Dependence and reversibility evals

Pass criteria

• A dependency record exists and names an owner
• It lists the dependent processes, roles, and systems
• It was reviewed within the stated review period, and the review is dated

Fail indicators

• No dependency record exists
• The record predates the system's current scope
• Dependents are listed by category rather than by name

Pass criteria

• Each of the three factors is measured and dated
• The score is recomputed when scope changes or on a stated cadence
• A threshold exists at which the score triggers review

Fail indicators

• Exposure is rated low, medium, or high with no factors behind it
• The score predates the most recent scope change
• No threshold connects the score to any action

Pass criteria

• A written rollback procedure exists and names its owner
• It was executed within the last review period
• Data and integrations survived the rollback without unrecoverable loss

Fail indicators

• Rollback has never been executed
• The procedure depends on a person who has left
• Rollback left downstream systems in an inconsistent state

Pass criteria

• The dependent process continued during the drill at a stated fraction of normal throughput
• The fraction and the sustainable duration are recorded
• Staff who ran the fallback are named and were available

Fail indicators

• The process stopped when the system did
• Throughput during withdrawal was not measured
• The fallback ran on overtime or on people borrowed from other functions

Pass criteria

• A named body holds the authority to withdraw or replace the system and has exercised comparable authority before
• At least one alternative is maintained to a stated readiness level
• People with the expertise to run the alternative are employed and identified

Fail indicators

• No one can say who could decide to withdraw
• The alternative exists only as a document
• The people who understood the prior process have left and were not replaced

Pass criteria

• A rehearsal was completed within the last twelve months
• Its findings are recorded and each has an owner
• Actions arising from the previous rehearsal were closed before the next

Fail indicators

• No rehearsal has been run, or the last one predates a major scope change
• Findings were recorded and not assigned
• The rehearsal was a tabletop exercise with no execution

Pass criteria

• Every retired alternative has a decision record naming the decision-maker
• The record states the effect on reversibility
• The dependency record was updated when the alternative was retired

Fail indicators

• Alternatives disappeared through budget or headcount changes with no decision
• The decision record does not mention reversibility
• The dependency record still lists alternatives that no longer exist

Pass criteria

• The required skills are listed
• Headcount holding each skill is tracked over time
• A floor exists below which retraining or hiring is triggered

Fail indicators

• No one knows how many people could still run the fallback
• The count has fallen since deployment and nothing was triggered
• Training for the fallback stopped when the system went live

Pass criteria

• Capacities to challenge, audit, replace, and withdraw are each listed
• Each capacity has a named owner and a last-verified date
• A capacity found to be degraded produced a recorded action

Fail indicators

• No preserved-capacities list exists
• Capacities are listed without owners
• A capacity has been verified as degraded and nothing happened

Pass criteria

• Each scope increase has an authorization decision
• The decision records the change in exposure score it accepted
• At least one proposed expansion was declined or deferred on dependence grounds, or the record explains why none has been

Fail indicators

• Scope tracks performance with no intervening decision
• Expansion decisions do not mention dependence or reversibility
• No expansion has ever been declined

Pass criteria

• Every capacity carries a last_exercised date or is explicitly marked as never exercised
• The record distinguishes capacities that have carried real work from those asserted on paper
• Each date is traceable to a drill log, incident record, or production run rather than to an attestation

Fail indicators

• Capacities are listed with no exercise history
• A never-exercised capacity is counted toward reversibility as though it were demonstrated
• Exercise dates are self-attested with no underlying log

Pass criteria

• Each capacity carries a change_since_last_assessment value of replenished, unchanged, or consumed
• A consumed value names the change that consumed the capacity
• The values are recorded per capacity rather than summarized as one figure for the deployment

Fail indicators

• Change is reported only as an overall reversibility rating
• A capacity that has visibly degraded is recorded as unchanged
• Depreciation is only detectable by diffing record versions by hand

Pass criteria

• Each lost capacity has a dated replenishment record or a dated narrowing of the authority it supported
• The choice between the two is recorded with its reasoning and its owner
• Authority narrowing is reflected in the grant record, not only in a meeting note

Fail indicators

• A capacity has been lost and authority continues unchanged
• Replenishment is planned but unscheduled and unfunded
• The lost status was removed from the record without either option

Pass criteria

• The evaluator is named separately from the executor for every consequential process
• Detection does not rest solely on instrumentation the executing provider supplies or controls
• The evaluator can report a finding the executing provider disputes, and has a route to do so

Fail indicators

• Detection depends entirely on the executing provider's telemetry
• The evaluating party is a function of the executing provider or reports through it
• No evaluator is named at all and instrumentation volume is offered as the answer