From a2b254786e43d6e29b2e603ae991f84074755f74 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 5 Sep 2026 21:16:29 +0200 Subject: [PATCH] Introduce shared evidence model and governance imports Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a070b5-4994-7271-bd8b-7c3dbcedec4b --- WORK-RECORDS.md | 4 + canon.yaml | 7 +- .../agent/briefs/model-access-control.md | 1 + infospace/agent/briefs/model-capability.md | 1 + infospace/agent/briefs/model-data.md | 1 + infospace/agent/briefs/model-devsecops.md | 1 + infospace/agent/briefs/model-evidence.md | 34 ++++ infospace/agent/briefs/model-governance.md | 3 +- .../agent/briefs/model-information-space.md | 1 + infospace/agent/briefs/model-landscape.md | 1 + infospace/agent/briefs/model-network.md | 1 + infospace/agent/briefs/model-observability.md | 3 +- infospace/agent/briefs/model-organization.md | 1 + infospace/agent/briefs/model-security.md | 3 +- infospace/agent/briefs/model-task.md | 1 + infospace/agent/briefs/standard-caring.md | 1 + infospace/agent/briefs/standard-tagging.md | 1 + infospace/agent/global-agent-brief.md | 6 +- infospace/agent/retrieval-index.json | 116 ++++++++++- infospace/agent/retrieval-index.md | 42 ++-- infospace/agent/retrieval-index.yaml | 71 ++++++- infospace/artifacts/index.yaml | 41 ++++ infospace/indexes/artifact-tree.yaml | 8 +- infospace/indexes/concept-ownership.yaml | 22 ++- infospace/indexes/import-matrix.yaml | 35 ++++ infospace/infospace.yaml | 2 + infospace/kernel/InfoTechCanonKernelMap.md | 19 +- .../InfoTechCanonAccessControlModel.md | 3 +- .../InfoTechCanonCapabilityModel.md | 4 +- .../models/data/InfoTechCanonDataModel.md | 3 +- .../devsecops/InfoTechCanonDevSecOpsModel.md | 3 +- .../evidence/InfoTechCanonEvidenceModel.md | 187 ++++++++++++++++++ .../InfoTechCanonGovernanceModel.md | 56 +++--- .../InfoTechCanonInformationSpaceModel.md | 2 +- .../network/InfoTechCanonNetworkModel.md | 2 +- .../InfoTechCanonObservabilityModel.md | 2 +- .../InfoTechCanonOrganizationModel.md | 3 +- .../security/InfoTechCanonSecurityModel.md | 3 +- .../models/task/InfoTechCanonTaskModel.md | 3 +- ...TechCanonCaringAccessGovernanceStandard.md | 2 +- .../tagging/InfoTechCanonTaggingStandard.md | 2 +- infospace/views/by-concept.md | 7 +- infospace/views/by-mapping-target.md | 19 ++ infospace/views/by-standard.md | 6 +- infospace/views/import-matrix.md | 157 +++++++-------- infospace/views/kernel-overview.md | 10 +- infospace/views/repository-tree.md | 4 +- intakes/intakes.md | 1 + src/info_tech_canon/generation.py | 3 +- tests/test_cli.py | 2 +- tests/test_evidence_boundary.py | 28 +++ tests/test_service.py | 10 +- .../INFO-WP-0020-shared-evidence-model.md | 74 +++++++ workplans/index.yaml | 8 + 54 files changed, 854 insertions(+), 177 deletions(-) create mode 100644 infospace/agent/briefs/model-evidence.md create mode 100644 infospace/models/evidence/InfoTechCanonEvidenceModel.md create mode 100644 tests/test_evidence_boundary.py create mode 100644 workplans/INFO-WP-0020-shared-evidence-model.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 50c0ff9..f9e6462 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -10,6 +10,7 @@ | --- | --- | --- | --- | --- | | workplan | ITC-WP-ADHOC-2026-08-15 | finished | — | workplans/ADHOC-2026-08-15.md | | workplan | INFO-WP-0019 | blocked | — | workplans/INFO-WP-0019-conformance-and-maintenance.md | +| workplan | INFO-WP-0020 | finished | — | workplans/INFO-WP-0020-shared-evidence-model.md | | workplan | ITC-WP-0001 | finished | — | workplans/ITC-WP-0001-infospace-scaffold-and-seed-placement.md | | workplan | ITC-WP-0002 | finished | — | workplans/ITC-WP-0002-service-surface-cli-json-api.md | | workplan | ITC-WP-0003 | finished | — | workplans/ITC-WP-0003-validation-indexes-and-generated-views.md | @@ -37,6 +38,9 @@ | task | INFO-WP-0019-T04 | done | — | workplans/INFO-WP-0019-conformance-and-maintenance.md | | task | INFO-WP-0019-T05 | done | — | workplans/INFO-WP-0019-conformance-and-maintenance.md | | task | INFO-WP-0019-T06 | wait | — | workplans/INFO-WP-0019-conformance-and-maintenance.md | +| task | INFO-WP-0020-T01 | done | — | workplans/INFO-WP-0020-shared-evidence-model.md | +| task | INFO-WP-0020-T02 | done | — | workplans/INFO-WP-0020-shared-evidence-model.md | +| task | INFO-WP-0020-T03 | done | — | workplans/INFO-WP-0020-shared-evidence-model.md | | task | ITC-WP-0001-T01 | done | — | workplans/ITC-WP-0001-infospace-scaffold-and-seed-placement.md | | task | ITC-WP-0001-T02 | done | — | workplans/ITC-WP-0001-infospace-scaffold-and-seed-placement.md | | task | ITC-WP-0001-T03 | done | — | workplans/ITC-WP-0001-infospace-scaffold-and-seed-placement.md | diff --git a/canon.yaml b/canon.yaml index f011d3a..699a320 100644 --- a/canon.yaml +++ b/canon.yaml @@ -1,7 +1,7 @@ repository: info-tech-canon title: InfoTechCanon status: service-baseline -version: 0.7.0 +version: 0.8.0 description: > An evolving, markdown-first canon for building interoperable, adaptable, and extensible information-processing systems. @@ -61,6 +61,11 @@ models: title: InfoTechCanonGovernanceModel path: infospace/models/governance/InfoTechCanonGovernanceModel.md status: RC1-seed + - id: itc-evid + title: InfoTechCanonEvidenceModel + path: infospace/models/evidence/InfoTechCanonEvidenceModel.md + status: draft + version: 0.1.0 - id: itc-task title: InfoTechCanonTaskModel path: infospace/models/task/InfoTechCanonTaskModel.md diff --git a/infospace/agent/briefs/model-access-control.md b/infospace/agent/briefs/model-access-control.md index 2d1c081..8627509 100644 --- a/infospace/agent/briefs/model-access-control.md +++ b/infospace/agent/briefs/model-access-control.md @@ -20,6 +20,7 @@ generated: true Imports and anchors: - `kernel/itc-core` +- `model/evidence` - `model/governance` - `model/organization` diff --git a/infospace/agent/briefs/model-capability.md b/infospace/agent/briefs/model-capability.md index d9b469c..0992e86 100644 --- a/infospace/agent/briefs/model-capability.md +++ b/infospace/agent/briefs/model-capability.md @@ -21,6 +21,7 @@ generated: true Imports and anchors: - `catalog/evidence-basis` - `kernel/itc-core` +- `model/evidence` - `model/governance` - `model/landscape` - `model/observability` diff --git a/infospace/agent/briefs/model-data.md b/infospace/agent/briefs/model-data.md index 5376eb7..ff25612 100644 --- a/infospace/agent/briefs/model-data.md +++ b/infospace/agent/briefs/model-data.md @@ -20,6 +20,7 @@ generated: true Imports and anchors: - `kernel/itc-core` +- `model/evidence` - `model/governance` ## Owned Concepts diff --git a/infospace/agent/briefs/model-devsecops.md b/infospace/agent/briefs/model-devsecops.md index ef79f76..af483d6 100644 --- a/infospace/agent/briefs/model-devsecops.md +++ b/infospace/agent/briefs/model-devsecops.md @@ -20,6 +20,7 @@ generated: true Imports and anchors: - `kernel/itc-core` +- `model/evidence` - `model/security` ## Owned Concepts diff --git a/infospace/agent/briefs/model-evidence.md b/infospace/agent/briefs/model-evidence.md new file mode 100644 index 0000000..ceb6c1e --- /dev/null +++ b/infospace/agent/briefs/model-evidence.md @@ -0,0 +1,34 @@ +--- +id: agent-brief/model-evidence +artifact_id: model/evidence +source_path: models/evidence/InfoTechCanonEvidenceModel.md +source_kind: model +generated: true +--- + + + +# Agent Brief: InfoTechCanon Evidence Model + +- Artifact ID: `model/evidence` +- Kind: `model` +- Canonical path: `models/evidence/InfoTechCanonEvidenceModel.md` +- Full source: `models/evidence/InfoTechCanonEvidenceModel.md` +- Summary: Domain model used by canon profiles and standards: InfoTechCanon Evidence Model. + +## Retrieval Hints + +Imports and anchors: +- `kernel/itc-core` + +## Owned Concepts + +- `Adjudication Outcome` +- `Evidence` +- `Evidence Source` +- `Evidence strength` +- `InfoTechCanon Evidence Model` + +## Related Distinctions + +- **Policy vs Control vs Evidence**: Governance owns policy and control; ITC-EVID owns the distinct evidence assertion and its addressable source. Evidence supports a stated interest without guaranteeing truth. diff --git a/infospace/agent/briefs/model-governance.md b/infospace/agent/briefs/model-governance.md index 12f9c48..14cfbaa 100644 --- a/infospace/agent/briefs/model-governance.md +++ b/infospace/agent/briefs/model-governance.md @@ -20,6 +20,7 @@ generated: true Imports and anchors: - `kernel/itc-core` +- `model/evidence` ## Owned Concepts @@ -27,4 +28,4 @@ Imports and anchors: ## Related Distinctions -- **Policy vs Control vs Evidence**: Policy states intent or rule, control implements or enforces that rule, and evidence records why the claim should be trusted. +- **Policy vs Control vs Evidence**: Governance owns policy and control; ITC-EVID owns the distinct evidence assertion and its addressable source. Evidence supports a stated interest without guaranteeing truth. diff --git a/infospace/agent/briefs/model-information-space.md b/infospace/agent/briefs/model-information-space.md index eea3ddd..f9e9901 100644 --- a/infospace/agent/briefs/model-information-space.md +++ b/infospace/agent/briefs/model-information-space.md @@ -20,6 +20,7 @@ generated: true Imports and anchors: - `kernel/itc-core` +- `model/evidence` ## Owned Concepts diff --git a/infospace/agent/briefs/model-landscape.md b/infospace/agent/briefs/model-landscape.md index 4911ef3..32c88d0 100644 --- a/infospace/agent/briefs/model-landscape.md +++ b/infospace/agent/briefs/model-landscape.md @@ -20,6 +20,7 @@ generated: true Imports and anchors: - `kernel/itc-core` +- `model/evidence` ## Owned Concepts diff --git a/infospace/agent/briefs/model-network.md b/infospace/agent/briefs/model-network.md index d8929d6..3da3ed3 100644 --- a/infospace/agent/briefs/model-network.md +++ b/infospace/agent/briefs/model-network.md @@ -20,6 +20,7 @@ generated: true Imports and anchors: - `kernel/itc-core` +- `model/evidence` - `model/security` ## Owned Concepts diff --git a/infospace/agent/briefs/model-observability.md b/infospace/agent/briefs/model-observability.md index b32b0d9..1e966bd 100644 --- a/infospace/agent/briefs/model-observability.md +++ b/infospace/agent/briefs/model-observability.md @@ -20,6 +20,7 @@ generated: true Imports and anchors: - `kernel/itc-core` +- `model/evidence` - `model/task` ## Owned Concepts @@ -28,4 +29,4 @@ Imports and anchors: ## Related Distinctions -- **Policy vs Control vs Evidence**: Policy states intent or rule, control implements or enforces that rule, and evidence records why the claim should be trusted. +- **Policy vs Control vs Evidence**: Governance owns policy and control; ITC-EVID owns the distinct evidence assertion and its addressable source. Evidence supports a stated interest without guaranteeing truth. diff --git a/infospace/agent/briefs/model-organization.md b/infospace/agent/briefs/model-organization.md index eb22190..3fead0a 100644 --- a/infospace/agent/briefs/model-organization.md +++ b/infospace/agent/briefs/model-organization.md @@ -20,6 +20,7 @@ generated: true Imports and anchors: - `kernel/itc-core` +- `model/evidence` ## Owned Concepts diff --git a/infospace/agent/briefs/model-security.md b/infospace/agent/briefs/model-security.md index 64c49f1..cf48924 100644 --- a/infospace/agent/briefs/model-security.md +++ b/infospace/agent/briefs/model-security.md @@ -21,6 +21,7 @@ generated: true Imports and anchors: - `kernel/itc-core` - `model/access-control` +- `model/evidence` ## Owned Concepts @@ -28,4 +29,4 @@ Imports and anchors: ## Related Distinctions -- **Policy vs Control vs Evidence**: Policy states intent or rule, control implements or enforces that rule, and evidence records why the claim should be trusted. +- **Policy vs Control vs Evidence**: Governance owns policy and control; ITC-EVID owns the distinct evidence assertion and its addressable source. Evidence supports a stated interest without guaranteeing truth. diff --git a/infospace/agent/briefs/model-task.md b/infospace/agent/briefs/model-task.md index d4673d2..a2638b1 100644 --- a/infospace/agent/briefs/model-task.md +++ b/infospace/agent/briefs/model-task.md @@ -20,6 +20,7 @@ generated: true Imports and anchors: - `kernel/itc-core` +- `model/evidence` ## Owned Concepts diff --git a/infospace/agent/briefs/standard-caring.md b/infospace/agent/briefs/standard-caring.md index 0a59594..4e28174 100644 --- a/infospace/agent/briefs/standard-caring.md +++ b/infospace/agent/briefs/standard-caring.md @@ -23,6 +23,7 @@ Imports and anchors: - `model/access-control` - `model/data` - `model/devsecops` +- `model/evidence` - `model/governance` - `model/network` - `model/observability` diff --git a/infospace/agent/briefs/standard-tagging.md b/infospace/agent/briefs/standard-tagging.md index a2ae4c1..9f73515 100644 --- a/infospace/agent/briefs/standard-tagging.md +++ b/infospace/agent/briefs/standard-tagging.md @@ -20,6 +20,7 @@ generated: true Imports and anchors: - `kernel/itc-core` +- `model/evidence` - `model/task` ## Owned Concepts diff --git a/infospace/agent/global-agent-brief.md b/infospace/agent/global-agent-brief.md index cd11c55..2564c96 100644 --- a/infospace/agent/global-agent-brief.md +++ b/infospace/agent/global-agent-brief.md @@ -5,8 +5,8 @@ This brief summarizes the current canon service surface for agents. - Infospace slug: `canon` -- Artifact count: 76 -- Retrieval index items: 76 +- Artifact count: 77 +- Retrieval index items: 77 - Primary confidence command: `make validate` - Refresh generated indexes and views with: `make index` - Refresh agent briefs and interface templates with: `make agent-briefs` @@ -33,7 +33,7 @@ This brief summarizes the current canon service surface for agents. - **Interface deprecation vs retirement vs removal**: Deprecation guides and observes callers, retirement ends legacy behavior while retaining a metered tombstone, and removal deletes that tombstone only after the evidence gate passes. - **Actor vs Subject vs Principal**: Use actor for the acting entity in a context, subject for the entity a policy evaluates, and principal for the authenticated identity bound to access decisions. - **Organization Role vs AccessRole vs CARING role**: Organization roles describe responsibility or position; access roles describe permissions; CARING roles classify access-governance needs and analysis. -- **Policy vs Control vs Evidence**: Policy states intent or rule, control implements or enforces that rule, and evidence records why the claim should be trusted. +- **Policy vs Control vs Evidence**: Governance owns policy and control; ITC-EVID owns the distinct evidence assertion and its addressable source. Evidence supports a stated interest without guaranteeing truth. - **Intent vs Scope vs Purpose**: Intent captures why a producer or consumer exists, scope bounds producer ownership and promises, and purpose captures consumer demand anchored in consumer intent. ## Consumption Notes diff --git a/infospace/agent/retrieval-index.json b/infospace/agent/retrieval-index.json index ef22790..d835742 100644 --- a/infospace/agent/retrieval-index.json +++ b/infospace/agent/retrieval-index.json @@ -40,10 +40,11 @@ "id": "policy-control-evidence", "source_artifacts": [ "model/governance", + "model/evidence", "model/security", "model/observability" ], - "summary": "Policy states intent or rule, control implements or enforces that rule, and evidence records why the claim should be trusted.", + "summary": "Governance owns policy and control; ITC-EVID owns the distinct evidence assertion and its addressable source. Evidence supports a stated interest without guaranteeing truth.", "title": "Policy vs Control vs Evidence" }, { @@ -59,7 +60,7 @@ } ], "infospace": "canon", - "item_count": 76, + "item_count": 77, "items": [ { "canonical_path": "assimilation/emission-cadence/ASSIMILATION.md", @@ -1068,6 +1069,10 @@ "target": "model/governance", "type": "maps" }, + { + "target": "model/evidence", + "type": "maps" + }, { "target": "model/task", "type": "maps" @@ -1189,6 +1194,7 @@ "id": "model/access-control", "imports": [ "kernel/itc-core", + "model/evidence", "model/governance", "model/organization" ], @@ -1197,6 +1203,10 @@ "InfoTechCanon Access Control Model" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" @@ -1221,6 +1231,7 @@ "imports": [ "catalog/evidence-basis", "kernel/itc-core", + "model/evidence", "model/governance", "model/landscape", "model/observability", @@ -1244,6 +1255,10 @@ "InfoTechCanon Capability Model" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" @@ -1291,6 +1306,7 @@ "id": "model/data", "imports": [ "kernel/itc-core", + "model/evidence", "model/governance" ], "kind": "model", @@ -1298,6 +1314,10 @@ "InfoTechCanon Data Model" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" @@ -1321,6 +1341,7 @@ "id": "model/devsecops", "imports": [ "kernel/itc-core", + "model/evidence", "model/security" ], "kind": "model", @@ -1328,6 +1349,10 @@ "InfoTechCanon DevSecOps Model" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" @@ -1342,17 +1367,47 @@ "title": "InfoTechCanon DevSecOps Model", "warnings": [] }, + { + "canonical_path": "models/evidence/InfoTechCanonEvidenceModel.md", + "id": "model/evidence", + "imports": [ + "kernel/itc-core" + ], + "kind": "model", + "owned_concepts": [ + "Adjudication Outcome", + "Evidence", + "Evidence Source", + "Evidence strength", + "InfoTechCanon Evidence Model" + ], + "relationships": [ + { + "target": "kernel/itc-core", + "type": "conforms_to" + } + ], + "source_path": "../prj-canon-federation/ledger/concept-ownership.json", + "summary": "Domain model used by canon profiles and standards: InfoTechCanon Evidence Model.", + "title": "InfoTechCanon Evidence Model", + "warnings": [] + }, { "canonical_path": "models/governance/InfoTechCanonGovernanceModel.md", "id": "model/governance", "imports": [ - "kernel/itc-core" + "kernel/itc-core", + "model/evidence" ], "kind": "model", "owned_concepts": [ "InfoTechCanon Governance Model" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" @@ -1371,13 +1426,18 @@ "canonical_path": "models/information-space/InfoTechCanonInformationSpaceModel.md", "id": "model/information-space", "imports": [ - "kernel/itc-core" + "kernel/itc-core", + "model/evidence" ], "kind": "model", "owned_concepts": [ "InfoTechCanon Information Space Model" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" @@ -1392,13 +1452,18 @@ "canonical_path": "models/landscape/InfoTechCanonLandscapeModel.md", "id": "model/landscape", "imports": [ - "kernel/itc-core" + "kernel/itc-core", + "model/evidence" ], "kind": "model", "owned_concepts": [ "InfoTechCanon Landscape Model" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" @@ -1414,6 +1479,7 @@ "id": "model/network", "imports": [ "kernel/itc-core", + "model/evidence", "model/security" ], "kind": "model", @@ -1421,6 +1487,10 @@ "InfoTechCanon Network Model" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" @@ -1440,6 +1510,7 @@ "id": "model/observability", "imports": [ "kernel/itc-core", + "model/evidence", "model/task" ], "kind": "model", @@ -1447,6 +1518,10 @@ "InfoTechCanon Observability Model" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" @@ -1465,13 +1540,18 @@ "canonical_path": "models/organization/InfoTechCanonOrganizationModel.md", "id": "model/organization", "imports": [ - "kernel/itc-core" + "kernel/itc-core", + "model/evidence" ], "kind": "model", "owned_concepts": [ "InfoTechCanon Organization Model" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" @@ -1535,13 +1615,18 @@ "id": "model/security", "imports": [ "kernel/itc-core", - "model/access-control" + "model/access-control", + "model/evidence" ], "kind": "model", "owned_concepts": [ "InfoTechCanon Security Model" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" @@ -1560,13 +1645,18 @@ "canonical_path": "models/task/InfoTechCanonTaskModel.md", "id": "model/task", "imports": [ - "kernel/itc-core" + "kernel/itc-core", + "model/evidence" ], "kind": "model", "owned_concepts": [ "InfoTechCanon Task Model" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" @@ -2565,6 +2655,7 @@ "model/access-control", "model/data", "model/devsecops", + "model/evidence", "model/governance", "model/network", "model/observability", @@ -2593,6 +2684,10 @@ "InfoTechCanon CARING Access Governance Standard" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" @@ -2732,6 +2827,7 @@ "id": "standard/tagging", "imports": [ "kernel/itc-core", + "model/evidence", "model/task" ], "kind": "standard", @@ -2739,6 +2835,10 @@ "InfoTechCanon Tagging Standard" ], "relationships": [ + { + "target": "model/evidence", + "type": "uses" + }, { "target": "kernel/itc-core", "type": "conforms_to" diff --git a/infospace/agent/retrieval-index.md b/infospace/agent/retrieval-index.md index de40ea8..51490df 100644 --- a/infospace/agent/retrieval-index.md +++ b/infospace/agent/retrieval-index.md @@ -4,7 +4,7 @@ Schema: `info-tech-canon.retrieval-index.v1` Infospace: `canon` -Items: **76** +Items: **77** ## Common Distinctions @@ -12,7 +12,7 @@ Items: **76** - **Interface deprecation vs retirement vs removal**: Deprecation guides and observes callers, retirement ends legacy behavior while retaining a metered tombstone, and removal deletes that tombstone only after the evidence gate passes. Sources: `practice-pattern/interface-deprecation-strangler` - **Actor vs Subject vs Principal**: Use actor for the acting entity in a context, subject for the entity a policy evaluates, and principal for the authenticated identity bound to access decisions. Sources: `model/organization`, `model/access-control`, `standard/caring` - **Organization Role vs AccessRole vs CARING role**: Organization roles describe responsibility or position; access roles describe permissions; CARING roles classify access-governance needs and analysis. Sources: `model/organization`, `model/access-control`, `standard/caring` -- **Policy vs Control vs Evidence**: Policy states intent or rule, control implements or enforces that rule, and evidence records why the claim should be trusted. Sources: `model/governance`, `model/security`, `model/observability` +- **Policy vs Control vs Evidence**: Governance owns policy and control; ITC-EVID owns the distinct evidence assertion and its addressable source. Evidence supports a stated interest without guaranteeing truth. Sources: `model/governance`, `model/evidence`, `model/security`, `model/observability` - **Intent vs Scope vs Purpose**: Intent captures why a producer or consumer exists, scope bounds producer ownership and promises, and purpose captures consumer demand anchored in consumer intent. Sources: `kernel/itc-core`, `model/purpose-demand-extension`, `pattern/intent-scope-purposes`, `profile/small-saas` ## Items @@ -354,7 +354,7 @@ Items: **76** - Canonical path: `models/access-control/InfoTechCanonAccessControlModel.md` - Source path: `seeds/InfoTechCanonAccessControlModel_RC1_seed.md` - Summary: Domain model used by canon profiles and standards: InfoTechCanon Access Control Model. -- Imports and anchors: `kernel/itc-core`, `model/governance`, `model/organization` +- Imports and anchors: `kernel/itc-core`, `model/evidence`, `model/governance`, `model/organization` - Owned concepts: `InfoTechCanon Access Control Model` ### InfoTechCanon Capability Model @@ -364,7 +364,7 @@ Items: **76** - Canonical path: `models/capability/InfoTechCanonCapabilityModel.md` - Source path: `infospace/assimilation/it-capability-canon/source/ITCapabilityCanonV0.1.md` - Summary: Domain model used by canon profiles and standards: InfoTechCanon Capability Model. -- Imports and anchors: `catalog/evidence-basis`, `kernel/itc-core`, `model/governance`, `model/landscape`, `model/observability`, `model/purpose-demand-extension` +- Imports and anchors: `catalog/evidence-basis`, `kernel/itc-core`, `model/evidence`, `model/governance`, `model/landscape`, `model/observability`, `model/purpose-demand-extension` - Owned concepts: `Capability`, `CapabilityConsumption`, `CapabilityContract`, `CapabilityDomain`, `CapabilityEvidenceHook`, `CapabilityInclusionRule`, `CapabilityMaturityLevel`, `CapabilityProfile`, `CapabilityProvider`, `CapabilityProvision`, `CapabilityQualityDimension`, `CapabilityRequirement`, `CapabilityResourceClass`, `InfoTechCanon Capability Model` ### InfoTechCanon Data Model @@ -374,7 +374,7 @@ Items: **76** - Canonical path: `models/data/InfoTechCanonDataModel.md` - Source path: `seeds/InfoTechCanonDataModel_RC1_seed.md` - Summary: Domain model used by canon profiles and standards: InfoTechCanon Data Model. -- Imports and anchors: `kernel/itc-core`, `model/governance` +- Imports and anchors: `kernel/itc-core`, `model/evidence`, `model/governance` - Owned concepts: `InfoTechCanon Data Model` ### InfoTechCanon DevSecOps Model @@ -384,9 +384,19 @@ Items: **76** - Canonical path: `models/devsecops/InfoTechCanonDevSecOpsModel.md` - Source path: `seeds/InfoTechCanonDevSecOpsModel_RC1_seed.md` - Summary: Domain model used by canon profiles and standards: InfoTechCanon DevSecOps Model. -- Imports and anchors: `kernel/itc-core`, `model/security` +- Imports and anchors: `kernel/itc-core`, `model/evidence`, `model/security` - Owned concepts: `InfoTechCanon DevSecOps Model` +### InfoTechCanon Evidence Model + +- ID: `model/evidence` +- Kind: `model` +- Canonical path: `models/evidence/InfoTechCanonEvidenceModel.md` +- Source path: `../prj-canon-federation/ledger/concept-ownership.json` +- Summary: Domain model used by canon profiles and standards: InfoTechCanon Evidence Model. +- Imports and anchors: `kernel/itc-core` +- Owned concepts: `Adjudication Outcome`, `Evidence`, `Evidence Source`, `Evidence strength`, `InfoTechCanon Evidence Model` + ### InfoTechCanon Governance Model - ID: `model/governance` @@ -394,7 +404,7 @@ Items: **76** - Canonical path: `models/governance/InfoTechCanonGovernanceModel.md` - Source path: `seeds/InfoTechCanonGovernanceModel_RC1_seed.md` - Summary: Domain model used by canon profiles and standards: InfoTechCanon Governance Model. -- Imports and anchors: `kernel/itc-core` +- Imports and anchors: `kernel/itc-core`, `model/evidence` - Owned concepts: `InfoTechCanon Governance Model` ### InfoTechCanon Information Space Model @@ -404,7 +414,7 @@ Items: **76** - Canonical path: `models/information-space/InfoTechCanonInformationSpaceModel.md` - Source path: `seeds/InfoTechCanonInformationSpaceModel_RC1_seed.md` - Summary: Domain model used by canon profiles and standards: InfoTechCanon Information Space Model. -- Imports and anchors: `kernel/itc-core` +- Imports and anchors: `kernel/itc-core`, `model/evidence` - Owned concepts: `InfoTechCanon Information Space Model` ### InfoTechCanon Landscape Model @@ -414,7 +424,7 @@ Items: **76** - Canonical path: `models/landscape/InfoTechCanonLandscapeModel.md` - Source path: `seeds/InfoTechCanonLandscapeModel_RC1_seed.md` - Summary: Domain model used by canon profiles and standards: InfoTechCanon Landscape Model. -- Imports and anchors: `kernel/itc-core` +- Imports and anchors: `kernel/itc-core`, `model/evidence` - Owned concepts: `InfoTechCanon Landscape Model` ### InfoTechCanon Network Model @@ -424,7 +434,7 @@ Items: **76** - Canonical path: `models/network/InfoTechCanonNetworkModel.md` - Source path: `seeds/InfoTechCanonNetworkModel_RC1_seed.md` - Summary: Domain model used by canon profiles and standards: InfoTechCanon Network Model. -- Imports and anchors: `kernel/itc-core`, `model/security` +- Imports and anchors: `kernel/itc-core`, `model/evidence`, `model/security` - Owned concepts: `InfoTechCanon Network Model` ### InfoTechCanon Observability Model @@ -434,7 +444,7 @@ Items: **76** - Canonical path: `models/observability/InfoTechCanonObservabilityModel.md` - Source path: `seeds/InfoTechCanonObservabilityModel_RC1_seed.md` - Summary: Domain model used by canon profiles and standards: InfoTechCanon Observability Model. -- Imports and anchors: `kernel/itc-core`, `model/task` +- Imports and anchors: `kernel/itc-core`, `model/evidence`, `model/task` - Owned concepts: `InfoTechCanon Observability Model` ### InfoTechCanon Organization Model @@ -444,7 +454,7 @@ Items: **76** - Canonical path: `models/organization/InfoTechCanonOrganizationModel.md` - Source path: `seeds/InfoTechCanonOrganizationModel_RC1_seed.md` - Summary: Domain model used by canon profiles and standards: InfoTechCanon Organization Model. -- Imports and anchors: `kernel/itc-core` +- Imports and anchors: `kernel/itc-core`, `model/evidence` - Owned concepts: `InfoTechCanon Organization Model` ### InfoTechCanon Purpose And Demand Model Extension @@ -464,7 +474,7 @@ Items: **76** - Canonical path: `models/security/InfoTechCanonSecurityModel.md` - Source path: `seeds/InfoTechCanonSecurityModel_RC1_seed.md` - Summary: Domain model used by canon profiles and standards: InfoTechCanon Security Model. -- Imports and anchors: `kernel/itc-core`, `model/access-control` +- Imports and anchors: `kernel/itc-core`, `model/access-control`, `model/evidence` - Owned concepts: `InfoTechCanon Security Model` ### InfoTechCanon Task Model @@ -474,7 +484,7 @@ Items: **76** - Canonical path: `models/task/InfoTechCanonTaskModel.md` - Source path: `seeds/InfoTechCanonTaskModel_RC1_seed.md` - Summary: Domain model used by canon profiles and standards: InfoTechCanon Task Model. -- Imports and anchors: `kernel/itc-core` +- Imports and anchors: `kernel/itc-core`, `model/evidence` - Owned concepts: `InfoTechCanon Task Model` ### Intent Scope Purposes Pattern @@ -744,7 +754,7 @@ Items: **76** - Canonical path: `standards/caring/InfoTechCanonCaringAccessGovernanceStandard.md` - Source path: `seeds/InfoTechCanonCaringAccessGovernanceStandard.md` - Summary: Cross-cutting canon standard: InfoTechCanon CARING Access Governance Standard. -- Imports and anchors: `kernel/itc-core`, `model/access-control`, `model/data`, `model/devsecops`, `model/governance`, `model/network`, `model/observability`, `model/organization`, `model/security`, `model/task`, `standard/tagging` +- Imports and anchors: `kernel/itc-core`, `model/access-control`, `model/data`, `model/devsecops`, `model/evidence`, `model/governance`, `model/network`, `model/observability`, `model/organization`, `model/security`, `model/task`, `standard/tagging` - Owned concepts: `CARINGAccessDescriptor`, `CARINGAnalysisFitnessTest`, `CARINGAnalysisProcedure`, `CARINGCanonicalRole`, `CARINGCapabilityProfile`, `CARINGDeclaredAccessMap`, `CARINGDerivedCapability`, `CARINGEffectiveAccessMap`, `CARINGExposureEvent`, `CARINGExposureMode`, `CARINGInducedAccess`, `CARINGOrganizationRelation`, `CARINGPlane`, `CARINGRedesignProcedure`, `CARINGRestrictionPrecedence`, `InfoTechCanon CARING Access Governance Standard` ### InfoTechCanon Emission Cadence Standard @@ -774,5 +784,5 @@ Items: **76** - Canonical path: `standards/tagging/InfoTechCanonTaggingStandard.md` - Source path: `seeds/InfoTechCanonTaggingStandard_RC1_seed.md` - Summary: Cross-cutting canon standard: InfoTechCanon Tagging Standard. -- Imports and anchors: `kernel/itc-core`, `model/task` +- Imports and anchors: `kernel/itc-core`, `model/evidence`, `model/task` - Owned concepts: `InfoTechCanon Tagging Standard` diff --git a/infospace/agent/retrieval-index.yaml b/infospace/agent/retrieval-index.yaml index ce1f537..e31d016 100644 --- a/infospace/agent/retrieval-index.yaml +++ b/infospace/agent/retrieval-index.yaml @@ -1,6 +1,6 @@ schema: info-tech-canon.retrieval-index.v1 infospace: canon -item_count: 76 +item_count: 77 items: - id: assimilation/emission-cadence kind: assimilation @@ -656,6 +656,8 @@ items: target: model/organization - type: maps target: model/governance + - type: maps + target: model/evidence - type: maps target: model/task - type: maps @@ -737,9 +739,12 @@ items: - InfoTechCanon Access Control Model imports: - kernel/itc-core + - model/evidence - model/governance - model/organization relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses @@ -772,11 +777,14 @@ items: imports: - catalog/evidence-basis - kernel/itc-core + - model/evidence - model/governance - model/landscape - model/observability - model/purpose-demand-extension relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses @@ -807,8 +815,11 @@ items: - InfoTechCanon Data Model imports: - kernel/itc-core + - model/evidence - model/governance relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses @@ -827,13 +838,35 @@ items: - InfoTechCanon DevSecOps Model imports: - kernel/itc-core + - model/evidence - model/security relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses target: model/security warnings: [] +- id: model/evidence + kind: model + title: InfoTechCanon Evidence Model + canonical_path: models/evidence/InfoTechCanonEvidenceModel.md + source_path: ../prj-canon-federation/ledger/concept-ownership.json + summary: 'Domain model used by canon profiles and standards: InfoTechCanon Evidence + Model.' + owned_concepts: + - Adjudication Outcome + - Evidence + - Evidence Source + - Evidence strength + - InfoTechCanon Evidence Model + imports: + - kernel/itc-core + relationships: + - type: conforms_to + target: kernel/itc-core + warnings: [] - id: model/governance kind: model title: InfoTechCanon Governance Model @@ -845,7 +878,10 @@ items: - InfoTechCanon Governance Model imports: - kernel/itc-core + - model/evidence relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: introduces @@ -862,7 +898,10 @@ items: - InfoTechCanon Information Space Model imports: - kernel/itc-core + - model/evidence relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core warnings: [] @@ -877,7 +916,10 @@ items: - InfoTechCanon Landscape Model imports: - kernel/itc-core + - model/evidence relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core warnings: [] @@ -892,8 +934,11 @@ items: - InfoTechCanon Network Model imports: - kernel/itc-core + - model/evidence - model/security relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses @@ -910,8 +955,11 @@ items: - InfoTechCanon Observability Model imports: - kernel/itc-core + - model/evidence - model/task relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses @@ -928,7 +976,10 @@ items: - InfoTechCanon Organization Model imports: - kernel/itc-core + - model/evidence relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core warnings: [] @@ -978,7 +1029,10 @@ items: imports: - kernel/itc-core - model/access-control + - model/evidence relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses @@ -995,7 +1049,10 @@ items: - InfoTechCanon Task Model imports: - kernel/itc-core + - model/evidence relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core warnings: [] @@ -1643,6 +1700,7 @@ items: - model/access-control - model/data - model/devsecops + - model/evidence - model/governance - model/network - model/observability @@ -1651,6 +1709,8 @@ items: - model/task - standard/tagging relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: imports @@ -1740,8 +1800,11 @@ items: - InfoTechCanon Tagging Standard imports: - kernel/itc-core + - model/evidence - model/task relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: imports @@ -1780,10 +1843,12 @@ common_distinctions: - standard/caring - id: policy-control-evidence title: Policy vs Control vs Evidence - summary: Policy states intent or rule, control implements or enforces that rule, - and evidence records why the claim should be trusted. + summary: Governance owns policy and control; ITC-EVID owns the distinct evidence + assertion and its addressable source. Evidence supports a stated interest without + guaranteeing truth. source_artifacts: - model/governance + - model/evidence - model/security - model/observability - id: intent-scope-purpose diff --git a/infospace/artifacts/index.yaml b/infospace/artifacts/index.yaml index 1b902bf..f62a266 100644 --- a/infospace/artifacts/index.yaml +++ b/infospace/artifacts/index.yaml @@ -27,6 +27,8 @@ artifacts: target: model/organization - type: maps target: model/governance + - type: maps + target: model/evidence - type: maps target: model/task - type: maps @@ -56,6 +58,8 @@ artifacts: placement: copied placement_workplan: ITC-WP-0001 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - id: model/landscape @@ -67,6 +71,8 @@ artifacts: placement: copied placement_workplan: ITC-WP-0001 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - id: model/organization @@ -78,6 +84,8 @@ artifacts: placement: copied placement_workplan: ITC-WP-0001 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - id: model/governance @@ -89,10 +97,23 @@ artifacts: placement: copied placement_workplan: ITC-WP-0001 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: introduces target: catalog/evidence-basis + - id: model/evidence + path: models/evidence/InfoTechCanonEvidenceModel.md + kind: model + title: InfoTechCanon Evidence Model + provenance: + placement: adapted + placement_workplan: INFO-WP-0020 + source_path: ../prj-canon-federation/ledger/concept-ownership.json + relationships: + - type: conforms_to + target: kernel/itc-core - id: model/purpose-demand-extension path: models/governance/InfoTechCanonPurposeDemandExtension.md kind: model-extension @@ -121,6 +142,8 @@ artifacts: assimilation: assimilation/it-capability-canon source_body: Information Technology Capability Canon (ITCC) v0.1 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses @@ -185,6 +208,8 @@ artifacts: placement: copied placement_workplan: ITC-WP-0001 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - id: model/access-control @@ -196,6 +221,8 @@ artifacts: placement: copied placement_workplan: ITC-WP-0001 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses @@ -211,6 +238,8 @@ artifacts: placement: copied placement_workplan: ITC-WP-0001 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses @@ -224,6 +253,8 @@ artifacts: placement: copied placement_workplan: ITC-WP-0001 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses @@ -247,6 +278,8 @@ artifacts: placement: copied placement_workplan: ITC-WP-0001 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses @@ -260,6 +293,8 @@ artifacts: placement: copied placement_workplan: ITC-WP-0001 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses @@ -273,6 +308,8 @@ artifacts: placement: copied placement_workplan: ITC-WP-0001 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: uses @@ -286,6 +323,8 @@ artifacts: placement: copied placement_workplan: ITC-WP-0001 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: imports @@ -299,6 +338,8 @@ artifacts: placement: copied placement_workplan: ITC-WP-0001 relationships: + - type: uses + target: model/evidence - type: conforms_to target: kernel/itc-core - type: imports diff --git a/infospace/indexes/artifact-tree.yaml b/infospace/indexes/artifact-tree.yaml index d4341ca..40889b6 100644 --- a/infospace/indexes/artifact-tree.yaml +++ b/infospace/indexes/artifact-tree.yaml @@ -1,5 +1,5 @@ root: infospace -file_count: 208 +file_count: 210 files: - path: README.md directory: . @@ -109,6 +109,9 @@ files: - path: agent/briefs/model-devsecops.md directory: agent/briefs name: model-devsecops.md +- path: agent/briefs/model-evidence.md + directory: agent/briefs + name: model-evidence.md - path: agent/briefs/model-governance.md directory: agent/briefs name: model-governance.md @@ -415,6 +418,9 @@ files: - path: models/devsecops/InfoTechCanonDevSecOpsModel.md directory: models/devsecops name: InfoTechCanonDevSecOpsModel.md +- path: models/evidence/InfoTechCanonEvidenceModel.md + directory: models/evidence + name: InfoTechCanonEvidenceModel.md - path: models/governance/InfoTechCanonGovernanceModel.md directory: models/governance name: InfoTechCanonGovernanceModel.md diff --git a/infospace/indexes/concept-ownership.yaml b/infospace/indexes/concept-ownership.yaml index 6b4abc4..49abbd9 100644 --- a/infospace/indexes/concept-ownership.yaml +++ b/infospace/indexes/concept-ownership.yaml @@ -1,4 +1,4 @@ -concept_count: 129 +concept_count: 134 concepts: - concept: "Assimilation \u2014 EmissionCadenceDeclaration handover" owner: assimilation/emission-cadence @@ -200,6 +200,26 @@ concepts: owner: model/devsecops path: models/devsecops/InfoTechCanonDevSecOpsModel.md source: artifact_title +- concept: InfoTechCanon Evidence Model + owner: model/evidence + path: models/evidence/InfoTechCanonEvidenceModel.md + source: artifact_title +- concept: Evidence + owner: model/evidence + path: models/evidence/InfoTechCanonEvidenceModel.md + source: frontmatter.owned_concepts +- concept: Evidence Source + owner: model/evidence + path: models/evidence/InfoTechCanonEvidenceModel.md + source: frontmatter.owned_concepts +- concept: Adjudication Outcome + owner: model/evidence + path: models/evidence/InfoTechCanonEvidenceModel.md + source: frontmatter.owned_concepts +- concept: Evidence strength + owner: model/evidence + path: models/evidence/InfoTechCanonEvidenceModel.md + source: frontmatter.owned_concepts - concept: InfoTechCanon Governance Model owner: model/governance path: models/governance/InfoTechCanonGovernanceModel.md diff --git a/infospace/indexes/import-matrix.yaml b/infospace/indexes/import-matrix.yaml index 03b88e2..906dc62 100644 --- a/infospace/indexes/import-matrix.yaml +++ b/infospace/indexes/import-matrix.yaml @@ -36,6 +36,7 @@ artifacts: - model/capability - model/data - model/devsecops +- model/evidence - model/governance - model/information-space - model/landscape @@ -380,6 +381,8 @@ rows: - maps model/devsecops: - maps + model/evidence: + - maps model/governance: - maps model/information-space: @@ -422,6 +425,8 @@ rows: targets: kernel/itc-core: - conforms_to + model/evidence: + - uses model/governance: - uses model/organization: @@ -438,6 +443,8 @@ rows: - conforms_to mapping/capability-anchors: - introduces + model/evidence: + - uses model/governance: - uses model/landscape: @@ -452,44 +459,64 @@ rows: - introduces kernel/itc-core: - conforms_to + model/evidence: + - uses model/governance: - uses - artifact: model/devsecops targets: kernel/itc-core: - conforms_to + model/evidence: + - uses model/security: - uses +- artifact: model/evidence + targets: + kernel/itc-core: + - conforms_to - artifact: model/governance targets: catalog/evidence-basis: - introduces kernel/itc-core: - conforms_to + model/evidence: + - uses - artifact: model/information-space targets: kernel/itc-core: - conforms_to + model/evidence: + - uses - artifact: model/landscape targets: kernel/itc-core: - conforms_to + model/evidence: + - uses - artifact: model/network targets: kernel/itc-core: - conforms_to + model/evidence: + - uses model/security: - uses - artifact: model/observability targets: kernel/itc-core: - conforms_to + model/evidence: + - uses model/task: - uses - artifact: model/organization targets: kernel/itc-core: - conforms_to + model/evidence: + - uses - artifact: model/purpose-demand-extension targets: concept-catalog/purpose-demand: @@ -508,10 +535,14 @@ rows: - conforms_to model/access-control: - uses + model/evidence: + - uses - artifact: model/task targets: kernel/itc-core: - conforms_to + model/evidence: + - uses - artifact: pattern/intent-scope-purposes targets: model/governance: @@ -816,6 +847,8 @@ rows: - imports model/devsecops: - imports + model/evidence: + - uses model/governance: - imports model/network: @@ -856,5 +889,7 @@ rows: targets: kernel/itc-core: - conforms_to + model/evidence: + - uses model/task: - imports diff --git a/infospace/infospace.yaml b/infospace/infospace.yaml index db91ead..243bbba 100644 --- a/infospace/infospace.yaml +++ b/infospace/infospace.yaml @@ -17,6 +17,8 @@ disciplines: path: models/organization/InfoTechCanonOrganizationModel.md - name: Governance Model path: models/governance/InfoTechCanonGovernanceModel.md + - name: Evidence Model + path: models/evidence/InfoTechCanonEvidenceModel.md - name: Task Model path: models/task/InfoTechCanonTaskModel.md - name: Access Control Model diff --git a/infospace/kernel/InfoTechCanonKernelMap.md b/infospace/kernel/InfoTechCanonKernelMap.md index 099e831..98784bf 100644 --- a/infospace/kernel/InfoTechCanonKernelMap.md +++ b/infospace/kernel/InfoTechCanonKernelMap.md @@ -41,6 +41,7 @@ InfoTechCanonInformationSpaceModel InfoTechCanonLandscapeModel InfoTechCanonOrganizationModel InfoTechCanonGovernanceModel +InfoTechCanonEvidenceModel InfoTechCanonTaskModel InfoTechCanonTaggingStandard InfoTechCanonAccessControlModel @@ -61,6 +62,7 @@ Core = how the canon works. Information Space = how canon knowledge is stored, linked, retrieved, and reused. Landscape = what systems, services, resources, and runtime entities exist. Organization = who can act, belong, own, steward, operate, and be responsible. +Evidence = assertions, their addressable sources, and contextual strength. Governance = how action is directed, constrained, justified, reviewed, and evidenced. Task = what work exists and how it becomes actionable, committed, and completed. Tagging = how entities are lightly classified, filtered, and retrieved. @@ -119,7 +121,11 @@ InfoTechCanonOrganizationModel owns: actors, roles, memberships, responsibility, authority, accountability InfoTechCanonGovernanceModel - owns: policies, rules, decisions, controls, risk, exceptions, evidence + owns: policies, rules, decisions, controls, risk, exceptions + imports: Evidence and Evidence Source from InfoTechCanonEvidenceModel + +InfoTechCanonEvidenceModel (draft 0.1.0) + owns: Evidence, Evidence Source, Adjudication Outcome, Evidence strength ``` This is the first conceptual triad: @@ -311,7 +317,10 @@ Network owns communication and reachability. Observability owns signals and runt | Control | Governance | | Risk | Governance | | Exception / Waiver | Governance | -| Evidence | Governance | +| Evidence | Evidence (itc-evid) | +| Evidence Source | Evidence (itc-evid) | +| Adjudication Outcome | Evidence (itc-evid) | +| Evidence strength | Evidence (itc-evid) | | Audit / Assurance | Governance | ## 4.6 Task Owns Work @@ -1444,8 +1453,8 @@ VAL-KERNEL-CARING-008: CARING native role mappings must not assume that native r ```text Should Core own Relationship as runtime graph edge, or only RelationshipDefinition? -Should generic Evidence remain in Governance or move to Core? -Should ProvenanceRecord stay in Core while Evidence stays in Governance? +Evidence ownership resolved by CUST-ADR-006 R3/R5/R7: dedicated itc-evid model. +Core retains provenance mechanisms; Evidence Source belongs to itc-evid. Should CanonInterfaceCard be Core or Information Space? ``` @@ -1453,7 +1462,7 @@ Recommendation: ```text Core owns ProvenanceRecord and CanonInterfaceCard. -Governance owns Evidence as support for claims, controls, decisions, and assurance. +Evidence owns Evidence and Evidence Source; Governance imports them for claims, controls, decisions, and assurance. Information Space owns SourceReference and Citation as knowledge artifacts. ``` diff --git a/infospace/models/access-control/InfoTechCanonAccessControlModel.md b/infospace/models/access-control/InfoTechCanonAccessControlModel.md index e8addf8..9746c0e 100644 --- a/infospace/models/access-control/InfoTechCanonAccessControlModel.md +++ b/infospace/models/access-control/InfoTechCanonAccessControlModel.md @@ -142,12 +142,13 @@ Decision Approval Exception Risk -Evidence Review Audit ComplianceRequirement ``` +Evidence and Evidence Source are imported from ITC-EVID. + The Access Control Model uses governance concepts for: ```text diff --git a/infospace/models/capability/InfoTechCanonCapabilityModel.md b/infospace/models/capability/InfoTechCanonCapabilityModel.md index 1dcc773..9616571 100644 --- a/infospace/models/capability/InfoTechCanonCapabilityModel.md +++ b/infospace/models/capability/InfoTechCanonCapabilityModel.md @@ -22,6 +22,7 @@ imports: - InfoTechCanonCore - InfoTechCanonLandscapeModel - InfoTechCanonGovernanceModel + - InfoTechCanonEvidenceModel - InfoTechCanonPurposeDemandExtension - InfoTechCanonObservabilityModel related: @@ -113,7 +114,8 @@ Resource classes → native units ← classification owned here ## 2.2 Out of Scope - landscape entities, services, technologies, and runtime resources — ITC-LAND; -- policy, control, and evidence semantics — ITC-GOV; +- policy and control semantics — ITC-GOV; +- general evidence and source semantics — ITC-EVID; - permission, grant, and authorization-decision semantics — ITC-ACCESS; - telemetry, SLO measurement, and health — ITC-OBS; - delivery pipeline semantics — ITC-DEVSECOPS; diff --git a/infospace/models/data/InfoTechCanonDataModel.md b/infospace/models/data/InfoTechCanonDataModel.md index 35e6a2e..e62d437 100644 --- a/infospace/models/data/InfoTechCanonDataModel.md +++ b/infospace/models/data/InfoTechCanonDataModel.md @@ -138,12 +138,13 @@ Obligation Control Risk Exception -Evidence Review Approval ComplianceRequirement ``` +Evidence and Evidence Source are imported from ITC-EVID. + The Data Model owns data-specific structures that are governed: ```text diff --git a/infospace/models/devsecops/InfoTechCanonDevSecOpsModel.md b/infospace/models/devsecops/InfoTechCanonDevSecOpsModel.md index 9660ffa..ac158a6 100644 --- a/infospace/models/devsecops/InfoTechCanonDevSecOpsModel.md +++ b/infospace/models/devsecops/InfoTechCanonDevSecOpsModel.md @@ -181,12 +181,13 @@ Control Decision Approval Exception -Evidence Assurance Review RiskAcceptance ``` +Evidence and Evidence Source are imported from ITC-EVID. + The DevSecOps Model references governance when delivery activity is governed. Examples: diff --git a/infospace/models/evidence/InfoTechCanonEvidenceModel.md b/infospace/models/evidence/InfoTechCanonEvidenceModel.md new file mode 100644 index 0000000..db2e668 --- /dev/null +++ b/infospace/models/evidence/InfoTechCanonEvidenceModel.md @@ -0,0 +1,187 @@ +--- +id: itc-evid:EvidenceModel +title: InfoTechCanon Evidence Model +short_name: ITC-EVID +type: domain-model +standard_family: InfoTechCanon +repository_context: info-tech-canon +recommended_path: models/evidence/InfoTechCanonEvidenceModel.md +status: draft +version: 0.1.0 +canonical_owner: InfoTechCanonEvidenceModel +namespace: itc-evid +classification: model +imports: + - InfoTechCanonCore +owned_concepts: + - Evidence + - Evidence Source + - Adjudication Outcome + - Evidence strength +created_at: 2026-09-05 +updated_at: 2026-09-05 +--- + +# InfoTechCanon Evidence Model + +**Short Name:** `ITC-EVID` · **Status:** Draft · **Version:** 0.1.0 + +## 1. Purpose and boundary + +This model owns the general evidence/source pair, adjudication outcomes as a +specialization of evidence, and the general evidence-strength dimension, under +accepted CUST-ADR-006 R3/R5/R7. Governance, identity, and CommerceCanon consume +these semantics. Registration makes this draft retrievable; it does not claim +consumer adoption or promote the model to a stable standard. + +[Governance](../governance/InfoTechCanonGovernanceModel.md) retains Policy, +Control, Decision, Assertion, AssuranceCase, AssuranceConclusion and Audit. +Its EvidenceBasis catalog remains the established quantity-origin application, +with its existing identifiers, tiers and rules. Identity owns Assurance Level; +CommerceCanon owns Counterparty Assurance Gradient. Neither is a synonym for +general evidence strength. Core retains provenance mechanisms; Information +Space retains SourceReference/Citation for document retrieval. This model does +not redefine those concepts or originate booked financial facts. + +## 2. Owned concepts + +### 2.1 Evidence Source + +An **Evidence Source** is an addressable information container from which an +assertion can be drawn. It MUST have a URI identifying the source; where content +can change, the evidence record MUST also identify the relevant version or +capture. A URI need not be public or grant access. A source may be a document, +an artifact, or a captured record of an event or observation. An issuer or +verification process alone is not the container: identify the resulting record. + +Sources may contain multiple assertions. They may carry commentary, context, +version information and integrity metadata. Identifying a source does not +establish its authenticity, completeness, or the truth of its contents. + +### 2.2 Evidence + +**Evidence** is a distinct assertion drawn from one or more identified Evidence +Sources for an explicit interest or question. The source and the assertion have +separate identities. Evidence MUST state the assertion, identify its sources, +and record the interest being served. It SHOULD locate the supporting passage, +field, or fragment and record who or what captured it and when. Evidence may +carry commentary, including interpretation, uncertainty and disagreement. + +The same source can yield different evidence for different interests. Capturing +an invoice's issuer, amount and due date yields three assertions; it need not +extract every statement in the document. Evidence is not guaranteed truth. +Conflicting assertions remain separately attributable rather than being erased +by choosing one source as authoritative for every purpose. + +### 2.3 Adjudication Outcome + +An **Adjudication Outcome** is Evidence asserting the outcome of an adjudication +or formal dispute/enforcement determination, drawn from the corresponding +judgment, award or determination record. The judgment document is the Evidence +Source; the outcome assertion is not that document. Record the deciding body, +parties or subject, determination, scope and relevant status/time as supported +by the source. Do not infer finality, enforceability or broader applicability +that the source does not establish. A filing alone does not assert a judgment. + +An outcome may support a downstream commercial lifecycle decision. That decision +and its authorization remain with their owning models; evidence does not itself +grant access, settle a ledger, or execute a commitment transition. + +### 2.4 Evidence strength + +**Evidence strength** is the assessed degree of support an evidence assertion +provides for a stated interest in context. A strength assessment MUST identify +its assessment scheme, rationale and scope; absence of assessment is unknown, +not an implicit strongest or weakest value. A scheme may use ordered tiers or +multiple dimensions; this model imposes no universal numeric score or ordering. + +Consider source authenticity and integrity, relevance to the question, method +of capture, corroboration, freshness and unresolved contradictions. These are +assessment considerations, not a closed mandatory scoring formula. An unchanged +signed source can still contain a false statement. A well-supported assertion +about one question need not be strong support for another. + +EvidenceBasis describes how a quantity was obtained and its existing propagation +rules; it does not exhaust general strength. Counterparty Assurance Gradient is +a named commercial application. Its opinion/observed/committed/adjudicated tiers +are not imposed on all evidence. Identity Assurance Level and governance +AssuranceConclusion remain separately owned concepts. + +## 3. Relationships and capture rules + +```text +Evidence --drawn_from--> Evidence Source +Evidence Source --contains--> information supporting zero or more Evidence assertions +Adjudication Outcome --specializes--> Evidence +Evidence --assessed_for--> interest using a named strength scheme +``` + +Containment identifies where supporting information resides; derivation records +which assertion was drawn from it and how. A computed assertion MUST retain its +input evidence and transformation, so it can be traced to the original sources. +No extraction is presumed complete or uniquely correct. Commentary on a source +and commentary on an assertion stay distinguishable. + +## 4. Worked examples + +### 4.1 Invoice and embedded extraction + +This is an illustrative data model, not an invoicing-format requirement or legal +claim. Let `urn:example:invoice:42:revision:1` identify a PDF source. For payment +preparation, capture separate Evidence assertions: + +| Evidence ID | Assertion | Source location | +| --- | --- | --- | +| invoice-42-issuer | The invoice names Example Supplier as issuer. | Issuer field | +| invoice-42-amount | The invoice states a total of 120 EUR. | Total field | +| invoice-42-due | The invoice states a due date of 2026-10-01. | Due-date field | + +Those assertions concern what the invoice states. They do not assert that money +was paid, that the supplier is authenticated, or that a booked financial fact +exists. A dispute reviewer may capture different assertions from the same PDF. + +In a signed-PDF-with-embedded-XML example, the XML carries a structured extraction +of invoice fields. Record the enclosing PDF URI/version, XML fragment or embedded +artifact locator, and the binding to the signed content. Where signature +verification confirms that the relevant PDF content and XML embedding are +covered, modification is detectable relative to that verified signed revision. +Record the verification result and covered revision; embedding XML alone does +not make it tamper-evident. Later changes outside that verified coverage must not +inherit the earlier integrity claim. Signature coverage proves no automatic +semantic agreement between rendered fields and XML; compare them and retain any +disagreement as evidence. No real signature verification is performed by this +illustration. + +### 4.2 Adjudication + +`urn:example:award:7:revision:1` identifies an award document. An outcome assertion +states that the named tribunal determined a particular dispute as recorded in a +specified paragraph. The source may also contain background assertions that are +not determinations. Capture those separately. A downstream commercial model may +use the outcome while retaining the source's scope and recorded status. + +## 5. Conformance cases + +| Case | Expected result | +| --- | --- | +| Three invoice assertions reference one versioned source, each with an interest and field locator | Accept the pair separation. | +| A PDF is labelled Evidence with no distinct assertion | Reject: identify the source and capture the assertion. | +| An issuer name is the sole Evidence Source | Reject: identify an addressable information container. | +| XML is embedded but signature coverage is unverified | Do not assert a verified integrity binding. | +| Rendered invoice and embedded XML disagree | Preserve both assertions and record the discrepancy. | +| An award document is equated with an outcome assertion | Reject: separate source from outcome evidence. | +| A strength value has no scheme or assessment scope | Reject the strength assessment as uninterpretable. | +| A source is authentic but unrelated to the question | Do not infer strong support for that question. | + +## 6. Provenance and continuation + +The [project ledger](../../../../prj-canon-federation/ledger/README.md) pins the +identity-canon donor at `4bb474970b73d500da03b6482e84e6c256146b79` and assigns +these concepts under accepted ADR-006. This model replaces the donor glossary's +source-subtype treatment of Adjudication Outcome with an assertion/source pair. +The governance seed's original broad Evidence definition remains in seeds/ as +historical provenance; the live governance section now imports this model. + +Native INFO-WP-0020 implements CFED-WP-0001-T11. CFED T05/T06 own identity and +commerce imports; T07 owns corpus disposition; T08 owns reciprocal interface +cards. The original donor corpus and finished native workplans remain unchanged. diff --git a/infospace/models/governance/InfoTechCanonGovernanceModel.md b/infospace/models/governance/InfoTechCanonGovernanceModel.md index ee572b1..3d6f7f7 100644 --- a/infospace/models/governance/InfoTechCanonGovernanceModel.md +++ b/infospace/models/governance/InfoTechCanonGovernanceModel.md @@ -4,6 +4,7 @@ **Document Status:** Seed Standard Release Candidate 1 **Version:** RC1-seed **Date:** 2026-05-22 +**Boundary updated:** 2026-09-05 — Evidence imported from ITC-EVID (INFO-WP-0020). **Repository Context:** `info-tech-canon` **Document Type:** InfoTechCanon Domain Standard **Intended Audience:** Governance designers, enterprise architects, service owners, platform owners, risk managers, compliance reviewers, security architects, quality managers, auditors, product owners, DevSecOps teams, organization designers, knowledge-system builders, standards authors, and agentic tooling. @@ -29,7 +30,7 @@ It provides the canonical vocabulary for: - issues, - exceptions, - waivers, -- evidence, +- governance uses of imported evidence, - assurance, - audits, - reviews, @@ -120,7 +121,6 @@ Risk Issue Exception Waiver -Evidence Assurance Audit Review @@ -189,7 +189,6 @@ Control ControlObjective Policy Exception -Evidence Assurance ComplianceRequirement ``` @@ -220,6 +219,16 @@ AccessException as an exception --- +## 3.5 Boundary with Evidence + +ITC-EVID owns Evidence, Evidence Source, Adjudication Outcome and general evidence +strength under CUST-ADR-006 R3/R5/R7. Governance imports the pair for control, +policy, decision and assurance reasoning. AssuranceCase, AssuranceConclusion, +Audit and the existing EvidenceBasis quantity-origin application remain here. +EvidenceBasis is not a competing definition of general evidence strength. + +--- + # 4. Research Basis and External Alignment This seed standard draws on multiple bodies of governance knowledge. @@ -258,7 +267,7 @@ NIST CSF 2.0 introduced `Govern` as one of its top-level functions alongside Ide ## 4.7 ISO 9001 Roles, Responsibilities, and Authorities -Quality management practice emphasizes that responsibilities and authorities must be assigned, communicated, and understood. In InfoTechCanon, Organization owns the actor/role structure, while Governance owns the rules and evidence that ensure responsibilities and authorities are directed and reviewed. +Quality management practice emphasizes that responsibilities and authorities must be assigned, communicated, and understood. In InfoTechCanon, Organization owns the actor/role structure, while Governance owns the rules and imports evidence that ensures responsibilities and authorities are directed and reviewed. ## 4.8 Audit, Assurance, and Compliance Practice @@ -499,7 +508,6 @@ GovernanceEntity │ ├── CompensatingControl │ └── ExpiryCondition ├── EvidenceEntity -│ ├── Evidence │ ├── Attestation │ ├── Assertion │ ├── Finding @@ -1048,26 +1056,15 @@ A **CompensatingControl** is a control used to reduce risk when the primary expe ## 11.34 Evidence -**Evidence** is information used to support a claim, decision, control result, compliance status, risk assessment, audit conclusion, or assurance case. +Evidence and Evidence Source are imported from +[ITC-EVID](../evidence/InfoTechCanonEvidenceModel.md), which owns their definitions. +A governance evidence record identifies a distinct assertion, its addressable +source/version and the interest it supports. Logs, tickets, screenshots and audit +reports are possible sources; a claim drawn from one is the evidence assertion. +This section retains its locator for existing consumers, not concept ownership. -Examples: - -```text -log extract -signed attestation -ticket -screenshot -scan result -configuration file -test result -deployment record -policy document -meeting decision -audit sample -``` - -A quantity offered as evidence MUST declare an **EvidenceBasis** (§11.34a) -so a decision can be graded by the weakest thing it actually rests on. +A quantity offered as governance evidence MUST declare an **EvidenceBasis** +(§11.34a) under the existing quantity-origin application rules. --- @@ -1403,7 +1400,7 @@ Policy -> Control -> ControlImplementation -> ControlActivity / ControlTest - -> Evidence + -> itc-evid:Evidence (assertion drawn_from itc-evid:Evidence Source) -> AssuranceConclusion ``` @@ -1856,6 +1853,9 @@ risk-driven work exception remediation ``` +Evidence consumers import the general pair directly from ITC-EVID; the following +lists contain only governance-owned concepts. + ## 18.4 Tagging Standard Tagging imports governance concepts for: @@ -1868,7 +1868,6 @@ compliance exception review approval -evidence audit ``` @@ -1884,7 +1883,6 @@ access review exception waiver control objective -evidence ``` ## 18.6 Security Model @@ -1897,7 +1895,6 @@ security control objective risk exception finding -evidence assurance compliance requirement ``` @@ -1914,6 +1911,7 @@ Example: subsystem: governance-policy-registry implements: - InfoTechCanonGovernanceModel + - InfoTechCanonEvidenceModel - SmallSaaSGovernanceProfile produces: - Policy @@ -2138,7 +2136,7 @@ standards/governance/agent-brief.md standards/governance/concepts/policy.md standards/governance/concepts/control.md standards/governance/concepts/risk.md -standards/governance/concepts/evidence.md +models/evidence/InfoTechCanonEvidenceModel.md standards/governance/concepts/exception.md standards/governance/concepts/decision.md standards/governance/patterns/policy-control-evidence-chain.md diff --git a/infospace/models/information-space/InfoTechCanonInformationSpaceModel.md b/infospace/models/information-space/InfoTechCanonInformationSpaceModel.md index dc99ca4..ec019d1 100644 --- a/infospace/models/information-space/InfoTechCanonInformationSpaceModel.md +++ b/infospace/models/information-space/InfoTechCanonInformationSpaceModel.md @@ -130,7 +130,7 @@ A corpus of Markdown files may be treated as data by the Data Model, but the inf ## 3.4 Boundary with Governance -Governance owns policies, controls, decisions, exceptions, evidence, and assurance. +Governance owns policies, controls, decisions, exceptions, and assurance. Evidence and Evidence Source are imported from ITC-EVID. The Information Space Model owns how governance documents, evidence references, citations, and versioned documentation artifacts are structured and retrieved. diff --git a/infospace/models/network/InfoTechCanonNetworkModel.md b/infospace/models/network/InfoTechCanonNetworkModel.md index b12ac55..8134cae 100644 --- a/infospace/models/network/InfoTechCanonNetworkModel.md +++ b/infospace/models/network/InfoTechCanonNetworkModel.md @@ -185,7 +185,7 @@ Network determines what traffic the firewall rule permits or denies. ## 3.4 Boundary with Governance -Governance owns policies, controls, exceptions, evidence, and reviews. +Governance owns policies, controls, exceptions, and reviews. Evidence and Evidence Source are imported from ITC-EVID. Network owns network policy as technical traffic-control semantics while referencing governance policies as sources or constraints. diff --git a/infospace/models/observability/InfoTechCanonObservabilityModel.md b/infospace/models/observability/InfoTechCanonObservabilityModel.md index dd559cd..29e13ea 100644 --- a/infospace/models/observability/InfoTechCanonObservabilityModel.md +++ b/infospace/models/observability/InfoTechCanonObservabilityModel.md @@ -152,7 +152,7 @@ SecurityIncident may reference Alert, Trace, LogRecord, or Event. ## 3.3 Boundary with Governance -Governance owns policies, controls, evidence, reviews, assurance, and compliance claims. +Governance owns policies, controls, reviews, assurance, and compliance claims. Evidence and Evidence Source are imported from ITC-EVID. Observability provides evidence and indicators. diff --git a/infospace/models/organization/InfoTechCanonOrganizationModel.md b/infospace/models/organization/InfoTechCanonOrganizationModel.md index ec9f876..fda87e4 100644 --- a/infospace/models/organization/InfoTechCanonOrganizationModel.md +++ b/infospace/models/organization/InfoTechCanonOrganizationModel.md @@ -1698,7 +1698,8 @@ standards/organization/mappings/raci.yaml ## Phase 3: Governance Boundary - Create or align with `InfoTechCanonGovernanceModel`. -- Move policies, controls, risks, obligations, evidence, and decision governance to Governance. +- Move policies, controls, risks, obligations, and decision governance to Governance. +- Import general Evidence and Evidence Source from ITC-EVID. - Keep actor, authority, accountability, and responsibility concepts here. ## Phase 4: First Assimilations diff --git a/infospace/models/security/InfoTechCanonSecurityModel.md b/infospace/models/security/InfoTechCanonSecurityModel.md index 6cee848..1889891 100644 --- a/infospace/models/security/InfoTechCanonSecurityModel.md +++ b/infospace/models/security/InfoTechCanonSecurityModel.md @@ -82,7 +82,6 @@ ControlObjective Control Risk Exception -Evidence Audit Assurance ComplianceRequirement @@ -91,6 +90,8 @@ Approval Review ``` +Evidence and Evidence Source are imported from ITC-EVID. + The Security Model owns: ```text diff --git a/infospace/models/task/InfoTechCanonTaskModel.md b/infospace/models/task/InfoTechCanonTaskModel.md index e70779a..3cf0da9 100644 --- a/infospace/models/task/InfoTechCanonTaskModel.md +++ b/infospace/models/task/InfoTechCanonTaskModel.md @@ -129,11 +129,12 @@ Review Risk Control Exception -Evidence Obligation Requirement ``` +Evidence and Evidence Source are imported from ITC-EVID. + The Task Model may reference these when work is created by or constrained by governance. Examples: diff --git a/infospace/standards/caring/InfoTechCanonCaringAccessGovernanceStandard.md b/infospace/standards/caring/InfoTechCanonCaringAccessGovernanceStandard.md index fbe24d5..a1791f8 100644 --- a/infospace/standards/caring/InfoTechCanonCaringAccessGovernanceStandard.md +++ b/infospace/standards/caring/InfoTechCanonCaringAccessGovernanceStandard.md @@ -245,7 +245,7 @@ And when does access become exceptional or irregular? ## 0.8 Relationship to Governance and Security -Governance owns policies, exceptions, approvals, reviews, controls, risk, and evidence. +Governance owns policies, exceptions, approvals, reviews, controls, risk. Evidence and Evidence Source are imported from ITC-EVID. Security owns threats, vulnerabilities, exposure, security findings, attack paths, incidents, and mitigations. diff --git a/infospace/standards/tagging/InfoTechCanonTaggingStandard.md b/infospace/standards/tagging/InfoTechCanonTaggingStandard.md index 59c6308..80f8f9e 100644 --- a/infospace/standards/tagging/InfoTechCanonTaggingStandard.md +++ b/infospace/standards/tagging/InfoTechCanonTaggingStandard.md @@ -135,7 +135,7 @@ Bad: ## 3.3 Boundary with Governance -Governance owns policies, controls, risks, obligations, decisions, approvals, exceptions, and evidence. +Governance owns policies, controls, risks, obligations, decisions, approvals, exceptions. Evidence and Evidence Source are imported from ITC-EVID. Tags may identify governance-relevant work or artifacts, but should not replace policy/control/evidence records. diff --git a/infospace/views/by-concept.md b/infospace/views/by-concept.md index 6ac1d02..dabbaf1 100644 --- a/infospace/views/by-concept.md +++ b/infospace/views/by-concept.md @@ -2,7 +2,7 @@ # By Concept -Concept count: **129** +Concept count: **134** | Concept | Owner | Source | | --- | --- | --- | @@ -56,6 +56,11 @@ Concept count: **129** | CapabilityInclusionRule | `model/capability` | `frontmatter.owned_concepts` | | InfoTechCanon Data Model | `model/data` | `artifact_title` | | InfoTechCanon DevSecOps Model | `model/devsecops` | `artifact_title` | +| InfoTechCanon Evidence Model | `model/evidence` | `artifact_title` | +| Evidence | `model/evidence` | `frontmatter.owned_concepts` | +| Evidence Source | `model/evidence` | `frontmatter.owned_concepts` | +| Adjudication Outcome | `model/evidence` | `frontmatter.owned_concepts` | +| Evidence strength | `model/evidence` | `frontmatter.owned_concepts` | | InfoTechCanon Governance Model | `model/governance` | `artifact_title` | | InfoTechCanon Information Space Model | `model/information-space` | `artifact_title` | | InfoTechCanon Landscape Model | `model/landscape` | `artifact_title` | diff --git a/infospace/views/by-mapping-target.md b/infospace/views/by-mapping-target.md index 08fb9b9..7e01289 100644 --- a/infospace/views/by-mapping-target.md +++ b/infospace/views/by-mapping-target.md @@ -75,6 +75,7 @@ - `model/capability` via `conforms_to` - `model/data` via `conforms_to` - `model/devsecops` via `conforms_to` +- `model/evidence` via `conforms_to` - `model/governance` via `conforms_to` - `model/information-space` via `conforms_to` - `model/landscape` via `conforms_to` @@ -146,6 +147,24 @@ - `small-saas/deployment/production` via `uses` - `standard/caring` via `imports` +## `model/evidence` + +- `kernel/itc-kernel-map` via `maps` +- `model/access-control` via `uses` +- `model/capability` via `uses` +- `model/data` via `uses` +- `model/devsecops` via `uses` +- `model/governance` via `uses` +- `model/information-space` via `uses` +- `model/landscape` via `uses` +- `model/network` via `uses` +- `model/observability` via `uses` +- `model/organization` via `uses` +- `model/security` via `uses` +- `model/task` via `uses` +- `standard/caring` via `uses` +- `standard/tagging` via `uses` + ## `model/governance` - `benchmark/caring/kubernetes-rbac` via `stress_tests` diff --git a/infospace/views/by-standard.md b/infospace/views/by-standard.md index c5b9c33..1960f31 100644 --- a/infospace/views/by-standard.md +++ b/infospace/views/by-standard.md @@ -14,14 +14,14 @@ - ID: `kernel/itc-kernel-map` - Kind: `kernel` - Path: `kernel/InfoTechCanonKernelMap.md` -- Relationships: 15 +- Relationships: 16 ## InfoTechCanon CARING Access Governance Standard - ID: `standard/caring` - Kind: `standard` - Path: `standards/caring/InfoTechCanonCaringAccessGovernanceStandard.md` -- Relationships: 11 +- Relationships: 12 ## InfoTechCanon Emission Cadence Standard @@ -42,4 +42,4 @@ - ID: `standard/tagging` - Kind: `standard` - Path: `standards/tagging/InfoTechCanonTaggingStandard.md` -- Relationships: 2 +- Relationships: 3 diff --git a/infospace/views/import-matrix.md b/infospace/views/import-matrix.md index 66f3989..0f5f941 100644 --- a/infospace/views/import-matrix.md +++ b/infospace/views/import-matrix.md @@ -2,81 +2,82 @@ # Import Matrix -| Artifact | `assimilation/emission-cadence` | `assimilation/it-capability-canon` | `benchmark/caring/kubernetes-rbac` | `benchmark/caring/kubernetes-rbac/access-descriptors` | `benchmark/caring/kubernetes-rbac/caring-mapping` | `benchmark/caring/kubernetes-rbac/findings` | `benchmark/caring/kubernetes-rbac/native-concepts` | `capability-catalog/itc-cap` | `catalog/attribute-value-types` | `catalog/evidence-basis` | `comparison/repo-scoping/canon-benefit-analysis` | `comparison/repo-scoping/consumer-workplan-brief` | `comparison/repo-scoping/extension-candidates` | `comparison/repo-scoping/frame` | `comparison/repo-scoping/report` | `concept-catalog/purpose-demand` | `conformance/railiance-fabric` | `conformance/railiance-fabric/consumer-workplan-brief` | `conformance/railiance-fabric/entity-edge-capture-criteria` | `conformance/railiance-fabric/mapping-expectations` | `conformance/railiance-fabric/visualization-examples` | `evaluation/user-engine` | `evaluation/user-engine/consumer-workplan-brief` | `evaluation/user-engine/interface-card-expectations` | `evaluation/user-engine/questions` | `evaluation/user-engine/small-saas-alignment` | `example/consumer-purpose-portfolio` | `example/emission-cadence/qonto-assistant` | `kernel/itc-core` | `kernel/itc-kernel-map` | `mapping/capability-anchors` | `mapping/emission-cadence-handover` | `mapping/purpose-demand-governance-candidates` | `model/access-control` | `model/capability` | `model/data` | `model/devsecops` | `model/governance` | `model/information-space` | `model/landscape` | `model/network` | `model/observability` | `model/organization` | `model/purpose-demand-extension` | `model/security` | `model/task` | `pattern/intent-scope-purposes` | `practice-pattern/agentic-drives-functional` | `practice-pattern/interface-deprecation-strangler` | `practice/intake-and-assimilation` | `profile/small-saas` | `review-kit/alignment` | `review-kit/alignment/model-selection-guide` | `review-kit/alignment/schema` | `review-kit/alignment/scorecard` | `review-kit/alignment/workflow` | `review-kit/alignment/workplan-template` | `scheme/practice-pattern` | `small-saas/capability-requirements/production` | `small-saas/control/namespace-per-tenant` | `small-saas/dataset/subscription-ledger` | `small-saas/deployment/production` | `small-saas/evidence/access-review-2026-05` | `small-saas/incident/cross-tenant-access-attempt` | `small-saas/policy/tenant-isolation` | `small-saas/service/billing-portal` | `small-saas/system/billing-system` | `small-saas/task/onboard-tenant` | `small-saas/team/platform` | `small-saas/tenant/acme` | `small-saas/tenant/globex` | `small-saas/user/ada-admin` | `standard/caring` | `standard/emission-cadence` | `standard/repository-layout` | `standard/tagging` | -| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | -| `assimilation/emission-cadence` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `assimilation/it-capability-canon` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `benchmark/caring/kubernetes-rbac` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `stress_tests` | | | `stress_tests` | `stress_tests` | | | `stress_tests` | `stress_tests` | | | `stress_tests` | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | `uses` | -| `benchmark/caring/kubernetes-rbac/access-descriptors` | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | `uses` | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | -| `benchmark/caring/kubernetes-rbac/caring-mapping` | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | `maps` | | | | | | | `maps` | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | -| `benchmark/caring/kubernetes-rbac/findings` | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `proposes` | | | | | | | `proposes` | | | | | | | | | | | | | | | | | | | | | | | | | | | | `proposes` | | | | -| `benchmark/caring/kubernetes-rbac/native-concepts` | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | | | `maps` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | -| `capability-catalog/itc-cap` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `catalog/attribute-value-types` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `catalog/evidence-basis` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `comparison/repo-scoping/canon-benefit-analysis` | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | `maps` | `maps` | | | | | `maps` | | `maps` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | -| `comparison/repo-scoping/consumer-workplan-brief` | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `comparison/repo-scoping/extension-candidates` | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | `proposes` | `proposes` | | | | | `proposes` | | `proposes` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `comparison/repo-scoping/frame` | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | `uses` | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `comparison/repo-scoping/report` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | `uses` | | | | | `compares` | | `uses` | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `concept-catalog/purpose-demand` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `conformance/railiance-fabric` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | `uses` | `uses` | | `uses` | `uses` | `uses` | | `uses` | `uses` | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | -| `conformance/railiance-fabric/consumer-workplan-brief` | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `conformance/railiance-fabric/entity-edge-capture-criteria` | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | `uses` | `uses` | `uses` | | `uses` | `uses` | `uses` | | `uses` | `uses` | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `conformance/railiance-fabric/mapping-expectations` | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | `maps` | `maps` | `maps` | | `maps` | `maps` | `maps` | | `maps` | `maps` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `conformance/railiance-fabric/visualization-examples` | | | | | | | | | | | | | | | | | `part_of` | | `illustrates` | `illustrates` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `evaluation/user-engine` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | `uses` | | `uses` | | | | | `uses` | `uses` | `uses` | `uses` | | | | | `evaluates` | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | -| `evaluation/user-engine/consumer-workplan-brief` | | | | | | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `evaluation/user-engine/interface-card-expectations` | | | | | | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | -| `evaluation/user-engine/questions` | | | | | | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | `uses` | | `uses` | | `uses` | | | | | `uses` | `uses` | `uses` | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `evaluation/user-engine/small-saas-alignment` | | | | | | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | `uses` | | | | `uses` | | | | | `uses` | | | | | | | | `evaluates` | | | | | | | | | | | | | | | | | | | | | | | | | | -| `example/consumer-purpose-portfolio` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `illustrates` | | | `illustrates` | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | -| `example/emission-cadence/qonto-assistant` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | -| `kernel/itc-core` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `kernel/itc-kernel-map` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | | `maps` | `maps` | `maps` | `maps` | `maps` | `maps` | `maps` | `maps` | `maps` | `maps` | | `maps` | `maps` | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | `maps` | -| `mapping/capability-anchors` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `mapping/emission-cadence-handover` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | `maps` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | -| `mapping/purpose-demand-governance-candidates` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | | | `maps` | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `model/access-control` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `model/capability` | | `derived_from` | | | | | | `introduces` | | `uses` | | | | | | | | | | | | | | | | | | | `conforms_to` | | `introduces` | | | | | | | `uses` | | `uses` | | `uses` | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `model/data` | | | | | | | | | `introduces` | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `model/devsecops` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `model/governance` | | | | | | | | | | `introduces` | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `model/information-space` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `model/landscape` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `model/network` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `model/observability` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `model/organization` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `model/purpose-demand-extension` | | | | | | | | | | | | | | | | `introduces` | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `extends` | `uses` | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `model/security` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `model/task` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `pattern/intent-scope-purposes` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | `implements` | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `practice-pattern/agentic-drives-functional` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | `uses` | | | | `uses` | | | | `uses` | | | `related_to` | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | -| `practice-pattern/interface-deprecation-strangler` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | `uses` | | | | `uses` | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | -| `practice/intake-and-assimilation` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `profile/small-saas` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | `requires` | | `requires` | `requires` | `requires` | | `requires` | `requires` | `requires` | `requires` | | `requires` | `requires` | | | | | | | | | | | | | | | | | | | | | | | | | | | `requires` | | | `requires` | -| `review-kit/alignment` | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | | | | | | `uses` | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | -| `review-kit/alignment/model-selection-guide` | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | `uses` | `uses` | `uses` | | `uses` | `uses` | `uses` | `uses` | `uses` | `uses` | `uses` | | | | | `uses` | `part_of` | | | | | | | | | | | | | | | | | | | | | `uses` | | | `uses` | -| `review-kit/alignment/schema` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | `uses` | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | -| `review-kit/alignment/scorecard` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | `uses` | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | -| `review-kit/alignment/workflow` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | `uses` | | `uses` | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | -| `review-kit/alignment/workplan-template` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | `uses` | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | -| `scheme/practice-pattern` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `small-saas/capability-requirements/production` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | `instantiates` | | | | | | | | | | | | | | | `applies_to` | | | | | | | | | | | -| `small-saas/control/namespace-per-tenant` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | `instantiates` | | | | | | | | | | | | `evidenced_by` | | | | | | | | | | `uses` | | | | -| `small-saas/dataset/subscription-ledger` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | `instantiates` | | | | | | | | | | | | | | `governed_by` | `owned_by` | | | | `partitioned_for` | `partitioned_for` | | | | | | -| `small-saas/deployment/production` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | `uses` | | | | | | | | | | `instantiates` | | | | | | | | | `implements` | | | | | | `deploys` | | | | `separates` | `separates` | | | | | | -| `small-saas/evidence/access-review-2026-05` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | `instantiates` | | | | | | | | | | | | | | | | | | | | | | | | | | -| `small-saas/incident/cross-tenant-access-attempt` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | `instantiates` | | | | | | | | | `constrained_by` | | | `evidenced_by` | | | | | | | | | | | | | | -| `small-saas/policy/tenant-isolation` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | `instantiates` | | | | | | | | | `requires` | | | `evidenced_by` | | | | | | | | | | | | | | -| `small-saas/service/billing-portal` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | `instantiates` | | | | | | | | | | | | | | | | `part_of` | | `owned_by` | | | | | | | | -| `small-saas/system/billing-system` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | `instantiates` | | | | | | | | | | | | | | | | | | | `serves` | `serves` | | | | | | -| `small-saas/task/onboard-tenant` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | `instantiates` | | | | | | | | | | | | | | `governed_by` | | | | `owned_by` | `changes` | | | | | | | -| `small-saas/team/platform` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | `instantiates` | | | | | | | | | | | | | | | | | | | | | | | | | | -| `small-saas/tenant/acme` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | `instantiates` | | | | | | | | | `isolated_by` | | | | | | | | | | | | `represented_by` | | | | | -| `small-saas/tenant/globex` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | `instantiates` | | | | | | | | | `isolated_by` | | | | | | | | | | | | | | | | | -| `small-saas/user/ada-admin` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | `uses` | | | | | | | | `instantiates` | | | | | | | | | | | | `access_evidenced_by` | | `has_access_under` | | | | `member_of` | | | | | | | | -| `standard/caring` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | `imports` | | `imports` | `imports` | `imports` | | | `imports` | `imports` | `imports` | | `imports` | `imports` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `imports` | -| `standard/emission-cadence` | `derived_from` | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `imports` | | | | `imports` | | | `related_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `standard/repository-layout` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `imports` | `imports` | | | | | | | `imports` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| `standard/tagging` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | `imports` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| Artifact | `assimilation/emission-cadence` | `assimilation/it-capability-canon` | `benchmark/caring/kubernetes-rbac` | `benchmark/caring/kubernetes-rbac/access-descriptors` | `benchmark/caring/kubernetes-rbac/caring-mapping` | `benchmark/caring/kubernetes-rbac/findings` | `benchmark/caring/kubernetes-rbac/native-concepts` | `capability-catalog/itc-cap` | `catalog/attribute-value-types` | `catalog/evidence-basis` | `comparison/repo-scoping/canon-benefit-analysis` | `comparison/repo-scoping/consumer-workplan-brief` | `comparison/repo-scoping/extension-candidates` | `comparison/repo-scoping/frame` | `comparison/repo-scoping/report` | `concept-catalog/purpose-demand` | `conformance/railiance-fabric` | `conformance/railiance-fabric/consumer-workplan-brief` | `conformance/railiance-fabric/entity-edge-capture-criteria` | `conformance/railiance-fabric/mapping-expectations` | `conformance/railiance-fabric/visualization-examples` | `evaluation/user-engine` | `evaluation/user-engine/consumer-workplan-brief` | `evaluation/user-engine/interface-card-expectations` | `evaluation/user-engine/questions` | `evaluation/user-engine/small-saas-alignment` | `example/consumer-purpose-portfolio` | `example/emission-cadence/qonto-assistant` | `kernel/itc-core` | `kernel/itc-kernel-map` | `mapping/capability-anchors` | `mapping/emission-cadence-handover` | `mapping/purpose-demand-governance-candidates` | `model/access-control` | `model/capability` | `model/data` | `model/devsecops` | `model/evidence` | `model/governance` | `model/information-space` | `model/landscape` | `model/network` | `model/observability` | `model/organization` | `model/purpose-demand-extension` | `model/security` | `model/task` | `pattern/intent-scope-purposes` | `practice-pattern/agentic-drives-functional` | `practice-pattern/interface-deprecation-strangler` | `practice/intake-and-assimilation` | `profile/small-saas` | `review-kit/alignment` | `review-kit/alignment/model-selection-guide` | `review-kit/alignment/schema` | `review-kit/alignment/scorecard` | `review-kit/alignment/workflow` | `review-kit/alignment/workplan-template` | `scheme/practice-pattern` | `small-saas/capability-requirements/production` | `small-saas/control/namespace-per-tenant` | `small-saas/dataset/subscription-ledger` | `small-saas/deployment/production` | `small-saas/evidence/access-review-2026-05` | `small-saas/incident/cross-tenant-access-attempt` | `small-saas/policy/tenant-isolation` | `small-saas/service/billing-portal` | `small-saas/system/billing-system` | `small-saas/task/onboard-tenant` | `small-saas/team/platform` | `small-saas/tenant/acme` | `small-saas/tenant/globex` | `small-saas/user/ada-admin` | `standard/caring` | `standard/emission-cadence` | `standard/repository-layout` | `standard/tagging` | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | +| `assimilation/emission-cadence` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `assimilation/it-capability-canon` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `benchmark/caring/kubernetes-rbac` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `stress_tests` | | | `stress_tests` | | `stress_tests` | | | `stress_tests` | `stress_tests` | | | `stress_tests` | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | `uses` | +| `benchmark/caring/kubernetes-rbac/access-descriptors` | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | `uses` | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | +| `benchmark/caring/kubernetes-rbac/caring-mapping` | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | | `maps` | | | | | | | `maps` | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | +| `benchmark/caring/kubernetes-rbac/findings` | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `proposes` | | | | | | | `proposes` | | | | | | | | | | | | | | | | | | | | | | | | | | | | `proposes` | | | | +| `benchmark/caring/kubernetes-rbac/native-concepts` | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | | | | `maps` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | +| `capability-catalog/itc-cap` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `catalog/attribute-value-types` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `catalog/evidence-basis` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `comparison/repo-scoping/canon-benefit-analysis` | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | `maps` | `maps` | | | | | `maps` | | `maps` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | +| `comparison/repo-scoping/consumer-workplan-brief` | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `comparison/repo-scoping/extension-candidates` | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | `proposes` | `proposes` | | | | | `proposes` | | `proposes` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `comparison/repo-scoping/frame` | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | `uses` | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `comparison/repo-scoping/report` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | `uses` | | | | | `compares` | | `uses` | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `concept-catalog/purpose-demand` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `conformance/railiance-fabric` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | `uses` | | `uses` | | `uses` | `uses` | `uses` | | `uses` | `uses` | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | +| `conformance/railiance-fabric/consumer-workplan-brief` | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `conformance/railiance-fabric/entity-edge-capture-criteria` | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | `uses` | `uses` | | `uses` | | `uses` | `uses` | `uses` | | `uses` | `uses` | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `conformance/railiance-fabric/mapping-expectations` | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | `maps` | `maps` | | `maps` | | `maps` | `maps` | `maps` | | `maps` | `maps` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `conformance/railiance-fabric/visualization-examples` | | | | | | | | | | | | | | | | | `part_of` | | `illustrates` | `illustrates` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `evaluation/user-engine` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | `uses` | | | `uses` | | | | | `uses` | `uses` | `uses` | `uses` | | | | | `evaluates` | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | +| `evaluation/user-engine/consumer-workplan-brief` | | | | | | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `evaluation/user-engine/interface-card-expectations` | | | | | | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | +| `evaluation/user-engine/questions` | | | | | | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | `uses` | | `uses` | | | `uses` | | | | | `uses` | `uses` | `uses` | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `evaluation/user-engine/small-saas-alignment` | | | | | | | | | | | | | | | | | | | | | | `part_of` | | | | | | | | | | | | `uses` | | | | | `uses` | | | | | `uses` | | | | | | | | `evaluates` | | | | | | | | | | | | | | | | | | | | | | | | | | +| `example/consumer-purpose-portfolio` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `illustrates` | | | `illustrates` | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | +| `example/emission-cadence/qonto-assistant` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | +| `kernel/itc-core` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `kernel/itc-kernel-map` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | | `maps` | `maps` | `maps` | `maps` | `maps` | `maps` | `maps` | `maps` | `maps` | `maps` | `maps` | | `maps` | `maps` | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | `maps` | +| `mapping/capability-anchors` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `mapping/emission-cadence-handover` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | `maps` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | +| `mapping/purpose-demand-governance-candidates` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `maps` | | | | | | `maps` | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/access-control` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | `uses` | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/capability` | | `derived_from` | | | | | | `introduces` | | `uses` | | | | | | | | | | | | | | | | | | | `conforms_to` | | `introduces` | | | | | | | `uses` | `uses` | | `uses` | | `uses` | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/data` | | | | | | | | | `introduces` | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/devsecops` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/evidence` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/governance` | | | | | | | | | | `introduces` | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/information-space` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/landscape` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/network` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/observability` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/organization` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/purpose-demand-extension` | | | | | | | | | | | | | | | | `introduces` | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | `extends` | `uses` | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/security` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | `uses` | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `model/task` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `pattern/intent-scope-purposes` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | `implements` | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `practice-pattern/agentic-drives-functional` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | `uses` | | | | `uses` | | | | `uses` | | | `related_to` | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | +| `practice-pattern/interface-deprecation-strangler` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | `uses` | | | | `uses` | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | +| `practice/intake-and-assimilation` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `profile/small-saas` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | `requires` | | `requires` | `requires` | | `requires` | | `requires` | `requires` | `requires` | `requires` | | `requires` | `requires` | | | | | | | | | | | | | | | | | | | | | | | | | | | `requires` | | | `requires` | +| `review-kit/alignment` | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | `uses` | | | | | | `uses` | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | +| `review-kit/alignment/model-selection-guide` | | | `uses` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | `uses` | `uses` | | `uses` | | `uses` | `uses` | `uses` | `uses` | `uses` | `uses` | `uses` | | | | | `uses` | `part_of` | | | | | | | | | | | | | | | | | | | | | `uses` | | | `uses` | +| `review-kit/alignment/schema` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | `uses` | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | +| `review-kit/alignment/scorecard` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | `uses` | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | +| `review-kit/alignment/workflow` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | `uses` | | `uses` | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | +| `review-kit/alignment/workplan-template` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | `uses` | | | | | | `part_of` | | | | | | | | | | | | | | | | | | | | | | | | | +| `scheme/practice-pattern` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `small-saas/capability-requirements/production` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | | `instantiates` | | | | | | | | | | | | | | | `applies_to` | | | | | | | | | | | +| `small-saas/control/namespace-per-tenant` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | `instantiates` | | | | | | | | | | | | `evidenced_by` | | | | | | | | | | `uses` | | | | +| `small-saas/dataset/subscription-ledger` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | | | | `instantiates` | | | | | | | | | | | | | | `governed_by` | `owned_by` | | | | `partitioned_for` | `partitioned_for` | | | | | | +| `small-saas/deployment/production` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | `uses` | | | | | | | | | | `instantiates` | | | | | | | | | `implements` | | | | | | `deploys` | | | | `separates` | `separates` | | | | | | +| `small-saas/evidence/access-review-2026-05` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | `instantiates` | | | | | | | | | | | | | | | | | | | | | | | | | | +| `small-saas/incident/cross-tenant-access-attempt` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | `instantiates` | | | | | | | | | `constrained_by` | | | `evidenced_by` | | | | | | | | | | | | | | +| `small-saas/policy/tenant-isolation` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | | | `instantiates` | | | | | | | | | `requires` | | | `evidenced_by` | | | | | | | | | | | | | | +| `small-saas/service/billing-portal` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | `instantiates` | | | | | | | | | | | | | | | | `part_of` | | `owned_by` | | | | | | | | +| `small-saas/system/billing-system` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | | `instantiates` | | | | | | | | | | | | | | | | | | | `serves` | `serves` | | | | | | +| `small-saas/task/onboard-tenant` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | `instantiates` | | | | | | | | | | | | | | `governed_by` | | | | `owned_by` | `changes` | | | | | | | +| `small-saas/team/platform` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | `instantiates` | | | | | | | | | | | | | | | | | | | | | | | | | | +| `small-saas/tenant/acme` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | `instantiates` | | | | | | | | | `isolated_by` | | | | | | | | | | | | `represented_by` | | | | | +| `small-saas/tenant/globex` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | `instantiates` | | | | | | | | | `isolated_by` | | | | | | | | | | | | | | | | | +| `small-saas/user/ada-admin` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `uses` | | | | | | | | | | `uses` | | | | | | | | `instantiates` | | | | | | | | | | | | `access_evidenced_by` | | `has_access_under` | | | | `member_of` | | | | | | | | +| `standard/caring` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | `imports` | | `imports` | `imports` | `uses` | `imports` | | | `imports` | `imports` | `imports` | | `imports` | `imports` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `imports` | +| `standard/emission-cadence` | `derived_from` | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | `imports` | | | | `imports` | | | `related_to` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `standard/repository-layout` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | | `imports` | `imports` | | | | | | | `imports` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| `standard/tagging` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `conforms_to` | | | | | | | | | `uses` | | | | | | | | | `imports` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | diff --git a/infospace/views/kernel-overview.md b/infospace/views/kernel-overview.md index 6a9aed9..244718f 100644 --- a/infospace/views/kernel-overview.md +++ b/infospace/views/kernel-overview.md @@ -3,7 +3,7 @@ # Kernel Overview - Infospace: `canon` -- Artifacts: 76 +- Artifacts: 77 ## Artifact Kinds @@ -33,7 +33,7 @@ - `kernel`: 2 - `mapping`: 3 - `mapping-expectation`: 1 -- `model`: 12 +- `model`: 13 - `model-extension`: 1 - `model-selection-guide`: 1 - `native-concept-map`: 1 @@ -53,7 +53,7 @@ - `applies_to`: 1 - `changes`: 1 - `compares`: 1 -- `conforms_to`: 28 +- `conforms_to`: 29 - `constrained_by`: 1 - `deploys`: 1 - `derived_from`: 2 @@ -68,7 +68,7 @@ - `instantiates`: 14 - `introduces`: 5 - `isolated_by`: 2 -- `maps`: 40 +- `maps`: 41 - `member_of`: 1 - `owned_by`: 3 - `part_of`: 22 @@ -80,4 +80,4 @@ - `separates`: 2 - `serves`: 2 - `stress_tests`: 6 -- `uses`: 126 +- `uses`: 140 diff --git a/infospace/views/repository-tree.md b/infospace/views/repository-tree.md index f634a19..109937f 100644 --- a/infospace/views/repository-tree.md +++ b/infospace/views/repository-tree.md @@ -2,7 +2,7 @@ # Repository Tree -File count: **208** +File count: **210** - `README.md` - `agent/README.md` @@ -40,6 +40,7 @@ File count: **208** - `agent/briefs/model-capability.md` - `agent/briefs/model-data.md` - `agent/briefs/model-devsecops.md` +- `agent/briefs/model-evidence.md` - `agent/briefs/model-governance.md` - `agent/briefs/model-information-space.md` - `agent/briefs/model-landscape.md` @@ -142,6 +143,7 @@ File count: **208** - `models/data/attribute-value-types-alignment.md` - `models/data/attribute-value-types.yaml` - `models/devsecops/InfoTechCanonDevSecOpsModel.md` +- `models/evidence/InfoTechCanonEvidenceModel.md` - `models/governance/InfoTechCanonGovernanceModel.md` - `models/governance/InfoTechCanonPurposeDemandExtension.md` - `models/governance/evidence-basis.yaml` diff --git a/intakes/intakes.md b/intakes/intakes.md index 88f62e2..e14c18a 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -39,4 +39,5 @@ resolution: >- architecture and importing profiles. resolved_by: codex resolved_at: '2026-09-04T03:10:00+02:00' +state_hub_intake_id: "01a072ff-659a-7b07-b693-e82f509d3057" ``` diff --git a/src/info_tech_canon/generation.py b/src/info_tech_canon/generation.py index 812624f..6e8bf0a 100644 --- a/src/info_tech_canon/generation.py +++ b/src/info_tech_canon/generation.py @@ -90,9 +90,10 @@ COMMON_DISTINCTIONS = [ { "id": "policy-control-evidence", "title": "Policy vs Control vs Evidence", - "summary": "Policy states intent or rule, control implements or enforces that rule, and evidence records why the claim should be trusted.", + "summary": "Governance owns policy and control; ITC-EVID owns the distinct evidence assertion and its addressable source. Evidence supports a stated interest without guaranteeing truth.", "source_artifacts": [ "model/governance", + "model/evidence", "model/security", "model/observability", ], diff --git a/tests/test_cli.py b/tests/test_cli.py index e2e0db1..cb88abf 100644 --- a/tests/test_cli.py +++ b/tests/test_cli.py @@ -11,7 +11,7 @@ def test_cli_inspect_emits_json(capsys) -> None: assert exit_code == 0 payload = json.loads(capsys.readouterr().out) assert payload["ok"] is True - assert payload["infospace"]["artifact_count"] == 76 + assert payload["infospace"]["artifact_count"] == 77 def test_cli_missing_profile_uses_structured_error(capsys) -> None: diff --git a/tests/test_evidence_boundary.py b/tests/test_evidence_boundary.py new file mode 100644 index 0000000..c50cdf1 --- /dev/null +++ b/tests/test_evidence_boundary.py @@ -0,0 +1,28 @@ +import re + +from info_tech_canon.generation import concept_ownership +from info_tech_canon.service import load_context + + +def test_shared_evidence_has_one_retrievable_owner(): + context = load_context() + concepts = concept_ownership(context)["concepts"] + for name in ["Evidence", "Evidence Source", "Adjudication Outcome", "Evidence strength"]: + assert {item["owner"] for item in concepts if item["concept"] == name} == {"model/evidence"} + artifacts = {item.id: item for item in context.infospace.artifacts} + assert "model/evidence" in artifacts + assert "model/evidence" in (context.infospace_root / "artifacts/index.yaml").read_text() + + +def test_live_governance_ownership_lists_do_not_reclaim_evidence(): + root = load_context().infospace_root + for path in [*(root / "models").rglob("*.md"), *(root / "standards").rglob("*.md")]: + text = path.read_text() + for clause in re.findall(r"Governance owns([^.\n]*)", text, re.I): + owned_clause = re.split(r"\band imports\b", clause, flags=re.I)[0] + assert not re.search(r"\bevidence\b", owned_clause, re.I), str(path) + for block in re.findall(r"(?:The )?Governance Model owns[^\n]*:\n\n```[^\n]*\n(.*?)```", text, re.S): + assert "Evidence" not in block.splitlines(), str(path) + gov = (root / "models/governance/InfoTechCanonGovernanceModel.md").read_text() + assert "**Evidence** is" not in gov + assert "itc-evid:Evidence (assertion drawn_from itc-evid:Evidence Source)" in gov diff --git a/tests/test_service.py b/tests/test_service.py index 17c6a99..c7437fa 100644 --- a/tests/test_service.py +++ b/tests/test_service.py @@ -25,7 +25,7 @@ def test_inspect_canon_counts_artifact_kinds() -> None: assert payload["ok"] is True assert payload["infospace"]["slug"] == "canon" - assert payload["infospace"]["artifact_count"] == 76 + assert payload["infospace"]["artifact_count"] == 77 assert payload["infospace"]["kinds"] == { "access-descriptor-set": 1, "alignment-review-kit": 1, @@ -53,7 +53,7 @@ def test_inspect_canon_counts_artifact_kinds() -> None: "kernel": 2, "mapping": 3, "mapping-expectation": 1, - "model": 12, + "model": 13, "model-extension": 1, "model-selection-guide": 1, "native-concept-map": 1, @@ -70,7 +70,7 @@ def test_inspect_canon_counts_artifact_kinds() -> None: def test_model_and_standard_lists_are_filtered() -> None: - assert list_models()["count"] == 12 + assert list_models()["count"] == 13 assert list_standards()["count"] == 4 @@ -99,14 +99,14 @@ def test_validate_canon_passes_scaffold() -> None: assert payload["ok"] is True assert payload["errors"] == [] assert "warnings" in payload - assert payload["details"]["artifact_count"] == 76 + assert payload["details"]["artifact_count"] == 77 def test_graph_exports_relationship_summary() -> None: payload = artifact_graph() assert payload["ok"] is True - assert payload["graph"]["node_count"] == 76 + assert payload["graph"]["node_count"] == 77 assert payload["graph"]["edge_count"] > 15 diff --git a/workplans/INFO-WP-0020-shared-evidence-model.md b/workplans/INFO-WP-0020-shared-evidence-model.md new file mode 100644 index 0000000..b746961 --- /dev/null +++ b/workplans/INFO-WP-0020-shared-evidence-model.md @@ -0,0 +1,74 @@ +--- +id: INFO-WP-0020 +type: workplan +title: "Shared evidence model and governance import boundary" +domain: infotech +repo: info-tech-canon +status: finished +owner: codex +topic_slug: canon +created: "2026-09-05" +updated: "2026-09-05" +state_hub_workstream_id: "2091f147-842b-5e79-8ae3-06ff8d0adccf" +--- + +# Shared evidence model and governance import boundary + +Implements CFED-WP-0001-T11 under accepted CUST-ADR-006 R3/R5/R7. The existing +INFO-WP-0019 maintenance work remains separately owned. This plan uses the local +workplan convention's INFO prefix. Registration retains model status draft. + +## Author the shared pair and worked examples + +```task +id: INFO-WP-0020-T01 +status: done +priority: high +state_hub_task_id: "db42df00-cf84-57a7-81a4-a5fd998717bc" +``` + +Own Evidence, Evidence Source, Adjudication Outcome and general evidence strength +in itc-evid. Separate assertions from containers, make capture interest explicit, +and show invoice/XML integrity and adjudication cases without claiming legal or +financial effects. Preserve the donor corpus and original seed provenance. + +## Transfer the live ownership boundary and register + +```task +id: INFO-WP-0020-T02 +status: done +priority: high +state_hub_task_id: "00444404-1963-568d-a8e0-631adb607073" +``` + +Replace governance Evidence ownership with imports, update its chain pattern, +register the new model in canon and service catalogs and kernel map, and correct +live direct consumer ownership assertions. Preserve EvidenceBasis catalog +identifiers and behavior as the existing quantity-origin application. + +## Verify retrieval, ownership and generated surfaces + +```task +id: INFO-WP-0020-T03 +status: done +priority: high +state_hub_task_id: "5b675961-de3c-57d8-a102-c2f0e9ea55e6" +``` + +Refresh indexes/briefs; run repository checks and focused evidence-boundary +regressions. Verify seed, catalog and finished workplan hashes unchanged. +Record evidence and reconcile native/project workplans. + +## Live continuation + +CFED-WP-0001-T05/T06 own identity/commerce migration imports; T07 owns research +corpus distribution; T08 owns reciprocal interface cards. These remain live in +prj-canon-federation. No consumer adoption or stable model promotion is claimed. + +## Verification — 2026-09-05 + +make check passes: 38 tests, generated-artifact consistency, canon validation +and small-saas profile validation. git diff --check passes. All 34 protected +seed/catalog/historical plan hashes remain unchanged. The federation donor ledger +verifies its pinned source with zero unowned or multiply owned concepts. +See [project evidence](../../prj-canon-federation/docs/evidence/2026-09-05-shared-evidence-model.md). diff --git a/workplans/index.yaml b/workplans/index.yaml index cb15ff3..0de0c45 100644 --- a/workplans/index.yaml +++ b/workplans/index.yaml @@ -16,6 +16,14 @@ implementation_decisions: consumer_workplans_live_in_consumer_repos: true workplans: + - id: INFO-WP-0020 + title: Shared evidence model and governance import boundary + status: finished + priority: high + path: workplans/INFO-WP-0020-shared-evidence-model.md + depends_on: [ITC-WP-0015] + produces: [itc-evid, governance evidence imports] + - id: INFO-WP-0019 title: Conformance, reproducible consumption, and maintenance status: blocked