K07 · evidence-bundled critical-infrastructure assurance
Mission and authority analysis
Direct answer
Define the protected mission, competent authorities, asset scope, allowed actions, prohibited outcomes, decision rights, deconfliction, and evidence obligations before technology selection.
Authority and evidence boundary. K07 publishes knowledge architecture, bounded reference records, procurement structures, local validation tools, signed synthetic fixtures, and point-in-time source review. It does not certify a facility, award a contract, authorize an operation, prove truth, establish deployment, or claim current operation.
Statement of work
Define the protected mission, competent authorities, asset scope, allowed actions, prohibited outcomes, decision rights, deconfliction, and evidence obligations before technology selection.
| Current package ID | WP-K07-01 |
|---|---|
| Inherited stable ID | WP-K06-01 |
| Period | To be defined by the acquiring authority; no duration is inferred by the public pattern. |
| Dependencies | None declared |
Required outcomes
- approved mission boundary
- competent-authority register
- prohibited-outcome and deconfliction baseline
- decision-expiry and review schedule
Owner-furnished information
- controlling authority instruments
- asset and service ownership records
- jurisdiction facts
- mission-essential function list
- stakeholder and escalation contacts
Contractor deliverables
- mission thread
- authority matrix
- allowed-action matrix
- prohibited-outcome register
- decision and escalation map
Performance standards
- Every action class has a named competent authority or an explicit UNAVAILABLE state
- Assets, effects, locations, time window and exclusions are bounded
- Unresolved authority remains visible and blocks downstream readiness
Quality surveillance
- document review and owner attestation
- traceability replay
- graph propagation test
Exclusions
- no self-generated authority
- no target package
- no legal opinion without retained counsel
Acceptance matrix
| Criterion | Required result | Assessment | Outcome vocabulary |
|---|---|---|---|
| Authority completeness | Every action class has a named competent authority or an explicit UNAVAILABLE state | document review and owner attestation | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| Scope precision | Assets, effects, locations, time window and exclusions are bounded | traceability replay | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| Negative result preservation | Unresolved authority remains visible and blocks downstream readiness | graph propagation test | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
Bid-evaluation criteria
- demonstrated authority-analysis method
- ability to preserve unresolved conclusions
- conflict-of-interest disclosure
- evidence-delivery and data-rights plan
- price realism and schedule credibility
- data-rights and evidence-delivery terms
- subcontractor and supply-chain transparency
Evidence rights
- The acquiring authority receives perpetual access to final reports, schemas, manifests, acceptance evidence, defects, and correction history within the negotiated data-rights regime.
- Contractor proprietary methods may remain protected only when they do not prevent independent replay of required results.
- Source artifacts, hashes, versions, tool outputs, and negative findings required for acceptance cannot be withheld merely because they are unfavorable.
- No clause transfers authority, licensing status, or ownership beyond the signed contract and governing law.
Negative-result clauses
- A failed, partial, stale, disputed, unavailable, or superseded result must be delivered and may not be converted into a pass.
- Discovery of a safety, authority, evidence, or common-cause defect triggers prompt notice and preserves stop authority.
- Acceptance of one deliverable does not waive latent defects, falsified evidence, or later-discovered nonconformance.
- The final package must distinguish work completed, work not performed, evidence unavailable, and owner decisions pending.
Data requirements
- controlling authority instruments
- asset and service ownership records
- jurisdiction facts
- mission-essential function list
- stakeholder and escalation contacts