Corrections, suspensions, retractions, and retirement workflow

Protocol ID: LL-FDE-PUB-INT-001
Version: 0.1.0
Status: proposed workflow; monitored reporting routes and named owners are not yet operational

1. Principle

A correction changes a record. A retraction removes authority from a record. Neither erases history.

Every canonical page, downloadable artifact, archive, DOI record, citation file, API, search surface, and result/credential surface must converge on the current status. A Git commit or silent webpage edit is not a publication-integrity response.

The workflow adapts the COPE Retraction Guidelines to benchmark specifications, data, software, methods, studies, and results. This is not a COPE membership or conformance claim.

2. Report channels to activate

Before a citable release, appoint and test:

Each route needs a named monitoring owner, backup, receipt behavior, triage target, escalation path, privacy notice, and quarterly test receipt. Targets remain unassigned until the named owner accepts them; this document does not invent an operational service level.

3. Severity model

Severity is based on possible consequence, not intent or embarrassment. When uncertainty spans levels, apply the more protective temporary control until triage resolves it.

4. State machine

received → triaged → investigating ─┬→ closed_no_action
                                  ├→ correction_approved → corrected
                                  ├→ suspended → investigating / correction_approved / retraction_approved / retired
                                  ├→ retraction_approved → retracted
                                  └→ retired

Every transition records time, authority, reason codes, evidence digest, and affected scope. Terminal records remain addressable.

5. Intake record

EVENT ID:
RECEIVED AT / CHANNEL:
REPORTER CLASS AND SAFE CONTACT PATH:
CONFIDENTIAL REPORT LOCATION AND DIGEST:
PUBLICATION / RELEASE / STUDY / CLAIM / RESULT AFFECTED:
ISSUE CLASS:
REPORTED FACTS:
POSSIBLE PARTICIPANT, CUSTOMER, OR DECISION IMPACT:
POSSIBLE SECURITY OR PRIVACY SENSITIVITY:
TRIAGE OWNER / CONFLICT CHECK:
TEMPORARY CONTROLS APPLIED:
NEXT DECISION DATE:

Do not put a confidential report or direct identifier in the public repository. The public event record stores metadata and digests only.

6. Investigation packet

The investigation owner freezes:

1. the exact affected artifacts and public screenshots;
2. claims, calculations, data rows, code, environments, task/rubric/grader versions, and upstream/downstream dependencies;
3. access logs and chain-of-custody evidence where relevant;
4. author, reviewer, participant, and affected-party statements, with protected channels;
5. independent technical or methods review required by the issue;
6. an impact analysis across people, decisions, citations, versions, and derivative artifacts;
7. remediation options and limits; and
8. a written decision, dissent, approvals, notifications, and preservation plan.

The subject of a misconduct allegation may respond but must not control triage or sole disposition. Security, privacy, legal, HR, or participant-safety processes may run in parallel under appropriate confidentiality.

Decision authority follows the affected output:

• a public-draft source correction requires a named non-conflicted publication authority and preserved change record;
• an empirical finding requires a non-conflicted methods/disclosure review path separate from the study author’s sole control;
• an official human result, tier, credential, or governing independence claim requires the FDE Benchmark Commission with external-majority quorum under the Independence and Institutional Firewall;
• a trainer, recruiter, staffing representative, sales lead, engagement owner, original reviewer, sponsor, or commercial beneficiary cannot control the affected person’s disposition or appeal.

Loss of the required external-majority quorum keeps the material suspended. It does not transfer protected authority to the founding steward.

7. Public notices

Correction notice

CORRECTION — [publication title, version]
Published: [timestamp]
Affected material: [claim/artifact/section]
What was wrong:
What changed:
What did not change:
Effect on interpretation, results, and prior uses:
Original version and archive:
Corrected version and archive:
Review and decision authority:
How to report a further concern:

Suspension notice

SUSPENDED PENDING REVIEW — [publication/result]
Effective: [timestamp]
Scope of hold:
Reason stated without compromising protected investigation:
Actions users should take now:
Next status channel:

Retraction notice

RETRACTED — [publication title, version]
Effective: [timestamp]
Authority withdrawn from:
Reason and evidence boundary:
Affected claims, results, and downstream uses:
Participant remediation, if applicable:
Original preserved record and tombstone:
Replacement, if any:
Decision authority and independent review:

Notices must avoid defamatory speculation and must not expose reporters, participants, customers, secrets, or confidential investigative material.

8. Remediation and notification

Impact analysis determines whether to:

• recalculate, replay, re-rate, or independently reproduce;
• correct or withdraw a claim receipt;
• notify participants, employers, verifiers, authors, archives, indexers, or downstream users;
• invalidate or reissue a result or credential under a later authorized system;
• reimburse or provide a new administration where appropriate;
• delete or restrict unlawfully held data while preserving a metadata audit trail; and
• change controls, protocol, training, or monitoring.

Participant remediation cannot depend on signing a nondisclosure agreement about the error.

9. Closeout verification

Closeout requires evidence that:

• status banners and machine metadata agree;
• old and new versions link bidirectionally;
• the archive and persistent-identifier metadata reflect the status;
• downloads, API, search, citations, and derived assets are corrected or held;
• claims and receipts are superseded, corrected, or retracted;
• affected parties received required notices;
• the original is preserved unless lawful deletion requires a different controlled record; and
• monitoring confirms the correction did not silently regress.

Machine records conform to SCHEMAS/research-ops/0.1.0/publication-integrity-event.schema.json.

10. Current disposition

The workflow is designed but not operational. Do not publish a monitored-channel or response-time claim until owners, routes, escalation, and test receipts exist.