**REVISE** — 9 of 12 checks fail, 2 pass with defects, 1 passes. Two items are hard blockers for revision 3: unbound rule IDs (9) and an unattested identifier (11). --- ### Closed audit checklist — EM-PEO-08, candidateRevision 2 **1. Identity — PARTIAL (non-blocking)** Keys are abstract and coherent: `gradeSchemeId`; (`gradeSchemeId`,`versionId`); level under (scheme, version, track/axis, levelKey); `roleProfileId`; `gradeAssignmentId`. Defects: (a) `GradeAssignment.trackOrAxisKey` is required and also implied by `levelRef`, with no invariant forcing the two to agree or requiring `levelRef` to be a member of the cited version/track — two fields can disagree silently; (b) `trackOrAxisKey` is required with no defined sentinel for a single-ladder scheme, so the `single-axis` fixture has no expressible key; (c) `GradeCrosswalk` identity is keyed to one `gradeSchemeId` without stating that the owner is the source scheme, and the merger case where a third authority owns the map is unaddressed; (d) `GradeCrosswalk` has no `contentDigest` although `digestPolicy.coverage` claims "all released semantic fields" and crosswalks carry `revision` + `supersedesRef`. **2. Lifecycle — FAIL (non-blocking)** Three lifecycles are enumerated, none has transition rules or terminal-state semantics. Specifically: `GradeSchemeVersion.status` is load-bearing ("frozen or effective" in `assignmentTargetWhen` and in two invariants) but its vocabulary is never enumerated anywhere — only the *scheme* lifecycle is listed, and it contains no `frozen`. GA carries both a `challenged` lifecycle state and an optional `challengeState` field with no statement of which is authoritative or whether challenge suspends effectivity. `revoked` / `expired` / `superseded` do not distinguish voiding an interval from closing it, so revocation's meaning for as-of history is undefined. Minor: instance state `published` on GS/RP collides in wording with the model-level publication hold. **3. Mastership — FAIL (non-blocking)** Three masters are named and are non-overlapping. But `PositionGrade` is asserted throughout (GA-INV, profile constraint 4) with **no declared master in any frozen deliverable** — grok-study B3 requires the Position draft to expose it, and that blocker is not carried into `profile-candidate.json`, which has no `holds`/`blockers` array at all. Likewise unowned and unrecorded in the frozen set: the calibration deliberative occasion (session composition, recusal — claude-study's explicit unclosed gap), performance rating, job-family architecture, pay-band master data, access master. Both studies list these; no frozen artifact carries an unowned-scope register. **4. Version pins — PARTIAL (non-blocking)** Correct and consistent where present: assignments require `schemeVersionRef`; frozen/published versions immutable; relabel/reorder/add forces a successor; historical assignments retain the cited version; `assignmentTargetWhen` gates draft targets; `draft-target` and `historic-pin` fixtures exist. Defect: `RoleProfileVersion.gradeExpectation` has **no frozen-or-effective-only constraint** — the draft-version prohibition covers assignments only, so a published profile may pin an unfrozen scheme version. Compounded by the undefined version-status enum (2) and the missing level-membership invariant (1). **5. Temporal behavior — FAIL (blocking for revision 3)** (a) No datetime format rule survives into any candidate JSON; claude-study's RFC 3339 with explicit offset requirement is dropped. (b) As-of behavior is asserted ("independently dated") but no invariant states that as-of resolves on effective time with `recordedAt` as the knowledge axis, so "preserves what was previously believed" is unenforced. (c) Asymmetry: crosswalks are explicitly "never retroactive", yet nothing prevents an assignment `effectiveFrom` earlier than its cited version's freeze/`effectiveFrom` — the 2024/2026 reassessment scenario runs straight through this hole. (d) `currentUniqueness` is keyed on *context + scheme version + track*, which permits two simultaneous current assignments on one Employment across two versions or two schemes; nothing requires closing the A assignment when a B assignment is ratified, contradicting grok-study S2's intent. **6. Privacy — FAIL (blocking for revision 3)** `privacyPolicy` is four booleans repeated verbatim in three files, with **zero privacy fixtures in any of the three fixture sets**. Dropped from claude-study without a recorded resolution: retention triggers per assertion/decision/evidence, legal hold suspending disposition, non-cascading disposal, and separate disclosure scopes for level / rationale / comparative ranking / dissent, plus the subject's read-to-contest. `GA-INV` "calibration-purpose access grants no disclosure authority" and "no published grade-pay join" are untested. `recordedBy` is required with no disclosure scoping. The `holds` line "privacy, retention … remain pending" bounds the claim but does not repair coverage. **7. Crosswalks — FAIL (blocking for revision 3)** Direct internal contradiction: claude-study's acceptance scenario pins "A-L5 → {IC3} narrow, **for pay benchmarking only**", which `forbiddenCrosswalkPurposes` (`pay`, `pay-eligibility-hint`) rejects; `provider-comparison.md` says only that Grok "restricts crosswalk purposes" and never marks that scenario superseded. Also: `mappingRows` is an unspecified blob, so explicit-null-with-reason, direction, and declared loss are invariant text only, not schema-bound; mapping **strength** ("narrow") and crosswalk **authority**, both required by claude-study, are absent from the object; `purpose` is not bound to the `allowedCrosswalkPurposes` enum; no fixture covers the forbidden `access` purpose or one-to-many loss. **8. Profile boundaries — FAIL (non-blocking)** Leaks in both directions. GS carries "Missing grade is unknown, never a default" plus the `missing-grade` fixture while `GS.boundary.excludes` lists "person grade assignment" — that invariant belongs to GA, which lacks it. `RP.boundary.owns` claims "competency and qualification expectations" while RP-INV and `competencyExpectationPolicy` defer competency entirely and `RoleProfileVersion` has no competency field. GS declares references to WM-XCT-023, WM-PER-008 and WM-PER-009 that no GS field consumes (and WM-PER-009 is simultaneously in `deferredBases`); GA declares WM-ORG-004 and WM-ECO-031 references with no corresponding field. `profile-candidate.json` mixes a PROFILE decision with `candidateRoots` and carries no holds. **9. Stable rule IDs — FAIL (hard blocker)** `GS-INV-nn`, `RP-INV-nn`, `GA-INV-nn` are cited by every fixture and **defined nowhere**; the `invariants` arrays are unlabeled prose. Under the only available reading (positional), the bindings are wrong: GS `single-axis`→GS-INV-01 (= level-identity, should be the assignment-target rule), `partial-map`→GS-INV-03 (= labels/ordinals, should be null-mapping), `label-match`→GS-INV-06 (= relabel-forces-successor); RP is off-by-one from `vacant-profile` onward, ending with `no-position`→RP-INV-14 (= "no identifier is allocated without registry reservation"); GA `dual-track`→GA-INV-03 (= forbidden subjects) and `bare-person`→GA-INV-06 (= two-track standing). GA has 17 invariants against 16 rule IDs. `profile-candidate.json`'s 7 constraints have no IDs at all. Fix: give every invariant an explicit `id` and re-derive every fixture's `rules` from it. **10. Fixture coverage — FAIL (non-blocking)** 44 declarative cases, good positive/negative/semantic balance, but uncovered normative content: **GS** — level-is-not-a-root, "scheme changes mutate no person/employment/position/compensation/access master", crosswalk direction and version-pinning, one-to-many loss, forbidden `access` purpose. **RP** — "applicability is explicit and time-bounded", "profile fulfillment creates no GradeAssignment" (absent from GA's set too), credential-expectation non-award. **GA** — evidence-is-optional, "no published grade-pay join", "calibration-purpose access grants no disclosure authority", RoleProfile-as-subject and compensation-as-subject rejections, the assignment→PositionGrade direction (only PositionGrade→assignment is tested), credential and Position non-mutation, and as-of independence for PositionGrade/band/pay decision (the `as-of` case exercises assignments only). No fixture file exists for the profile at all. The registry-reservation invariants are untestable as written and should be marked non-fixturable rather than left silently uncovered. **11. No guessed identifiers — FAIL (hard blocker)** Allocation discipline holds: `modelId` and `registryId` are `null` in all three candidates, `allocationState: "unassigned"`, `newRuntimeId: false`, and no WM-* target is claimed. Two violations of the weaker rule — do not cite identifiers you cannot evidence: (a) `GA/allocation-candidate.json` references **WM-PER-001, purpose "Person subject"**; that ID appears in no other frozen deliverable, not in `profile-candidate.bases`, and in neither study's base inventory — and its stated purpose contradicts `subjectPolicy`, the forbidden-subject invariant, and `GA.boundary.excludes "person or position identity"`. (b) `claude-study.raw.md` names **WM-ACT-025** as the absent deliberative-occasion model, an identifier asserted from outside the dossier. Both must be evidenced from the base inventory or struck. **12. No publication claim — PASS with one defect (non-blocking)** Clean in four of five artifacts: `canonicalPublishable: false`, `relationState: "provisional-reviewable-draft"`, `relationPolicy` provisional, `digestPolicy.verification: "unverified until live conformance"` with no digest value emitted, fixtures `executable: false` / `status: "declarative-normative-expectations"` with every expectation hedged "Normatively" — no verification or installability is claimed anywhere. Defect: `profile-candidate.json` carries no `canonicalPublishable` flag, no holds, and no publication statement — the one deliverable readable as unconditioned. Separately, the identical 4-line `holds` block understates the studies' own limits: claude-study's WM-ACT-034 single-provider waiver and access-dimension downgrade hold, the codex-only waived bases (WM-PER-008, WM-ORG-005, WM-ECO-031, WM-XCT-017), "no approved relation rows exist for any proposed edge", and the unverified HR Open / ESCO / SFIA / SPACE crosswalks and source pins all vanish at the frozen layer. --- Checklist closed — 12 of 12 items evaluated. Revision 3 is gated on items 9 and 11; items 5, 6 and 7 are substantive semantic repairs, not editorial.