{ "format": "vercy-world-model-candidate/v1", "contourId": "EM-TEC-05", "modelId": "WM-ACT-019", "registryId": "vr.wm-act-019", "name": "Operational / Service Incident", "version": "0.2.1-candidate.1", "entryKind": "incident-aggregate", "status": "research-candidate", "canonicalPublishable": false, "purpose": "Replace the legacy WM-ACT-019 physical-emergency boundary with a held operational/service-incident candidate while preserving separate observation, qualification, Problem, Defect, Task and communication masters.", "disposition": { "kind": "replace-legacy-model-semantics", "newModelId": false, "legacyVersion": "0.2.0-legacy", "reason": "The retained identifier requires a version above the legacy line and registry-approved migration; this candidate is not publishable." }, "boundary": { "owns": [ "one incident declaration identity per determined occurrence", "definition-pinned declaration and revision history", "severity and revisioned incident impact assertions", "containment restoration resolution closure and reopen state/history assertions", "incident review findings and recommendations" ], "delegates": [ "observations and occurrence evidence to WM-MAT-008 and WM-ACT-015", "cyber qualification and regulatory clocks to WM-ACT-020", "persistent discrepancy problem and root-cause claims to WM-KNW-014", "version-pinned product nonconformity to reserved WM-SFT-014", "containment restoration and remediation work execution to WM-ACT-006", "public or addressed communications to WM-ACT-027" ], "excludes": [ "automatic incident identity from an alert", "a second peer incident master for cyber qualification", "problem defect or task lifecycle", "cause-claim overwrite", "closure cascade across aggregates", "priority derived from severity", "physical-emergency command semantics", "public-alerting and CAP delivery semantics" ] }, "objects": { "Incident": { "identity": [ "incidentId" ], "required": [ "incidentClass", "definitionRevisionRef", "declaredAt", "declarationDecisionRef", "authorityRef", "ownerRef", "status", "occurrenceRef", "recordedAt", "occurrenceAt", "ingestedAt" ], "optional": [ "reportedAt", "detectedAt", "observedAt", "containedAt", "restoredAt", "resolvedAt", "closedAt", "problemRefs", "qualificationRefs", "affectedServiceRefs", "observationSourceRefs", "coverageWindow", "coverageStatus", "stalenessStatus" ], "lifecycle": [ "declared", "contained", "restored", "resolved", "closed", "withdrawn" ], "rule": "One non-withdrawn declaration identity per occurrenceRef; reports remain external until declaration." }, "DeclarationDecision": { "identity": [ "declarationDecisionId" ], "required": [ "candidateEventRefs", "definitionRevisionRef", "authorityRef", "decision", "effectiveAt", "rationale", "recordedAt", "occurrenceRef" ], "optional": [ "confidence", "supersedesDecisionId" ], "lifecycle": [ "asserted", "superseded", "withdrawn" ] }, "SeverityAssessment": { "identity": [ "severityAssessmentId" ], "required": [ "incidentRef", "scaleRef", "grade", "assessorRef", "effectiveAt", "basisRefs", "recordedAt" ], "optional": [ "supersedesAssessmentId", "confidence" ], "lifecycle": [ "asserted", "superseded", "withdrawn" ] }, "ImpactAssessment": { "identity": [ "impactAssessmentId" ], "required": [ "incidentRef", "impactDomain", "actuality", "method", "assessorRef", "effectiveAt", "recordedAt", "basisRefs" ], "optional": [ "quantity", "unitRef", "affectedSubjectRefs", "supersedesAssessmentId" ], "lifecycle": [ "asserted", "superseded", "withdrawn" ], "rule": "Identified revisioned child of exactly one incident; no implicit roll-up to Problem." }, "IncidentStateTransition": { "identity": [ "transitionId" ], "required": [ "incidentRef", "fromStatus", "toStatus", "effectiveAt", "authorityRef", "evidenceRefs", "recordedAt" ], "optional": [ "reason" ], "rule": "Transitions append; reopening and correction preserve all prior state, impact and review records." }, "ResolutionRecord": { "identity": [ "resolutionRecordId" ], "required": [ "incidentRef", "outcome", "resolvedAt", "authorityRef", "residualRiskRef", "evidenceRefs", "recordedAt" ], "optional": [ "restorationTaskRefs", "problemRefs", "followUpRefs" ], "lifecycle": [ "proposed", "effective", "superseded" ] }, "IncidentReview": { "identity": [ "reviewId" ], "required": [ "incidentRef", "reviewedAt", "reviewerRefs", "evidenceRefs", "findings", "recommendations", "rootCauseClaimRefs" ], "optional": [ "actionTaskRefs", "publicationRef" ], "lifecycle": [ "draft", "approved", "superseded" ], "rule": "findings and recommendations may not contain authoritative causal assertions; causal content resolves through typed rootCauseClaimRefs." }, "IncidentCorrespondence": { "identity": [ "correspondenceId" ], "required": [ "incidentRef", "peerRecordRef", "peerModelRef", "representationRole", "sameOccurrenceBasisRefs", "assertedAt", "authorityRef", "validFrom" ], "optional": [ "confidence", "validTo", "withdrawalReason" ], "rule": "REFERENCE only; correspondence never proves identity or creates another master.", "lifecycle": "Effective-dated, append-only and correctable; mistaken correspondence closes with validTo and withdrawalReason." }, "IncidentMerge": { "identity": [ "mergeId" ], "required": [ "survivingIncidentRef", "absorbedIncidentRef", "authorityRef", "evidenceRefs", "effectiveAt", "recordedAt" ], "optional": [ "reason" ], "rule": "Absorbed identity remains addressable through IncidentCorrespondence with role mirror; no history or outbound reference is deleted." }, "QualificationReference": { "identity": [ "qualificationRefId" ], "required": [ "incidentRef", "qualificationKind", "peerRecordRef", "peerModelRef", "occurrenceRef", "governingDeclarationDecisionRef", "representationRole", "evidenceRefs" ], "optional": [ "recordedAt" ], "rule": "The peer record cannot hold an independent declaration decision for the same occurrence." } }, "relations": [ { "target": "WM-ACT-015", "relation": "REFERENCE", "required": true, "purpose": "Resolve occurrence evidence used by declaration." }, { "target": "WM-MAT-008", "relation": "REFERENCE", "required": false, "purpose": "Resolve observations without copying identity." }, { "target": "WM-ACT-020", "relation": "REFERENCE", "required": false, "purpose": "Resolve cyber qualification under the single-declaration rule." }, { "target": "WM-KNW-014", "relation": "REFERENCE", "required": false, "purpose": "Resolve persistent problems and their cause claims." }, { "target": "WM-SFT-014", "relation": "REFERENCE", "required": false, "purpose": "Resolve version-pinned defects; reserved external boundary only." }, { "target": "WM-ACT-006", "relation": "REFERENCE", "required": false, "purpose": "Resolve containment restoration and remediation tasks." }, { "target": "WM-ACT-027", "relation": "REFERENCE", "required": false, "purpose": "Resolve communication delivery records." } ], "clockSemantics": [ "occurrenceAt", "detectedAt", "observedAt", "declaredAt", "containedAt", "restoredAt", "resolvedAt", "closedAt", "recordedAt" ], "invariants": [ "INV-001 Observation event alarm or report never becomes an incident without an authorized definition-pinned declaration decision.", "INV-002 Among non-withdrawn declarations occurrenceRef is unique; operational cyber and AI qualifications share the governing declarationDecisionId.", "INV-003 Cyber-first or operational-first qualification references the governing declarationDecisionId and never creates a peer incident master.", "INV-004 If a separate cyber record is retained it requires explicit same-occurrence correspondence with representation role and evidence.", "INV-005 Incident Problem Defect Task Communication and observation identities never merge.", "INV-006 Severity assessments name their scale and append rather than overwrite.", "INV-007 Task priority is independently asserted and is never copied or derived from incident severity.", "INV-008 ImpactAssessment is an identified revisioned incident child and distinguishes actual from potential impact.", "INV-009 Problem impact is never an implicit roll-up of incident impact.", "INV-010 RootCauseClaim is a namespaced Problem child with evidence confidence status and provenance.", "INV-011 Supported disputed and other competing cause claims coexist.", "INV-012 A cause claim may reference a defect but can never be the defect.", "INV-013 WM-SFT-014 defect identity and lifecycle remain external and version pinned.", "INV-014 Containment restoration and permanent remediation are separate WM-ACT-006 tasks.", "INV-015 Restoration never proves cause elimination or permanent remediation completion.", "INV-016 Incident restore resolve close reopen or merge never closes deletes or mutates Problem Defect Task Claim or Communication.", "INV-017 Temporary restoration may permit incident closure under incident authority while Problem and permanent remediation remain open.", "INV-018 Problem closure requires its own authority and cannot be inferred from incident or task state.", "INV-019 Incident state Problem disposition Claim status Defect state and Task state remain independent.", "INV-020 Occurrence detection observation declaration restoration ingestion and recording clocks remain distinct.", "INV-021 Reopen supersession correction and merge preserve all declaration severity impact resolution review and correspondence history.", "INV-022 Correspondence relationship and role assignment do not prove identity execution completion or causation.", "INV-023 Unknown missing and stale evidence remain explicit and never mean absence.", "INV-024 Personal sensitive and regulated evidence is exposed only through governed projections.", "INV-025 No cascade delete crosses aggregate boundaries.", "INV-026 Every Reference carries targetModel and targetId; Defect references also carry targetRevision.", "INV-027 Incident transitions conform to allowedTransitions; reopen is closed-to-declared.", "INV-028 An absorbed incident remains as a mirror correspondence after merge.", "INV-029 Authoritative causal assertions never live in free-text IncidentReview findings.", "INV-030 A separate qualification record has no independent declaration decision for the same occurrence.", "INV-031 Known clocks satisfy occurrence before detection or observation before declaration, and restoration before resolution before closure.", "INV-032 Missing source coverage is represented as partial or unknown with a window and staleness state.", "INV-033 Incident evidence and affected-subject references carry external classification and disclosure controls before projection." ], "holds": [ "WM-ACT-019 is a semantic rewrite of a legacy physical-emergency model and requires registry review before publication.", "WM-SFT-014 has a reservation but no live complete specification and remains reference-only.", "WM-KNW-014 Problem specialization and its incident relations require registry approval.", "WM-ACT-034 versus incident-child ImpactAssessment remains an explicit neighbor decision.", "Observation-plane identity and the physical/service/cyber/AI incident neighbor set remain unresolved.", "Canonical publication runtime search resolve and package verification are pending.", "WM-ACT-020 shared-ledger COMPOSE edge conflicts with this REFERENCE boundary and must be corrected before publication.", "WM-KNW-014 and WM-SFT-014 share an unpinned parent signal that requires registry adjudication.", "WM-ACT-020 remains single-provider or independently waived and is not treated as canonically complete here.", "Incident and Problem master-system authorities are not named in the frozen dossier.", "A field-level crosswalk for every external reference contract is absent.", "WM-AI-010 inbound migration and qualification binding is unresolved.", "External registry identifiers for definition/policy catalogue, authority/party, severity scale, unit, residual risk and affected service remain unassigned and no placeholder identifier is minted.", "WM-ACT-020 incident-local cause-hypothesis overlap with WM-KNW-014 RootCauseClaim requires registry adjudication." ], "referenceType": { "name": "Reference", "fields": { "targetModel": "required governed model identifier or explicit unassigned registry role", "targetId": "required target record identifier", "targetRevision": "optional except required for Defect references", "role": "optional enumerated representation role" }, "representationRoles": [ "originating", "master", "mirror" ], "rule": "A reference never proves identity, execution, completion or causation." }, "allowedTransitions": [ [ "declared", "contained" ], [ "declared", "restored" ], [ "declared", "resolved" ], [ "contained", "restored" ], [ "contained", "resolved" ], [ "restored", "resolved" ], [ "resolved", "closed" ], [ "closed", "declared" ], [ "closed", "withdrawn" ], [ "declared", "withdrawn" ], [ "contained", "withdrawn" ], [ "restored", "withdrawn" ], [ "resolved", "withdrawn" ] ], "transitionRules": { "reopen": "Reopen is the closed-to-declared transition with evidence and authority; reopened is not a resting state.", "shortcuts": "A skipped operational state requires explicit evidence in the transition.", "ordering": "When known: occurrenceAt <= detectedAt or observedAt <= declaredAt; restoredAt <= resolvedAt <= closedAt. Unknown clocks are explicit and never fabricated." }, "coverageValues": [ "complete", "partial", "unknown" ], "stalenessValues": [ "current", "stale", "unknown" ], "neighborExpectations": { "WM-KNW-014": { "base": "WM-KNW-014", "rootCauseClaim": { "identity": [ "problemRef", "claimId" ], "required": [ "statement", "status", "confidence", "evidenceRefs", "assertedAt", "assertedBy", "statusHistory" ], "optional": [ "incidentRefs", "defectRef", "supersedesClaimId" ], "statuses": [ "asserted", "supported", "disputed", "rejected", "withdrawn", "endorsed", "superseded" ], "rule": "First-class namespaced child of Problem; competing claims coexist and are never represented by overwriting one root-cause field.", "statusHistory": { "entryRequired": [ "status", "assertedBy", "assertedAt", "evidenceRefs" ], "rule": "Append-only; supersedesClaimId requires superseded status on the prior claim." } }, "closureRule": "Problem closure stays WM-KNW-014-owned and requires its own authority and evidence; this candidate never infers closure.", "authority": "non-normative neighbor expectation pending WM-KNW-014 registry approval" }, "WM-ACT-020": { "base": "WM-ACT-020", "identityRule": "Specializes or qualifies the same incident declaration identity; if an implementation retains a separate record, IncidentCorrespondence is mandatory and the record is not a peer incident master.", "owns": [ "cyber determination", "regulatory reporting clocks", "evidence custody", "attribution and disclosure markings" ], "authority": "non-normative neighbor expectation pending WM-ACT-020 approval", "originationRules": [ "Operational-first: WM-ACT-020 qualification references the governing declarationDecisionId and may not create another declaration.", "Cyber-first: WM-ACT-020 may originate the sole declaration identity; any later WM-ACT-019 representation is a mirror referencing that declarationDecisionId.", "Any retained peer record carries qualificationKind, occurrenceRef and governing declarationDecisionId and has no independent DeclarationDecision." ] }, "WM-AI-010": { "authority": "non-normative migration expectation", "rule": "AI incident qualification follows the one-declaration rule; exact binding remains held." } }, "qualificationKinds": [ "cyber", "ai", "other-governed-specialization" ], "causePromotionRule": "Incident-local hypotheses are non-authoritative references only while no Problem exists; once a Problem is opened, claims are mastered as WM-KNW-014 children and the incident retains typed references.", "declarationDecisionValues": [ "declare", "do-not-declare", "near-miss", "false-positive", "withdraw" ], "resolutionBinding": "Incident status resolved requires an effective ResolutionRecord; closed additionally requires an authorized closed transition.", "linkAuthority": { "incidentProblem": "WM-KNW-014 Problem owns association; Incident.problemRefs and ResolutionRecord.problemRefs are projections and must reconcile to it." }, "externalReferenceContracts": [ { "role": "incident-definition-or-policy-catalogue", "registryId": null, "required": true }, { "role": "party-authority-and-owner", "registryId": null, "required": true }, { "role": "severity-scale", "registryId": null, "required": true }, { "role": "unit", "registryId": null, "required": false }, { "role": "residual-risk", "registryId": null, "required": true }, { "role": "affected-service-or-configuration-subject", "registryId": null, "required": false } ], "migration": { "from": "WM-ACT-019 0.2.0-legacy", "retained": [ "incident identity", "occurrence linkage", "impact history", "authority and evidence history" ], "reexpressed": [ "legacy occurrence extension as occurrenceRef", "legacy impact as revisioned ImpactAssessment", "emergency state as operational incident transition history" ], "dropped": [ "physical incident-command semantics", "CAP/public-alert delivery semantics" ], "inboundImpacts": [ "WM-AI-010 must follow the one-declaration qualification rule" ], "publicationRule": "No migration is canonical until registry review approves the replacement and inbound reference plan." } }