tool failure, SIMOPS change, IPERC delta, PETAR change and critical-control change is dependency-scoped; no global invalidation and no under-invalidation detected for the seven triggers.

IPERC Continuo

PASS WITH FINDINGF-SADR-02F-SADR-11

SYSTEM_PREPOPULATED / FIELD_OBSERVED / HUMAN_CONFIRMED / REVIEWED / AUTHORIZED are separated and source values remain reconstructable after human modification. Concurrent row edits and revert-to-source reason coding are under-specified.

Crew decision facts

PASS

FitnessDecisionFact, CompetencyDecisionFact and TrainingDecisionFact carry validity timestamps; underlying medical, training-history and HR detail is not stored in the field layer. Stale decision facts are visibly time-stamped and cannot be silently accepted.

Tools / equipment

PASS WITH FINDINGF-SADR-07F-SADR-10

Tool (portable, person-attached) and Equipment (installed, Location-attached) are distinguished. Substitution, relocation and operator change propagate correctly. Inspection expiry during an active shift is not re-evaluated, and no governance owner is distinguishable.

SIMOPS

PASSF-SADR-08

Pairwise and LocationConcurrentWorkSet evaluation are independent. Three-activity cases where all pairs pass and CUM-3 / CUM-4 / CUM-6 fail were reconstructed and correctly produce a non-compensable STOP. PAIRWISE_PASS ≠ AGGREGATE_PASS holds in logic; the interaction layer must not collapse the two verdicts into one chip.

Delta propagation

PASS

Nine change classes were traced against the dependency graph. No under-invalidation and no over-invalidation detected; propagation is dependency-scoped in every case.

Digital signature

FAILF-SADR-01

SignerIdentity, DecisionRight, ObjectVersion, ContentIntegrity and CredentialStatus are all bound. VALID_SIGNATURE ≠ VALID_DECISION is stated. However the post-signature invalidation outcome is unnamed and the timestamp-authority-unavailable behaviour is undefined — the two conditions most likely to occur in field use.

Legal claim boundary

PASS

No artefact or interaction wording asserts LegalValidityConfirmed, DigitalNotary, NonRepudiationGuaranteed, LegallyBinding, PKIValidated or TrustedTimestampValidated. Signature is consistently described as an assurance control, not a legal instrument. UnsupportedLegalClaims = 0.

Concurrency

PASS WITH FINDINGF-SADR-02

Six of seven race conditions are governed by base-version comparison, conflict detection and audit events with no last-write-wins. IPERC row-level concurrent edit lacks a stated base-version granularity, leaving one uncontrolled path.

Idempotency

PASS

Eight replays executed at design level (location confirmation, retrieval, package generation, crew confirmation, IPERC submit, approval request, signature request, event emission). Correlation identity prevents duplicate objects, duplicate authority acts, duplicate signatures and double transitions. IdempotencyUncontrolledPaths = 0.

Offline / degraded

PASS

ONLINE / OFFLINE / SYNC_PENDING / CONFLICT / SOURCE_UNAVAILABLE each carry an allowed-action set. Material authorization is prohibited offline; captured evidence is marked PENDING_VERIFICATION. No OFFLINE_BYPASS_OF_CONTROL path found.

Failure containment

PASS

GPS, Aconex, IAM, signature, critical-control source, storage and synchronization failures are each dependency-scoped. FailurePropagation = DEPENDENCY_SCOPED confirmed for all seven.

Determinism

PASS WITH FINDINGF-SADR-10

Same facts, rule versions, configuration and decision rights produce the same material decision in every reconstructed case except tool inspection expiry, where wall-clock evaluation time changes the outcome without a recorded fact change.

AI containment

PASS

AI output cannot confirm Location, determine final applicability, establish competency, approve IPERC or PETAR, grant DecisionRight, sign or authorize work — each attempt fails at the AI-to-Rule firewall. AI_OFF_MATERIAL_STATE_EQUIVALENCE confirmed: disabling AI changes no material state, only proposal availability.

Provenance

PASS WITH FINDINGF-SADR-12

Decision ← RuleVersion ← Facts ← SourceRecords ← SourceSystems ← Owners ← HumanActions ← Timestamps is reconstructable for all material objects. One break: the applicability evaluation does not bind the retrieval snapshot id, so the exact document set behind an applicability decision is inferable but not pinned.

Event model

PASS

26 emitted events inspected. Each carries actor, role, authority basis, previous and new state, reason code, object version and correlation id. Event ≠ State is preserved; no event is used as a state substitute.

Security architecture

PASS WITH FINDINGF-SADR-04

Authentication and authorization boundaries are separate, least privilege is stated, audit records are append-only, and signature credentials are never held by the field layer. IAM session-revocation propagation latency is an unenumerated external dependency.

Privacy / data minimisation

PASS

No health, HR or training detail is exposed to the field layer; decision facts are sufficient in every inspected case. Personal identifiers are limited to the person reference and displayed name required for crew confirmation.

UX → contract

FAILF-SADR-03F-SADR-08

Independent recalculation: OrphanUIActions = 2 (register bulk acknowledge, re-open of closed pre-start record). UnreachableHumanTransitions = 0. NewFunctionalStatesThroughUI = 0. HiddenAuthorityActions = 0. StatePresentationContradictions = 1 (aggregate SIMOPS collapse).

Contract → UX

PASS WITH FINDINGF-SADR-13

Every contractually required human transition is discoverable, reachable, permissioned and reason-coded. One transition — governed fallback for ambiguous canonical Location mapping — is technically reachable but buried three levels deep, i.e. OperationallyUnusableButTechnicallyReachable under field conditions.

Bechtelization readiness

PASS WITH FINDINGF-SADR-09

Corporate vocabulary, document identity, register behaviour, workflow/owner/authority/source visibility, history and provenance are enterprise-grade; no consumer-app drift and no proprietary pixel copy. F-IAD-03 (vocabulary gap) was reassessed and is upgraded from NON_BLOCKING to BLOCKING for G-FPSO-04B: the field layer uses three terms for the same document object.

Configuration management

PASS

Lineage IADA → AIA → FCD → FCA → FUNCTIONAL-BASELINE → IAD is intact. ParentBaseline references, change classes, finding closure and correction traceability are present. NoSilentMutation and NoRetroactiveBaselineEdit confirmed.

Evidence taxonomy

PASS

Architecture, design assurance, interaction design, implementation, software verification, simulation, operational closure, pilot and production evidence remain strictly separated. EVIDENCE_CLASS_PROMOTION = 0. OperationalClosureEvidence remains NOT_YET_ACQUIRED.

Overclaim audit

PASS

No claim of live Aconex integration, validated APIs, configured corporate IAM, confirmed Forwood or Engica authority, signature legal sufficiency, completed owner validation, completed pilot or production readiness. All are consistently carried as pending owner decisions. OverclaimFindings = 0.

Testability

PASS WITH FINDINGF-SADR-02

Acceptance predicates are observable, repeatable, version-aware and source-aware. One is untestable as written: IPERC delta materiality depends on unrecorded human judgement, so the same input cannot be shown to yield the same classification.

AM. Adversarial scenario results ADV-01…ADV-20

14 pass · 2 controlled · 4 fail — adversarial design assurance evidence only

ID	Initial state / trigger	Contracts	Expected governed behaviour	Observed design behaviour	Invariant	Disposition
ADV-01	IPERC REVIEWED, signature request open → Location changes	FC-01, FC-05, FC-08	Signature request invalidated; authorization scope voided	Location change invalidates authorization scope and voids the open request	HELD	PASS
ADV-02	Package REVIEWED → Crew member replaced	FC-04, FC-03	Dependency-scoped invalidation of crew confirmation and package completeness only	Exactly those two objects invalidated; documents and tools untouched	HELD	PASS
ADV-03	Package READY_FOR_AUTHORITY → New document revision published	FC-02, FC-03	Package returns to incomplete pending materiality assessment; no auto-election	Correct; materiality assessment is human	HELD	PASS
ADV-04 F-SADR-10	Tool declared ready, shift active → Inspection validity expires during shift	FC-07	Readiness recomputed on validity boundary; work stops or reassesses	Expiry evaluated only at declaration; readiness persists until next explicit event	VIOLATED	FAIL
ADV-05	Signature request against version v3 → Object advances to v4 before submission	FC-08	Signature refused with version-mismatch reason code	Refused as expected	HELD	PASS
ADV-06	Two activities, all pairwise PASS → Third activity added	SIMOPS (parent)	Cumulative rules evaluated independently; non-compensable STOP	CUM-3/4/6 fire; location verdict STOP regardless of pairwise pass	HELD	PASS
ADV-07	Authenticated session, authorization pending → IAM becomes unavailable	FC-08, Authority (parent)	DecisionRight unverifiable → UNRESOLVED → authorization refused; unrelated capabilities continue	Fail-closed and dependency-scoped	HELD	PASS
ADV-08 F-SADR-02	Offline IPERC edit queued → Newer online version exists at sync	FC-05	Conflict raised, human reconciliation, no last-write-wins	Conflict raised at document granularity; row-level granularity unspecified	UNDETERMINED	FAIL
ADV-09	Package under preparation → Applicability configuration missing for a potentially mandatory PETAR	Applicability (parent), FC-03	REQUIRES_HUMAN_CONFIRMATION, never NOT_APPLICABLE	Correct; UNKNOWN ≠ NOT_REQUIRED enforced	HELD	PASS
ADV-10 F-SADR-02	Retrieval in progress → Two plausible active revisions returned	FC-02	No auto-election; named ambiguous state; human resolution with reason code	No auto-election, but no named state — object remains RETRIEVED while non-consumable	VIOLATED	FAIL
ADV-11	Crew confirmation in progress → Source reports competent, DecisionRight expired	FC-04, Authority	Competency ≠ authority; authorization refused, crew membership unaffected	Correct separation	HELD	PASS
ADV-12	Data retrieved, authorization pending → Source becomes unavailable	FC-02, FC-03	Retrieved facts marked with freshness; authorization allowed only within governed staleness window	Freshness carried; staleness window defined	HELD	PASS
ADV-13	Package COMPLETE → Package item invalidated	FC-03	COMPLETE revoked, not overridden; reason code recorded	Correct — completeness is recomputed, never latched	HELD	PASS
ADV-14	IPERC in preparation → AI proposes a control conflicting with a governed control	FC-05, AI firewall	Proposal is non-consumable by the rule engine; human disposition required	SEMANTIC_PROPOSAL blocked from IRDE consumption	HELD	PASS
ADV-15	Signature request open → User re-activates request repeatedly	FC-08	Idempotent — one authority act, one signature	Correlation identity dedupes	HELD	PASS
ADV-16 F-SADR-13	Location acquisition → High GPS confidence, ambiguous canonical mapping	FC-01	Confidence never resolves ambiguity; governed human fallback, discoverable in the field	Fallback exists but is three levels deep — usable only by a trained user	HELD	CONTROLLED
ADV-17 F-SADR-02	IPERC prepopulated → Field user modifies a source-derived hazard	FC-05	Source value preserved and reconstructable; modification evented with actor and reason	Correct, except revert-to-source emits no reason code	HELD	CONTROLLED
ADV-18	Critical control verified in source → Local observation contradicts source	FC-05, Critical control (parent)	Conflict is a first-class state; no automatic precedence; fail-closed pending human resolution	Correct	HELD	PASS
ADV-19	Authorization pending → Supervisor role changes mid-shift	Authority	Cached permission invalid; DecisionRight re-resolved	Re-resolved; stale cache rejected	HELD	PASS
ADV-20 F-SADR-10	Identical facts, rules, configuration, decision rights → Re-evaluation at a later clock time	FC-07, Determinism	Same material decision	Different decision possible via tool inspection expiry evaluated against wall clock without a fact change	VIOLATED	FAIL

AN. Unknown-unknown / systemic failure analysis

How the system could be locally correct and globally unsafe

SYS-01HIGHF-SADR-14

Temporal decoherence of a correct package: every fact is individually correct at the moment it was captured, and the package is authorized against a composition of facts that were never simultaneously true.

Propagation path

Document freshness window, competency validity, tool inspection validity, critical-control verification interval and SIMOPS work-set membership each have independent validity clocks. Package completeness is computed as a conjunction over facts, not over a common validity interval. A package can therefore be COMPLETE at T while no instant exists at which all constituent facts were simultaneously valid.

Detection mechanism

None currently. Freshness is displayed per item; no composite validity interval is computed or asserted.

Current control

Per-item staleness windows and invalidation on explicit change events — effective against changes, ineffective against elapsed validity.

Residual exposure

HIGH — this is the most credible route to a materially incorrect authorization while every component is locally correct.

SYS-02MEDIUMF-SADR-07

Governance-gap absorption: capabilities without a distinguishable owner (tool inspection validity, trusted timestamp) will acquire de facto owners at implementation, embedding organizational assumptions into code.

Propagation path

CAPABILITY_GOVERNANCE_GAP → implementation default → unwritten operational rule → audit finding at pilot.

Detection mechanism

Capability ownership test (section D) — currently the only detection point.

Current control

External dependency register (14 owner decisions).

Residual exposure

MEDIUM — controlled provided the register is closed by owner decision, not by assumption.

AO. Findings register

1 critical · 5 high (1 uncontrolled) · 6 medium · 2 low

F-SADR-01CRITICALUNCONTROLLEDFUNCTIONAL BASELINE CHANGE REQUIRED

Impact domain

FUNCTIONAL_CONTRACT / STATE_MODEL / AUTHORITY

Affected baseline

PH6A-FPSO-FUNCTIONAL-BASELINE-REV0

Affected contract

FC-FPSO-08 DigitalSignatureAssurance

Affected clause

Signature lifecycle — postconditions and timestamp dependency

Current conditionSIGNED is a terminal state. The contract names no successor for a signed object that is subsequently invalidated (document revision, crew change, delta, SIMOPS change), and defines no behaviour when the timestamp authority is unavailable.

Structural exposureAn authorization can be evidenced by a signature that is structurally valid while the decision it attests to has been invalidated. The record set contains no state expressing 'signed but no longer authorizing', so downstream readers — including audit — will read SIGNED as current authority.

Downstream consequenceWork may proceed in the field under an authorization that the readiness layer internally considers void, and the evidence chain will not show the divergence. Two implementation teams will additionally diverge on the offline/degraded timestamp path, one refusing signature and one accepting a device timestamp.

Failure scenarioADV-03 followed by ADV-05: a revision is published after signing; the package is invalidated; the signature record remains terminal SIGNED and is presented as the authorization of record.

Required architectural decisionName the post-signature invalidation state and its entry condition, and decide the timestamp-unavailable disposition (refuse vs. degraded-timestamp with explicit evidence marking).

Competent authorityAuthority function owner + signature/PKI owner (external dependency, unclosed)

Required correctionTargeted amendment to FC-FPSO-08: add successor state SIGNED_SUPERSEDED with entry condition, reason code and event; add explicit timestamp-authority failure behaviour; restate VALID_SIGNATURE ≠ VALID_DECISION as an enforced predicate, not a principle.

Evidence of closureAmended contract clause under a controlled change to the functional baseline, plus regression of ADV-01, ADV-03, ADV-05, ADV-13 and the illegal-state set.

Regression requiredADV-01, ADV-03, ADV-05, ADV-13, illegal-state H-04

Residual riskUntil closed, no implementation of FC-FPSO-08 is safe to start.

F-SADR-02HIGHUNCONTROLLEDFUNCTIONAL BASELINE CHANGE REQUIRED

Impact domain

FUNCTIONAL_CONTRACT / CONCURRENCY / TESTABILITY

Affected baseline

PH6A-FPSO-FCD-REV0 / FUNCTIONAL-BASELINE-REV0

Affected contract

FC-FPSO-02, FC-FPSO-05

Affected clause

Retrieval election, delta materiality, row-level concurrency

Current conditionThree material ambiguities: (a) ambiguous active revisions produce no named state; (b) IPERC delta materiality has no recorded classification predicate; (c) concurrent IPERC edits declare conflict without stating base-version granularity.

Structural exposureImplementationMaterialAmbiguity = 3 against a required value of 0. The prior declaration of 0 was schema completeness, not semantic sufficiency.

Downstream consequenceTwo competent teams produce materially different behaviour: one blocks a package on any concurrent edit, another merges per row; one treats an ambiguous revision as unusable, another as usable-with-warning. Delta materiality becomes untestable.

Failure scenarioADV-08, ADV-10, ADV-17.

Required architectural decisionName the ambiguous-revision state; define a materiality classification predicate with recorded inputs; fix concurrency granularity at row level with document-level base-version guard.

Competent authorityDocument control owner + ES&H authority + readiness layer architect

Required correctionContract-level clarification of FC-02 and FC-05 under a controlled change.

Evidence of closureRevised clauses plus re-execution of ADV-08, ADV-10, ADV-17 and the testability audit.

Regression requiredADV-08, ADV-10, ADV-17, AL testability set

Residual riskHIGH while open — divergent field behaviour on the two most-used contracts.

F-SADR-03HIGHCONTROLLEDDOWNSTREAM DESIGN CORRECTION

Impact domain

INTERACTION

Affected baseline

PH6A-FPSO-IAD-REV1

Affected contract

Interaction layer (no contract)

Affected clause

UX→contract traceability, declared OrphanUIActions = 0

Current conditionTwo affordances have no governing transition, authority or event: register bulk acknowledge, and re-open of a closed pre-start record.

Structural exposureBoth are state-affecting in user perception. Re-open in particular would resurrect a closed authority context outside any transition.

Downstream consequenceImplementation would invent transitions to satisfy the UI — the classic route to a UI-only state.

Failure scenarioUser re-opens a closed pre-start record after shift end; no reason code, no authority check, no event.

Required architectural decisionRemove both affordances or bind each to an existing governed transition.

Competent authorityInteraction design owner (downstream, no baseline change)

Required correctionIAD Rev.2 correction: delete bulk acknowledge; replace re-open with a governed supersession action.

Evidence of closureRecalculated UX→contract matrix with OrphanUIActions = 0 verified independently.

Regression requiredAF, AG assessments

Residual riskLOW once corrected downstream; no contract change needed.

F-SADR-04HIGHCONTROLLEDDOWNSTREAM DESIGN CORRECTION

Impact domain

EXTERNAL_DEPENDENCY / SECURITY

Affected baseline

PH6A-FPSO-FCA-REV0

Affected contract

FC-FPSO-08 / Authority

Affected clause

External dependency register

Current conditionDenominator declared as 12 owner decisions; reconstruction yields 14. Unenumerated: trusted-timestamp authority ownership, IAM session-revocation propagation latency.

Structural exposureUnenumerated dependencies are closed by assumption at implementation time.

Downstream consequenceA revoked session could remain materially authorizing for an unbounded window.

Failure scenarioADV-19 with a revocation that propagates after the authorization.

Required architectural decisionExtend the register to 14 and obtain owner decisions.

Competent authorityIAM owner; signature/timestamp owner

Required correctionRegister amendment (downstream) — no contract semantics change.

Evidence of closureOwner-signed decisions for both dependencies.

Regression requiredAD, ADV-07, ADV-19

Residual riskMEDIUM, controlled by the register.

F-SADR-05MEDIUMCONTROLLEDDOWNSTREAM DESIGN CORRECTION

Impact domain

ARCHITECTURE

Affected baseline

PH6A-FPSO-FCD-REV0

Affected contract

FC-FPSO-03 / FC-FPSO-05

Affected clause

Control adequacy vs package completeness

Current conditionBoth objects express 'control still required' with no stated precedence.

Structural exposureSemanticOverlap allowing contradictory readiness statements on one screen.

Downstream consequenceField user receives two answers to one question.

Failure scenarioIPERC adequate, package incomplete for the same control.

Required architectural decisionDeclare IPERC control adequacy as the authoritative control statement and package completeness as its aggregate consumer.

Competent authorityReadiness layer architect

Required correctionPrecedence clause in the downstream design.

Evidence of closurePrecedence rule documented and reflected in the interaction layer.

Regression requiredN, O assessments

Residual riskLOW.

F-SADR-06MEDIUMCONTROLLEDDOWNSTREAM DESIGN CORRECTION

Impact domain

STATE_MODEL

Affected baseline

PH6A-FPSO-FCD-REV0

Affected contract

FC-FPSO-05 / FC-FPSO-06

Affected clause

Delta ↔ IPERC reassessment cycle

Current conditionCycle exists with no termination rule.

Structural exposureUncontrolled cycle; theoretically unbounded reassessment.

Downstream consequenceField loop with no escalation point.

Failure scenarioEach reassessment raises a further delta.

Required architectural decisionAdd a delta generation counter with an escalation threshold to Hold Point.

Competent authorityES&H authority

Required correctionDownstream design rule; no contract semantics change.

Evidence of closureTermination rule documented; cycle regression executed.

Regression requiredG, S assessments

Residual riskLOW.

F-SADR-07MEDIUMCONTROLLEDDOWNSTREAM DESIGN CORRECTION

Impact domain

ARCHITECTURE / EXTERNAL_DEPENDENCY

Affected baseline

PH6A-FPSO-FCD-REV0

Affected contract

FC-FPSO-07 ToolReadiness

Affected clause

Ownership of tool inspection validity

Current conditionNo distinguishable owner for business meaning, source data, rule or configuration.

Structural exposureCAPABILITY_GOVERNANCE_GAP.

Downstream consequenceImplementation default becomes de facto governance (SYS-02).

Failure scenarioTool inspection source chosen by developers.

Required architectural decisionAssign owners — not to be invented by this review.

Competent authorityProject/asset governance (external, unclosed)

Required correctionRegister as owner decision; no contract change.

Evidence of closureOwner assignment evidence.

Regression requiredD, Q assessments

Residual riskMEDIUM.

F-SADR-08MEDIUMCONTROLLEDDOWNSTREAM DESIGN CORRECTION

Impact domain

INTERACTION / ARCHITECTURE

Affected baseline

PH6A-FPSO-IAD-REV1

Affected contract

SIMOPS presentation

Affected clause

Aggregate verdict presentation

Current conditionPairwise and aggregate verdicts collapse into a single chip; the collapse rule lives only in the interaction layer.

Structural exposurePresentationLayerBusinessLogic; aggregate conflict can be visually indistinguishable from a pairwise one.

Downstream consequenceA non-compensable cumulative STOP could read as an ordinary conflict.

Failure scenarioADV-06 displayed as a single conflict chip.

Required architectural decisionPresent pairwise and aggregate verdicts as separate, non-collapsible statements.

Competent authorityInteraction design owner

Required correctionDownstream interaction correction.

Evidence of closureRevised presentation spec; AF regression.

Regression requiredR, AF

Residual riskLOW.

F-SADR-09MEDIUMCONTROLLEDDOWNSTREAM DESIGN CORRECTION

Impact domain

BECHTELIZATION

Affected baseline

PH6A-BXIA-REV0 / PH6A-FPSO-IAD-REV1

Affected contract

Vocabulary

Affected clause

F-IAD-03 reassessment

Current conditionThree terms are used for the same document object across corporate and field layers.

Structural exposureTerminology divergence at the enterprise boundary.

Downstream consequenceRegister/search behaviour inconsistent with corporate expectation.

Failure scenarioUser searches a corporate term and finds nothing in the field layer.

Required architectural decisionSingle canonical document vocabulary before G-FPSO-04B.

Competent authorityDocument control owner

Required correctionVocabulary reconciliation — reclassified from NON_BLOCKING to BLOCKING for G-FPSO-04B only.

Evidence of closureReconciled vocabulary table.

Regression requiredAH

Residual riskLOW; does not block Macro-Prompt A by itself.

F-SADR-10HIGHCONTROLLEDDOWNSTREAM DESIGN CORRECTION

Impact domain

STATE_MODEL / DETERMINISM

Affected baseline

PH6A-FPSO-FCD-REV0

Affected contract

FC-FPSO-07 ToolReadiness

Affected clause

Inspection validity evaluation point

Current conditionValidity is evaluated at declaration only; elapsed time does not trigger re-evaluation.

Structural exposureReachableIllegalMaterialState (ToolReadyWithExpiredRequiredInspection) and a determinism violation.

Downstream consequenceReadiness persists past validity within a shift.

Failure scenarioADV-04, ADV-20.

Required architectural decisionTreat validity boundaries as governed temporal events that re-evaluate dependent readiness.

Competent authorityReadiness layer architect

Required correctionDownstream design rule: validity-boundary re-evaluation, dependency-scoped.

Evidence of closureRe-execution of ADV-04, ADV-20 and illegal-state H-06 with reachable = false.

Regression requiredADV-04, ADV-20, H, Q, Z

Residual riskControlled by an explicit correction commitment; blocks nothing at contract level.

F-SADR-11MEDIUMCONTROLLEDDOWNSTREAM DESIGN CORRECTION

Impact domain

AUTHORITY / SECURITY

Affected baseline

PH6A-FPSO-FCD-REV0

Affected contract

FC-FPSO-05

Affected clause

Review of field-observed rows

Current conditionOne person may author, confirm and review the same control-adequacy row.

Structural exposureSOD_REQUIRED_BUT_UNDEFINED for control adequacy.

Downstream consequenceSelf-review of a life-critical control statement.

Failure scenarioLone supervisor at shift start.

Required architectural decisionDefine where independent review is materially required and what the governed exception is.

Competent authorityES&H authority

Required correctionDownstream SoD rule with a governed exception path.

Evidence of closureSoD rule documented; J regression.

Regression requiredJ, O

Residual riskMEDIUM.

F-SADR-12LOWCONTROLLEDDOWNSTREAM DESIGN CORRECTION

Impact domain

PROVENANCE

Affected baseline

PH6A-FPSO-FCD-REV0

Affected contract

FC-FPSO-02 → Applicability

Affected clause

Retrieval snapshot binding

Current conditionApplicability decisions do not pin the retrieval snapshot id.

Structural exposureProvenance is inferable but not pinned.

Downstream consequenceReconstruction of a historical applicability decision requires inference.

Failure scenarioAudit of an applicability decision after several revisions.

Required architectural decisionBind snapshot id into the applicability fact.

Competent authorityReadiness layer architect

Required correctionDownstream data-binding correction.

Evidence of closureProvenance chain test with pinned snapshot.

Regression requiredAB

Residual riskLOW.

F-SADR-13LOWCONTROLLEDDOWNSTREAM DESIGN CORRECTION

Impact domain

INTERACTION

Affected baseline

PH6A-FPSO-IAD-REV1

Affected contract

FC-FPSO-01

Affected clause

Governed fallback discoverability

Current conditionFallback for ambiguous canonical mapping is three levels deep.

Structural exposureOperationallyUnusableButTechnicallyReachable.

Downstream consequenceField users bypass by choosing a plausible Location.

Failure scenarioADV-16.

Required architectural decisionSurface the fallback at the point of ambiguity.

Competent authorityInteraction design owner

Required correctionDownstream interaction correction.

Evidence of closureRevised screen spec; AG regression.

Regression requiredAG, ADV-16

Residual riskLOW.

F-SADR-14HIGHCONTROLLEDDOWNSTREAM DESIGN CORRECTION

Impact domain

ARCHITECTURE / DATA

Affected baseline

PH6A-IADA-REV1 (consumer-side) / FC-FPSO-03

Affected contract

PreStartPreventivePackage

Affected clause

Composite validity of package facts

Current conditionCompleteness is a conjunction over individually fresh facts; no composite validity interval is computed.

Structural exposureTemporal decoherence (SYS-01) — a package can be authorized against facts that were never simultaneously valid.

Downstream consequenceMaterially incorrect authorization while every component is locally correct.

Failure scenarioCompetency valid to 08:00, tool inspection valid from 08:30, document freshness window expiring 08:15; authorization at 08:40 sees three individually acceptable facts.

Required architectural decisionIntroduce a composite validity interval as a first-class readiness attribute, evaluated at authorization time.

Competent authorityReadiness layer architect + ES&H authority

Required correctionDownstream design correction on the consumer side of the sealed parent; the parent's semantics are not changed, only a derived attribute is added.

Evidence of closureComposite-interval predicate specified and regression of N, S, Z and SYS-01.

Regression requiredN, S, Z, SYS-01

Residual riskHIGH until specified; controlled by explicit correction commitment and by PilotExposure = PROHIBITED.

AP. Prior finding reconciliation

No finding silently reopened, closed or lost

Prior finding set	Declared	Independent verification	Verdict
F-FCA-01…F-FCA-10 (contract assurance corrections)	CLOSED by controlled correction	10/10 remain closed; corrections are traceable to clause text	CONFIRMED
F-FCA-11 (LOW, controlled-open)	CONTROLLED_OPEN	Remains controlled-open; no silent closure	CONFIRMED
F-IAD-01, F-IAD-02 (corrected in design)	CLOSED	Closed with design evidence	CONFIRMED
F-IAD-03 (vocabulary gap)	NON_BLOCKING	Reassessed as BLOCKING for G-FPSO-04B only	RECLASSIFIED
F-IAD-04 (LOW controlled non-blocking)	CONTROLLED_OPEN	Unchanged	CONFIRMED
ADR-03, ADR-13/CA-01, ADR-15…24, CA-03, CA-04	CONTROLLED_OPEN	All remain controlled-open; none silently closed	CONFIRMED

silentlyReopened

silentlyClosed

lostFindings

findingWithNoClosureEvidence

AQ. Required corrections & change classification

Downstream design correction

F-SADR-03F-SADR-04F-SADR-05F-SADR-06F-SADR-07F-SADR-08F-SADR-09F-SADR-10F-SADR-11F-SADR-12F-SADR-13F-SADR-14

Functional baseline change required

F-SADR-01F-SADR-02

Architecture reopen required

None — PH6A-IADA-REV1 remains sealed and unmodified

AR. Residual risk register

ID	Risk	Severity	Control	Exposure
RR-01	Signature record outlives the decision it attests to	CRITICAL	FC-FPSO-08 amendment (F-SADR-01) — not yet made	OPEN
RR-02	Divergent implementations of retrieval election, delta materiality and IPERC concurrency	HIGH	FC-02/FC-05 clarification (F-SADR-02) — not yet made	OPEN
RR-03	Temporal decoherence of package facts	HIGH	Composite validity interval (F-SADR-14) + PilotExposure PROHIBITED	CONTROLLED
RR-04	Governance gaps absorbed by implementation defaults	MEDIUM	External dependency register extended to 14 owner decisions	CONTROLLED
RR-05	UI-only affordances becoming UI-only states	MEDIUM	IAD downstream correction (F-SADR-03)	CONTROLLED

AS. Authorization decision for Macro-Prompt A

Hard-stop criteria evaluated independently

Hard-stop criterion	Value	Status
CriticalFinding > 0	1	BREACHED
HighUncontrolledFinding > 0	1	BREACHED
ArchitectureReopenRequired	FALSE	CLEAR
FunctionalBaselineChangeRequired	TRUE	BREACHED
OpenMaterialSemanticAmbiguity > 0	3	BREACHED
ReachableIllegalMaterialState > 0	1	BREACHED
AuthorityLeakage > 0	0	CLEAR
SourceAuthorityPromotion > 0	0	CLEAR
ContractToUITraceabilityBreak > 0	2	BREACHED
UncontrolledConcurrencyPath > 0	1	BREACHED
UncontrolledIdempotencyFailure > 0	0	CLEAR

INTEGRATED_SOFTWARE_ASSURANCE_REVIEW

HOLD

ReviewID

PH6A-II-SADR-REV0

CriticalFindings

HighFindings

HighUncontrolledFindings

MediumFindings

LowFindings

OpenMaterialSemanticAmbiguity

ReachableIllegalMaterialStates

AuthorityLeakage

SourceAuthorityPromotions

ArchitectureDrift

FunctionalBaselineChangeRequired

TRUE

ArchitectureReopenRequired

FALSE

TraceabilityBreaks

ConcurrencyUncontrolledPaths

IdempotencyUncontrolledPaths

ADVRegression

16/20

BechtelizationReadiness

NOT_READY

MacroPromptA_Authorized

FALSE

Blocking finding IDs

F-SADR-01F-SADR-02F-SADR-03F-SADR-10

Affected baselines

· PH6A-FPSO-FUNCTIONAL-BASELINE-REV0
· PH6A-FPSO-FCD-REV0
· PH6A-FPSO-FCA-REV0
· PH6A-FPSO-IAD-REV1

Required correction layer

· FUNCTIONAL_CONTRACT (FC-FPSO-08, FC-FPSO-02, FC-FPSO-05) — controlled change to the frozen functional baseline
· DOWNSTREAM_DESIGN (IAD interaction corrections, validity-boundary re-evaluation, composite validity interval, SoD rule, dependency register)

Required regression

· ADV-01, ADV-03, ADV-04, ADV-05, ADV-08, ADV-10, ADV-13, ADV-16, ADV-17, ADV-20
· Illegal-state reachability set (10)
· UX→contract and contract→UX recalculation
· Testability and determinism audits

Not authorized

Bechtelization (G-FPSO-04B)Prototype implementationDemonstrationMacro-Prompt A