TRUST-001 — One canonical derived report and no weaker downstream trust

[chaoz23]

Priority: P0
Type: architecture/trust/UX
Size: L

Problem

On the authorized live sheet, derive --brief correctly marks AC and spell preparation/slots for confirmation, while QA labels uncertain fields OK, quiz privately grades against the uncertain AC and omits missing slot questions, and stance/seatpack/intake present downstream values without equivalent warning. Trust evaporates as data is projected.

Proposed contract

Every field in DerivedCharacterV1 carries:

{
  "value": null,
  "state": "trusted | confirm | unsupported | unknown | invalid | not_applicable",
  "formula": null,
  "inputs": [],
  "sources": [],
  "rules_profile": null,
  "findings": [],
  "confidence": null,
  "authority": "source | player | dm | rules_engine | session_host",
  "as_of": null,
  "stale": false,
  "sensitivity": "mechanical | persona | player_private | dm_private"
}

Views may omit detail but may never improve state or remove a material finding.

Acceptance criteria

• Define and version one canonical report schema used by CLI, MCP, brief, report, QA, stance, quiz, seatpack, intake, and future UI.
• Trust state is field-level and distinguishes numeric base values from conditional defenses/advantages.
• Quiz never supplies an expected answer for a confirm, unsupported, unknown, or invalid field.
• Stance either marks uncertain inputs inline or declines dependent calculations.
• Aggregate readiness/status is derived from canonical findings with documented severity thresholds.
• Every projection carries engine/schema/rules versions, source fingerprint, and as_of.
• Observed build facts, deterministic derivations, player declarations, DM rulings, and mutable session facts retain distinct authority and freshness.
• Role filtering, summarization, context truncation, and dependent agent calculations may never improve trust state or remove a material warning.
• Unknown global scope prevents “everything clean/trusted.”
• A projection-invariant test enumerates every canonical field and proves output state is equal or more conservative in every view.

Test plan

• Golden authorized-sheet replacement; synthetic uncertain AC/slots/speed/defense; unhandled unknown; cross-view property tests; backward-compat fixtures.

Dependencies

Architectural prerequisite for QA-001, CLI-001, MCP-001, UX-001, and WORKFLOW-001.

[chaoz23]

Progress in draft PR #31 (head 8b90565): source omissions now carry a typed, fingerprinted mechanical-family scope through canonical reports, snapshots, diffs, CLI, and MCP projections. Reviewed display/provenance omissions are trust-neutral; reviewed mechanical omissions are unsupported; genuinely novel paths still fail closed as global unknown. The supplied authorized live character now has zero unknown families, while its aggregate remains unsupported because the current scoped union reaches all 21 families.

This materially advances canonical trust routing but does not satisfy this issue's complete acceptance criteria. Selection dependencies and live mechanics coverage remain open; the issue should stay open.

[chaoz23]

Concrete suite integration evidence is available in draft PRs #32 and
chaoz23/table-kit#15.

PR #32 projects the canonical field-assessment map without character values.
Trusted fields are evaluated; unsupported, unknown, invalid, and unresolved
non-authority confirmations fail closed. Mutable player-authority fields remain
outside evaluator authority and become explicit advisories requiring
player/session-host reconciliation. Output is always self_attested.

Table-kit #15 pins exact commit
e6ef29f5beb8f7bae972865e724988c932ebf708, cold-installs both wheels outside
their checkouts, and validates six paths with the actual shared JSON Schema and
semantic validator. Hosted Python 3.9/3.12/3.14, cold-wheel, and four-tool gates
are green. This does not close the broader canonical-trust acceptance criteria
or authorize a release.