LINEAGE
Per-decision provenance · WORM ledger · reproducible
Compliance posture
live · in-flight · confirmed roadmap (no vapourware)
SOC 2 Type 1
Insight Assurance · audit Q3 2025
SOC 2 Type 2
Drata · 6-month observation period began 2026-04
ISO 27001
Stage 1 audit scheduled Q3 2026
ISO 42001
AI management system · audit completed 2026-Q1
HIPAA
BAA-ready · access policies enforced
FedRAMP Moderate
Sponsor agency in discussion (US DoT)
Protected B (CCCS)
GoC procurement track
GDPR + PIPEDA
Data residency + DPA in place
RECENT DECISIONS · 5 TOTAL
DECISION
Rotate next shift
DEC-2026-05-06-04412at 10:24:14·subject shift:SHFT-9012·by Fatigue GuardianREPRODUCE
same inputs · same hash
Lineage chain · seven stages
each row is a hash-anchored ledger entry
SIGNAL
sig-a1f4e2d80msAnomaly emitted from data plane
type
anomaly · severity=watchscorer
fatigue-cluster-density v3.2threshold
score >= 85 AND consecutive_shifts >= 3raw input
WFM rest_hrs, fatigue_score history, scheduleMODEL
mdl-f4e2d8c4+0.32sScoring + reasoning model invocation
model
claude-opus-4-7 (1M ctx) — frozen at policy v23model hash
sha256:e8a3...0921input tokens
12,840output tokens
1,022temperature
0.0 (deterministic)PROMPT
prm-e2d8c4ce+0.34sTemplated prompt with grounded context
template
fatigue-guardian/rotation-policy.v17template hash
sha256:c4f2...8810context bytes
4.2 KB · all from ontology, no free-text injectionredactions
PII tokenised (per access policy)AGENT
agt-a1f4e2d8+0.41sSpecialist proposing a typed action
agent
Fatigue Guardian v23skill
rotate_shiftversion
promoted 2d ago after eval-suite + 1σpolicy gate
severity=review (not auto)ACTION
act-f4e2d8c4+0.42sTyped action proposal entered queue
action key
shift.rotate_shiftsubject
shift:SHFT-9012mutates
shift.person_id, shift.fill_methodreversibility
60 min auto-rollback windowAPPROVER
apv-e2d8c4ce+12.18sHuman gate (severity=review)
approver
sup-aviation-lead-3approval surface
Slack (Adaptive Card)MFA
device-bound · attested at 09:11delegation chain
ops-manager-east → sup-aviation-lead-3AUDIT
aud-a1f4e2d8c4ce+12.19sAppend-only ledger entry
ledger row id
DEC-2026-05-06-04412WORM storage
S3 Object Lock · 7-year retentionmerkle root
0xa18f...3d04 (block 2,184,210)external attest
anchored on AWS QLDB hourlyProperty mutations · diff view
contracted by
shift.rotate_shift| PROPERTY | BEFORE | AFTER | NOTE |
|---|---|---|---|
| shift.person_id | PRSN-1284 | PRSN-872 | Reassigned to lower-fatigue operator |
| shift.fill_method | regular | swap | Marked as fatigue-driven swap |
| shift.status | filled | filled | Status unchanged (still active) |
Reproducibility contract
DECISION HASH
a1f4e2d8c4ce
DETERMINISTIC SEED
20260506-04412 · derived from decision id
MODEL VERSION
claude-opus-4-7 · frozen at policy v23
PROMPT TEMPLATE
fatigue-guardian/rotation-policy.v17 · sha256 c4f2…8810
ONTOLOGY VERSION
2026-05-05 · 18 types · 142 props
CODE COMMIT
git@d6c9b21 · main
Run reproducibility: any auditor — internal QA, external SOC 2, government oversight — can re-execute this decision with the recorded inputs and verify the same proposal. Failure to reproduce within tolerance triggers automatic incident escalation. We have not had a reproducibility failure in 184 cycles.