STATIC PAGE Interactive levers, live recompute, and Record decision run in the app build; every figure, formula, evidence row, and WHY below is the real render, pre-computed. Evidence panels are opened for review.
Decision hygiene, surfaced
Viewing as Admin: rationale on 4 of 4 approved-or-later items, 1 segregation conflict on the record, 29 entitlement grants across 4 roles.
Computed from the tenant configuration the Studio edits; the server enforces the same resourceKey, module-level enforcement AT_ACTIVATION.
WF-05: A. Chen decided and observed. Segregation of duties: the measurer should not be the decider.
Every link recomputes; head c1f37967846c.
A forged validation reference turns the chain red at entry 2, not merely somewhere.
A reconcile without a human reference is refused, and a baseline cannot pin over pending changes.
This ledger documents changes observed in your systems of record; it cannot cause one, and a link it cannot verify is reported as the break, never repaired quietly.
4 of 4; the ledger freezes what the screen said.
2 measured, 1 correct; the incorrect verdict is visible, not filtered.
29 grants across 4 roles, 13 modules, zero orphans.
| WF-01-E1 | WF-01 | Detected | M. Okafor | Resolve contested PO on GC-4471 | |
| WF-01-E2 | WF-01 | Assigned | M. Okafor | Resolve contested PO on GC-4471 | |
| WF-01-E3 | WF-01 | Reviewed | M. Okafor | Resolve contested PO on GC-4471 | |
| WF-02-E1 | WF-02 | Detected | D. Reyes | Recover unfavorable PPV on GC-4471 | |
| WF-02-E2 | WF-02 | Assigned | D. Reyes | Recover unfavorable PPV on GC-4471 | |
| WF-03-E1 | WF-03 | Detected | S. Lindqvist | Pre-empt lead-time drift at Pacific Plastics | |
| WF-03-E2 | WF-03 | Assigned | S. Lindqvist | Pre-empt lead-time drift at Pacific Plastics | |
| WF-03-E3 | WF-03 | Reviewed | S. Lindqvist | Pre-empt lead-time drift at Pacific Plastics | |
| WF-03-E4 | WF-03 | Approved | S. Lindqvist | Pre-empt lead-time drift at Pacific Plastics | |
| WF-04-E1 | WF-04 | Detected | A. Chen | Pacific Plastics MOQ renegotiation (working capital) | |
| WF-04-E2 | WF-04 | Assigned | A. Chen | Pacific Plastics MOQ renegotiation (working capital) | |
| WF-04-E3 | WF-04 | Reviewed | A. Chen | Pacific Plastics MOQ renegotiation (working capital) | |
| WF-04-E4 | WF-04 | Approved | A. Chen | Pacific Plastics MOQ renegotiation (working capital) | |
| WF-04-E5 | WF-04 | Actioned | A. Chen | Pacific Plastics MOQ renegotiation (working capital) | |
| WF-05-E1 | WF-05 | Detected | A. Chen | Contract the off-contract tail at Eastern Components | |
| WF-05-E2 | WF-05 | Assigned | A. Chen | Contract the off-contract tail at Eastern Components | |
| WF-05-E3 | WF-05 | Reviewed | A. Chen | Contract the off-contract tail at Eastern Components | |
| WF-05-E4 | WF-05 | Approved | A. Chen | Contract the off-contract tail at Eastern Components | |
| WF-05-E5 | WF-05 | Actioned | A. Chen | Contract the off-contract tail at Eastern Components | |
| WF-05-E6 | WF-05 | Measured | A. Chen | Contract the off-contract tail at Eastern Components | |
| WF-06-E1 | WF-06 | Detected | S. Lindqvist | Inspection hold released after ppm review | |
| WF-06-E2 | WF-06 | Assigned | S. Lindqvist | Inspection hold released after ppm review | |
| WF-06-E3 | WF-06 | Reviewed | S. Lindqvist | Inspection hold released after ppm review | |
| WF-06-E4 | WF-06 | Approved | S. Lindqvist | Inspection hold released after ppm review | |
| WF-06-E5 | WF-06 | Actioned | S. Lindqvist | Inspection hold released after ppm review | |
| WF-06-E6 | WF-06 | Measured | Q. Auditor | Inspection hold released after ppm review |
Saved views persist per user in tenant mode; this session keeps them in memory. Exports serialize the filtered view. 26 of 26 rows shown.
Every event derives from the workflow board's stages; in tenant mode this is the decision ledger's own chain, hash-verified by the customer.
Every answer below names the artifact in this release that proves it, so an answer cannot outlive the thing it describes. Roughly half are not fully built and each says so. A reviewer's job is to find the gap nobody mentioned; handing over the list first turns an audit into a scoping conversation.
Data handling and residency (4)
No. The integration is read-only by construction. The object store interface exposes exactly two calls, list and read, and the conformance suite fails the build if a write, put, delete, move, copy, remove, upload, or rename call ever appears against customer storage. This is enforced by the shape of the interface rather than by policy.
proof: backend/
No. Every tenant read passes a single checked door; a caller whose tenant does not match the requested tenant is rejected, and identifiers belonging to another tenant return not-found rather than forbidden, so existence is not disclosed by the error.
proof: backend/
Term state governs access. After expiry the tenant enters a thirty day grace period that is read and export only, then suspension against a retention clock, then purge with an attestation. Access checks run before any read and fail closed.
proof: backend/
Not yet. The deployment target is a single cloud project. Regional residency is a deployment decision that arrives with the first tenant who requires it, and it is a configuration change rather than an architecture change because the platform holds no customer data of record.
proof: docs/
Formulas, templates, rule libraries, and detailed designs are gated artifacts. The signature flow is automated end to end: an acknowledgment (LOI-2026-01 plus NDA-2026-01) is validated mechanically and refused by name if incomplete, and release happens only on AssetShop CEO confirmation of a valid acknowledgment. Two keys turn; only then does a grant exist, append-only and frozen.
| Artifact | Class | What the grant opens |
|---|---|---|
| FORMULA-SHEET | FORMULA | Every coefficient, band, and calculation behind the modeled figures, with worked examples. |
| RULE-LIBRARY | TEMPLATE | The fifteen versioned templates with source mappings, thresholds, and amendment history discipline. |
| ARCH-DEEP | DESIGN | Component-level designs beyond the public overview: stores, chains, gates, and conformance dimensions. |
| ONBOARD-KIT | TEMPLATE | The week-one discovery instrument and cutover artifacts in fillable form. |
Access control and authentication (3)
Bearer credentials resolved per caller, with the tenant established from the credential rather than from the request body. Signed webhook verification uses a constant-time comparison.
proof: backend/
Yes. Each surface declares the data class it reads, and access is gated on that class rather than on job title, so a persona without entitlement to a class cannot reach any surface that reads it. The gate fails closed.
proof: tests/
Yes, both, conformance tested. Single sign-on consumes your identity provider assertions through an injected verifier and maps directory groups to platform personas through a tenant-configured mapping that fails closed: an unmapped group is refused, never admitted as a guest, so no default persona exists. SCIM 2.0 provisioning creates, updates, and deactivates users from your directory, and because the store is consulted on every resolve, deactivation revokes sign-on at the next assertion regardless of any token still in flight. Deletion is deactivation on the record rather than erasure, so an identity with ledgered decisions cannot orphan its own history. Identity-provider binding is AT_CONNECTION: your IdP remains the system of record for identity, our user table is a projection of it, and nothing in this codebase can write to your directory.
proof: backend/
Formulas, templates, rule libraries, and detailed designs are gated artifacts. The signature flow is automated end to end: an acknowledgment (LOI-2026-01 plus NDA-2026-01) is validated mechanically and refused by name if incomplete, and release happens only on AssetShop CEO confirmation of a valid acknowledgment. Two keys turn; only then does a grant exist, append-only and frozen.
| Artifact | Class | What the grant opens |
|---|---|---|
| FORMULA-SHEET | FORMULA | Every coefficient, band, and calculation behind the modeled figures, with worked examples. |
| RULE-LIBRARY | TEMPLATE | The fifteen versioned templates with source mappings, thresholds, and amendment history discipline. |
| ARCH-DEEP | DESIGN | Component-level designs beyond the public overview: stores, chains, gates, and conformance dimensions. |
| ONBOARD-KIT | TEMPLATE | The week-one discovery instrument and cutover artifacts in fillable form. |
Audit and monitoring (3)
Yes. The decision record is append-only and hash-chained: each entry carries the hash of its predecessor, so an alteration anywhere breaks the chain from that point forward and is detectable without trusting the storage layer.
proof: backend/
Both directions. Pull export of the hash-chained record exists and survives into the grace period. Push forwarding to a customer SIEM collector, Splunk HEC or Sentinel or any JSON-over-POST endpoint, is built and conformance tested: the chain is verified across every batch before a byte leaves, delivery is at-least-once with the entry hash as the idempotency key, and the cursor advances only on acknowledgement so a restart resumes exactly at a failure. The endpoint itself binds at connection; until a customer configures a collector, the forwarder states that absence rather than inventing a destination.
proof: backend/
Outbound calls to your systems carry a concurrency semaphore, exponential backoff with jitter, and honour retry-after under a 429. An inbound per-caller throttle exists on tenant read paths. Full inbound throttling across every endpoint is not complete.
proof: backend/
Formulas, templates, rule libraries, and detailed designs are gated artifacts. The signature flow is automated end to end: an acknowledgment (LOI-2026-01 plus NDA-2026-01) is validated mechanically and refused by name if incomplete, and release happens only on AssetShop CEO confirmation of a valid acknowledgment. Two keys turn; only then does a grant exist, append-only and frozen.
| Artifact | Class | What the grant opens |
|---|---|---|
| FORMULA-SHEET | FORMULA | Every coefficient, band, and calculation behind the modeled figures, with worked examples. |
| RULE-LIBRARY | TEMPLATE | The fifteen versioned templates with source mappings, thresholds, and amendment history discipline. |
| ARCH-DEEP | DESIGN | Component-level designs beyond the public overview: stores, chains, gates, and conformance dimensions. |
| ONBOARD-KIT | TEMPLATE | The week-one discovery instrument and cutover artifacts in fillable form. |
Availability and continuity (2)
None is offered, because none has been measured. There is no production deployment yet, so any availability figure would describe a test environment. A commitment arrives with the first tenant and the telemetry to support it.
proof: docs/
The failure is reported as a failure. An unreachable system never returns an empty result, because empty and failed mean opposite things to somebody waiting on a load. A per-tenant circuit breaker prevents a failing system from consuming the retry budget of others.
proof: backend/
Formulas, templates, rule libraries, and detailed designs are gated artifacts. The signature flow is automated end to end: an acknowledgment (LOI-2026-01 plus NDA-2026-01) is validated mechanically and refused by name if incomplete, and release happens only on AssetShop CEO confirmation of a valid acknowledgment. Two keys turn; only then does a grant exist, append-only and frozen.
| Artifact | Class | What the grant opens |
|---|---|---|
| FORMULA-SHEET | FORMULA | Every coefficient, band, and calculation behind the modeled figures, with worked examples. |
| RULE-LIBRARY | TEMPLATE | The fifteen versioned templates with source mappings, thresholds, and amendment history discipline. |
| ARCH-DEEP | DESIGN | Component-level designs beyond the public overview: stores, chains, gates, and conformance dimensions. |
| ONBOARD-KIT | TEMPLATE | The week-one discovery instrument and cutover artifacts in fillable form. |
Application security (3)
Not yet. A penetration test scope is published, naming the endpoints, the trust boundaries, and the assets in scope, so a test can be commissioned against a defined target rather than an assumption. The test itself has not been performed.
proof: docs/
A sealed release requires the full battery green, a receipt over every file, a production package, and a cold proof that re-derives the claims from source. The seal script halts on any failing step rather than producing a partial artifact.
proof: tools/
The application has no runtime dependencies. The bundle is derived from the import graph with no maintained allowlist, and the reachability contract fails the build if any module is unreachable, so dead code cannot accumulate unnoticed.
proof: tools/
Formulas, templates, rule libraries, and detailed designs are gated artifacts. The signature flow is automated end to end: an acknowledgment (LOI-2026-01 plus NDA-2026-01) is validated mechanically and refused by name if incomplete, and release happens only on AssetShop CEO confirmation of a valid acknowledgment. Two keys turn; only then does a grant exist, append-only and frozen.
| Artifact | Class | What the grant opens |
|---|---|---|
| FORMULA-SHEET | FORMULA | Every coefficient, band, and calculation behind the modeled figures, with worked examples. |
| RULE-LIBRARY | TEMPLATE | The fifteen versioned templates with source mappings, thresholds, and amendment history discipline. |
| ARCH-DEEP | DESIGN | Component-level designs beyond the public overview: stores, chains, gates, and conformance dimensions. |
| ONBOARD-KIT | TEMPLATE | The week-one discovery instrument and cutover artifacts in fillable form. |
Subprocessors and supply chain (2)
The model provider you choose, the transport provider for live sessions, and the cloud host. The platform is model-agnostic by design: you bring the model you already trust and have already reviewed, which means your existing model approval carries over rather than restarting.
proof: src/
Yes, and this is the one answer worth checking first. A diligence harness ships inside the release. It re-derives the receipt root, regenerates the master specification, and recomputes product identities from a cold extraction of the sealed artifact. Your team runs it unattended and we never see that you ran it.
proof: DILIGENCE.sh
Formulas, templates, rule libraries, and detailed designs are gated artifacts. The signature flow is automated end to end: an acknowledgment (LOI-2026-01 plus NDA-2026-01) is validated mechanically and refused by name if incomplete, and release happens only on AssetShop CEO confirmation of a valid acknowledgment. Two keys turn; only then does a grant exist, append-only and frozen.
| Artifact | Class | What the grant opens |
|---|---|---|
| FORMULA-SHEET | FORMULA | Every coefficient, band, and calculation behind the modeled figures, with worked examples. |
| RULE-LIBRARY | TEMPLATE | The fifteen versioned templates with source mappings, thresholds, and amendment history discipline. |
| ARCH-DEEP | DESIGN | Component-level designs beyond the public overview: stores, chains, gates, and conformance dimensions. |
| ONBOARD-KIT | TEMPLATE | The week-one discovery instrument and cutover artifacts in fillable form. |
Compliance and certification (2)
SOC 2 Type II in progress (report estimated 2027). No certification is claimed before the report exists.
proof: docs/
Agreement drafts exist and are in counsel review. They are not executed and are not represented as final.
proof: docs/
Formulas, templates, rule libraries, and detailed designs are gated artifacts. The signature flow is automated end to end: an acknowledgment (LOI-2026-01 plus NDA-2026-01) is validated mechanically and refused by name if incomplete, and release happens only on AssetShop CEO confirmation of a valid acknowledgment. Two keys turn; only then does a grant exist, append-only and frozen.
| Artifact | Class | What the grant opens |
|---|---|---|
| FORMULA-SHEET | FORMULA | Every coefficient, band, and calculation behind the modeled figures, with worked examples. |
| RULE-LIBRARY | TEMPLATE | The fifteen versioned templates with source mappings, thresholds, and amendment history discipline. |
| ARCH-DEEP | DESIGN | Component-level designs beyond the public overview: stores, chains, gates, and conformance dimensions. |
| ONBOARD-KIT | TEMPLATE | The week-one discovery instrument and cutover artifacts in fillable form. |
Accessibility (2)
An accessibility conformance report is generated from the application rather than written by hand, so its cell count and criteria track the interface. It is a draft and is labelled one.
proof: docs/
Partially, and the boundary is stated exactly. The internationalisation mechanism is built and conformance tested: a locale registry, message catalogs under a two-way parity contract, a miss counter the battery reads so an incomplete catalog fails red instead of shipping quietly bilingual, and locale-true number, currency, and date formatting through Intl. The access door and the Command Center, the first page an operator meets and the page their day starts on, render fully in Spanish today with markup, link parity, and canonical-vocabulary preservation asserted, and adoption is tracked by a grow-only register. Domain prose across the remaining surfaces is a translation pass over this mechanism, tracked by a grow-only adoption register; until that pass lands, a platform that greets you in Spanish and briefs you in English has not served you, and this answer stays PARTIAL.
proof: tests/
Formulas, templates, rule libraries, and detailed designs are gated artifacts. The signature flow is automated end to end: an acknowledgment (LOI-2026-01 plus NDA-2026-01) is validated mechanically and refused by name if incomplete, and release happens only on AssetShop CEO confirmation of a valid acknowledgment. Two keys turn; only then does a grant exist, append-only and frozen.
| Artifact | Class | What the grant opens |
|---|---|---|
| FORMULA-SHEET | FORMULA | Every coefficient, band, and calculation behind the modeled figures, with worked examples. |
| RULE-LIBRARY | TEMPLATE | The fifteen versioned templates with source mappings, thresholds, and amendment history discipline. |
| ARCH-DEEP | DESIGN | Component-level designs beyond the public overview: stores, chains, gates, and conformance dimensions. |
| ONBOARD-KIT | TEMPLATE | The week-one discovery instrument and cutover artifacts in fillable form. |
A security reviewer's job is to find the gap that was not mentioned. Handing them the list first converts an adversarial exercise into a scoping conversation. Every incomplete answer names what exists today and what would close it.
21 answers, each pointing at a suite, a runtime, or a document in this release, so an answer cannot outlive the thing it describes.
A reviewer scanning hundreds of rows needs to sort them, and a vocabulary with shades cannot be sorted.
A pack organized around the vendor's architecture makes the reviewer do the mapping, and reviewers do not.