{
  "format": "vercy-enterprise-profile-candidate/v1",
  "contourId": "EM-TEC-01",
  "name": "Enterprise Software Product and Provenance",
  "decision": "PROFILE",
  "newRuntimeId": false,
  "candidateRevision": 3,
  "canonicalPublishable": false,
  "bases": [
    "WM-SFT-001",
    "WM-SFT-007",
    "WM-SFT-008",
    "WM-SFT-009"
  ],
  "baseDetails": [
    {
      "id": "WM-SFT-001",
      "status": "non-canonical-reviewable-draft",
      "waiver": null
    },
    {
      "id": "WM-SFT-007",
      "status": "non-canonical-reviewable-draft",
      "waiver": null
    },
    {
      "id": "WM-SFT-008",
      "status": "non-canonical-reviewable-draft",
      "waiver": "single-provider"
    },
    {
      "id": "WM-SFT-009",
      "status": "non-canonical-reviewable-draft",
      "waiver": "single-provider"
    }
  ],
  "references": [
    "AISMM-3.1.0",
    "WM-SFT-010",
    "WM-SFT-012"
  ],
  "evidencePins": {
    "AISMM-3.1.0": {
      "evidencedPlane": "repository",
      "release": "3.1.0",
      "evidence": "provider dossier repository files, release notes and migration filename",
      "runtimeCompatibility": "unproven"
    }
  },
  "pendingNeighbours": [
    {
      "id": "WM-SFT-003",
      "reason": "reserved but no usable specification"
    },
    {
      "id": "Source Repository",
      "reason": "identifier-unassigned EM-TEC-01 candidate; product and build relations unapproved"
    }
  ],
  "constraintRules": [
    {
      "id": "EM-TEC-01.EP-01",
      "text": "WM-SFT-001 owns durable Software Product identity, classification, offering and licence context, support statement and support lifecycle only."
    },
    {
      "id": "EM-TEC-01.EP-02",
      "text": "WM-SFT-001 requires removal of eight embedded bundles—release record, artifact integrity, build provenance, BOM document, dependency graph, deployed instance, hosting environment and effective configuration—and replacement by approved typed references."
    },
    {
      "id": "EM-TEC-01.EP-03",
      "text": "AISMM 3.1.0 is ALIGN context keyed to product_id or model_instance_id and never a second Software Product master."
    },
    {
      "id": "EM-TEC-01.EP-04",
      "text": "Every AISMM projection is classified as derived, carries derivedFrom owner references and derivation metadata, passes an owner-validation gate, and never copies HR, incident or dataset payloads; a projection without derivedFrom is defective."
    },
    {
      "id": "EM-TEC-01.EP-05",
      "text": "WM-SFT-007 owns Component and Package; WM-SFT-008 owns Build, Release and Artifact; WM-SFT-009 owns Deployment occurrence."
    },
    {
      "id": "EM-TEC-01.EP-06",
      "text": "WM-SFT-003 remains a pending Interface Contract neighbour; WM-SFT-001 does not own interface contracts."
    },
    {
      "id": "EM-TEC-01.EP-07",
      "text": "WM-SFT-012 remains SBOM document master; Product, Component and SBOM are distinct identities and bindings cite the SBOM without copying it."
    },
    {
      "id": "EM-TEC-01.EP-08",
      "text": "Artifact digest identifies released bytes and never substitutes for AISMM semantic fingerprint."
    },
    {
      "id": "EM-TEC-01.EP-09",
      "text": "Regional, tenant and repeated deployment never fork Software Product identity."
    },
    {
      "id": "EM-TEC-01.EP-10",
      "text": "Release and Deployment are distinct N-to-M records; every redeployment creates a new Deployment occurrence without creating a new Release."
    },
    {
      "id": "EM-TEC-01.EP-11",
      "text": "A product support statement is not a deployed-runtime observation and cannot be inferred from deployment state."
    },
    {
      "id": "EM-TEC-01.EP-12",
      "text": "Every WM-SFT-008 build input pins Source Repository, immutable RepositoryRevision and subpath where applicable; this rule remains non-executable until the relation is approved."
    },
    {
      "id": "EM-TEC-01.EP-13",
      "text": "One Software Product may reference many Source Repositories and one repository may support many products without identity merging; this relation remains pending allocation and approval."
    },
    {
      "id": "EM-TEC-01.EP-14",
      "text": "SaaS, library, on-premise, container and firmware delivery profiles share product identity while delivery-specific artifacts and deployments remain external."
    },
    {
      "id": "EM-TEC-01.EP-15",
      "text": "A SaaS product without a distributable artifact uses an explicit no-artifact degradation profile and never fabricates a package."
    },
    {
      "id": "EM-TEC-01.EP-16",
      "text": "A library delivery references package and release artifacts and does not create Deployment unless an actual runtime occurrence exists."
    },
    {
      "id": "EM-TEC-01.EP-17",
      "text": "An on-premise delivery references distributable release artifacts and each customer installation is a separate Deployment occurrence."
    },
    {
      "id": "EM-TEC-01.EP-18",
      "text": "A container delivery distinguishes image Artifact digest from running Deployment and from Product semantic fingerprint."
    },
    {
      "id": "EM-TEC-01.EP-19",
      "text": "A firmware delivery distinguishes Product, device-bound Deployment and firmware Artifact or Release."
    },
    {
      "id": "EM-TEC-01.EP-20",
      "text": "AISMM evidence is pinned to repository release 3.1.0; runtime compatibility is unproven and no 3.2.0 delta is asserted without evidence."
    }
  ],
  "holds": [
    "All bases remain non-canonical reviewable drafts; WM-SFT-008 and WM-SFT-009 have single-provider waivers.",
    "WM-SFT-001 still embeds eight duplicated bundles requiring removal: release record, artifact integrity, build provenance, BOM document, dependency graph, deployed instance, hosting environment and effective configuration.",
    "WM-SFT-003 specification is missing; it cannot be profiled and WM-SFT-001 does not own interface contracts.",
    "WM-SFT-012 is SBOM master, but CHILD versus REFERENCE relation kind remains unresolved.",
    "Architecture and engineering context has no registered owner.",
    "WM-SFT-009 alternate_names collision and non-terminating currency on withdrawn environment remain open.",
    "The WM-SFT-001 to WM-SFT-008 ledger row, prose-only CHILD/EXTEND edges, unregistered WM-SFT-002, conflicting CHILD parents for WM-SFT-008/009 and nine functions omitted from add_functions remain open.",
    "Source Repository and repository-to-build/product relations have no registry allocation or approval.",
    "AISMM 3.1.0 is evidenced in repository materials only; runtime compatibility is unproven and 3.2.0 is unevidenced.",
    "No semantic crosswalk, canonical package conversion or live conformance is complete."
  ],
  "publicationStatement": "Research candidate only; not canonically publishable, installable, allocated or verified."
}