Three-layer outcome architecture

Status: Proposed / not authorized
Applies to: Future research releases only
Current official output: None

1. Decision

The proposed three-layer split is accepted with one material correction: the middle layer is not yet a validated psychometric instrument. It is a proposed multidimensional measurement output whose interpretations must be earned through evidence.

The phrase FDE Score should not name the system at this stage. It collapses three different questions:

1. What production facts can be audited?
2. What does eligible evidence support about capability in a declared role context?
3. What governed classification, if any, may an issuer allow a person to share?

Those questions have different inputs, reviewers, error modes, rights, and consequences. The architecture keeps them separate.

2. Authority matrix

No downstream layer may overwrite the upstream record. It must cite the exact input digests and append a new decision event.

3. Layer 1 — Verified Production Record

3.1 Unit of assertion

A record contains small, contestable facts rather than an omnibus label. Each fact binds:

• a controlled fact type and claim template;
• the deployment or work scope without exposing a customer identity;
• source and verification-event digests;
• the named verification protocol and version;
• contribution attribution such as direct owner, shared contributor, technical lead, reviewer/advisor, or unresolved;
• the time window and disclosure state; and
• any dispute, hold, correction, or review-due state.

Examples of appropriately bounded assertions are:

• a production deployment existed during a declared period;
• the subject contributed to a named technical workstream under a declared attribution class;
• an artifact digest existed and was reviewed under a named protocol; or
• an outcome measure was defined and an observation was recorded.

The record must not convert “an outcome was observed” into “the subject caused the outcome.” Causal attribution requires a separately specified design.

3.2 Verification does not mean capability

Identity proofing answers whether the record is bound to the intended subject. Production-fact verification answers whether the bounded facts were corroborated under the protocol. Neither establishes capability. A person may have a verified contribution to a poorly designed system; a strong practitioner may also lack disclosable production evidence.

The record therefore preserves:

• verified facts;
• unresolved or disputed facts;
• facts withheld for consent, confidentiality, or legal reasons; and
• absence of evidence without converting absence into weakness.

When a Capability Profile later cites a verified production fact, the evidence binding must identify both the enclosing production-record digest and the exact corroborated fact ID and fact digest. A record-level digest alone is insufficient because it does not say which bounded assertion supports the profile. Non-production evidence classes cannot populate verified-fact fields.

3.3 Required controls before operation

Operational use requires approved identity, consent, confidentiality, data-minimization, verifier-conflict, reference-contact, correction, appeal, retention, deletion, security, and audit protocols. Customer names, source code, credentials, protected data, or other people's private information do not belong in a shareable record.

4. Layer 2 — Capability Profile

4.1 Intended structure

The profile is a vector of versioned capability dimensions—not a résumé score or reputation index. Each dimension carries its own:

• construct and rubric binding;
• immutable benchmark-release, schema-bundle, rubric, evaluator, scoring-policy, competency-registry, and calculation-manifest identifiers and digests;
• eligible evidence and lineage groups;
• estimate state, including Insufficient Evidence, withheld, or disputed;
• coverage;
• support confidence;
• highest eligible evidence maturity;
• contradictions and reviewer agreement;
• uncertainty method, when a synthetic estimate is being studied;
• critical-gate state; and
• limitations.

Coverage, confidence, maturity, verification, recency, integrity, readiness, and capability remain separate. They may qualify interpretation but may not be blended into a flattering number.

The proposal contract fails closed at the dimension boundary. An experimental synthetic estimate must cite at least one evidence binding, and every cited binding must be eligible under the declared policy. An unresolved or disputed contradiction forces the dimension to disputed, which cannot carry a numeric estimate. High support confidence additionally requires multiple independent evidence lineages, reviewer agreement, and no unresolved contradiction. The machine gate requires at least two eligible bindings across at least two distinct lineage-group digests and at least two distinct human-review artifact digests. Distinct review artifacts do not prove distinct reviewer identities; reviewer independence requires a separately governed identity and conflict control. These are integrity constraints for the research format, not evidence that the instrument is valid.

A non-estimated state cannot claim High support confidence, even if its independence and agreement flags are populated. Each dimension also binds its declared competency and rubric entries to the same immutable registry ID and digest carried by the profile. The contract can verify this lineage; it does not prove that the rubric or evaluator is valid for the intended use.

4.2 Why “psychometric instrument” is premature

An instrument is not validated by publishing a rubric or producing stable software. For each intended interpretation and use, the program still needs a coherent validity argument and evidence addressing, as applicable:

• job/practice analysis and content representation;
• response processes and administration conditions;
• internal structure and dimensionality;
• rater agreement, reliability, precision, and uncertainty;
• relationships to external criteria and field outcomes;
• fairness, accessibility, accommodations, subgroup behavior, and irrelevant variance;
• consequences, adverse impact, alternatives, and decision errors;
• generalization and transport to each role, domain, and population; and
• ongoing monitoring, correction, and version linkage.

The Testing Standards place the validity burden on the proposed score interpretation and use, not on the test name or technology. Until those claims are supported, public language should say proposed multidimensional capability profile or experimental measurement profile, not validated psychometric instrument.

5. Layer 3 — Governed Credential Tier

5.1 Tier versus profile

A tier compresses a profile into a decision category. That makes it useful and consequential. It also discards information. A future tier scheme must define:

• the precise role, population, context, and intended use;
• eligibility, critical floors, missingness, uncertainty, and contradiction rules;
• a defensible standard-setting method with qualified subject-matter and measurement experts;
• decision consistency and classification-error analysis;
• accommodation and alternate-demonstration paths;
• issue, expiration, renewal, suspension, revocation, and version-transition rules;
• correction and independent appeal; and
• monitoring for subgroup effects, misuse, drift, and unintended consequences.

The tier should never be reverse-engineered from marketing labels such as “elite” or from a desired pass rate.

5.2 Credential versus truth

A future shareable tier can target W3C Verifiable Credentials and Open Badges interoperability. That is a transport and integrity choice, not measurement evidence. The W3C Verifiable Credentials Data Model explicitly distinguishes verifiability from truth: a verifier must still apply its policy to the issuer, proof, subject, claims, status, and purpose.

A credential verifier should be able to inspect at least:

• issuer and governance identity;
• benchmark, ontology, tier-scheme, and policy versions;
• issue, expiry, status, and revocation endpoints;
• intended-use and role-profile identifiers;
• result and source-record digests without private evidence;
• limitations and disclosure scope; and
• correction and appeal routes.

The holder controls optional public presentation. A shareable credential is not a public leaderboard.

6. End-to-end lineage

Private evidence and references
  -> bounded verification events
  -> Verified Production Record (facts only)
  -> eligible evidence bindings and human review
  -> Capability Profile (multidimensional interpretation)
  -> independent tier decision under a released scheme
  -> holder-controlled verifiable credential presentation

Each arrow is a governed inference or decision boundary, not a database join. Every output names the relevant purpose, versions, input digests, reviewer or decision class, limitations, and lifecycle state.

7. Error and rights model

8. Current implementation boundary

The proposal schemas are deliberately non-operational:

• the production record requires a synthetic declaration and synthetic-shaped identifiers and cannot make a capability claim; JSON Schema cannot prove the declaration's provenance, so an application/environment ingestion guard is required;
• the profile accepts only experimental synthetic estimates and cannot contain a global score;
• the credential candidate cannot assign a tier, create signed material, or issue a credential; and
• no contract authorizes real-person data, employment use, public ranking, or official scoring.

See the machine-contract README and contract tests.