Introduce shared evidence model and governance imports

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a070b5-4994-7271-bd8b-7c3dbcedec4b

infospace/models/governance/InfoTechCanonGovernanceModel.md

@@ -4,6 +4,7 @@
 **Document Status:** Seed Standard Release Candidate 1
 **Version:** RC1-seed
 **Date:** 2026-05-22
+**Boundary updated:** 2026-09-05 — Evidence imported from ITC-EVID (INFO-WP-0020).
 **Repository Context:** `info-tech-canon`
 **Document Type:** InfoTechCanon Domain Standard
 **Intended Audience:** Governance designers, enterprise architects, service owners, platform owners, risk managers, compliance reviewers, security architects, quality managers, auditors, product owners, DevSecOps teams, organization designers, knowledge-system builders, standards authors, and agentic tooling.
@@ -29,7 +30,7 @@ It provides the canonical vocabulary for:
 - issues,
 - exceptions,
 - waivers,
-- evidence,
+- governance uses of imported evidence,
 - assurance,
 - audits,
 - reviews,
@@ -120,7 +121,6 @@ Risk
 Issue
 Exception
 Waiver
-Evidence
 Assurance
 Audit
 Review
@@ -189,7 +189,6 @@ Control
 ControlObjective
 Policy
 Exception
-Evidence
 Assurance
 ComplianceRequirement
 ```
@@ -220,6 +219,16 @@ AccessException as an exception
 
 ---
 
+## 3.5 Boundary with Evidence
+
+ITC-EVID owns Evidence, Evidence Source, Adjudication Outcome and general evidence
+strength under CUST-ADR-006 R3/R5/R7. Governance imports the pair for control,
+policy, decision and assurance reasoning. AssuranceCase, AssuranceConclusion,
+Audit and the existing EvidenceBasis quantity-origin application remain here.
+EvidenceBasis is not a competing definition of general evidence strength.
+
+---
+
 # 4. Research Basis and External Alignment
 
 This seed standard draws on multiple bodies of governance knowledge.
@@ -258,7 +267,7 @@ NIST CSF 2.0 introduced `Govern` as one of its top-level functions alongside Ide
 
 ## 4.7 ISO 9001 Roles, Responsibilities, and Authorities
 
-Quality management practice emphasizes that responsibilities and authorities must be assigned, communicated, and understood. In InfoTechCanon, Organization owns the actor/role structure, while Governance owns the rules and evidence that ensure responsibilities and authorities are directed and reviewed.
+Quality management practice emphasizes that responsibilities and authorities must be assigned, communicated, and understood. In InfoTechCanon, Organization owns the actor/role structure, while Governance owns the rules and imports evidence that ensures responsibilities and authorities are directed and reviewed.
 
 ## 4.8 Audit, Assurance, and Compliance Practice
 
@@ -499,7 +508,6 @@ GovernanceEntity
 │   ├── CompensatingControl
 │   └── ExpiryCondition
 ├── EvidenceEntity
-│   ├── Evidence
 │   ├── Attestation
 │   ├── Assertion
 │   ├── Finding
@@ -1048,26 +1056,15 @@ A **CompensatingControl** is a control used to reduce risk when the primary expe
 
 ## 11.34 Evidence
 
-**Evidence** is information used to support a claim, decision, control result, compliance status, risk assessment, audit conclusion, or assurance case.
+Evidence and Evidence Source are imported from
+[ITC-EVID](../evidence/InfoTechCanonEvidenceModel.md), which owns their definitions.
+A governance evidence record identifies a distinct assertion, its addressable
+source/version and the interest it supports. Logs, tickets, screenshots and audit
+reports are possible sources; a claim drawn from one is the evidence assertion.
+This section retains its locator for existing consumers, not concept ownership.
 
-Examples:
-
-```text
-log extract
-signed attestation
-ticket
-screenshot
-scan result
-configuration file
-test result
-deployment record
-policy document
-meeting decision
-audit sample
-```
-
-A quantity offered as evidence MUST declare an **EvidenceBasis** (§11.34a)
-so a decision can be graded by the weakest thing it actually rests on.
+A quantity offered as governance evidence MUST declare an **EvidenceBasis**
+(§11.34a) under the existing quantity-origin application rules.
 
 ---
 
@@ -1403,7 +1400,7 @@ Policy
   -> Control
   -> ControlImplementation
   -> ControlActivity / ControlTest
-  -> Evidence
+  -> itc-evid:Evidence (assertion drawn_from itc-evid:Evidence Source)
   -> AssuranceConclusion
 ```
 
@@ -1856,6 +1853,9 @@ risk-driven work
 exception remediation
 ```
 
+Evidence consumers import the general pair directly from ITC-EVID; the following
+lists contain only governance-owned concepts.
+
 ## 18.4 Tagging Standard
 
 Tagging imports governance concepts for:
@@ -1868,7 +1868,6 @@ compliance
 exception
 review
 approval
-evidence
 audit
 ```
 
@@ -1884,7 +1883,6 @@ access review
 exception
 waiver
 control objective
-evidence
 ```
 
 ## 18.6 Security Model
@@ -1897,7 +1895,6 @@ security control objective
 risk
 exception
 finding
-evidence
 assurance
 compliance requirement
 ```
@@ -1914,6 +1911,7 @@ Example:
 subsystem: governance-policy-registry
 implements:
   - InfoTechCanonGovernanceModel
+  - InfoTechCanonEvidenceModel
   - SmallSaaSGovernanceProfile
 produces:
   - Policy
@@ -2138,7 +2136,7 @@ standards/governance/agent-brief.md
 standards/governance/concepts/policy.md
 standards/governance/concepts/control.md
 standards/governance/concepts/risk.md
-standards/governance/concepts/evidence.md
+models/evidence/InfoTechCanonEvidenceModel.md
 standards/governance/concepts/exception.md
 standards/governance/concepts/decision.md
 standards/governance/patterns/policy-control-evidence-chain.md