The Track

track/run-001.trig records the escalated run as PROV-O Lebo et al., 2013 with EARL outcomes Abou-Zahra, 2017: automatic Guard results (with an honest cantTell among the outcomes), fired Gates raising obligations, and an earl:manual approval by a named person that discharges both obligations and generates the post-review case state (an action that discharges an obligation must also mutate state, a ruling logged as GAP-02). This run’s discharger happens to be human, as the two gates that fired require; the shapes demand a declared mode and a named accountable party, not humanness (GAP-09 in the open-questions chapter).

run-001 is itself fabricated example data (the record’s own header says so): a constructed execution that exercises the shapes and queries. Its approver is an invented person, named only because a discharging action must name an accountable party.

SHACL shapes Knublauch & Kontokostas, 2017 derived from the manifest’s own track.include list check the record. The cell states what the record contains, then what the shapes conclude:

The same shapes can refuse. The counterexample record raises the same two obligations and contains no discharging action; that absence is the only difference in the data, so the refusal is checkable by eye, one violation per undischarged obligation.

The shapes also hold the record to its own gates, in both directions, against the parameters it says were in force: a gate decision must cite a reading whose value satisfies the gate’s condition, and a reading whose value satisfies a gate’s condition must have a recorded decision. A second external review found the model’s gates to be one-way implications (GAP-10) and asked whether the shapes were too; they were, so a Track could show a below-threshold confidence with no GATE-01 decision, or a GATE-04 decision on a vendor scored low. Both are now refused (the counterexample track-ungated-reading.trig exercises both and is checked in the test suite). The consensus oracle’s call must also carry the metric’s input matrix, so the recorded reading is recomputable (GAP-12; the previous chapter recomputes it).

One acknowledged judgment call sits in these shapes: the citation of final_output is conditional on the aggregate outcome. An executed run’s Track must cite the output it emitted; a noOp run’s Track cites none, because nothing crossed the boundary. That is a statement about a system boundary, not about the record. The Track is the record internal to the system of interest; final_output names an action output that crossed to an external system, through the assembly’s port result, the one place output leaves. Where that boundary sits depends on the system of interest, and zooming in or out changes what counts as inside; defining and enforcing such boundaries is part of why the Op is modeled as a SysML v2 assembly at all. For this example the adjudicator ruled the trace evidence internal and the written output external: noOp means no action output over the boundary, and an internal record that the Op tried, that policy prevented it, and why, is kept. Everything else about a stopped run, its readings, its gates, the stop and its escalation, is retained and checked exactly as for an executed run, and the next cell shows one. The conditional reading knowingly departs from the pinned draft’s unconditional include list, and the departure is stated in the shape messages themselves (GAP-07 in the open-questions chapter).

1A stopped run’s Track¶

track/run-002.trig records the pii-stop scenario from the worked examples as a Track: the privacy guard fails, GATE-03 fires, the stop obligation is discharged by an escalation service acting for an accountable privacy office (earl:automatic, with the accountable party named, per GAP-09), and the aggregate is noOp. The record retains the four oracle citations, the guard results, the gate decision, and the escalation, and it cites no final_output.

It retains one more thing. The summary cog had already produced an anomaly summary when the stop landed. That artifact is kept as a withheld output, an evidence entity the escalation refers to, so an auditor can see what would have gone out; it is never cited as final_output, which names only what crossed the boundary. A shape enforces the distinction, and the same shape refuses a Track that cites a withheld artifact as its output (a ruling on GAP-07, refined after the adjudicator’s own re-reading of this chapter).

Section 5.3 names five purposes a Track serves: auditability, governance, learning, debugging, and trust. On this substrate each one is a query Harris & Seaborne, 2013 over the run graph, not a reading exercise.

2Auditability¶

3Governance¶

Rows are violations; empty means every obligation raised by a fired Gate was discharged by a recorded action with a named accountable party. The same query catches the counterexample:

4Trust¶

The full outcome distribution, automatic and manual, with cantTell visible rather than absorbed:

5Learning¶

Directly from the quoted text: what the signals improve are Frames, Cogs, Ops, and Guards — the system’s constituents. Learning changes the system.

The rest of this section is the adjudicator’s interpretation, logged verbatim in the judgment record: learning is the ability to calibrate the system — change parameters, add or remove gates, switch policies when one is not producing the intended behavior — acting on the system so it can adapt, rather than within the system as currently constituted. This substrate keeps that adaptation surface explicit on purpose: every threshold is a single-point parameter, every gate is a declared unit whose addition or removal is a traceable model edit, and the disagreement policy is a deliberately unbound slot. The cell maps each signal this run left behind to the part of the system it acts on:

5.1A worked calibration¶

One of those responses, made concrete (a logged suggestion from the adjudicator, recorded in the judgment record): the RiskLevel enumeration carries an unknown value (GAP-01), and the committed gate binds on high alone, so an unknown-risk vendor obliges nothing. A conservative posture would treat unknown as high. That is a learning edit: one change at a declared point, and the system obliges something it previously did not. The committed policy stays exactly as adjudicated; the variant below exists only in this cell:

6Debugging¶

Directly from the quoted text: this purpose is about understanding why the Op failed or behaved unexpectedly. Read beside the Learning purpose above, the paper’s own words draw a clean division of labor: Debugging looks backward at whether the Op behaved as its declared specification says; Learning looks forward at whether the declared specification itself should change. (A related distinction — build it right versus build the right thing — is recorded in the judgment record as a logged suggestion from the adjudicator, available to raise with the author; it is not the paper’s usage.)

For each guard finding that did not pass: the recorded explanation and, where a gate evaluated an oracle-provided value on the strength of that finding, the cited call that produced the value — enough to reconstruct whether the Op did what the specification says:

7The interface: where every value came from¶

This purpose is not on the paper’s list; it is a consequence of a ruling logged as GAP-05. The policy applies to oracle-provided values and is never their provider, so for each variable a gate evaluated the Track must cite the call: what service, what payload was sent, what response code came back, and the response that carried the value. The numerical precision lives inside the oracles or in documented threshold rules; a reading nobody can source fails the shapes.