{
  "format": "vercy-model-allocation-candidate/v1",
  "contourId": "EM-TEC-10",
  "proposedName": "Change Execution",
  "modelId": null,
  "registryId": null,
  "allocationState": "unassigned",
  "decision": "NEW MODEL",
  "canonicalPublishable": false,
  "identityTest": {
    "stableIdentity": "One actual operational-change occurrence remains identifiable independently of request, authorization, window, release, deployment, rollback and verification.",
    "versionIdentity": "Corrections append assertion revisions under the same occurrence; retry, continuation and rollback create distinct linked execution identities.",
    "independentLifecycle": [
      "scheduled",
      "pending-retrospective-authorization",
      "started",
      "partially-completed",
      "completed",
      "failed",
      "aborted",
      "closed"
    ],
    "mastership": "operational change-execution authority"
  },
  "boundary": {
    "owns": [
      "persistent execution occurrence identity",
      "immutable execution assertion revisions",
      "actual target actions and outcomes",
      "emergency relaxation and retrospective obligation",
      "rollback execution linkage",
      "acting-shift and handover references",
      "verification and closure evidence"
    ],
    "references": [
      {
        "target": "WM-ACT-032",
        "purpose": "Operational Change request and approved revision"
      },
      {
        "target": "WM-ACT-008",
        "purpose": "Versioned window, freeze and rollback plan"
      },
      {
        "target": "WM-ACT-024",
        "purpose": "Authorization decision act"
      },
      {
        "target": "WM-KNW-010",
        "purpose": "Authorization rationale"
      },
      {
        "target": "WM-REC-010",
        "purpose": "Issued authorization instrument"
      },
      {
        "target": "WM-SFT-008",
        "purpose": "Release or build association"
      },
      {
        "target": "WM-SFT-009",
        "purpose": "Software deployment caused by this execution; association only"
      },
      {
        "target": "WM-SFT-015",
        "purpose": "Verification evidence target; publication remains held"
      },
      {
        "target": "WM-ACT-006",
        "purpose": "Execution task"
      }
    ],
    "excludes": [
      "request or authorization identity",
      "window, freeze or rollback-plan identity",
      "release, deployment or verification identity",
      "roster, assignment or IAM grant identity",
      "automatic restoration or access assertion"
    ]
  },
  "objects": {
    "ChangeExecution": {
      "identity": [
        "changeExecutionId",
        "assertionRevisionId"
      ],
      "required": [
        "kind",
        "authorizationKind",
        "targetScope",
        "authorityRef",
        "conditionsRef",
        "effectivityFrom",
        "effectivityTo",
        "executedWindowRef",
        "assertedAt",
        "status"
      ],
      "conditionalRequired": {
        "nonEmergency": [
          "approvedRequestRevisionRef"
        ],
        "emergency": [
          "relaxedControls",
          "relaxationReason",
          "relaxationAuthorityRef",
          "retrospectiveDueAt"
        ],
        "rollback": [
          "revertsExecutionRef",
          "rollbackPlanRef"
        ],
        "startedOrLater": [
          "startedAt"
        ],
        "terminal": [
          "endedAt"
        ],
        "resultStates": [
          "perTargetOutcomes"
        ],
        "restoredState": [
          "verificationRefs"
        ]
      },
      "optional": [
        "approvedRequestRevisionRef",
        "startedAt",
        "endedAt",
        "operatorRefs",
        "perTargetOutcomes",
        "rollbackPlanRef",
        "revertsExecutionRef",
        "verificationRefs",
        "restoredStateAsserted",
        "causedDeploymentRefs",
        "derogationRef",
        "actingShiftRefs",
        "handoverRefs",
        "retrospectiveDecisionRef",
        "supersedesRef"
      ],
      "enums": {
        "kind": [
          "normal",
          "standard",
          "emergency",
          "rollback",
          "retry",
          "continuation"
        ],
        "authorizationKind": [
          "normal",
          "emergency"
        ],
        "status": [
          "scheduled",
          "pending-retrospective-authorization",
          "started",
          "partially-completed",
          "completed",
          "failed",
          "aborted",
          "closed"
        ]
      }
    },
    "PerTargetOutcome": {
      "required": [
        "targetRef",
        "actionRef",
        "outcome",
        "observedAt"
      ],
      "coverageRule": "covers every target in targetScope for result states"
    },
    "OperatorRef": {
      "required": [
        "operatorRef",
        "actingShiftRef",
        "from",
        "to"
      ],
      "optional": [
        "accessGrantRef",
        "accessGrantExpiresAt",
        "grantGapRecorded"
      ]
    },
    "FreezeDerogation": {
      "required": [
        "grantingAuthorityRef",
        "validFrom",
        "validTo",
        "compensatingObligationRef"
      ]
    }
  },
  "invariants": [
    "Request, authorization decision and execution have distinct identities.",
    "Every non-emergency execution pins an approved request revision, conditions, effectivity and immutable reference digests.",
    "Emergency execution records relaxed controls, reason, authority and retrospective due date and cannot close before retrospective authorization.",
    "Execution begins within authorization effectivity and never after request closure.",
    "Window and freeze constrain execution but never authorize it.",
    "Execution inside a freeze requires a bounded authorized derogation and compensating obligation.",
    "Rollback is a distinct execution with kind rollback and directed revertsExecutionRef.",
    "Rollback intent, plan, execution and verified restored state remain distinct.",
    "Restored state requires pinned verification evidence from the declared verification master.",
    "Release, deployment and change remain separate; deployments are caused associations only.",
    "Scheduled executions need no startedAt; terminal states require endedAt.",
    "Partial, completed and failed executions record per-target outcomes covering targetScope.",
    "Every instant is RFC 3339 with seconds and explicit offset; knowledge time orders corrections.",
    "Execution pins the plan, window, authority and request versions it actually used; later versions never rewrite history.",
    "Acting shift and handover intervals make the responsible party recoverable at every execution instant.",
    "Roster membership grants no right; privileged action requires a separate time-bounded authorized grant reference or an explicit gap."
  ],
  "holds": [
    "Registry allocation is pending.",
    "WM-SFT-015 verification publication and relation contracts remain held.",
    "Non-software target crosswalks and IAM-grant authority require canonical approval."
  ],
  "referencePinShape": {
    "required": [
      "model",
      "id",
      "revision",
      "digest"
    ],
    "targetWhitelist": [
      "WM-ACT-032",
      "WM-ACT-008",
      "WM-ACT-024",
      "WM-KNW-010",
      "WM-REC-010",
      "WM-SFT-008",
      "WM-SFT-009",
      "WM-SFT-015",
      "WM-ACT-006"
    ]
  },
  "timePolicy": {
    "instantFormat": "RFC3339 with seconds and explicit offset",
    "validTimeDistinctFromKnowledgeTime": true
  },
  "lifecycleRules": {
    "scheduled": "startedAt absent",
    "pending-retrospective-authorization": "emergency retrospective decision still open",
    "terminal": "completed, failed, aborted and closed require endedAt",
    "closed": "no latent or in-flight execution and no open retrospective obligation"
  },
  "invariantRules": [
    {
      "id": "CE-01",
      "rule": "Request, authorization decision and execution have distinct identities."
    },
    {
      "id": "CE-02",
      "rule": "Every non-emergency execution pins an approved request revision, conditions, effectivity and immutable reference digests."
    },
    {
      "id": "CE-03",
      "rule": "Emergency execution records relaxed controls, reason, authority and retrospective due date and cannot close before retrospective authorization."
    },
    {
      "id": "CE-04",
      "rule": "Execution begins within authorization effectivity and never after request closure."
    },
    {
      "id": "CE-05",
      "rule": "Window and freeze constrain execution but never authorize it."
    },
    {
      "id": "CE-06",
      "rule": "Execution inside a freeze requires a bounded authorized derogation and compensating obligation."
    },
    {
      "id": "CE-07",
      "rule": "Rollback is a distinct execution with kind rollback and directed revertsExecutionRef."
    },
    {
      "id": "CE-08",
      "rule": "Rollback intent, plan, execution and verified restored state remain distinct."
    },
    {
      "id": "CE-09",
      "rule": "Restored state requires pinned verification evidence from the declared verification master."
    },
    {
      "id": "CE-10",
      "rule": "Release, deployment and change remain separate; deployments are caused associations only."
    },
    {
      "id": "CE-11",
      "rule": "Scheduled executions need no startedAt; terminal states require endedAt."
    },
    {
      "id": "CE-12",
      "rule": "Partial, completed and failed executions record per-target outcomes covering targetScope."
    },
    {
      "id": "CE-13",
      "rule": "Every instant is RFC 3339 with seconds and explicit offset; knowledge time orders corrections."
    },
    {
      "id": "CE-14",
      "rule": "Execution pins the plan, window, authority and request versions it actually used; later versions never rewrite history."
    },
    {
      "id": "CE-15",
      "rule": "Acting shift and handover intervals make the responsible party recoverable at every execution instant."
    },
    {
      "id": "CE-16",
      "rule": "Roster membership grants no right; privileged action requires a separate time-bounded authorized grant reference or an explicit gap."
    }
  ]
}