E1_E2_Fidelity_Audit_CODEX.md
Memory Rebuild Docs/Stage_6_Charters/E1_E2_DOC81_Scope_Policy/Reviews/E1_E2_Fidelity_Audit_CODEX.md
ELNOR REPO READER TEXT MIRROR
Original path: Memory Rebuild Docs/Stage_6_Charters/E1_E2_DOC81_Scope_Policy/Reviews/E1_E2_Fidelity_Audit_CODEX.md
Source repo: /Users/OpenClaw1/Elnor/Elnor Specs
Git branch: main
Git commit: dbaa25962edc11ab30e8d4ca1715f9ae5bf77331
Generated: 2026-06-09T01:23:58.539Z
---
# DOC81 E1/E2 Charter Draft — CODEX Fidelity & Traceability Audit
## Repo Access And Reads
Repo access confirmed locally at `/Users/OpenClaw1/Elnor/Elnor Specs`, branch `main`, remote `github.com/wbrody/Elnor-Specs`. I verified 10 acceptance criteria from `Memory Rebuild Docs/Stage_6_Charters/E1_E2_DOC81_Scope_Policy/E1_E2_Drafting_Commission_Claude_Code.md:158`.
Files read:
- `Memory Rebuild Docs/Stage_6_Charters/E1_E2_DOC81_Scope_Policy/E1_E2_CODEX_Fidelity_Audit_Prompt.md`
- `Memory Rebuild Docs/Stage_6_Charters/E1_E2_DOC81_Scope_Policy/Charter_Draft.md`
- `Memory Rebuild Docs/Stage_6_Charters/E1_E2_DOC81_Scope_Policy/E1_E2_Drafting_Commission_Claude_Code.md`
- `Memory Rebuild Docs/Stage_6_Charters/E1_E2_DOC81_Scope_Policy/Charter_Opening_Brief.md`
- `Memory Rebuild Docs/Stage_6_Charters/E1_E2_DOC81_Scope_Policy/Charter_Input_Deck.md`
- `Memory Rebuild Docs/Stage_6_Charters/E0_DOC80_Core/Charter_Draft.md`
- `Memory Rebuild Docs/DOC80 Target Baseline/Skeletal Spec/DOC80_Skeletal_Target_Baseline.md`
- `Memory Rebuild Docs/DOC80 Target Baseline/Owner Map/DOC80_Owner_Map.md`
- `Memory Rebuild Docs/DOC80 Target Baseline/Import Graph/DOC80_Import_Graph.md`
- `Memory Rebuild Docs/DOC80 Target Baseline/Retired Names/DOC80_Retired_Names.md`
- `Memory Rebuild Docs/Flattening/Execution Ledger/Architect Decision Queue/Architect_Decision_Queue.md`
- `Memory Rebuild Docs/Flattening/Supersession Matrix/Supersession_Matrix.md`
- `OP-A and Operations and Trackers/OPA_V4.md`
- `OP-A and Operations and Trackers/Archived DOC OP-A and Operations DOCS/OPA_V3_18.md`
- `Current Specs/Miscellaneous Specs/MultiDoc_PropA_R6_3_Compiled_Operative_Spec.md`
- `Memory Rebuild Docs/Memory Rebuild Review Packs/DOC80_Memory_Control_Plane_PreSpec_Review_Pack_v1_0_2026-05-25/13_Round_D_Policy_Scope_UI_Micro_Patch_R0_2.md`
No standalone drafter self-report / application report artifact was present under `Memory Rebuild Docs/Stage_6_Charters/E1_E2_DOC81_Scope_Policy/`; the folder contains only the draft, opening brief, input deck, drafting commission, and this audit prompt. I therefore audited the draft's embedded self-reporting claims in §§13-14 against the actual text and sources.
## Summary And Verdict
**Verdict: `FIXES_NEEDED_BEFORE_RED_TEAM`.** The DOC81 charter draft is structurally strong: the required 14-section skeleton is present, most DOC81-owned schemas are paste-ready, E0 binding is mostly by reference, the DOC81 -> DOC86 import-graph fix is preserved, and the named invariants have runtime gate / Stage 9 lint / Stage 8 fixture coverage.
The blocking fidelity defect is the PropA fold-in. `Charter_Draft.md` §7.3 claims landing sites for the 8 carried PropA rows inherited from `OPA_V3_18.md`, but those landing-site descriptions do not match the archived row bodies, and the exact carried concepts do not appear elsewhere in the draft. This is not a design disagreement; it is a traceability failure against the required archived OP-A source.
## Acceptance Criteria Table
| AC | result | evidence | notes |
|---|---|---|---|
| 1. `Charter_Draft.md` exists; §§1-14 present and substantive | PASS | `Charter_Draft.md:52`, `:113`, `:342`, `:701`, `:916`, `:990`, `:1092`, `:1200`, `:1234`, `:1271`, `:1290`, `:1308`, `:1320`, `:1336` | 1,386-line draft with all required sections. |
| 2. All 20 draft targets addressed | PARTIAL | Opening Brief targets at `Charter_Opening_Brief.md:30`; draft landings mostly at `Charter_Draft.md:117-1316` | Targets 1-18 and 20 are addressed. Target 19, the whole PropA fold-in, is materially incomplete/mis-mapped. |
| 3. Pinned ADQs have explicit §14 landing sites | PASS | `Charter_Draft.md:1340` plus ADQ source rows at `Architect_Decision_Queue.md:38`, `:47`, `:49`, `:52`, `:54`, `:55`, `:67`, `:68` | ADQ-310, 315, 316, 313, 308, 213, 406, PASS2-02 are listed with landing sites. |
| 4. 10 PropA OPA rows + 2 E0-handed obligations have landing sites | FAIL | Draft table at `Charter_Draft.md:1165`; V4 retarget list at `OPA_V4.md:76`; V3.18 bodies at `OPA_V3_18.md:3218` | IDs are listed, but 8 carried row bodies are not correctly landed. Source-exclusion + both E0 handoffs are clean. |
| 5. 5-plane `CascadingSourceInvalidation` wiring check with six revocation lints | PASS | `Charter_Draft.md:960`; Skeletal baseline at `DOC80_Skeletal_Target_Baseline.md:543` | Five planes + six lints are present, including published-view lint. |
| 6. Four named invariants have runtime gate + Stage 9 lint + Stage 8 fixture | PASS | `Charter_Draft.md:1275` | LegalHoldState, policy monotonicity, DOC81/DOC87 non-overlap, and capability/disclosure separation each have all three. |
| 7. Required full schemas paste-ready; E0 contracts referenced, not redefined | PASS with one boundary defect | Required schemas at `Charter_Draft.md:117-1126`; E0 bind list at `Charter_Draft.md:97` and `:1310` | E0 contracts are not redefined. Separate boundary defect: DOC81 locally defines/uses DOC86-owned `AvailabilityDisposition`. |
| 8. `EffectiveMemoryPolicy` meet algorithm specified | PASS | `Charter_Draft.md:452` | Algorithm is keyed by object/action/destination, monotone-restrictive, and conservative on missing/incomparable inputs. |
| 9. `OPEN_FOR_ARCHITECT_REVIEW` items <= 5 | PASS | `Charter_Draft.md:1322` | Draft reports 3. §13.3 should be converted from open item to required PropA patch, but count remains <= 5. |
| 10. Read-once-understandable by Stage 7 author / cold red-teamer | PARTIAL | Overall structure pass; PropA table at `Charter_Draft.md:1165` | The non-PropA architecture is readable. The PropA §7.3 table is actively misleading because it looks like the 10 rows are landed when 8 carried bodies are not. |
## Schema Presence, Traceability, E0 Binding, And Invariants
- [CONFIRMED] Core DOC81 schema presence is strong. The draft gives TypeScript-style bodies for the required scope family, policy family, safe-label/disclosure policy, extraction envelope, DAMS ceiling, contamination threshold, `TopicRiskClass`, `CascadingSourceInvalidation`, `LegalHoldState`, and collection suppression governance (`Charter_Draft.md:117`, `:342`, `:726`, `:778`, `:811`, `:855`, `:920`, `:994`, `:1096`).
- recommended action: keep the structure; patch the traceability defects below.
- [AC_FAIL | UNTRACEABLE] The PropA fold-in table does not match the archived carried-row bodies. `OPA_V4.md:764` says surviving V3.18 rows inherit canonical body fields from `OPA_V3_18.md`; `Charter_Draft.md:1161` says §7.3 did not use those bodies and only mapped at topic level. The audit did use `OPA_V3_18.md`, and the exact row bodies are different from the draft table.
- affected draft sections: `Charter_Draft.md:1159`, `:1165`, `:1328`, `:1353`
- recommended action: replace §7.3 with a row-body-accurate table; remove §13.3 as an architect-open item after patch.
- paste-ready fix:
```markdown
Replace the §7.3 landing-site table with a row-body reconciliation table whose source-body column is taken from `OPA_V3_18.md`:
| OPA row | canonical carried body | DOC81 landing requirement |
|---|---|---|
| `OBL-PROPA-NEW-01` | `ExposureContextSchema` owned by PropA; DOC24 passes context to EC PolicyDecisionEngine | Add an explicit PropA-owned `ExposureContextSchema` input/ref to DOC81 policy evaluation (`MemoryPolicyDecision` / EC compiled policy input), without redefining the PropA enum. |
| `OBL-PROPA-NEW-02` | policy hard-block precedence over BDSM `force_level` | State that policy block is final; BDSM/DAMS force or salience may operate only inside `PolicyCappedDAMSInput` eligibility and can never override `EffectiveMemoryPolicy`. |
| `OBL-PROPA-NEW-V15-01` | `LearningVisibilityScope` filtering for prompt-iteration signals | Land as a learning/policy partition gate: sealed signals discarded; firewalled signals same-firewall only; DOC85 consumes, DOC81 owns policy gating. |
| `OBL-PROPA-NEW-V15-02` | `SchemaMigrationPlan` emission for schema-changing prompt iterations | Add an obligation/gate that schema-changing prompt iterations require a migration plan or route to `manual_review_only`. |
| `OBL-PROPA-NEW-V15-03` | `VerifierCalibrationLedger` gating for verifier prompt iteration | Add a policy gate excluding signals from uncalibrated/drifting/failed verifiers. |
| `OBL-PROPA-NEW-V15-04` | AVAPO regression fixture exclusion rules | Add a fixture-generation privacy gate: sealed-source fixtures are not generated; firewalled fixtures stay same-firewall. |
| `OBL-PROPA-NEW-V15-05` | post-retrieval critique prompt surface | Add a PropA/DOC81 landing for post-retrieval critique prompt registration and critique-utility signal eligibility. |
| `OBL-PROPA-NEW-V15-06` | counterfactual ambiguity classification + additive synthesis prompts | Add a landing for these prompt surfaces and their policy/learning eligibility constraints. |
| `OBL-XDOC-PROPA-DSPY-TARGETS-01` | four added DSPy target ids + `DspyTargetEligibilitySchemaV4` discipline | Enumerate `claim_extractor_main`, `outcome_evaluator_main`, `revision_compiler_main`, `outcome_compiler_main`; state PropA owns the target registry and DOC81 supplies policy eligibility ceilings. |
| `OBL-PROPA-NEW-SOURCE-EXCLUSION-FILTER-01` | V4 ADD source-exclusion starter body | Keep current §7.2; it matches `OPA_V4.md:770`. |
```
- [BOUNDARY_CREEP] `AvailabilityDisposition` is DOC86-owned, but DOC81 defines and uses it inside `SafeLabelDisclosurePolicy`. Owner Map assigns `AvailabilityDisposition` to DOC86 (`DOC80_Owner_Map.md:191`), Skeletal places it in DOC86 §6 (`DOC80_Skeletal_Target_Baseline.md:254`), and Import Graph says DOC84 -> DOC86 carries `AvailabilityDisposition` runtime state (`DOC80_Import_Graph.md:81`). The DOC81 draft locally defines the type at `Charter_Draft.md:736` and embeds it as `availability` at `Charter_Draft.md:749`. That risks an upward DOC86 -> DOC81 schema dependency, conflicting with the B1 fix and the stated DOC81 -> DOC86 direction (`DOC80_Import_Graph.md:63`, `Charter_Draft.md:1236`).
- recommended action: make DOC81 export disclosure constraints; let DOC86 map those constraints to its own `AvailabilityDisposition`.
- paste-ready fix:
```typescript
/** The policy MEANING of a safe label. schema_owner = DOC81 (Owner Map line 87; ADQ-308; Round D §6.2).
* EC enforces; DOC86 maps these constraints to DOC86-owned AvailabilityDisposition / rendered notices. */
interface SafeLabelDisclosurePolicy extends E0DurableRecord {
policy_id: string;
schema_owner: 'DOC81';
disclosure_class: DisclosureClass;
protected_reason_class:
| 'privileged' | 'sealed' | 'firewalled' | 'personal'
| 'client_confidential' | 'matter_specific' | 'policy_unknown';
may_disclose_existence: boolean;
may_disclose_container_type: boolean;
may_disclose_topic_label: boolean;
may_disclose_source_title: boolean;
may_disclose_count: boolean;
may_disclose_reason_summary: boolean;
default_label_ref: SafeReferenceLabelRef;
inspector_label_ref?: SafeReferenceLabelRef;
effective_policy_ref: EffectiveMemoryPolicyRef;
reason_codes: ReasonCodeId[];
}
// Remove the local `type AvailabilityDisposition = ...` block from DOC81.
// Add prose: "AvailabilityDisposition is DOC86-owned; DOC81 exports disclosure_class + safe-label constraints only."
```
- [CONFIRMED] E0 contracts are bound by reference rather than redefined. The draft identifies `EffectiveMemoryPolicyRef` as E0's consumption pointer while declaring the DOC81-owned schema (`Charter_Draft.md:101`, `:420`), binds `policy_generation_id` to E0 (`Charter_Draft.md:103`, `:669`), and references E0 `RestampMFC`/`MemoryFlowCertificate` without re-declaring the union (`Charter_Draft.md:105`, `:600`, `:1310`).
- recommended action: keep.
- [CONFIRMED] Required invariant enforcement points landed. The §10 table names runtime gates, Stage 9 lints, and Stage 8 fixtures for the four acceptance-named invariants and additional DOC81 invariants (`Charter_Draft.md:1275`).
- recommended action: keep.
## Carried-PropA Body Confirmation
| row | archived body confirmed from `OPA_V3_18.md` | draft mapping | result |
|---|---|---|---|
| `OBL-PROPA-NEW-01` | `ExposureContextSchema` owned by PropA; DOC24 passes context to EC PolicyDecisionEngine (`OPA_V3_18.md:3218`, `:3222`) | "§1 sensitivity/collection/visibility" -> `MemoryPolicyDecision` axes + obligations (`Charter_Draft.md:1167`) | FAIL: exact body absent; `ExposureContextSchema` not in draft. |
| `OBL-PROPA-NEW-02` | hard-block precedence over BDSM `force_level` (`OPA_V3_18.md:3228`, `:3232`) | "§2 sharing/injection/governance" -> meet/disclosure (`Charter_Draft.md:1168`) | FAIL/PARTIAL: policy-meet material exists, but no explicit force-level precedence landing. |
| `OBL-PROPA-NEW-V15-01` | `LearningVisibilityScope` filtering; sealed discarded, firewalled same-firewall only (`OPA_V3_18.md:3240`, `:3244`) | per-category collection caps + `collection_mode` (`Charter_Draft.md:1169`) | FAIL: wrong topic. |
| `OBL-PROPA-NEW-V15-02` | `SchemaMigrationPlan` emission for schema-changing prompt iterations (`OPA_V3_18.md:3250`, `:3254`) | visibility policies / safe labels (`Charter_Draft.md:1170`) | FAIL: wrong topic. |
| `OBL-PROPA-NEW-V15-03` | `VerifierCalibrationLedger` gates verifier prompt iteration (`OPA_V3_18.md:3260`, `:3264`) | automatic injection guards / obligations / DAMS ceiling (`Charter_Draft.md:1171`) | FAIL: wrong topic. |
| `OBL-PROPA-NEW-V15-04` | AVAPO regression fixture exclusion rules (`OPA_V3_18.md:3270`, `:3274`) | source-policy adapter / source exclusion (`Charter_Draft.md:1172`) | FAIL: wrong topic. |
| `OBL-PROPA-NEW-V15-05` | post-retrieval critique prompt surface (`OPA_V3_18.md:3280`, `:3284`) | sharing matrix / outbound (`Charter_Draft.md:1173`) | FAIL: wrong topic. |
| `OBL-PROPA-NEW-V15-06` | counterfactual ambiguity classification + additive synthesis prompts (`OPA_V3_18.md:3290`, `:3294`) | misclassification recovery / restamp (`Charter_Draft.md:1174`) | FAIL: wrong topic. |
| `OBL-XDOC-PROPA-DSPY-TARGETS-01` | four specific DSPy target IDs + eligibility discipline (`OPA_V3_18.md:5449`, `:5455`) | generic self-improvement policy ceiling (`Charter_Draft.md:1175`, `:1178`) | PARTIAL: monotonicity is useful but target-ID acceptance is not landed. |
| `OBL-PROPA-NEW-SOURCE-EXCLUSION-FILTER-01` | V4 ADD starter body: source-exclusion rule, EC retrieval-eligibility enforcement, provenance (`OPA_V4.md:770`, `:774`) | §7.2 `SourceExclusionFilterRule` (`Charter_Draft.md:1128`, `:1147`) | PASS. |
| `OBL-D81-TOPIC-COLLECTION-SUPPRESSION-01` | topic-level suppression body (`OPA_V4.md:834`, `:838`) | §7.1 `CollectionModeSuppressionGovernance` (`Charter_Draft.md:1096`, `:1116`) | PASS. |
| `OBL-PROPA-LOCALFILEEXPORT-OUTBOUND-PATCH-01` | local-file export treated as egress (`OPA_V4.md:948`, `:952`) | §7.4 egress note (`Charter_Draft.md:1186`, `:1192`) | PASS. |
## Reconciliations And Open-For-Architect-Review Items
- [CONFIRMED] §13.1 `ScopeAffinity` reconciliation is acceptable as a non-blocking review confirmation. Draft cites both value sets and chooses the traceable union (`Charter_Draft.md:208`, `:1324`).
- [CONFIRMED] §13.2 `disclosure_class` order is acceptable as a non-blocking review confirmation. Round D provides the unordered set, and the meet algorithm needs a chain; the draft explains the chosen order (`Charter_Draft.md:396`, `:1326`).
- [MALFORMED] §13.3 should not remain an architect-open item after this audit. The archived source is available and confirms the mapping is wrong/incomplete, not merely unconfirmed (`Charter_Draft.md:1328`; `OPA_V3_18.md:3218`).
- recommended action: replace §13.3 with a "FIX APPLIED" row after the §7.3 table is corrected.
- [CONFIRMED] §13.4 `PolicyMembraneDecision` enum synthesis is a legitimate open confirmation. It is traceable to SM-014/Round D but not lifted from a single source (`Charter_Draft.md:1330`).
- [CONFIRMED] §13.5 destination-vocabulary crosswalk is a legitimate open confirmation. The distinction between scope relation and egress destination class is real (`Charter_Draft.md:1332`; E0 egress class at `E0_DOC80_Core/Charter_Draft.md:1719`).
## Retired Names, Import Graph, And Soundness
- [CONFIRMED] Retired-name compliance is clean in the audited text. The draft mentions retired names in lineage/guard contexts and uses canonical replacements for scalar `MemoryPolicyDecision`, scalar `PolicyMembraneDecision`, `ask_user`, linear `contamination_risk`, and standalone DAMS (`Charter_Draft.md:119`, `:344`, `:633`, `:843`, `:1380`; retired-name table at `DOC80_Retired_Names.md:24`, `:25`, `:26`, `:36`, `:39`).
- [CONFIRMED] The main DOC81 -> DOC86 import-graph correction landed. The draft carries the corrected downward export and explicitly forbids DOC81 importing DOC86 (`Charter_Draft.md:1236`); Import Graph proves acyclicity on `schema_import` edges (`DOC80_Import_Graph.md:106`, `:119`).
- [SOUNDNESS_BUG] The `AvailabilityDisposition` boundary defect above is the only import-graph/soundness issue found. If left unchanged, it can imply a DOC86-owned type in a DOC81 schema, which weakens the B1 correction even though the draft prose says DOC81 must not import DOC86.
## Design Advisory
- [DESIGN_ADVISORY] The PropA fold-in should use row-specific fixtures instead of only `fixture.propa.all_ten_rows_have_landing_sites` (`Charter_Draft.md:1182`). A fixture that checks only IDs would have passed this draft despite eight wrong carried bodies. Add fixtures such as `fixture.propa.exposure_context_reaches_policy_engine`, `fixture.propa.policy_block_overrides_force_level`, `fixture.propa.learning_visibility_scope_filters_prompt_iteration`, and `fixture.propa.dspy_target_ids_registered_with_eligibility`.
- [OUT_OF_SCOPE_ADVISORY] Several V15 carried bodies are naturally learning/prompt-iteration adjacent. DOC81 does not need to draft PropA/DOC85 internals, but it does need to name the policy gates and handoff obligations precisely so Stage 6 E9 and PropA amendments cannot miss them.
## Final Verdict
`FIXES_NEEDED_BEFORE_RED_TEAM`.
The charter is not a return-to-zero draft; the scope/policy architecture is mostly coherent and traceable. It should not go to red-team until §7.3 / §13.3 are patched against `OPA_V3_18.md` and the DOC86-owned `AvailabilityDisposition` dependency is removed from the DOC81 schema body. After those fixes, the draft should be ready for red-team fidelity/design review.