Skip to content

title: UCCA — Envelope Drift-Check Finding — the frozen v1 content schema is course-shaped doc_id: UCCA-ENVELOPE-DRIFT-FINDING-01 type: finding — load-bearing, escalated for a Tim ruling. Not fixed here (frozen + acked contract). layer: ground canonical: false status: CLOSED 2026-07-03 by ADR-0005 (Tim: "option 1 with the adapter rider"). authored: 2026-07-03 NYC (surfaced while wiring step 2, envelope crypto) relates_to: UCCA-ENGINE-LIVE-ORDER-01 §1 (mandated the purpose drift-check at this seam) · ucca-content-payload-schema-v1.json (FROZEN) · UCCA-CONTRACT-PACK-01 v1.0 · RTOPACKS-ACK-CONTRACT-PACK-01 · UCCA-FENCE-ADOPTION-01 (the two drift-checks) · ADR-0002 (gate neutrality) discipline: respond-never-redline on a frozen/acked contract. The engine conforms; it does not unilaterally reshape the client's contract. This is a finding, not an edit.

Envelope Drift-Check Finding — course-shape in the frozen v1 schema

CLOSED 2026-07-03 by ADR-0005 — Tim ruled option 1 with the adapter rider: the v1 content shape is the client's shape (ADAPTER, NOT GATE), knowingly signed under a provenance-only seal; the domain-neutral inner artefact (option 3) is the named direction, triggered by the second client or the diagnosis build, not before. No fence crossing; the frozen contract is untouched; the proof job is unblocked. The three options below are retained as the record of what was weighed.

The order predicted this. UCCA-ENGINE-LIVE-ORDER-01 §1: "Purpose: is anything being hashed/signed course-shaped — a fossil of the course-creation engine? … the envelope seam is its natural second hunting ground." Applied at the envelope seam while wiring step 2. It fired.

What fired

The signed envelope's content payload surface is ucca-content-payload-schema-v1.json (FROZEN). Its required top-level fields are:

ucca_code · source_code · title · description · learning_outcomes · modules · content_revision · content_changelog · artifacts · course_code

Of these, ucca_code, course_code, learning_outcomes, content_changelog, artifacts are course-creation-engine identifiers — the shape of a course, extracted from the CHCPRT025 course run the schema was derived from. The schema also sets additionalProperties: true at top level, which loosens the surface (course-isms like target_job/cultural_flavour could ride along if a future mapping stopped dropping them).

What is NOT wrong (so this is a shape finding, not a leak)

In the reasoner path there is no new leak: build_content_payload drops target_job/meta, no cultural_flavour is passed, and the actual envelope content is exactly the 10 frozen fields. Golden §8.1 confirmed the mapping is clean and schema-conformant against the real frozen bytes. The engine is conforming to its frozen contract — which is correct behaviour.

The finding is that the contract's shape itself is a course fossil, and signing bakes it into the immutable artefact permanently (the whole point of the envelope). ucca_code/course_code in particular read as the US-pivot course identifiers (e.g. UCCA-CARE-100-002), which is exactly the "AU units → US-biased courses" fossil the purpose drift-check names.

Why it is not fixed here

  • The schema is FROZEN (v1.0) and RTOpacks-acked (RTOPACKS-ACK-CONTRACT-PACK-01). Reshaping it is a contract change, which under the fence is relayed through Tim, not an engine build decision (respond-never-redline; the engine never redrafts a client's contract).
  • The engine assessment vocabulary is YES / NO / ADAPTER, NOT GATE. This is arguably an adapter concern (the course-shape is how the VET/course client wants its content object) — but that judgment, and whether v1.1 should neutralise the identifiers, is Tim's to rule.

The ruling this needs (options, not a recommendation the engine may take alone)

  1. Accept as-is for v1. The course-shape is the agreed v1 content object; the drift-check is noted and the fossil is knowingly signed. (Lowest friction; honest if the ack covered the shape.)
  2. v1.1 de-fossilise the identifiers — rename ucca_code/course_code to domain-neutral artefact IDs, tighten additionalProperties: false. A contract revision → a fence crossing → RTOpacks re-ack.
  3. Adapter split — keep v1 as the RTOpacks-world content shape, and treat the neutral engine artefact as a separate inner surface the world adapts. (Largest; most architecturally pure.)

Until ruled, the engine conforms to v1 as frozen — step 2 is built and green against it. Nothing is minted; no proof job has run. This finding blocks nothing mechanical; it blocks calling the course-shape resolved.