{
  "format": "vercy-model-allocation-candidate/v1",
  "contourId": "EM-RSK-01",
  "proposedName": "Control",
  "modelId": null,
  "registryId": null,
  "allocationState": "unassigned",
  "decision": "NEW MODEL",
  "canonicalPublishable": false,
  "candidateRevision": 3,
  "basePins": {
    "WM-KNW-015": "sha256:6725…3ccd",
    "WM-XCT-027": "sha256:4abb…5928"
  },
  "identityTest": {
    "stableIdentityRule": "EM-RSK-01.CTL-01",
    "versionIdentityRule": "EM-RSK-01.CTL-02",
    "mastership": "control-governance authority",
    "independentLifecycle": [
      "draft",
      "approved",
      "active",
      "suspended",
      "retired",
      "superseded"
    ],
    "stableIdentity": "Control identity survives revision, owner change, implementation change, re-estimation, register movement, split, merge, closure and assessment turnover.",
    "normativeRuleAuthority": "invariantRules; compatibility text copies are non-authoritative.",
    "lifecyclePolicy": {
      "states": [
        "draft",
        "approved",
        "active",
        "suspended",
        "retired",
        "superseded"
      ],
      "transitions": [
        "draft->approved",
        "approved->active",
        "active->suspended",
        "suspended->active",
        "active->retired",
        "active->superseded"
      ],
      "terminal": [
        "retired",
        "superseded"
      ],
      "gates": {
        "active": "approved effective definition revision required",
        "superseded": "successorRef required",
        "retired": "retiredAt required"
      }
    }
  },
  "boundary": {
    "owns": [
      "stable control identity",
      "immutable definition revisions",
      "identity-level owner authority states",
      "time-bounded implementation states",
      "time-bounded operating states",
      "supersession and retirement history"
    ],
    "references": [
      {
        "target": "WM-KNW-015",
        "pin": "sha256:6725…3ccd",
        "purpose": "Risk / Opportunity identity that cites the control"
      },
      {
        "target": "WM-XCT-027",
        "pin": "sha256:4abb…5928",
        "purpose": "host-scoped assessment context and residual reliance"
      },
      {
        "target": "external-evidence-plane",
        "allocationState": "unresolved",
        "purpose": "execution, test and documentary evidence custody"
      }
    ],
    "conditionalReferences": [
      {
        "target": "WM-ACT-034",
        "pin": "unverified-current-reservation",
        "condition": "written occupancy crosswalk against WM-ACT-033 and WM-XCT-027",
        "purpose": "generic assessment shape only"
      }
    ],
    "excludes": [
      "risk identity and estimates",
      "assessment-context identity",
      "execution occurrence identity",
      "effectiveness determination mastership",
      "risk-treatment workflow",
      "policy, requirement, evidence, appetite or decision mastership"
    ]
  },
  "objects": {
    "Control": {
      "identity": [
        "controlId"
      ],
      "required": [
        "status",
        "currentRevisionRef"
      ],
      "optional": [
        "successorRef",
        "retiredAt"
      ]
    },
    "ControlRevision": {
      "identity": [
        "controlId",
        "revision"
      ],
      "required": [
        "objective",
        "mechanism",
        "applicability",
        "contentDigest",
        "effectiveFrom",
        "status"
      ],
      "optional": [
        "effectiveTo",
        "cadence",
        "dependencyRefs",
        "successorRevisionRef"
      ],
      "lifecycle": {
        "states": [
          "draft",
          "approved",
          "effective",
          "superseded",
          "withdrawn"
        ],
        "transitions": [
          "draft->approved",
          "approved->effective",
          "effective->superseded",
          "approved->withdrawn"
        ],
        "terminal": [
          "superseded",
          "withdrawn"
        ]
      }
    },
    "ControlOwnerState": {
      "identity": [
        "controlId",
        "effectiveFrom"
      ],
      "required": [
        "ownerRef",
        "authorityRef",
        "recordedAt"
      ]
    },
    "ControlImplementationState": {
      "identity": [
        "controlId",
        "effectiveFrom"
      ],
      "required": [
        "state",
        "basisRef",
        "recordedAt"
      ],
      "values": [
        "planned",
        "partial",
        "implemented",
        "degraded",
        "withdrawn"
      ]
    },
    "ControlOperatingState": {
      "identity": [
        "controlId",
        "periodStart"
      ],
      "required": [
        "state",
        "expectedOccurrenceCount",
        "evidenceRefs",
        "recordedAt"
      ],
      "values": [
        "operating",
        "suspended",
        "not-operating"
      ]
    }
  },
  "invariantRules": [
    {
      "id": "EM-RSK-01.CTL-01",
      "text": "Control identity survives revision, owner change, implementation change, re-estimation, register movement, split, merge, closure and assessment turnover."
    },
    {
      "id": "EM-RSK-01.CTL-02",
      "text": "Changing objective, mechanism, applicability, cadence or dependency creates an immutable successor definition revision under the same control identity."
    },
    {
      "id": "EM-RSK-01.CTL-03",
      "text": "Owner authority is identity-level; owner change appends an authority state and never mutates a definition revision."
    },
    {
      "id": "EM-RSK-01.CTL-04",
      "text": "An effective control cites exactly one approved effective definition revision; new reliance cannot cite withdrawn, retired or superseded revisions."
    },
    {
      "id": "EM-RSK-01.CTL-05",
      "text": "Control existence, documentation, implementation or policy status never proves effectiveness or closes risk."
    },
    {
      "id": "EM-RSK-01.CTL-06",
      "text": "Design adequacy, implementation state, operating state, execution occurrence and effectiveness conclusion are distinct assertions."
    },
    {
      "id": "EM-RSK-01.CTL-07",
      "text": "Implementation and operating states are time-bounded identity-owned records and never mutate an immutable definition revision."
    },
    {
      "id": "EM-RSK-01.CTL-08",
      "text": "Execution occurrences and telemetry remain external evidence and never become control revisions or states."
    },
    {
      "id": "EM-RSK-01.CTL-09",
      "text": "One control cited by many risks never merges risk identities or assessments."
    },
    {
      "id": "EM-RSK-01.CTL-10",
      "text": "Control identity supersession and definition-revision supersession are distinct; both preserve historical resolution and mark affected contexts stale."
    },
    {
      "id": "EM-RSK-01.CTL-11",
      "text": "Superseded identity requires successor reference; retired identity requires retired time; superseded revision requires effective end and successor revision."
    },
    {
      "id": "EM-RSK-01.CTL-12",
      "text": "Control and revision identifiers remain immutable, resolvable and never recycled."
    },
    {
      "id": "EM-RSK-01.CTL-13",
      "text": "Operation is one of operating, suspended or not-operating and records expected versus observed occurrences by external reference."
    }
  ],
  "holds": [
    "Control has no registry allocation; no identifier is guessed.",
    "WM-KNW-015 and WM-XCT-027 are non-canonical single-provider reviewable drafts.",
    "WM-KNW-015 current-estimate overlap and WM-XCT-027 status:split require ratified field-level mastership cuts.",
    "WM-ACT-034 profiling is conditional on a written occupancy crosswalk against WM-ACT-033 and WM-XCT-027.",
    "EM-RSK-02 scope was provider-verified from public metadata but was not frozen in the original dossier; treatment mastership remains unsettled.",
    "The contour candidate list still names Risk Treatment and Control Execution while this revision externalizes both.",
    "Primary-source pins, approved relations, upstream staleness implementation, rights, package conversion and live conformance remain pending."
  ],
  "publicationStatement": "Research candidate only; not canonically publishable, installable or verified.",
  "invariants": [
    "Control identity survives revision, owner change, implementation change, re-estimation, register movement, split, merge, closure and assessment turnover.",
    "Changing objective, mechanism, applicability, cadence or dependency creates an immutable successor definition revision under the same control identity.",
    "Owner authority is identity-level; owner change appends an authority state and never mutates a definition revision.",
    "An effective control cites exactly one approved effective definition revision; new reliance cannot cite withdrawn, retired or superseded revisions.",
    "Control existence, documentation, implementation or policy status never proves effectiveness or closes risk.",
    "Design adequacy, implementation state, operating state, execution occurrence and effectiveness conclusion are distinct assertions.",
    "Implementation and operating states are time-bounded identity-owned records and never mutate an immutable definition revision.",
    "Execution occurrences and telemetry remain external evidence and never become control revisions or states.",
    "One control cited by many risks never merges risk identities or assessments.",
    "Control identity supersession and definition-revision supersession are distinct; both preserve historical resolution and mark affected contexts stale.",
    "Superseded identity requires successor reference; retired identity requires retired time; superseded revision requires effective end and successor revision.",
    "Control and revision identifiers remain immutable, resolvable and never recycled.",
    "Operation is one of operating, suspended or not-operating and records expected versus observed occurrences by external reference."
  ]
}