# Frozen semantic audit — EM-TEC-07

## Verdict

**Accept the disposition; reject the artifacts as frozen.** Nothing in the supplied text disproves the intended decision, so it stands unchanged: reuse WM-SFT-006 as the Vulnerability aggregate; profile WM-ACT-034 as the deployed-instance exposure root and WM-ACT-006 as remediation work; master VEX on WM-SFT-006 as source-qualified product/version/configuration assertions; retain one identifier-unassigned Exploit Artifact candidate; allocate no catalogue, registry or runtime identifier.

The defects are in the *binding* artifacts, not the decision. The PROFILE CANDIDATE — the only artifact that would constrain runtime behaviour for the exposure root — carries six prose constraints, no identity rule, no lifecycle, no time fields, no invariant set, no holds and no non-canonical flag, while the ALLOCATION CANDIDATE for a merely-candidate class is fully specified. The reconciliation is inverted: the decided root is the least specified object in the contour. Seventeen material defects follow; all remediations are mechanical and require no further judgement or provider input.

## Material defects

**1. VEX ownership is simultaneously resolved and unresolved, and no base amendment exists.**
PROVIDER COMPARISON and GROK declare VEX mastership "resolved to WM-SFT-006". LOCAL SYNTHESIS holds, CLAUDE holds and ALLOCATION CANDIDATE holds all still list VEX ownership as unresolved. Underneath, per CLAUDE, WM-SFT-008 assigns VEX to WM-SFT-012 while WM-SFT-012 excludes VEX/CSAF authoring — so naming WM-SFT-006 creates a third claimant rather than resolving two. PROFILE CANDIDATE states no VEX constraint at all.
*Remediation:* add PROFILE CANDIDATE constraint verbatim: "VEX-equivalent product/version/configuration status is mastered exclusively on WM-SFT-006 as a source-qualified assertion; WM-SFT-008, WM-SFT-012, WM-SFT-007, WM-ACT-006, WM-ACT-034 and the Exploit Artifact candidate may cite it and must not author, copy or rewrite it." Replace the three "VEX ownership unresolved" holds with the single hold: "WM-SFT-008 and WM-SFT-012 boundary texts contradict this allocation and require amendment before canonicalisation; amendment rows are not present in this contour."

**2. Publishability holds and non-canonical flags are missing from the profile and fixture artifacts.**
ALLOCATION CANDIDATE carries `canonicalPublishable:false` and a `holds` array. PROFILE CANDIDATE and FIXTURES carry neither. FIXTURES also omits `contourId`. ALLOCATION CANDIDATE `"decision":"NEW MODEL"` reads as an approved new master despite `allocationState:"unassigned"`.
*Remediation:* add to PROFILE CANDIDATE and FIXTURES: `"contourId":"EM-TEC-07"`, `"canonicalPublishable":false`, `"basesAreNonCanonicalDrafts":true`, `"installabilityClaim":"none"`, `"publicationReadinessClaim":"none"`, and a `holds` array replicating the ALLOCATION CANDIDATE holds plus defects 1, 11, 13 and 16. Change `"decision"` to `"NEW MODEL — CANDIDATE, IDENTIFIER-UNASSIGNED"`.

**3. The exposure root has no identity, lifecycle, field or time specification.**
PROFILE CANDIDATE specifies no `identity`, no `objects`, no `lifecycle`, no supersession reference, no as-of field. CLAUDE's anti-composite rule ("never the tuple of CVE + host") and GROK's independent-identity rule (invariant 3) are therefore unbound, and CLAUDE's own phrasing "per-(vulnerability, instance) remediation status" reintroduces exactly the composite key both forbid.
*Remediation:* add to PROFILE CANDIDATE an `objects.ExposureAssessment` block: `identity:["exposureAssessmentId"]`; `required:["subjectDeploymentRef","vulnerabilityRef","vulnerabilityRevisionRef","exposureStatus","assessedAsOf","evidenceRefs","scope"]`; `optional:["justificationCode","predicateEvaluations","reachabilityDetermination","environmentalRisk","localPriority","remediationStatus","supersedesRef","supersededByRef","maxStalenessSeconds"]`; `lifecycle:["draft","asserted","superseded","stale","withdrawn"]`; and the constraint: "`exposureAssessmentId` is opaque and independently allocated; it is never derived from, nor equal to, any function of `vulnerabilityRef`, `subjectDeploymentRef`, `assessedAsOf` or any combination thereof; exposure conclusions never exist as fields on WM-SFT-006, WM-SFT-007, WM-SFT-008, WM-SFT-009, WM-SFT-012 or WM-ACT-006."

**4. Instance-exposure status vocabulary is unenumerated and collides with product VEX labels.**
GROK asserts "Instance exposure is not VEX", yet LOCAL SYNTHESIS and CLAUDE label the I1 conclusion `not_affected (configuration)` and the I2 outcome `fixed` — VEX vocabulary at instance scope. `undetermined` (required by LOCAL invariant 4 and CLAUDE invariant 5) is absent from GROK's enumeration, which offers `under_investigation` instead; the two are not synonyms and nothing distinguishes them.
*Remediation:* enumerate two disjoint vocabularies in PROFILE CANDIDATE. Product scope on WM-SFT-006: `affected | not_affected | fixed | under_investigation`. Instance scope on the WM-ACT-034 profile: `exposure_affected | exposure_not_affected | exposure_fixed | exposure_undetermined`. Add: "`exposure_undetermined` denotes insufficient evidence and is the only admissible instance status when inventory completeness or required observation is absent; `under_investigation` is product-scope only and never satisfies an instance conclusion."

**5. Staleness is asserted as an invariant with no mechanism, no owner and no field.**
LOCAL invariant 11 requires corrected vulnerability revisions to stale dependent conclusions; CLAUDE states plainly that "no propagation mechanism exists today (gap)". An invariant with no mechanism is a conformance claim the contour cannot make.
*Remediation:* replace push-propagation with a derived rule in PROFILE CANDIDATE: "Every exposure assessment pins `vulnerabilityRevisionRef`. Status is evaluated, not stored-only: an assessment whose `vulnerabilityRevisionRef` is not the currently accepted WM-SFT-006 revision evaluates to lifecycle `stale` and its `exposureStatus` is not readable as a current conclusion. No writer marks other masters' records; no cascade is performed." Retain the hold: "staleness propagation contract between WM-SFT-006 and WM-ACT-034 is unapproved."

**6. Observation expiry has no field, no default and no expiry outcome.**
LOCAL SYNTHESIS makes I1's `not_affected (configuration)` valid "until its observation expires"; CLAUDE says every conclusion "carries maximum staleness". No field, no default, no owner, and no stated status after expiry — the dangerous default being silent retention of a not-affected verdict.
*Remediation:* add required fields `observedAt`, `maxStalenessSeconds` per `evidenceRefs` entry, and derived `expiresAt = observedAt + maxStalenessSeconds`. Add: "On expiry of any evidence item required by the conclusion, `exposureStatus` evaluates to `exposure_undetermined`; expiry never preserves `exposure_not_affected` or `exposure_fixed`."

**7. Configuration predicates have no declared logical role, making the I1 verdict an unsafe inference.**
LOCAL SYNTHESIS reads F as a necessary condition ("affected only when F is enabled"); GROK says only "a source-qualified configuration predicate is required" with no logical typing. Without typing, "F observed disabled" does not license `not_affected` — and the acceptance result asserts it from a single configuration observation with inventory completeness unstated.
*Remediation:* require on each WM-SFT-006 configuration condition `predicateRole: required_for_affectedness | contributing`. Add: "`exposure_not_affected` with `justificationCode = configuration` is admissible only when every `required_for_affectedness` predicate is observed false by unexpired evidence with declared observation scope; a `contributing` predicate observed false yields `exposure_undetermined`; absent `predicateRole`, the assessment yields `exposure_undetermined`."

**8. Fix-availability mastership is contradicted across providers and unnamed in the reconciliation.**
CLAUDE: "Fix availability — WM-SFT-006 contained reference." GROK: "stays with the software/fix master associated to WM-SFT-006" — an unnamed base. LOCAL SYNTHESIS says only "facts in their respective masters" and names no master for fix availability.
*Remediation:* pin it, consistent with the reuse decision and zero allocation: add PROFILE CANDIDATE constraint "Fix availability (fixed version, patch reference, commit reference, workaround) is a source-qualified contained facet of WM-SFT-006; no separate fix master is referenced or allocated in this contour." Strike "software/fix master" from the reconciled text as an unnamed base (see defect 13).

**9. Instance verification has two candidate owners and no evidence/conclusion split.**
CLAUDE places verification in "WM-SFT-009's post-deployment outcome" *and* in "a re-run exposure assessment concluding fixed"; GROK says "instance/deployment verification evidence"; LOCAL SYNTHESIS requires "a superseding assessment". This is the dual-write pattern GROK flags for VEX, left unremediated for verification.
*Remediation:* add constraint: "WM-SFT-009 masters the post-deployment verification *observation* (pinned build/release, configuration read-back, outcome) and never asserts an exposure status. The WM-ACT-034 profile masters the `exposure_fixed` *conclusion* and never asserts deployment facts. `exposure_fixed` requires a superseding assessment citing (a) a WM-SFT-009 deployment of the remediating build to the subject instance and (b) verification observations covering every criterion that produced the prior `exposure_affected`."

**10. Exploit Artifact / exploitation-observation boundary is contradicted, and the artifact `owns` list leaks observation.**
CLAUDE's minimal model set makes the new root "exploit artifact / exploitation observation" — one identity for two. LOCAL SYNTHESIS, GROK and the ALLOCATION CANDIDATE `excludes` keep estate exploitation observation separate. The ALLOCATION CANDIDATE nonetheless retains "authorized observations of artifact behavior" in `owns`, which is one rename away from the excluded estate observation.
*Remediation:* strike "/ exploitation observation" from CLAUDE's minimal model set; the candidate covers the artifact only. Rename the `owns` entry to "controlled-environment analysis observations of the artifact itself" and add the invariant: "The artifact root never records observation of the artifact acting on, or within, any estate component, build, deployment or instance; such observations are separate evidence records cited by the WM-ACT-034 profile."

**11. Artifact reference direction, target scope and mastership authority all leak.**
`objects.ExploitArtifact.optional.targetRefs` is untyped, and `boundary.references` lists WM-SFT-009 ("Deployment identity and outcome"), WM-ACT-020, WM-ACT-034 and WM-SFT-012 as outbound references — permitting an artifact record to point at a named deployed instance, an incident and an exposure conclusion, which is estate targeting and dual mastery inside a class whose `excludes` forbids both. `identityTest.mastership` names no base or registry ("authorized security-research or threat-intelligence evidence authority"). LOCAL SYNTHESIS and CLAUDE both record that WM-SFT-006 has *no approved outgoing relation contracts*, yet seven references are declared.
*Remediation:* restrict `targetRefs` to product/component/version scope (WM-SFT-007, WM-SFT-008 only) and add `"targetScope":"product_or_component_version"`. Reduce `boundary.references` to WM-SFT-006, WM-SFT-007, WM-SFT-008, and mark WM-SFT-009, WM-SFT-012, WM-ACT-020, WM-ACT-034 as `"inbound-only"` — those masters may cite the artifact; the artifact cites none of them. Replace `mastership` with "pending: no mastering authority base is named in this contour" and add the hold "relation-ledger rows backing every declared reference, including all WM-SFT-006 outgoing relations, are absent; no reference is approved."

**12. Artifact versioning rule is non-deterministic and the lifecycle conflates two axes.**
`identityTest.versionIdentity` says a change "creates a distinct artifact **or** immutable successor rendition" with no discriminator — two admissible outcomes for one input, and the `artifact-successor` fixture silently assumes one of them. `restricted` appears as a lifecycle state while `handlingClass` is a required field defaulting to restricted (one axis, two encodings). `disposedAt` is optional though `disposed` is a state, and `ArtifactRendition.required.storageRef` remains required after disposal despite the invariant that disposal preserves only non-content provenance.
*Remediation:* replace the or-rule with: "A byte-level change to captured content within the same acquisition creates a new `ArtifactRendition` with `supersedesRendition`. A distinct acquisition, or a change in functional capability class, creates a distinct `ExploitArtifact` with `successorRef`. No other change alters identity." Remove `restricted` from `lifecycle`, leaving `["reported","quarantined","analyzed","superseded","withdrawn","disposed"]`; handling remains solely `handlingClass`. Make `disposedAt` required when `status = disposed`; move `storageRef` to `optional` and add "`storageRef` is absent for renditions of a disposed artifact; `digest`, `mediaType`, `createdAt` and provenance are retained."

**13. The base set is inconsistent across artifacts and includes unnamed carriers.**
GROK's minimum model set names "task draft", "assessment draft", "claim draft" and "software/fix master" — unnamed bases, one of which (claim) carries a dedicated invariant (GROK 12) permitting it to "transport VEX or assessment assertions": an unbounded dual-write path. CLAUDE's set includes WM-KNW-007, which appears in no other artifact and is absent from PROFILE CANDIDATE `bases`. PROFILE CANDIDATE also states no constraint on WM-SFT-007, whose `f-affectedness` and `f-remediation-status` duplication CLAUDE "resolves" by permitting a cached verdict while LOCAL SYNTHESIS still holds it unresolved.
*Remediation:* freeze `bases` as exactly `["WM-SFT-006","WM-ACT-034","WM-ACT-006","WM-SFT-007","WM-SFT-008","WM-SFT-009","WM-SFT-012","WM-ACT-020"]`; strike all unnamed drafts and "software/fix master" from the reconciled text; strike WM-KNW-007 or add it to `bases` with the single purpose "contested reachability or attribution claims by reference only" — this audit strikes it, since no supplied artifact assigns it an owned fact. Replace GROK invariant 12 with: "Any transported copy of a VEX or exposure assertion carries `nonAuthoritativeCopy:true` and `sourceRef`, and is rejected as an input to any conclusion." Add constraint: "WM-SFT-007 `f-affectedness` and `f-remediation-status` are non-authoritative caches with `sourceRef`; they never satisfy invariant evaluation," and retain the hold that WM-SFT-007's boundary text is unamended.

**14. Three divergent invariant lists, no normative set, and the binding artifact drops most of them.**
LOCAL SYNTHESIS has 12, CLAUDE 10, GROK 13, with different numbering and non-overlapping content: GROK omits no-cascade-deletion and staleness; CLAUDE omits staleness as an invariant; LOCAL omits independent exposure identity, predicate requirement and transport carriers. PROFILE CANDIDATE encodes six constraints and drops no-cascade-deletion, as-of/supersession, "not_affected requires justification and evidence", "CVE is not the only identifier", and the four-way signal/artifact/observation/incident separation. Cross-document invariant references are therefore ambiguous.
*Remediation:* adopt the LOCAL SYNTHESIS list as normative, numbered `LS-1`…`LS-12` verbatim, extended by: `LS-13` instance exposure requires independent identity and is never a field on another master (from GROK 3); `LS-14` conditional affectedness requires an explicit predicate with declared `predicateRole`, and absence of a predicate defaults to neither exploited nor remediated (GROK 11 + defect 7); `LS-15` transported assertion copies never master and never feed conclusions (defect 13); `LS-16` VEX-equivalent status is mastered only on WM-SFT-006 and is source-qualified (defect 1). Copy `LS-1`…`LS-16` into PROFILE CANDIDATE as `invariants`. Add the rule: "Provider-local invariant numbering is non-normative; all references use LS-n." Note separately that "RFC 3339 with seconds and explicit offset" is a format rule, not an invariant (defect 15).

**15. Evidence pinning is unverifiable and the holds are stale.**
CLAUDE's evidence cites WM-SFT-006 as "159 582 bytes, sha256 3d39ea38…" — a truncated digest with no algorithm normalisation (no newline or encoding rule), on a contour whose own boundary bars digests from canonicalisation and whose holds include source-pin. The ALLOCATION CANDIDATE holds state that "Independent Grok review and one frozen semantic audit are pending", both of which are present in this contour; and CLAUDE asserts WM-SFT-006 had "independent review waived" while LOCAL SYNTHESIS treats it as a non-canonical reviewable draft.
*Remediation:* either record the full 64-hex digest with `"digestAlgorithm":"sha256"`, `"byteExact":true` and a declared newline normalisation, or strike the size and digest and mark the evidence `"sourcePin":"unpinned"`. This audit strikes them: no supplied text permits verification. Update holds to read "Independent Grok review: received in this contour. Frozen semantic audit: completed once, this document. Registry allocation: pending. Package conversion and live verification: pending." Add: "WM-SFT-006 independent-review waiver and its non-canonical draft status are both recorded and are not reconciled; the waiver does not confer canonical status." Add a global time-format constraint: "All instants are RFC 3339 with seconds and an explicit offset; `disposedAt >= createdAt`; `assessedAsOf >= observedAt` for every cited observation."

**16. Confidentiality is absent from the profile, though exposure records enumerate estate weakness.**
CLAUDE records that exposure records are deny-by-default and that WM-ACT-034's privacy gap and WM-SFT-009's actor-identifier sensitivity both apply. PROFILE CANDIDATE contains no access, disclosure or embargo constraint; only the artifact candidate is restricted-by-default.
*Remediation:* add PROFILE CANDIDATE constraints: "Exposure assessments, reachability determinations and local priority are deny-by-default; read access requires explicit purpose, scope and audit. Embargoed advisory content, reporter identities and exploit-artifact references are separately restricted and are not readable through an exposure record. Actor identifiers inherited from WM-SFT-009 retain their source sensitivity." Retain the hold "WM-ACT-034 privacy contract is an open gap; security-handling and disclosure controls require specialist approval."

**17. The fixture set is misallocated, has no pass/fail oracle, and one expectation is non-deterministic.**
FIXTURES is declared `candidateName:"Exploit Artifact"` yet `conditional-component`, `transitive-presence-proves-exploitability` and `closed-ticket-proves-fixed` test the exposure root and remediation work; `closed-ticket-proves-fixed` contains no artifact element at all. No profile fixture set exists for the decided roots. `conditional-component` expects "the deployment assessment **may be** not affected" — two admissible outcomes, so the case cannot fail. No case names an invariant, an expected status value or a rejection reason, so "The inference is rejected" has no oracle. `restricted-poc` expects the artifact to "receive independent artifact identity" while `allocationState` is `unassigned` and no identifier may be minted. `artifact-successor` presumes the artifact branch of the non-deterministic rule in defect 12 and conflates byte and capability change. The file declares no ordering or determinism metadata.
*Remediation:* split into two files, `vercy-enterprise-allocation-fixtures/v1` (artifact cases only) and `vercy-enterprise-profile-fixtures/v1` (exposure and remediation cases), each with `contourId`, `canonicalPublishable:false`, `"ordering":"by-id-ascending"`, `"determinism":"no-clock-no-network-no-randomness"`, and fixed `now` where time is material. Give every case `invariantRef` (LS-n) plus `expectStatus` and, for negatives, `expectRejectReason`. Rewrite `conditional-component` to expect exactly `exposure_not_affected` with `justificationCode:"configuration"` under an unexpired observation of a `required_for_affectedness` predicate, and move it to the profile set. Rewrite `restricted-poc` to expect "an identity slot is required and remains unallocated; no identifier value is produced". Split `artifact-successor` into a byte-change case and a capability-change case per defect 12. Move `closed-ticket-proves-fixed` and `transitive-presence-proves-exploitability` to the profile set. Add the fixtures below.

## Exact additional fixtures

```json
[
  {"id":"exposure-identity-not-composite","set":"profile","kind":"negative","invariantRef":"LS-13","input":"An exposure assessment is written with exposureAssessmentId derived as a concatenation or hash of vulnerabilityRef, subjectDeploymentRef and assessedAsOf.","expectStatus":"rejected","expectRejectReason":"exposure identity is opaque and independently allocated; derived composite keys are inadmissible"},
  {"id":"exposure-not-a-field","set":"profile","kind":"negative","invariantRef":"LS-13","input":"An exposure status is written as a field on the WM-SFT-009 deployment record with no exposure assessment object.","expectStatus":"rejected","expectRejectReason":"instance exposure requires an independent root; it never exists only as a field on another master"},
  {"id":"unknown-inventory-completeness","set":"profile","kind":"positive","invariantRef":"LS-4","input":"A subject deployment has a WM-SFT-012 manifest whose completeness is unknown and no runtime observation.","expectStatus":"exposure_undetermined","expectRejectReason":null},
  {"id":"missing-observation-not-safe","set":"profile","kind":"negative","invariantRef":"LS-4","input":"Absence of any scan result for a subject deployment is recorded as exposure_not_affected.","expectStatus":"rejected","expectRejectReason":"missing inventory or observation yields exposure_undetermined, never not-affected"},
  {"id":"not-affected-requires-justification","set":"profile","kind":"negative","invariantRef":"LS-5","input":"An exposure_not_affected conclusion is written with no justificationCode and no evidenceRefs.","expectStatus":"rejected","expectRejectReason":"not-affected requires a justification code and cited evidence"},
  {"id":"predicate-role-absent","set":"profile","kind":"negative","invariantRef":"LS-14","input":"A configuration condition carries no predicateRole and the condition is observed false.","expectStatus":"exposure_undetermined","expectRejectReason":"without a declared predicateRole no not-affected conclusion is licensed"},
  {"id":"contributing-predicate-false","set":"profile","kind":"positive","invariantRef":"LS-14","input":"A predicate with predicateRole contributing is observed false and all required_for_affectedness predicates are unobserved.","expectStatus":"exposure_undetermined","expectRejectReason":null},
  {"id":"observation-expiry-downgrades","set":"profile","kind":"positive","invariantRef":"LS-10","input":"An exposure_not_affected conclusion cites a configuration observation whose observedAt plus maxStalenessSeconds precedes the fixed evaluation instant.","expectStatus":"exposure_undetermined","expectRejectReason":null},
  {"id":"corrected-revision-stales","set":"profile","kind":"positive","invariantRef":"LS-11","input":"WM-SFT-006 issues a corrected revision superseding the revision pinned by an existing exposure assessment.","expectStatus":"stale","expectRejectReason":null},
  {"id":"stale-conclusion-not-readable","set":"profile","kind":"negative","invariantRef":"LS-11","input":"A conclusion in lifecycle stale is read as a current exposure status.","expectStatus":"rejected","expectRejectReason":"stale conclusions are not current; a superseding assessment is required"},
  {"id":"unpinned-revision-ref","set":"profile","kind":"negative","invariantRef":"LS-10","input":"An exposure assessment omits vulnerabilityRevisionRef.","expectStatus":"rejected","expectRejectReason":"criteria must pin a vulnerability revision; staleness cannot otherwise be evaluated"},
  {"id":"supersession-not-overwrite","set":"profile","kind":"negative","invariantRef":"LS-10","input":"A new assessment result overwrites the exposureStatus of an existing asserted assessment in place.","expectStatus":"rejected","expectRejectReason":"conclusions are superseded via supersedesRef, never overwritten"},
  {"id":"vex-dual-write","set":"profile","kind":"negative","invariantRef":"LS-16","input":"An exposure assessment writes a product-scope not_affected status back onto WM-SFT-006 or onto WM-SFT-008 or WM-SFT-012.","expectStatus":"rejected","expectRejectReason":"VEX-equivalent status is mastered only on WM-SFT-006 and may be cited, never authored or rewritten, by other masters"},
  {"id":"vex-label-at-instance-scope","set":"profile","kind":"negative","invariantRef":"LS-3","input":"An instance conclusion is recorded using the product-scope label under_investigation.","expectStatus":"rejected","expectRejectReason":"instance vocabulary is exposure_affected, exposure_not_affected, exposure_fixed, exposure_undetermined; product labels are inadmissible at instance scope"},
  {"id":"product-not-affected-closes-instance","set":"profile","kind":"negative","invariantRef":"LS-3","input":"A product-scope not_affected assertion is used to close exposure for an instance running a different reachable configuration.","expectStatus":"rejected","expectRejectReason":"product affectedness never implies deployed-instance exposure"},
  {"id":"cached-verdict-not-authoritative","set":"profile","kind":"negative","invariantRef":"LS-15","input":"A WM-SFT-007 f-affectedness cached verdict is supplied as the evidence basis for an exposure conclusion.","expectStatus":"rejected","expectRejectReason":"nonAuthoritativeCopy records never feed conclusions; the WM-SFT-006 assertion must be cited directly"},
  {"id":"non-cve-namespace-identity","set":"profile","kind":"positive","invariantRef":"LS-1","input":"A vulnerability is mastered on WM-SFT-006 with a non-CVE issuing namespace and no CVE alias.","expectStatus":"accepted","expectRejectReason":null},
  {"id":"cve-required-as-identity","set":"profile","kind":"negative","invariantRef":"LS-1","input":"An exposure assessment rejects a vulnerabilityRef because no CVE identifier is present.","expectStatus":"rejected","expectRejectReason":"CVE is one namespace among several and is not required for identity"},
  {"id":"fix-available-not-build-inclusion","set":"profile","kind":"negative","invariantRef":"LS-8","input":"A WM-SFT-006 fixed-version reference is used as proof that a build contains the fix.","expectStatus":"rejected","expectRejectReason":"fix availability and build inclusion are separately evidenced"},
  {"id":"build-inclusion-not-deployment","set":"profile","kind":"negative","invariantRef":"LS-8","input":"A WM-SFT-008 build containing the fixed component is used to conclude exposure_fixed for an instance still pinned to the prior release.","expectStatus":"rejected","expectRejectReason":"build inclusion is not deployment; a WM-SFT-009 deployment to the subject instance is required"},
  {"id":"deployment-not-verification","set":"profile","kind":"negative","invariantRef":"LS-8","input":"A completed WM-SFT-009 deployment of the remediating build is used to conclude exposure_fixed with no verification observation.","expectStatus":"rejected","expectRejectReason":"deployment is not verification; a superseding assessment citing verification of every prior criterion is required"},
  {"id":"verified-fix-supersedes","set":"profile","kind":"positive","invariantRef":"LS-8","input":"The remediating build is deployed to the subject instance and verification observations cover every criterion that produced the prior exposure_affected.","expectStatus":"exposure_fixed","expectRejectReason":null},
  {"id":"deployment-master-asserts-exposure","set":"profile","kind":"negative","invariantRef":"LS-13","input":"WM-SFT-009 records an exposure status alongside its post-deployment verification outcome.","expectStatus":"rejected","expectRejectReason":"WM-SFT-009 masters the verification observation only; the exposure conclusion belongs to the WM-ACT-034 profile"},
  {"id":"closed-work-not-outcome","set":"profile","kind":"negative","invariantRef":"LS-9","input":"A WM-ACT-006 task reaching a terminal state is supplied as the sole basis for a remediationStatus of remediated.","expectStatus":"rejected","expectRejectReason":"closed remediation work records work status only and never proves remediation outcome"},
  {"id":"work-state-vs-status-distinct","set":"profile","kind":"positive","invariantRef":"LS-9","input":"A WM-ACT-006 task is terminal while the exposure assessment still concludes exposure_affected on unexpired evidence.","expectStatus":"exposure_affected","expectRejectReason":null},
  {"id":"transitive-presence-not-reachable","set":"profile","kind":"negative","invariantRef":"LS-7","input":"A transitive component match in a WM-SFT-012 manifest is recorded as a reachability determination.","expectStatus":"rejected","expectRejectReason":"presence, loading, reachability and attacker-controlled reachability are distinct criteria with distinct evidence"},
  {"id":"reachability-not-exploitation","set":"profile","kind":"negative","invariantRef":"LS-7","input":"A reachability determination is recorded as an estate exploitation observation.","expectStatus":"rejected","expectRejectReason":"reachability does not establish exploitation"},
  {"id":"observation-not-incident","set":"profile","kind":"negative","invariantRef":"LS-7","input":"An estate exploitation observation is recorded as a WM-ACT-020 incident without incident qualification.","expectStatus":"rejected","expectRejectReason":"incident identity requires its own qualification and declaration decision"},
  {"id":"generic-severity-relabelled","set":"profile","kind":"negative","invariantRef":"LS-6","input":"A CVSS base score from WM-SFT-006 is written as the environmentalRisk of an exposure assessment with no environmental inputs.","expectStatus":"rejected","expectRejectReason":"generic severity never becomes local risk by relabelling"},
  {"id":"environmental-score-on-vulnerability","set":"profile","kind":"negative","invariantRef":"LS-6","input":"An environmental score or local priority is written onto WM-SFT-006.","expectStatus":"rejected","expectRejectReason":"environmental risk and remediation priority are instance-scoped and belong to the exposure root"},
  {"id":"kev-sets-local-priority","set":"profile","kind":"negative","invariantRef":"LS-6","input":"Known-exploited catalogue membership is used as the localPriority value with no asset criticality, controls or exposure-surface input.","expectStatus":"rejected","expectRejectReason":"severity, exploitation probability, known exploitation, local risk and priority are distinct and non-substitutable"},
  {"id":"epss-as-severity","set":"profile","kind":"negative","invariantRef":"LS-6","input":"An EPSS probability is stored in the CVSS severity container.","expectStatus":"rejected","expectRejectReason":"exploitation probability is not severity"},
  {"id":"cross-scheme-version-order","set":"profile","kind":"negative","invariantRef":"LS-2","input":"An affectedness range declares no ecosystem or version scheme and is compared against a version ordered under a different scheme.","expectStatus":"rejected","expectRejectReason":"every affectedness assertion names ecosystem and version scheme; no cross-scheme ordering is assumed"},
  {"id":"no-cascade-delete","set":"profile","kind":"negative","invariantRef":"LS-12","input":"Withdrawal of a WM-SFT-006 revision triggers deletion of dependent exposure assessments, evidence records or incident records.","expectStatus":"rejected","expectRejectReason":"no deletion cascades across vulnerability, component, build, deployment, evidence or incident masters"},
  {"id":"exposure-deny-by-default","set":"profile","kind":"negative","invariantRef":"LS-10","input":"An exposure assessment with reachability and local priority is read without an explicit purpose, scope and audit record.","expectStatus":"rejected","expectRejectReason":"exposure records are deny-by-default; read access requires purpose, scope and audit"},
  {"id":"timestamp-without-offset","set":"profile","kind":"negative","invariantRef":"LS-10","input":"assessedAsOf is supplied without seconds or without an explicit UTC offset.","expectStatus":"rejected","expectRejectReason":"all instants are RFC 3339 with seconds and an explicit offset"},
  {"id":"assessed-before-observed","set":"profile","kind":"negative","invariantRef":"LS-10","input":"assessedAsOf precedes the observedAt of an evidence item the conclusion cites.","expectStatus":"rejected","expectRejectReason":"a conclusion cannot precede the evidence it cites"},
  {"id":"artifact-rendition-byte-change","set":"allocation","kind":"positive","invariantRef":"LS-13","input":"Captured content of the same acquisition is re-encoded, changing bytes with no change in functional capability class.","expectStatus":"new ArtifactRendition with supersedesRendition; exploitArtifactId unchanged","expectRejectReason":null},
  {"id":"artifact-capability-change","set":"allocation","kind":"positive","invariantRef":"LS-13","input":"A variant changes functional capability class relative to the recorded artifact.","expectStatus":"distinct ExploitArtifact with successorRef","expectRejectReason":null},
  {"id":"artifact-ambiguous-version-route","set":"allocation","kind":"negative","invariantRef":"LS-13","input":"A byte-level change within one acquisition is recorded as a distinct ExploitArtifact.","expectStatus":"rejected","expectRejectReason":"same-acquisition byte changes create renditions; only distinct acquisition or capability change creates a new artifact"},
  {"id":"artifact-target-is-deployment","set":"allocation","kind":"negative","invariantRef":"LS-13","input":"targetRefs cites a WM-SFT-009 deployed instance.","expectStatus":"rejected","expectRejectReason":"artifact targets are product or component-version scope only; estate targeting is excluded"},
  {"id":"artifact-cites-exposure","set":"allocation","kind":"negative","invariantRef":"LS-13","input":"The artifact record declares an outbound reference to a WM-ACT-034 exposure assessment or a WM-ACT-020 incident.","expectStatus":"rejected","expectRejectReason":"those relations are inbound-only; the artifact root cites neither"},
  {"id":"artifact-estate-observation","set":"allocation","kind":"negative","invariantRef":"LS-7","input":"An observation of the artifact acting within an estate deployment is recorded on the artifact root.","expectStatus":"rejected","expectRejectReason":"the artifact root records controlled-environment analysis of the artifact only"},
  {"id":"artifact-link-proves-affectedness","set":"allocation","kind":"negative","invariantRef":"LS-3","input":"A sourced artifact-to-vulnerability link is used to assert product affectedness or instance exposure.","expectStatus":"rejected","expectRejectReason":"an artifact link is a sourced assertion and proves neither product affectedness nor deployed exposure"},
  {"id":"artifact-handling-default","set":"allocation","kind":"positive","invariantRef":"LS-13","input":"An artifact is recorded with no explicit handlingClass.","expectStatus":"restricted handling applied by default; access requires explicit purpose, scope and audit","expectRejectReason":null},
  {"id":"artifact-handling-as-lifecycle","set":"allocation","kind":"negative","invariantRef":"LS-13","input":"A status value of restricted is written to the artifact lifecycle field.","expectStatus":"rejected","expectRejectReason":"handling and lifecycle are separate axes; restricted is a handlingClass value only"},
  {"id":"artifact-disposed-without-timestamp","set":"allocation","kind":"negative","invariantRef":"LS-13","input":"status is set to disposed with disposedAt absent.","expectStatus":"rejected","expectRejectReason":"disposedAt is required when status is disposed"},
  {"id":"artifact-disposal-preserves-provenance","set":"allocation","kind":"positive","invariantRef":"LS-12","input":"An artifact is disposed and its renditions' stored content is destroyed.","expectStatus":"accepted; digest, mediaType, createdAt, provenance, decisions and historical references retained, storageRef absent","expectRejectReason":null},
  {"id":"artifact-missing-provenance","set":"allocation","kind":"negative","invariantRef":"LS-13","input":"An artifact is recorded with a content digest but no acquisition provenance or chain of custody.","expectStatus":"rejected","expectRejectReason":"provenance and chain of custody are required for every artifact"},
  {"id":"artifact-instruction-request","set":"allocation","kind":"negative","invariantRef":"LS-13","input":"A read of an artifact record is used to request generation of exploitation instructions or execution of captured content.","expectStatus":"rejected","expectRejectReason":"artifact records never authorize generating exploitation instructions or executing content"},
  {"id":"artifact-identifier-minted","set":"allocation","kind":"negative","invariantRef":"LS-13","input":"A registry or runtime identifier is assigned to the Exploit Artifact candidate in this contour.","expectStatus":"rejected","expectRejectReason":"allocationState is unassigned; no identifier may be minted or guessed"}
]
```

## Freeze decision

**Freeze the disposition. Do not freeze the artifacts as supplied.**

Frozen, unchanged: reuse WM-SFT-006 as the Vulnerability aggregate with source-qualified product/version/configuration affectedness and VEX-equivalent status; WM-ACT-034 profiled as the independently identified deployed-instance exposure root owning contextual exposure, reachability, environmental risk, local priority and the instance remediation-status conclusion; WM-ACT-006 profiled for remediation work only; fix availability contained in WM-SFT-006, build inclusion in WM-SFT-008, deployment and verification observation in WM-SFT-009, manifest evidence in WM-SFT-012, incident identity in WM-ACT-020; one Exploit Artifact candidate retained, identifier-unassigned; zero catalogue, registry, model or runtime identifiers allocated.

Conditionally frozen: PROFILE CANDIDATE, ALLOCATION CANDIDATE and FIXTURES are frozen only after defects 1–17 are applied exactly as written. Every remediation is mechanical and self-contained; none requires further adjudication, and none reopens the disposition. Base numbering for all invariant references is LS-1…LS-16 per defect 14.

Not frozen and not claimable: canonicalisation, installability, publication readiness and standards conformance. Publication remains held on registry namespace and identifier allocation for the Exploit Artifact candidate; amendment of the WM-SFT-008 and WM-SFT-012 VEX boundary texts and the WM-SFT-007 duplication; approved relation-ledger rows for all declared references, including every WM-SFT-006 outgoing relation; the WM-ACT-034 privacy contract and specialist approval of security-handling, malware-storage and disclosure controls; the WM-SFT-006 staleness-propagation contract; source pinning of WM-SFT-006 evidence; and verification of the CVE, NVD, OSV, CSAF, VEX, STIX, CWE and CVSS crosswalks and fixtures. All named bases remain non-canonical drafts.

This audit is closed. No further provider run is requested or required.