Define authorization-evidence source-history qualification (Phase A)

[samovers]

Summary

Related to #32; parent #10. This is the requested one-file Phase A canonical design, not runtime implementation or closure of the issue.

Primary trust boundary: authorization-evidence history classification and trusted producer determinations. Scope stayed inside that boundary. The only changed file is:

package_meta/history/clean_baseline_migration/phase_reports/authorization_evidence_source_history_qualification_rfc_candidate_v0_1.md

Base: 71ca724a8b6ec23f1655b086a6f549496d10a47f.
Review head: b9ccdc96c5b3961eb672290cd32019364b56f8e6.
Decision: OFARM-ISSUE32-AUTHORIZATION-EVIDENCE-SOURCE-HISTORY-QUALIFICATION-001, version 1, Phase A semantic approval recorded at this exact head. User approval record; exact-head review with no blocking findings. Approval covers the design only, not merge, materialization or implementation. The reviewed file's pending/proposed labels are its historical publication state; its bytes remain unchanged.

Phase A design

• Exact refusal-root and historical admission verification, using PR RFC candidate: authorization-evidence qualifying-record governance #34's approved source semantics.
• Complete authoritative snapshot enumeration before every established status. Exact source membership, provider/exhaustion proof and reply bindings remain required; no existing completeness watermark or deployed positive path is asserted.
• Deterministic six-label fold over corrections, disputes, resolution/reopening, replacement chains and competing branches. Unknown proof never becomes NONE or MIXED.
• Explicit review choices: upheld record objections and qualifier-basis objections use MIXED; replacing a correction alone does not claim that the original refusal evidence was superseded. Only explicit source controls change their branch.
• Closed internal invocation-bound producer/consumer contract, with a missing/unadmitted contract kept distinct from a valid producer's unavailable observation.
• Unchanged PR Define CP2 authorization-result qualification and public reasons (Phase A) #31 public fields, safe sentences, null rules, withholding precedence and both hidden-history-independent fallback paths.
• Nine invariants, 36 future case specifications and traceability for all ten Define authorization-evidence source-history qualification and producer contract #32 criteria, including CP2A-C01–C04 and C31–C39.

Exact dependency pins and compatibility

Source	Exact head
PR #34 source governance	c59fdbc75f26ee4694355adedd4df021f64b5131
PR #11 authorization/release scope	4494924998183fe3fa7bc1b63b76a85893335044
PR #31 public consumer	092be94f3a67497ba619295932cd0b2b1e9443f3
PR #20 human-finalization transaction	98f8c4fafbae42c8f7fd931f43f53adcb4733713
PR #26 NOT_REQUIRED transaction	e042efa2911b2ef0a61603b8e0adaa6911c03ac0
PR #29 retention/proof strength	8e0994cae5610ac9c0d2652e02c8a8a2dd7b45c5

These remain open/draft/unmerged. PR #34's version 2 approval, PR #11's renewed scope approval, and PR #31's public-design approval are inputs, not approval of this classifier. Section 3.1 exposes the newer pins and compatibility with older publication references; approved owner bytes are unchanged.

Completeness and scope limits

The actual source inventory/admission verifier, authoritative snapshot/predicate/exhaustion evidence, reply binding and trusted producer mapping are not yet bound (HSP-BIND01–04). The design is conditional on real owner-supported evidence, not a claimed working source or hypothetical guarantee. If an actual binding needs a new transaction, source-admission or access/custody guarantee, stop at that exact owner boundary before implementation.

No new writer or action is activated. The initial admitted set remains exactly ASSERT_OPERATION_CLAIM and RECEIVE_READ_DATA, with both full rules and all shared dependencies. This proposal proves neither that qualification writing can be deferred nor that it must be enabled. No second-policy workaround is proposed.

QG-DEP01, applicable QG-BIND02–05, QG-DOWN06, CP2A-DEP01, #21 and downstream G2/G3/G4 remain open. No schema, active law, current/default selection, public/transaction/custody rule, merge, promotion, extraction, deployment or OFARM2 runtime change is included. PR #359 remains at 7de8a2c4cf6eb1f293560af67e69565122c42f25.

Verification actually run

• python3 -B package_meta/tools/validate_repo_hygiene.py — passed.
• python3 -B package_meta/tools/check_generated_currentness.py — passed.
• python3 -B package_meta/tools/check_repository_cross_references.py — passed.
• python3 -B package_meta/tools/check_repository_steward_guardrails.py — passed.
• Direct document checks — passed: one new file, 448 lines, 13 tables, 131 table rows, nine invariant IDs, 36 case IDs, ten criteria, six exact local/live source pins, approval links, unchanged current six-label enum, whitespace and diff scope.
• git diff --cached --check — passed before commit.

Several repository checks exclude historical phase reports. These are document/package checks, not executed source admission, classifier conformance, authoritative completeness, runtime concurrency or privacy tests. No expensive OFARM2 baseline or manual hosted test run was started.

Review and approval

Start with sections 4–6: actual historical source coverage, complete observation, fresh-cut conditions and reply validity. Then review section 7's complete label mapping, especially upheld objections, qualifier histories and replacement focus. Finally check section 8's verifiable interface and section 9's unchanged public/retention handoff.

The exact-head review reports no blocking findings and requests no further patch. The user has now approved the Phase A design, including the three explicit mapping choices above. Keep this PR draft and unmerged; semantic approval supplies neither executable bindings nor merge authorization.

What is next: separately scope the binding-stage plan, starting with real historical-source coverage and authoritative observation/reply proof (HSP-BIND02/03), while preserving the complete selected claim/read closure. Do not begin materialization or runtime implementation from Phase A approval alone.

[samovers]

Exact-head review — no blocking findings

Reviewed b9ccdc96c5b3961eb672290cd32019364b56f8e6, unchanged when rechecked before posting. The PR remains draft and contains one new, 448-line Phase A document.

I found no must-fix semantic defect. I would not request another patch before the user's explicit Phase A semantic decision. This is not a finding that the producer is implementable or production-ready, and this COMMENT review does not grant semantic approval or merge authorization.

Reviewed document: Authorization Evidence Source-History Qualification v0.1.

Substantive review

Completeness is required before every established status—not just NONE (sections 4–6). The design requires authoritative snapshot membership, exhaustive observation, historical admission verification and reply validity. It does not let an individually valid correction, an empty search, a fresh refusal or an inactive writer stand in for complete history. It also identifies the actual source and observation bindings as unresolved rather than claiming that a digest or nominal watermark supplies them. This addresses the central trust problem in the proposal.

The graph reduction respects the source lifecycle (section 7; PR #34 sections 7–9 at c59fdbc75f26ee4694355adedd4df021f64b5131). Dispute controls operate on their explicit branches; corrections do not implicitly reopen disputes; superseding a successor does not revive its predecessors; and annotations on replaced records remain observable. The proposed classifier preserves these distinctions instead of selecting the newest record or interpreting free text as a state transition. I found no conflict between these rules and the inspected PR #34 relationship semantics.

The producer contract preserves the trust boundary (section 8). Producer authority comes from independently selected runtime bindings and the protected invocation—not from identifiers inside the response. Missing or unadmitted contracts remain binding failures, while a valid producer's inability to establish an observation may produce UNAVAILABLE. Invalid original-result proof cannot be concealed as merely unavailable history.

The read and public-response constraints remain intact (sections 6 and 9). Refreshing history cannot splice a newer observation into an older governed-read payload. The public handoff retains withholding precedence, null rules, fixed messages and the requirement that hidden history not select between a limited reply and an exclusion response. These are consistent with the inspected PR #11 section 18.5 governed-read provisions at 4494924998183fe3fa7bc1b63b76a85893335044 and PR #31 sections 5.3–6 consumer rules at 092be94f3a67497ba619295932cd0b2b1e9443f3.

Choices that should be explicitly approved

These are defensible proposed semantics, not meanings automatically supplied by the existing enum:

Situation	Proposed classification	Review assessment
An upheld record-content objection whose procedure is resolved	MIXED	Avoids falsely claiming either an open procedure or a separately admitted correction.
An outstanding or upheld objection to a qualifier's own basis	MIXED	Avoids claiming that the original refusal's authorization basis is disputed.
Replacement of a correction-only lineage	CORRECTED	Avoids claiming that the original refusal evidence itself was superseded.

Sections 7.1–7.3 make these choices explicit, and the existing generic or linked-correction public messages can express them without introducing a new status.

Remaining limits and validation

The decisive unresolved work remains HSP-BIND01–04: actual schemas, historical-source coverage, admission verification, authoritative snapshot/exhaustion evidence, reply binding and trusted producer integration. The proposal correctly leaves those open. It also proves neither that qualification writing can be deferred nor that the initial release must enable it. These are downstream binding/readiness questions, not reasons to manufacture another patch to this design document.

GitHub's repository-validation job and generated-currentness job both passed for the reviewed head. I inspected those results rather than rerunning them locally. They do not establish classifier correctness or runtime completeness. The 36 named cases remain future test specifications, with binding-dependent cases explicitly required to remain blocked or unexecuted until their prerequisites exist. No executable classifier, authoritative-observation, concurrency or privacy conformance was run as part of this review.

Recommendation: proceed to the exact-head Phase A semantic decision for decision version 1; keep the PR draft and unmerged, with CP2A-DEP01 and the source/observation/consumer bindings open. No materialization, active-law/currentness promotion, extraction, deployment or runtime implementation is authorized by this review.

[samovers]

Steward Phase A semantic approval — version 1 recorded

Recorded from the user's instruction in this task: “Approved”, following the exact-head review and the explicit explanation that approval covers the design only.

Decision: OFARM-ISSUE32-AUTHORIZATION-EVIDENCE-SOURCE-HISTORY-QUALIFICATION-001.
Version: 1.
Approved exact head: b9ccdc96c5b3961eb672290cd32019364b56f8e6.

Review 5191762787 is bound to this exact commit, reports no blocking findings and requests no further patch. The live PR head and all six pinned candidate dependency heads were checked unchanged before recording approval.

Approved design scope

Primary trust boundary: authorization-evidence history classification and trusted producer determinations. Scope stays inside the existing one-file Phase A design.

Approval covers the exact committed refusal root; historical admission verification distinct from invalidity and missing proof; complete authoritative snapshot enumeration before every established status; the reply-valid and conditional fresh-cut rules; deterministic classification of the source-governed graph; the closed, invocation-bound internal producer/consumer contract; and the unchanged public disclosure and retention handoff.

It includes the three explicit choices highlighted by review:

• A procedurally resolved but upheld record-content objection maps to MIXED, not an open dispute or an invented correction.
• An outstanding or upheld objection to a qualifier's own basis maps to MIXED, without claiming that the original refusal's authorization basis is disputed.
• Replacement of a correction-only lineage remains CORRECTED, not supersession of the original refusal evidence.

The other branch, annotation, replacement and composition rules remain exactly as reviewed. This approval does not assert objective truth from an attested qualification or change the original authorization outcome.

Limits and open work

HSP-BIND01–04 remain open: actual schemas, historical source coverage and admission verification, authoritative snapshot/predicate/exhaustion evidence, reply binding and trusted producer/consumer integration. QG-DEP01, applicable QG-BIND02–05, QG-DOWN06, CP2A-DEP01, #21 and downstream G2/G3/G4 are not closed.

The approval proves neither writer deferral nor a need to enable qualification writing. The initial complete claim/read release gains no third action, new writing/read privilege or second-policy workaround.

This is the user's semantic approval recorded by the AI, not AI-granted approval or a formal GitHub APPROVE review. It authorizes no merge, contract materialization, source/grant issuance, active-law/currentness promotion, extraction, deployment or runtime implementation. The approved owner candidates and OFARM2 PR #359 are unchanged. No conformance or runtime test was executed by recording this decision.

Keep PR #35 draft and unmerged. Keep the reviewed document bytes unchanged; its proposed/pending labels remain the historical publication state and do not require a new commit merely to record approval.

What is next: prepare the separately scoped binding-stage plan against this approved design and the complete selected claim/read dependency closure, beginning with actual historical-source coverage and observation proof (HSP-BIND02/03). Obtain direction for that next step before materialization or runtime work; do not create another writer or speculative history-service prerequisite.