{
  "format": "vercy-enterprise-profile-candidate/v1",
  "contourId": "EM-RSK-01",
  "name": "Enterprise Risk Assessment and Control Reliance",
  "decision": "PROFILE",
  "newRuntimeId": false,
  "candidateRevision": 3,
  "bases": [
    {
      "id": "WM-KNW-015",
      "pin": "sha256:6725…3ccd"
    },
    {
      "id": "WM-XCT-027",
      "pin": "sha256:4abb…5928"
    }
  ],
  "conditionalReferences": [
    {
      "target": "WM-ACT-034",
      "pin": "unverified-current-reservation",
      "condition": "written occupancy crosswalk against WM-ACT-033 and WM-XCT-027",
      "purpose": "generic assessment shape only"
    }
  ],
  "constraintRules": [
    {
      "id": "EM-RSK-01.EP-01",
      "text": "WM-KNW-015 remains the Risk / Opportunity identity master; assessment context has no identity or lifecycle independent of its host and pinned risk revision."
    },
    {
      "id": "EM-RSK-01.EP-02",
      "text": "WM-XCT-027 context pins risk revision, taxonomy, scope, exclusions, scale, expression mode, case basis, criteria version, method and technique versions, horizon, as-of, recorded and valid-until times."
    },
    {
      "id": "EM-RSK-01.EP-03",
      "text": "Comparability requires matching or traceably converted EP-02 pins and returns comparable, comparable-with-caveats or not-comparable plus mismatched-pin list."
    },
    {
      "id": "EM-RSK-01.EP-04",
      "text": "Aggregation requires explicit comparability and aggregation-eligibility verdicts; caveats travel and qualitative, ordinal and scenario modes prohibit difference, product and mean."
    },
    {
      "id": "EM-RSK-01.EP-05",
      "text": "Withdrawn criteria follow declared superseded-criteria handling and are never silently re-scored."
    },
    {
      "id": "EM-RSK-01.EP-06",
      "text": "Inherent and residual are distinct; residual cites current effectiveness, changed dimension, direction and explanation, and computes magnitude only when expression mode permits."
    },
    {
      "id": "EM-RSK-01.EP-07",
      "text": "WM-XCT-027 excludes control catalogue binding, objective classification, applicability, accountability, design, implementation, cadence, evidence, effectiveness, crosswalk and coverage-dependency authoring."
    },
    {
      "id": "EM-RSK-01.EP-08",
      "text": "Risk-to-control link records are contained by one host context; residual contribution is an assessment-authored claim while attribution status is risk-owner-held."
    },
    {
      "id": "EM-RSK-01.EP-09",
      "text": "Effectiveness determination mastership remains unowned pending the WM-ACT-034/033/027 crosswalk; profile citations cannot create that master."
    },
    {
      "id": "EM-RSK-01.EP-10",
      "text": "Effectiveness requires population, period, mechanism, method, evidence-chain digests, confidence, conclusion time, validity and invalidation triggers."
    },
    {
      "id": "EM-RSK-01.EP-11",
      "text": "Missing, expired or invalidated effectiveness is unknown at assessment as-of time and cannot justify adverse reduction or beneficial uplift."
    },
    {
      "id": "EM-RSK-01.EP-12",
      "text": "A failed execution affects only contexts whose population, period, mechanism and evidence chain match; other linked risks do not change automatically."
    },
    {
      "id": "EM-RSK-01.EP-13",
      "text": "Event, observation/as-of and record time are distinct; backdated correction and retroactive amendment are distinct append-only acts."
    },
    {
      "id": "EM-RSK-01.EP-14",
      "text": "A superseded risk or control revision marks its binding stale through an explicit named detection event; history is never rewritten."
    },
    {
      "id": "EM-RSK-01.EP-15",
      "text": "Evidence references resolve to matching digests; missing or mismatched evidence invalidates the determination, while lawful retention or destruction is recorded without falsifying history."
    },
    {
      "id": "EM-RSK-01.EP-16",
      "text": "Shared cause means same source, predisposing condition, held-fixed context condition, relied-on control or dependency; it creates caveats and no arithmetic permission."
    },
    {
      "id": "EM-RSK-01.EP-17",
      "text": "WM-KNW-015 may hold response option, rationale and treatment-plan reference; this profile authors no treatment plan, milestone, execution or closure."
    },
    {
      "id": "EM-RSK-01.EP-18",
      "text": "Residual acceptance requires an external decision with authority, threshold-table version and authorization time; acceptance does not close risk."
    },
    {
      "id": "EM-RSK-01.EP-19",
      "text": "WM-ACT-034 is reference-only until the written occupancy crosswalk makes population, period, mechanism, evidence chain and design-versus-operation mandatory."
    },
    {
      "id": "EM-RSK-01.EP-20",
      "text": "A completed test or assessment never implies implementation, residual closure, acceptance or treatment completion."
    }
  ],
  "fieldLevelCut": {
    "retainInContext": [
      "risk and revision pins",
      "causal anchors",
      "taxonomy pin",
      "scope and horizon pins",
      "criteria, method, technique and expression pins",
      "inherent and residual estimates",
      "uncertainty",
      "control and effectiveness citations",
      "appetite comparison",
      "comparability verdicts and caveats",
      "binding governance"
    ],
    "excludeFromContext": [
      "control catalogue binding",
      "control objective and applicability authoring",
      "control owner authoring",
      "design and implementation assertions",
      "operating cadence authoring",
      "assessment evidence payload",
      "effectiveness conclusion authoring",
      "crosswalk alignment authoring",
      "coverage dependency matrix"
    ]
  },
  "unownedScopeRegister": [
    "risk-treatment execution master",
    "control-execution occurrence master",
    "effectiveness-determination master",
    "evidence custody master",
    "appetite and tolerance master",
    "residual acceptance decision master",
    "criteria/method/technique registry",
    "scale registry",
    "party/owner registry",
    "policy and requirement master",
    "upstream-supersession detector"
  ],
  "holds": [
    "Control has no registry allocation; no identifier is guessed.",
    "WM-KNW-015 and WM-XCT-027 are non-canonical single-provider reviewable drafts.",
    "WM-KNW-015 current-estimate overlap and WM-XCT-027 status:split require ratified field-level mastership cuts.",
    "WM-ACT-034 profiling is conditional on a written occupancy crosswalk against WM-ACT-033 and WM-XCT-027.",
    "EM-RSK-02 scope was provider-verified from public metadata but was not frozen in the original dossier; treatment mastership remains unsettled.",
    "The contour candidate list still names Risk Treatment and Control Execution while this revision externalizes both.",
    "Primary-source pins, approved relations, upstream staleness implementation, rights, package conversion and live conformance remain pending."
  ],
  "canonicalPublishable": false,
  "publicationStatement": "Research candidate only; not canonically publishable, installable or verified.",
  "constraints": [
    "WM-KNW-015 remains the Risk / Opportunity identity master; assessment context has no identity or lifecycle independent of its host and pinned risk revision.",
    "WM-XCT-027 context pins risk revision, taxonomy, scope, exclusions, scale, expression mode, case basis, criteria version, method and technique versions, horizon, as-of, recorded and valid-until times.",
    "Comparability requires matching or traceably converted EP-02 pins and returns comparable, comparable-with-caveats or not-comparable plus mismatched-pin list.",
    "Aggregation requires explicit comparability and aggregation-eligibility verdicts; caveats travel and qualitative, ordinal and scenario modes prohibit difference, product and mean.",
    "Withdrawn criteria follow declared superseded-criteria handling and are never silently re-scored.",
    "Inherent and residual are distinct; residual cites current effectiveness, changed dimension, direction and explanation, and computes magnitude only when expression mode permits.",
    "WM-XCT-027 excludes control catalogue binding, objective classification, applicability, accountability, design, implementation, cadence, evidence, effectiveness, crosswalk and coverage-dependency authoring.",
    "Risk-to-control link records are contained by one host context; residual contribution is an assessment-authored claim while attribution status is risk-owner-held.",
    "Effectiveness determination mastership remains unowned pending the WM-ACT-034/033/027 crosswalk; profile citations cannot create that master.",
    "Effectiveness requires population, period, mechanism, method, evidence-chain digests, confidence, conclusion time, validity and invalidation triggers.",
    "Missing, expired or invalidated effectiveness is unknown at assessment as-of time and cannot justify adverse reduction or beneficial uplift.",
    "A failed execution affects only contexts whose population, period, mechanism and evidence chain match; other linked risks do not change automatically.",
    "Event, observation/as-of and record time are distinct; backdated correction and retroactive amendment are distinct append-only acts.",
    "A superseded risk or control revision marks its binding stale through an explicit named detection event; history is never rewritten.",
    "Evidence references resolve to matching digests; missing or mismatched evidence invalidates the determination, while lawful retention or destruction is recorded without falsifying history.",
    "Shared cause means same source, predisposing condition, held-fixed context condition, relied-on control or dependency; it creates caveats and no arithmetic permission.",
    "WM-KNW-015 may hold response option, rationale and treatment-plan reference; this profile authors no treatment plan, milestone, execution or closure.",
    "Residual acceptance requires an external decision with authority, threshold-table version and authorization time; acceptance does not close risk.",
    "WM-ACT-034 is reference-only until the written occupancy crosswalk makes population, period, mechanism, evidence chain and design-versus-operation mandatory.",
    "A completed test or assessment never implies implementation, residual closure, acceptance or treatment completion."
  ],
  "normativeRuleAuthority": "constraintRules; constraints is a compatibility projection."
}