FDE BenchmarkPublic document reader
Available in sourcev0.1 · live public draft · official release pending

Canonical source view. This renders the bundled repository document as readable HTML. Source metadata remains in the repository, and relative document links remain inside this reader.

Phase 2 trust and register proposal

Status: Proposed / Not authorized
Contract line: 0.2.0-proposal
Operative effect: None
Official numeric scoring: Disabled
Real-person data: Prohibited in this proposal package

This directory turns the Phase 2 design brief into a bounded research and contract proposal. It does not amend the v0.1 specification, authorize a service, approve public profiles, or activate a register.

The proposal preserves the useful direction of the brief—corroboration over time, prestige-neutral verification, behavioral integrity controls, privacy-protected participation views, multidimensional axes, and a meaningful appeal path—while retaining the stricter v0.1 scoring boundary.

Controlling decisions

  1. No trust state creates a score. A numeric result remains impossible until a later scoring release is independently reviewed and explicitly approved. Corroboration changes what can be trusted about evidence; it does not create a capability value.
  2. Four state machines remain separate. Trust progression, operational readiness, E0–E5 evidence maturity, and result lifecycle cannot be collapsed into a tier, badge, or number.
  3. No public person ranking. A named-person leaderboard, global human number, cost-per-person measure, or ordered register remains prohibited.
  4. No geographic aptitude. Geography cannot be an integrity input or a capability proxy. Any future map may describe privacy-protected participation only.
  5. No real personal data. Every fixture is synthetic and non-inferable. Operational identity, device, network, employment, referral, or payment data requires separate privacy, security, legal, and governance approval.
  6. Automated restrictions are contestable. Every restriction needs a disclosed reason category, a human path, correction rights, and an appeal route before activation.

Proposal documents

Machine-readable schemas are under SCHEMAS/json-schema/0.2.0-proposal. They are intentionally outside the released 0.1.0 line and have no runtime authority.

Proposal acceptance requires two checks: strict JSON Schema validation and the deterministic relational invariant gate in tests/proposal-invariants.mjs. The second gate verifies chronology, reducers, exact policy and digest bindings, candidate-to-public lineage, privacy arithmetic, unique metric identities, and active policy floors that JSON Schema cannot compare across fields. Passing either or both gates creates no operational authority.

All product copy for T0–T4 must follow the canonical display mapping. In particular, T0 is registration—not established identity; T1 is a recorded claim—not verified evidence; T3 records assessment completion and its required review—not a pass or score; and T4 is scoped field-outcome and attribution corroboration—not expertise, rank, or readiness.

Decision ledger

Brief direction Proposal disposition Reason
Trust progression over time Adopt as a distinct state machine Corroboration is valuable context when it is not confused with capability.
Score after initial corroboration Reject for this proposal It conflicts with the v0.1 activation gates and has no approved scale, validation study, or scoring release.
Expedite verifiable records Adopt with guardrails Queue priority may depend on verification tractability, never issuer prestige or inferred quality.
Staked referrals Research only This may deter abuse, but punitive effects, collusion, retaliation, due process, and accessibility require study. A voucher's standing cannot be automatically reduced.
Behavioral fraud detection Adopt as a design contract Geography and protected attributes are prohibited; restriction is limited, reason-coded, human-reviewable, and appealable.
Participation heatmap Adopt only after privacy gates Metro-level, broad count bands, immutable snapshots, visible sampling-bias notice, no ranking or capability inference.
Real consenting founding cohort Defer to an approved controlled pilot This package contains no real people and grants no intake authority.
Full axis structure Adopt as a versioned profile composition The axes remain separate; no weights, overall numeric score, or threshold are proposed.
Automatic tier decay Refine to reviewable freshness state Historical corroboration remains a fact; stale evidence may require refresh or withholding, not automatic loss of capability.

Activation sequence

None of the following is authorized by this package. If governance later elects to proceed, the minimum order is:

  1. approve purpose, job analysis, privacy impact assessment, threat model, and prohibited-use enforcement;
  2. approve identity, consent, deletion, accommodation, correction, human review, and appeal operations;
  3. validate issuer-neutral corroboration and integrity controls on synthetic and consented controlled-pilot data;
  4. measure error, subgroup impact, reviewer agreement, and appeal outcomes;
  5. independently review any proposed measurement or scoring release;
  6. authorize a narrow controlled pilot before considering public aggregate publication; and
  7. approve each immutable aggregate snapshot before publication.

Software completion alone satisfies none of these gates.