Define authorization-evidence source-history qualification and producer contract

[samovers]

Current status — Phase A version 1 approved

PR #35 has the user's Phase A semantic approval for decision OFARM-ISSUE32-AUTHORIZATION-EVIDENCE-SOURCE-HISTORY-QUALIFICATION-001, version 1, at exact head b9ccdc96c5b3961eb672290cd32019364b56f8e6. Review 5191762787 reports no blocking findings and requests no further patch.

Primary trust boundary: authorization-evidence history classification and trusted producer determinations. Scope stayed inside the one-file Phase A design; no reviewed candidate bytes changed when approval was recorded.

HSP-BIND01–04, applicable source-governance bindings, CP2A-DEP01 and downstream G2/G3/G4 remain open. Actual source coverage, admission verification, authoritative snapshot/exhaustion proof, reply validity and trusted producer/consumer integration have not been delivered by design approval. No writer is enabled or shown necessary, no writer deferral is proved, and the complete initial claim/read scope is unchanged.

Keep this issue open and PR #35 draft/unmerged. Approval does not authorize contract materialization, active-law/currentness promotion, extraction, deployment, merge or runtime implementation.

The original scope and criteria below are retained. Their earlier candidate pins and future-tense publication status are historical; PR #35 section 3 records its explicit newer source pins and compatibility assessment. No other owner's approval is altered.

What is next: separately scope the binding-stage plan, beginning with actual historical-source coverage and observation/reply proof under HSP-BIND02/03. Do not treat this approval as CP2A-DEP01 closure or permission to add a writer.

---

Parent: #10.

Required by: #30 / PR #31 through open dependency CP2A-DEP01, and the applicable complete-binding and acceptance/admission gates under #21. Downstream: samovers/OFARM2#353 / PR #359, samovers/OFARM2#178, and a bounded samovers/OFARM2#176 child.

This is a canonical contract prerequisite, not an OFARM2 runtime implementation issue. Creating it does not close CP2A-DEP01 or approve its new semantic choices.

Primary trust boundary and intended PR

The intended first PR changes one non-authoritative Phase A document in package_meta/history/clean_baseline_migration/phase_reports/. A proposed filename is authorization_evidence_source_history_qualification_rfc_candidate_v0_1.md; this is a future destination, not an existing or approved contract. Branch from canonical main and reference the exact approved candidates without copying or editing them. Do not append this owner work to PR #31 or silently amend PR #11.

Primary trust boundary: authorization-evidence history classification and trusted producer determinations. The independently reviewable outcome is a contract for establishing what an exact evidence record's governed history means at a defensible observation point. It does not create permission to correct evidence, change the original authorization outcome, or publish protected details.

Why this is needed

The approved public design, sections 5.4 and 11.1, requires an owner-produced history qualification for committed refusals in both fresh and historical replies. Its approval record explicitly leaves the producer contract open.

Existing sources establish only part of the chain:

• The Constitution AAI-C.1–1.1 and Platform AAI-P.6–6.1 require truthful qualification and prohibit hidden governance or material limitations.
• The accepted CP2 RFC, sections 2–3 and 9, requires applicable correction/dispute/supersession qualification without creating truth from the public response.
• The current ResultQualificationEnvelope schema supplies six labels: NONE, OPEN_DISPUTE, DISPUTED_BASIS, CORRECTED, SUPERSEDED, and MIXED. Labels alone do not define a classifier or prove completeness.
• PR #11 at its approved head, section 17.2, permits immutable authorization evidence and new linked correction/failure records. It does not supply this classifier, its producer interface, or observation/completeness rules.

In plain English: the public response has an approved place to say that its evidence was corrected, disputed or superseded, but no complete contract yet tells a trusted component how to establish that fact. Reporting an intact original record, an empty visible search, or a very recent commit cannot fill the gap.

Exact source anchors

Live PR heads matched these anchors on 2026-09-10. All five PRs were open, draft and unmerged; semantic approval does not make their contents active law.

Source	Exact head and relevance
Canonical main	71ca724a8b6ec23f1655b086a6f549496d10a47f; baseline and accepted CP2 authority
PR #11	03a21f669ee04f96d444e14f00ae7212cab04803; evidence owner, append-only correction limits, four-package design and staged delivery
PR #31	092be94f3a67497ba619295932cd0b2b1e9443f3; approved public consumer, CP2A-DEP01 and C31–C39
PR #20	98f8c4fafbae42c8f7fd931f43f53adcb4733713; separate human-finalization transaction owner
PR #26	e042efa2911b2ef0a61603b8e0adaa6911c03ac0; separate NOT_REQUIRED transaction/reconciliation owner
PR #29	8e0994cae5610ac9c0d2652e02c8a8a2dd7b45c5; separate retention and proof-strength owner

Outcome and acceptance criteria

Define the smallest compatible owner-side contract that lets a trusted consumer verify a qualification for one exact committed authorization-evidence source at a governed observation point. The first consumer is the approved CP2 refusal response, in both CURRENT_ATTEMPT and RECORDED_RESULT modes. Do not expand to classifying all farm/domain history.

1. Source inventory and minimum carrier. Identify the existing evidence records, governed correction/dispute/supersession relationships and policy inputs that can support a determination. Prefer a bounded profile/binding within PR RFC candidate: executable authorization evidence v0.2 #11's proposed evidence packages where it fits. Explain any need for a separate carrier; do not invent a history store, registry or durable receipt merely to hold a status. Missing authoritative input semantics must be named rather than assumed.
2. Producer responsibility and authority. Name the responsible producer, the governed basis permitting it to classify the source, and how the consumer verifies that provenance and scope. Neither a caller flag, a public response, an authenticated identity alone nor the public projector acquires classification authority. This contract consumes existing governance for accepting/correcting evidence; it does not grant correction-writing authority.
3. Exact source binding. Bind the determination to the correct evidence kind and immutable source identity/content, tenant/scope context and applicable versioned rules. Define which related committed evidence belongs to that source and what is out of scope. A correction to another request, another evidence record or another tenant cannot qualify this one. The original result, original time and source bytes remain unchanged.
4. Deterministic status meanings. Define the authorization-evidence meanings and complete mapping for the six existing CP2 labels. Distinguish a dispute about the evidence from disputed supporting basis, a correction from supersession, and concurrent/multiple applicable qualifications from a later unrelated authorization decision. Define precedence/composition and unsupported, contradictory or unresolved-input handling without inventing a seventh public label, silently picking the newest record, or treating failure to classify as NONE. These mapping choices require later semantic review; issue creation does not approve them.
5. Observation and completeness. Define the authoritative observation point and the real evidence supporting its completeness for the relevant source history. Distinguish the original decision time, correction event/effective time, history observation time and outward projection time. Cover late arrival, concurrent linked evidence, replay/reordering and partial/stale history. An intact digest, filtered query, stale cache, unverified checkpoint or empty result is insufficient by itself. Do not specify a fictional watermark that no governed source can supply.
6. Fresh-refusal rule. Decide explicitly whether, and under what proven conditions, an owner determination made at the refusal commit can establish NONE. Explain the concurrent-correction case and what happens when completeness cannot be established. Commit recency alone never proves NONE. State the required transaction-owner guarantee without changing isolation, locking, commit/reconciliation rules or adding a second commit here; any necessary change to those guarantees becomes a separate prerequisite.
7. Verifiable input/output contract. Specify closed, versioned producer input/output bindings and a consumer verification procedure, including exact source/rule binding, observation evidence and failure/unavailability behavior. Distinguish an unavailable determination for a valid source from an absent or unadmitted producer contract. A schema-valid result with fabricated time, substituted source, unsupported version or caller-selected policy must not count as a trusted determination.
8. Public and retention compatibility. Keep producer knowledge separate from permission to disclose it. Preserve PR Define CP2 authorization-result qualification and public reasons (Phase A) #31's AVAILABLE/non-null versus UNAVAILABLE/WITHHELD/null rules, WITHHELD precedence, required safe messages and history-independent fallback. Internal provenance and correction references do not become public fields or access credentials. Preserve PR RFC: authorization evidence retention and proof strength (Phase A) #29's retained-byte/digest-only and missing-byte limits; do not change custody or invent a reconstruction claim. Preserve all original authorization outcomes, action eligibility and retry restrictions.
9. Traceable examples and hostile cases. Map every acceptance criterion to invariants and named case specifications, with the public-consumer handoff linked to PR Define CP2 authorization-result qualification and public reasons (Phase A) #31 C31–C39 and the fresh-refusal rows C01–C04. Distinguish schema-invalid cases, semantic/source-verification failures and later runtime/concurrency/privacy tests. Do not present the initial Phase A examples as executable proof.
10. Exact later units and closure gates. Identify the future non-default profile/schema, source/rule bindings, producer and consumer fixtures, conformance manifest/checker, and their owners. Materialization must use actual reviewed bytes and digests, not placeholders. Explain how accepted governance, binding review, conformance, promotion and extraction will be obtained under the existing staged process. Phase A approval alone must leave CP2A-DEP01 open until the required owner contract is governed and bound.

Required case coverage

The future design must specify at least these situations; this table is a required coverage checklist, not an approved classifier or test result.

Situation	Required distinction to prove
Fresh refusal with a valid, complete owner determination	NONE is justified by the governed evidence, not by freshness
Fresh refusal without that determination, including a concurrent correction	No invented NONE or claim that the missing producer is implemented
Historical source with each applicable correction/dispute/supersession posture	Deterministic classification, including mixed inputs, without rewriting the original outcome
Qualifying-record lifecycle and chains	Where existing evidence governance supports them, cover corrections to corrections, dispute resolution/reopening, and supersession chains or competing successors. Define their effect at each observation point; reject or explicitly handle cycles and unsupported relationships; preserve the original authorization outcome. Missing relationship or authoring semantics remain a named dependency, not permission for the classifier to invent them.
Later denial/allowance under changed permissions	No automatic correction or supersession of earlier evidence
Partial, stale, filtered, missing, contradictory or unrecognized history inputs	Explicit failure/unavailability as governed; no confident clean-history claim
Wrong tenant, source, content binding, policy version or producer authority	Rejection of the substituted/untrusted determination
Before/after observation cut, late arrival, reordered/replayed links and concurrent updates	One defensible observation meaning; no backdated point chosen to hide material history
Known status but hidden details, or hidden status itself	Existing CP2 disclosure rules apply without exposing internal provenance
Equivalent readable originals differing only in hidden history	Both limited replies and exclusion fallbacks obey C38; actual adapter testing belongs to the later runtime stage
Missing producer contract versus temporary producer unavailability	Missing governance/binding remains a readiness blocker even if a limited public reply is otherwise permitted

Scope fences and stop rules

Responsibility	Owner retained outside this prerequisite
Original authorization outcome, action rules, grants, principal/actorship and retry authority	Existing authorization and transaction owners; no second evaluator
Authority to create, accept, correct or supersede evidence	Existing evidence governance; unsupported authoring authority requires a separate owner decision
Public envelope, registered codes, display and permission-limited fallback	Approved PR #31; a conflict returns for separate public-design review, not an edit in this producer PR
Commit/locking/isolation, idempotency and reconciliation	PR #20 / PR #26 and their runtime owners
Retention, byte access, deletion/redaction and key custody	PR #29 and separately governed storage/custody work
Active-law acceptance, current/default selection, extraction and deployment	Existing separately authorized governance stages

If the producer cannot establish completeness without a new write-authority rule, source record, transaction guarantee or custody behavior, identify the exact missing guarantee and propose the corresponding separate dependency before editing that boundary. Such changes require their own scoped work and cannot be included merely to complete the classifier. Do not claim a deployable producer while that input remains unavailable.

Staged delivery and definition of done

1. When separately authorized, produce the one-file Phase A candidate, grounded in exact active sources and the approved candidate pins. Review its actual status/authority/completeness choices and obtain exact-head semantic approval. Keep PR Define CP2 authorization-result qualification and public reasons (Phase A) #31's approved bytes unchanged.
2. When separately authorized, materialize the non-default producer contract and its real source bindings, with exact bytes/digests and conformance evidence appropriate to that stage. Coordinate the separately owned public-consumer bindings without combining trust boundaries.
3. Complete the applicable accepted-governance, binding, conformance and promotion/extraction gates in their existing order. Only record CP2A-DEP01 as closed when the owner contract actually exists in the governed state required by its consumer and those exact bindings are verified. A design approval, green package check or synthetic fixture does not suffice.
4. Separately plan and authorize production producer/consumer implementation and real privacy/concurrency evidence. This issue does not reorder the broader OFARM2 destination: #353 / PR #359, then #178, then a bounded #176 child. It does not claim that completing this one prerequisite closes the other G2/G3/G4 or Promote executable authorization constraints and decision evidence RFC v0.2 #21 gates.

Verification and limits

For the initial one-file Phase A candidate, verify exact source pins, owner/consumer compatibility, criterion-to-invariant-to-case traceability, Markdown/table structure, whitespace and one-boundary scope. Run the existing cheap canonical hygiene, generated-currentness, cross-reference and steward-guardrail checks, noting that several exclude the historical candidate lane. Their success is not semantic approval or proof of runtime privacy, concurrency or persistence behavior.

Later contract and producer/consumer work must use real governed source bindings and execution evidence appropriate to each stage. Preserve the separate disclosure, transaction, correction-writing and custody owners. No new authority, active-law change, current/default promotion, extraction, merge, deployment or runtime implementation follows from issue creation or Phase A approval.

What is next: take up the bounded one-file Phase A design when authorized, then obtain exact-head review and semantic approval before later contract or runtime work. Keep CP2A-DEP01 open until the producer contract is actually governed and bound.

[samovers]

Review — ready for the bounded Phase A design

No blocking issue-level findings. Issue #32 accurately identifies the missing contract, assigns it to the correct owner, and keeps it separate from public disclosure, transaction execution, and evidence-correction authority. It is ready to guide the proposed one-file candidate when separately authorized—not implementation or closure of CP2A-DEP01.

This is an issue-scope review, not semantic approval of a classifier, authorization to undertake later stages, or approval to merge.

What checks out

The dependency is real, not invented process. PR #31 at its approved head, §11.1, explicitly says the existing sources do not define the authorization-evidence classifier, producer interface, or authoritative observation point. Its exact-head approval explicitly leaves that dependency open. Issue #32 addresses that missing input rather than reopening the approved public-response design.

It preserves the distinction between interpreting evidence and changing evidence. PR #11 at its approved head, §17.2, permits new linked correction/failure records while preserving the original evidence. Issue #32 does not turn that permission into an invented correction workflow or give the classifier permission to rewrite the original authorization result. Preferring a bounded profile within the existing evidence packages is consistent with PR #11’s effort to avoid unnecessary contract families.

The completeness requirement targets the actual failure mode. The issue correctly rejects “the original digest is intact,” “the query returned nothing,” and “the refusal was just committed” as sufficient proof of NONE. It also requires the designer to identify a real observation/completeness mechanism rather than inventing a watermark. That matches PR #31 §5.4, including its fresh-refusal rule.

The public/privacy handoff is preserved. The issue retains AVAILABLE versus UNAVAILABLE versus WITHHELD, the null-field rules, withholding precedence, and C38’s protection against revealing hidden history through the choice of fallback. It does not assume that a producer’s knowledge creates permission to disclose that knowledge. These are substantive compatibility requirements, not merely matching field names.

The delivery limits are appropriately explicit. A candidate, synthetic fixture, passing schema check, or permanently unavailable implementation cannot close the dependency. The issue retains the separate binding, acceptance, conformance, promotion, extraction, and runtime stages rather than treating semantic approval as permission to implement. This is consistent with PR #11 §24 and #21.

Non-blocking addition: test the history of the qualifying records themselves

The required cases cover mixed inputs, concurrent updates, replay/reordering, and unrelated later authorization decisions. They do not explicitly call out a qualifying record that is itself subsequently corrected, resolved, or superseded. The broad acceptance criteria could encompass this, so this is not an issue blocker—but an explicit case would remove an avoidable ambiguity.

For example, the candidate should address an original evidence record with a linked correction that later receives another correction, or a dispute that later receives a governed resolution. Otherwise, a simplistic implementation could classify from direct links only, keep every historical dispute permanently open, or clear a qualification merely because a newer record exists.

Suggested additional coverage row:

Qualification-record lifecycle and chains: Where supported by existing evidence governance, cover corrections to corrections, dispute resolution/reopening, and supersession chains or competing successors. Define their effect at each observation point, reject or explicitly handle cycles and unsupported relationships, and preserve the original authorization outcome. Missing relationship or authoring semantics remain a named dependency, not permission for the classifier to invent them.

This requests a reviewed answer; it does not prescribe a new lifecycle or approve any particular mapping to the six public labels.

Main risk to watch in the candidate

The difficult part is establishing what history was completely observed—not assigning an enum once the facts are known.

Review the candidate’s source inventory and observation contract before spending much effort on its schema shape. It must distinguish a complete view of governed history at a defensible observation cut from a claim that no later or late-arriving correction can exist. It must also explain when that observation remains valid for the reply. PR #31 §5.4 already rejects an old checkpoint selected to conceal a known material qualification.

If the proposed completeness proof depends on a transaction guarantee or governed relationship that does not exist, the correct result is the exact missing prerequisite—not a plausible-looking producer contract built around assumed inputs. Issue #32 already contains the necessary stop rule.

Recommended next step: the separately authorized one-file Phase A candidate. The issue does not need a broader rewrite or another speculative architecture ticket first. Add the qualifier-lifecycle case, then make the actual sources and completeness guarantee the first design checkpoint. Keep CP2A-DEP01 open until its governed owner contract and exact consumer bindings satisfy the existing gates.

[samovers]

Review response and source checkpoint

The user's “go” authorized the non-blocking lifecycle-case addition and the bounded Phase A source check. The required case now covers corrections to corrections, dispute resolution/reopening, supersession chains/competing successors, cycles and unsupported relationships only where existing governance supports them. The ten acceptance criteria are unchanged, and the amended body was read back.

The source checkpoint found an input-governance blocker before the classifier can be fully drafted. This is not a blocker merely because future schema bytes have not been materialized.

Evidence

• PR #11 section 17.2 permits immutable authorization evidence and new linked corrections/later failures. It does not close the qualifying record's admitted authoring basis, typed relationship or lifecycle. A later failure record is not automatically a correction.
• PR #11's closed target sets and PR #17's exact review-target mapping do not include authorization evidence as an attachment primary target or final-review target. The current ReviewDecision v0.1 family enum does not include it either. Generic review authority cannot silently be widened.
• SemanticEventEnvelope and CommitIngressRequest/Result supply event, reference, time and commit vocabulary, not a complete typed authorization-evidence relationship inventory. The accepted evidence-handling and temporal rules preserve history but do not supply this missing admission/lifecycle contract.
• PR #20 section 10 and PR #26 section 8 already require complete positive/negative/set guards for their operations. Those are valid design inputs, but do not identify the qualifying history set or its writers. Materialization freshness vectors likewise record an observed version envelope, not proof of complete authorization-evidence history.

Concrete counterexample: an immutable refusal D is followed by a generic EvidenceEvent E that references D and describes itself as a correction. Envelope validity alone does not prove E's authority to correct D rather than record an allegation or later failure. If E2 then references E, the sources do not establish whether it corrects, withdraws, resolves, reopens or replaces that qualification. A classifier cannot invent those effects from links or prose. D's original outcome stays unchanged.

Completeness must cover all eligible committed records at a defensible cut, not prove that no future correction can exist. The source owner must first identify the eligible set and authoritative admission/visibility semantics. Then #32 can test whether the existing transaction guards supply an actual reply-valid observation proof. No fictional watermark or automatic new transaction architecture is justified here. A fresh commit alone still cannot establish NONE; permitted UNAVAILABLE/WITHHELD replies do not close CP2A-DEP01.

Smallest proposed next owner decision — not created

Propose “Define governed qualifying records for authorization evidence”, under the existing authorization-evidence owner and linked as an input prerequisite of #32.

Its separate primary trust boundary is admission authority and lifecycle of qualifying evidence records: identify the permitted writer/act and target eligibility, immutable source/relationship/provenance bindings, supported lifecycle and existing commit/visibility mechanism. Do not select a new action, actor permission or carrier by assumption. Any necessary action/target-authority, ReviewDecision-result or transaction change must be exposed as a separately scoped owner amendment, not bundled into the classifier or silently added to an approved candidate.

The focused issue inventory found no dedicated qualifying-record governance issue. No further issue has been created, and no standalone transaction issue is proposed before the source set is settled.

Primary boundary for this work remained authorization-evidence history classification and trusted producer determinations. Scope stayed inside source inspection, the requested case amendment and dependency reporting. No other owner rule, candidate, active schema/law, runtime, approval, merge, promotion or extraction changed; no new worktree, candidate or PR was created. PR #31 remains unchanged at 092be94f3a67497ba619295932cd0b2b1e9443f3. This is a focused source checkpoint, not a full runtime audit or executed concurrency/privacy proof.

What is next: obtain direction for that bounded source-governance prerequisite, or an exact existing owner contract that closes the identified gap; then resume #32's classifier/completeness design. Keep CP2A-DEP01 and the existing OFARM2 #353 → #178 → bounded #176 gates open.