{
  "format": "vercy-model-allocation-candidate/v1",
  "contourId": "EM-LEG-06",
  "proposedName": "Processing Activity / Processing Register Entry",
  "modelId": null,
  "registryId": null,
  "allocationState": "unassigned",
  "decision": "NEW MODEL",
  "canonicalPublishable": false,
  "identityTest": {
    "stableIdentity": "A governed processing activity persists independently of datasets, systems, consent instruments, request cases and ROPA editions.",
    "versionIdentity": "Purposes, bases, roles, locations, operations, recipients, transfers and disposition constraints change through immutable non-overlapping revisions.",
    "independentLifecycle": [
      "draft",
      "assessed",
      "approved",
      "active",
      "suspended",
      "retired"
    ],
    "mastership": "controller accountability and processing-register authority"
  },
  "boundary": {
    "owns": [
      "stable processing-activity identity",
      "immutable processing-activity revisions",
      "purpose, basis and role assertions",
      "location bindings",
      "accountability lifecycle and register projection source"
    ],
    "references": [
      {
        "target": "WM-DAT-001",
        "purpose": "Dataset identity, lifecycle and durable dataset tombstones"
      },
      {
        "target": "WM-DAT-004",
        "purpose": "Schema and data-category semantics"
      },
      {
        "target": "WM-PER-001",
        "purpose": "Data-subject person reference only"
      },
      {
        "target": "WM-POL-001",
        "purpose": "Cited legal norm or provision"
      },
      {
        "target": "WM-XCT-002",
        "purpose": "Consent or permission instrument cited by a consent basis"
      },
      {
        "target": "WM-XCT-003",
        "purpose": "Disclosure projection shape that may only narrow"
      },
      {
        "target": "WM-KNW-012",
        "purpose": "Retention and processing policy"
      },
      {
        "target": "WM-XCT-029",
        "purpose": "Instantiated retention duty or assignment"
      },
      {
        "target": "WM-ACT-021",
        "purpose": "Data-subject request case and per-location outcomes"
      },
      {
        "target": "WM-REC-001",
        "purpose": "Record identity and durable record tombstones"
      }
    ],
    "excludes": [
      "payload data or record identity",
      "person identity",
      "consent adjudication",
      "request case execution",
      "norm or duty mastership",
      "ROPA edition identity",
      "purpose-taxonomy ownership",
      "legal compliance conclusions"
    ]
  },
  "objects": {
    "ProcessingActivity": {
      "identity": [
        "processingActivityId"
      ],
      "required": [
        "name",
        "status"
      ],
      "optional": [
        "successorRef"
      ],
      "lifecycle": [
        "draft",
        "assessed",
        "approved",
        "active",
        "suspended",
        "retired"
      ]
    },
    "ProcessingActivityRevision": {
      "identity": [
        "processingActivityId",
        "revision"
      ],
      "required": [
        "purposeAssertionRefs",
        "basisAssertionRefs",
        "roleAssertionRefs",
        "locationBindingRefs",
        "retentionAssignmentRefs",
        "effectiveFrom",
        "recordedAt",
        "contentDigest"
      ],
      "optional": [
        "effectiveTo",
        "holdRefs",
        "recipientRefs",
        "transferRefs",
        "safeguardRefs",
        "supersedesRevision"
      ],
      "rules": [
        "effective intervals do not overlap",
        "current revision is derived from the interval containing query time"
      ]
    },
    "PurposeAssertion": {
      "identity": [
        "purposeAssertionId"
      ],
      "required": [
        "activityRevisionRef",
        "purposeTerm",
        "taxonomyVersion",
        "wording",
        "granularity",
        "effectiveFrom",
        "recordedAt"
      ],
      "optional": [
        "effectiveTo",
        "supersedesRef"
      ]
    },
    "ProcessingBasisAssertion": {
      "identity": [
        "basisAssertionId"
      ],
      "required": [
        "purposeAssertionRef",
        "basisClass",
        "assertingRoleRef",
        "acceptanceState",
        "effectiveFrom",
        "recordedAt"
      ],
      "optional": [
        "provisionRef",
        "assessmentRef",
        "instrumentRef",
        "effectiveTo",
        "supersedesRef"
      ],
      "rules": [
        "instrumentRef is required when basisClass is consent",
        "withdrawal closes effectiveTo and never deletes history"
      ]
    },
    "RoleAssertion": {
      "identity": [
        "roleAssertionId"
      ],
      "required": [
        "partyRef",
        "roleClass",
        "purposeAssertionRef",
        "effectiveFrom",
        "recordedAt"
      ],
      "optional": [
        "effectiveTo",
        "supersedesRef"
      ]
    },
    "LocationBinding": {
      "identity": [
        "locationBindingId"
      ],
      "required": [
        "datasetRef",
        "systemRef",
        "ownerRef",
        "recordedAt"
      ],
      "optional": [
        "recordSetRef",
        "effectiveFrom",
        "effectiveTo"
      ]
    },
    "RetentionAssignment": {
      "identity": [
        "retentionAssignmentId"
      ],
      "required": [
        "targetLocationRef",
        "dutyRef",
        "authorityRef",
        "constraintKind",
        "precedenceOwnerRef",
        "effectiveFrom",
        "recordedAt"
      ],
      "optional": [
        "effectiveTo",
        "expiryAt"
      ],
      "constraintKinds": [
        "floor"
      ]
    },
    "Hold": {
      "identity": [
        "holdId"
      ],
      "required": [
        "targetLocationRef",
        "authorityRef",
        "constraintKind",
        "precedenceOwnerRef",
        "effectiveFrom",
        "recordedAt"
      ],
      "optional": [
        "effectiveTo",
        "releaseEventRef"
      ],
      "constraintKinds": [
        "suspension"
      ]
    },
    "DerivedPurposeCeiling": {
      "identity": [
        "derivedDatasetRef",
        "sourceActivityRef"
      ],
      "required": [
        "inputPurposeRefs",
        "ceilingPurposeRefs",
        "recordedAt"
      ],
      "rules": [
        "ceiling equals the intersection of input ceilings",
        "ceiling may only be preserved or narrowed",
        "a wider purpose requires a new ProcessingActivity"
      ]
    }
  },
  "invariants": [
    "ProcessingActivity is independently referencable and remains identifier-unassigned until registry allocation.",
    "Processing Activity and Processing Register Entry are one candidate type; ROPA is a read-only projection.",
    "Purpose and Processing Basis are separate attributable assertions.",
    "A revision cannot become active while any purpose lacks an accepted basis over the same interval.",
    "Consent basis requires an explicit WM-XCT-002 instrument reference.",
    "Consent withdrawal is prospective, instrument-specific and basis-scoped.",
    "Role assertions are scoped by party, purpose and effective interval.",
    "Every erasure location resolves to a dataset-system tuple with an explicit owner and optional record set.",
    "WM-ACT-021 records one outcome per resolved location tuple; case closure is not global erasure and does not retire the activity.",
    "Retention floor and legal hold remain distinct authority-backed constraints with explicit precedence owners.",
    "Conflicting disposition constraints without a resolvable precedence owner refuse execution.",
    "Retained data binds to a separately governed restricted-purpose activity with its own accepted basis and expiry.",
    "Derived purpose ceiling is the intersection of input ceilings and may only be preserved or narrowed.",
    "A wider analytics purpose requires a new ProcessingActivity.",
    "WM-XCT-003 may narrow shape but cannot add purpose, basis or authority.",
    "Durable tombstones are mastered by WM-DAT-001 or WM-REC-001 and outlive request-case retention.",
    "Deletion digest covers only the disposition record; subject-derived input requires a keyed digest whose key remains outside the proof.",
    "Event, effective and recorded times remain distinct and queryable.",
    "Revision effective intervals do not overlap and the current revision is derived, not independently asserted.",
    "Activity identifiers and revision numbers are never recycled.",
    "No record silently asserts legal compliance or lawfulness.",
    "An activity without a current purpose or accepted basis cannot project as an active ROPA row."
  ],
  "holds": [
    "Registry allocation is pending and no identifier may be guessed.",
    "Cross-model legal-hold precedence remains unresolved and blocks executable conflict resolution.",
    "Purpose-taxonomy and ROPA-edition mastership remain unowned.",
    "Cohort-control and derivation-lineage mastership remain unowned.",
    "Processing-operation vocabulary, technical-measure ownership and jurisdiction profiles remain incomplete.",
    "WM-XCT-002, WM-XCT-003 and WM-ACT-021 are non-canonical drafts with relation and source-pin gaps."
  ]
}