{
  "schema": "cognitiveliberties.private-inquiry-evidence-register-template.v1",
  "release": "1.19.0",
  "register_id": "NAV-CL-E001",
  "pathway_id": "NAV-CL-P001",
  "pathway_step_id": "NAV-CL-P001-S05",
  "audit_protocol_id": "AUDIT-CL-001",
  "authority_boundary": "This register is an operational crosswalk and template. It does not amend AUDIT-CL-001, does not replace any implementation kit, does not create a certification, and does not establish legal compliance or external-provider behavior without direct evidence.",
  "privacy_boundary": "Do not enter raw lawful queries, prompts, reading histories, drafts, inferred beliefs, sensitive-trait profiles, or person-level curiosity records. Record system controls, bounded observations, synthetic tests, policies, contracts, receipts, owners, limitations, and review events instead.",
  "critical_gate_rule": "A failed critical AUDIT-CL-001 domain must remain visible and blocks passing, certified, compliant, safe, or equivalent favorable summary language. It cannot be averaged away, hidden by unavailable evidence, or converted into a favorable composite score.",
  "status_vocabulary": [
    {
      "id": "NAV-CL-E001-S01",
      "value": "supported",
      "label": "Supported",
      "meaning": "The bounded claim is supported by identified evidence for the stated version, configuration, date, and scope.",
      "summary_rule": "May be described as supported only with provenance and limitations."
    },
    {
      "id": "NAV-CL-E001-S02",
      "value": "partially_supported",
      "label": "Partially supported",
      "meaning": "Some required evidence exists, but the claim is narrower, conditional, incomplete, or configuration-dependent.",
      "summary_rule": "State exactly which part remains unsupported or unknown."
    },
    {
      "id": "NAV-CL-E001-S03",
      "value": "unsupported",
      "label": "Unsupported",
      "meaning": "The available record does not establish the claim.",
      "summary_rule": "Do not restate the claim as fact."
    },
    {
      "id": "NAV-CL-E001-S04",
      "value": "contradicted",
      "label": "Contradicted",
      "meaning": "Available evidence conflicts with the claim for the documented scope.",
      "summary_rule": "Expose the contradiction and require remediation or a corrected claim."
    },
    {
      "id": "NAV-CL-E001-S05",
      "value": "unavailable",
      "label": "Evidence unavailable",
      "meaning": "Relevant evidence was requested or identified but could not be accessed, produced, or independently reviewed.",
      "summary_rule": "Unavailable is not equivalent to pass, fail, or not applicable."
    },
    {
      "id": "NAV-CL-E001-S06",
      "value": "not_applicable",
      "label": "Not applicable",
      "meaning": "The claim or control does not apply to the documented system boundary, with a written reason.",
      "summary_rule": "Name the exclusion and reopen it after boundary changes."
    },
    {
      "id": "NAV-CL-E001-S07",
      "value": "not_reviewed",
      "label": "Not reviewed",
      "meaning": "The item is in scope but has not yet received the required review.",
      "summary_rule": "Keep it open; do not infer a favorable result."
    }
  ],
  "evidence_areas": [
    {
      "id": "NAV-CL-E001-F01",
      "key": "provenance",
      "title": "Provenance",
      "purpose": "Make every material claim traceable to a source, observation, custodian, collection date, and integrity reference so a reviewer can distinguish evidence from assertion.",
      "privacy_limit": "Do not preserve raw lawful inquiries, named reading histories, prompts, drafts, or inferred beliefs merely to prove provenance. Prefer system-level records, bounded samples, synthetic tests, and redacted receipts.",
      "required_columns": [
        "record_id",
        "control_or_claim",
        "evidence_status",
        "evidence_tier_ids",
        "evidence_locator",
        "provenance_source",
        "provenance_custodian",
        "collected_on",
        "integrity_reference",
        "known_unknowns",
        "limitations"
      ],
      "audit_domain_ids": [
        "AUDIT-CL-D12",
        "AUDIT-CL-D14",
        "AUDIT-CL-D15",
        "AUDIT-CL-D18"
      ]
    },
    {
      "id": "NAV-CL-E001-F02",
      "key": "configuration_version_scope",
      "title": "Configuration and version scope",
      "purpose": "Bind findings to the exact system, model, release, configuration, region, account state, data flow, and test date that produced the evidence.",
      "privacy_limit": "Describe configuration and test conditions without embedding a person’s lawful inquiry history or exporting production cognitive dossiers.",
      "required_columns": [
        "system_or_process",
        "product_or_model_version",
        "build_or_release",
        "configuration_scope",
        "deployment_region_or_context",
        "test_account_state",
        "test_date",
        "data_flow_scope",
        "retention_scope",
        "known_unknowns",
        "limitations"
      ],
      "audit_domain_ids": [
        "AUDIT-CL-D01",
        "AUDIT-CL-D03",
        "AUDIT-CL-D04",
        "AUDIT-CL-D07",
        "AUDIT-CL-D08",
        "AUDIT-CL-D13",
        "AUDIT-CL-D18"
      ]
    },
    {
      "id": "NAV-CL-E001-F03",
      "key": "policy_authority",
      "title": "Policy authority",
      "purpose": "Identify the rule, decision body, approval date, scope, vendor obligation, exception, and sunset authority that governs the control being claimed.",
      "privacy_limit": "Authority records should govern data and power; they should not become a justification for collecting more inquiry content than the control requires.",
      "required_columns": [
        "policy_or_authority_title",
        "policy_or_authority_locator",
        "approving_body_or_role",
        "approval_date",
        "effective_date",
        "authority_scope",
        "vendor_clause_scope",
        "emergency_exception_scope",
        "sunset_or_expiry",
        "limitations"
      ],
      "audit_domain_ids": [
        "AUDIT-CL-D02",
        "AUDIT-CL-D06",
        "AUDIT-CL-D07",
        "AUDIT-CL-D08",
        "AUDIT-CL-D09",
        "AUDIT-CL-D10",
        "AUDIT-CL-D11",
        "AUDIT-CL-D14",
        "AUDIT-CL-D15"
      ]
    },
    {
      "id": "NAV-CL-E001-F04",
      "key": "deletion_evidence",
      "title": "Deletion evidence",
      "purpose": "Record what data or inference was deleted, under which rule, by which method, when deletion completed, how downstream copies were addressed, and what receipt or test supports the claim.",
      "privacy_limit": "A deletion record should prove control operation without retaining the deleted inquiry content inside the evidence register.",
      "required_columns": [
        "data_or_inference_class",
        "deletion_rule",
        "deletion_method",
        "deletion_completed_on",
        "deletion_verification_method",
        "downstream_deletion_status",
        "deletion_receipt_or_log",
        "exceptions_or_holds",
        "limitations"
      ],
      "audit_domain_ids": [
        "AUDIT-CL-D01",
        "AUDIT-CL-D04",
        "AUDIT-CL-D06",
        "AUDIT-CL-D07",
        "AUDIT-CL-D08",
        "AUDIT-CL-D16"
      ]
    },
    {
      "id": "NAV-CL-E001-F05",
      "key": "remediation_ownership",
      "title": "Remediation ownership",
      "purpose": "Give every finding an accountable owner, bounded corrective action, due date, retest method, challenge state, and closure evidence.",
      "privacy_limit": "Assign responsibility for systems and controls, not suspicion scores or labels attached to people because they asked lawful questions.",
      "required_columns": [
        "finding_or_issue_id",
        "remediation_owner_role",
        "remediation_action",
        "priority_or_gate",
        "due_date",
        "retest_method",
        "retest_date",
        "challenge_or_appeal_state",
        "closure_evidence_locator",
        "residual_risk",
        "limitations"
      ],
      "audit_domain_ids": [
        "AUDIT-CL-D05",
        "AUDIT-CL-D09",
        "AUDIT-CL-D10",
        "AUDIT-CL-D11",
        "AUDIT-CL-D13",
        "AUDIT-CL-D15",
        "AUDIT-CL-D16",
        "AUDIT-CL-D17"
      ]
    },
    {
      "id": "NAV-CL-E001-F06",
      "key": "incident_triggers",
      "title": "Incident triggers",
      "purpose": "Predefine the event, threshold, owner, containment action, affected evidence areas, notification duty, and re-audit scope that reopen the register after harm or material change.",
      "privacy_limit": "Incident response must target a defined failure or harmful event; it must not treat curiosity, privacy-tool use, or controversial lawful inquiry as an incident by itself.",
      "required_columns": [
        "incident_trigger",
        "trigger_threshold",
        "observed_on",
        "incident_owner_role",
        "containment_action",
        "affected_evidence_area_ids",
        "notification_or_notice_duty",
        "reaudit_scope",
        "incident_record_locator",
        "limitations"
      ],
      "audit_domain_ids": [
        "AUDIT-CL-D01",
        "AUDIT-CL-D02",
        "AUDIT-CL-D05",
        "AUDIT-CL-D06",
        "AUDIT-CL-D09",
        "AUDIT-CL-D10",
        "AUDIT-CL-D14",
        "AUDIT-CL-D15",
        "AUDIT-CL-D16",
        "AUDIT-CL-D18"
      ]
    },
    {
      "id": "NAV-CL-E001-F07",
      "key": "re_review_dates",
      "title": "Re-review dates",
      "purpose": "Preserve the last review, next review date, lifecycle assumptions, material-change triggers, monitoring owner, and supersession chain for every material claim.",
      "privacy_limit": "Review schedules should track controls, versions, authorities, and incidents—not maintain a longitudinal profile of what named people read or ask.",
      "required_columns": [
        "last_reviewed_on",
        "next_review_date",
        "review_cadence",
        "material_change_triggers",
        "lifecycle_assumptions",
        "monitoring_owner_role",
        "supersedes_record_id",
        "superseded_by_record_id",
        "review_outcome",
        "limitations"
      ],
      "audit_domain_ids": [
        "AUDIT-CL-D01",
        "AUDIT-CL-D02",
        "AUDIT-CL-D03",
        "AUDIT-CL-D04",
        "AUDIT-CL-D05",
        "AUDIT-CL-D06",
        "AUDIT-CL-D07",
        "AUDIT-CL-D08",
        "AUDIT-CL-D09",
        "AUDIT-CL-D10",
        "AUDIT-CL-D11",
        "AUDIT-CL-D12",
        "AUDIT-CL-D13",
        "AUDIT-CL-D14",
        "AUDIT-CL-D15",
        "AUDIT-CL-D16",
        "AUDIT-CL-D17",
        "AUDIT-CL-D18"
      ]
    }
  ],
  "kit_crosswalks": [
    {
      "id": "NAV-CL-E001-K01",
      "kit_id": "KIT-LIBRARIES-001",
      "all_evidence_area_ids": [
        "NAV-CL-E001-F01",
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F04",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ],
      "priority_evidence_area_ids": [
        "NAV-CL-E001-F01",
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F04",
        "NAV-CL-E001-F07"
      ],
      "integration_note": "Connect circulation, search, authentication, vendor, records, deletion, and challenge evidence to the library kit without retaining patron reading or inquiry histories."
    },
    {
      "id": "NAV-CL-E001-K02",
      "kit_id": "KIT-EDUCATION-001",
      "all_evidence_area_ids": [
        "NAV-CL-E001-F01",
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F04",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ],
      "priority_evidence_area_ids": [
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F06"
      ],
      "integration_note": "Connect student, educator, classroom, assessment, vendor, safeguarding, appeal, and incident evidence while preserving age- and power-sensitive limits."
    },
    {
      "id": "NAV-CL-E001-K03",
      "kit_id": "KIT-JOURNALISM-001",
      "all_evidence_area_ids": [
        "NAV-CL-E001-F01",
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F04",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ],
      "priority_evidence_area_ids": [
        "NAV-CL-E001-F01",
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ],
      "integration_note": "Connect newsroom, source-protection, exile-media, publication, archive, operational-security, and continuity evidence without exposing source or research trails."
    },
    {
      "id": "NAV-CL-E001-K04",
      "kit_id": "KIT-PUBLIC-INTEREST-TECH-001",
      "all_evidence_area_ids": [
        "NAV-CL-E001-F01",
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F04",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ],
      "priority_evidence_area_ids": [
        "NAV-CL-E001-F01",
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F07"
      ],
      "integration_note": "Connect architecture, model and dependency versions, tests, remediation ownership, reproducibility, and lifecycle evidence to public-interest technology delivery."
    },
    {
      "id": "NAV-CL-E001-K05",
      "kit_id": "KIT-PUBLIC-INSTITUTIONS-001",
      "all_evidence_area_ids": [
        "NAV-CL-E001-F01",
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F04",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ],
      "priority_evidence_area_ids": [
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F04",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F06"
      ],
      "integration_note": "Connect legal authority, procurement, records duties, deletion, due process, emergency powers, remediation, and public accountability to institutional operations."
    }
  ],
  "audit_domain_crosswalks": [
    {
      "id": "NAV-CL-E001-D01",
      "audit_domain_id": "AUDIT-CL-D01",
      "evidence_area_ids": [
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F04",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D02",
      "audit_domain_id": "AUDIT-CL-D02",
      "evidence_area_ids": [
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D03",
      "audit_domain_id": "AUDIT-CL-D03",
      "evidence_area_ids": [
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D04",
      "audit_domain_id": "AUDIT-CL-D04",
      "evidence_area_ids": [
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F04",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D05",
      "audit_domain_id": "AUDIT-CL-D05",
      "evidence_area_ids": [
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D06",
      "audit_domain_id": "AUDIT-CL-D06",
      "evidence_area_ids": [
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F04",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D07",
      "audit_domain_id": "AUDIT-CL-D07",
      "evidence_area_ids": [
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F04",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D08",
      "audit_domain_id": "AUDIT-CL-D08",
      "evidence_area_ids": [
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F04",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D09",
      "audit_domain_id": "AUDIT-CL-D09",
      "evidence_area_ids": [
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D10",
      "audit_domain_id": "AUDIT-CL-D10",
      "evidence_area_ids": [
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D11",
      "audit_domain_id": "AUDIT-CL-D11",
      "evidence_area_ids": [
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D12",
      "audit_domain_id": "AUDIT-CL-D12",
      "evidence_area_ids": [
        "NAV-CL-E001-F01",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D13",
      "audit_domain_id": "AUDIT-CL-D13",
      "evidence_area_ids": [
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D14",
      "audit_domain_id": "AUDIT-CL-D14",
      "evidence_area_ids": [
        "NAV-CL-E001-F01",
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D15",
      "audit_domain_id": "AUDIT-CL-D15",
      "evidence_area_ids": [
        "NAV-CL-E001-F01",
        "NAV-CL-E001-F03",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D16",
      "audit_domain_id": "AUDIT-CL-D16",
      "evidence_area_ids": [
        "NAV-CL-E001-F04",
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D17",
      "audit_domain_id": "AUDIT-CL-D17",
      "evidence_area_ids": [
        "NAV-CL-E001-F05",
        "NAV-CL-E001-F07"
      ]
    },
    {
      "id": "NAV-CL-E001-D18",
      "audit_domain_id": "AUDIT-CL-D18",
      "evidence_area_ids": [
        "NAV-CL-E001-F01",
        "NAV-CL-E001-F02",
        "NAV-CL-E001-F06",
        "NAV-CL-E001-F07"
      ]
    }
  ],
  "template_columns": [
    "record_id",
    "register_id",
    "evidence_area_id",
    "control_or_claim",
    "evidence_status",
    "evidence_tier_ids",
    "audit_domain_ids",
    "kit_ids",
    "evidence_locator",
    "public_summary_locator",
    "provenance_source",
    "provenance_custodian",
    "collected_on",
    "integrity_reference",
    "system_or_process",
    "product_or_model_version",
    "build_or_release",
    "configuration_scope",
    "deployment_region_or_context",
    "test_account_state",
    "test_date",
    "data_flow_scope",
    "retention_scope",
    "policy_or_authority_title",
    "policy_or_authority_locator",
    "approving_body_or_role",
    "approval_date",
    "effective_date",
    "authority_scope",
    "vendor_clause_scope",
    "emergency_exception_scope",
    "sunset_or_expiry",
    "data_or_inference_class",
    "deletion_rule",
    "deletion_method",
    "deletion_completed_on",
    "deletion_verification_method",
    "downstream_deletion_status",
    "deletion_receipt_or_log",
    "exceptions_or_holds",
    "finding_or_issue_id",
    "remediation_owner_role",
    "remediation_action",
    "priority_or_gate",
    "due_date",
    "retest_method",
    "retest_date",
    "challenge_or_appeal_state",
    "closure_evidence_locator",
    "residual_risk",
    "incident_trigger",
    "trigger_threshold",
    "observed_on",
    "incident_owner_role",
    "containment_action",
    "affected_evidence_area_ids",
    "notification_or_notice_duty",
    "reaudit_scope",
    "incident_record_locator",
    "last_reviewed_on",
    "next_review_date",
    "review_cadence",
    "material_change_triggers",
    "lifecycle_assumptions",
    "monitoring_owner_role",
    "supersedes_record_id",
    "superseded_by_record_id",
    "review_outcome",
    "confidentiality_basis",
    "known_unknowns",
    "unavailable_evidence",
    "critical_gate_failures",
    "limitations",
    "prepared_by_role",
    "last_updated"
  ],
  "template_record": {
    "record_id": "PLACEHOLDER-DELETE-BEFORE-USE",
    "register_id": "NAV-CL-E001",
    "evidence_area_id": "NAV-CL-E001-F01",
    "control_or_claim": "[Describe one bounded control or claim]",
    "evidence_status": "not_reviewed",
    "evidence_tier_ids": "[AUDIT-E01..AUDIT-E08 as applicable]",
    "audit_domain_ids": "[AUDIT-CL-D## separated by |]",
    "kit_ids": "[KIT-* separated by |]",
    "evidence_locator": "",
    "public_summary_locator": "",
    "provenance_source": "",
    "provenance_custodian": "",
    "collected_on": "",
    "integrity_reference": "",
    "system_or_process": "",
    "product_or_model_version": "",
    "build_or_release": "",
    "configuration_scope": "",
    "deployment_region_or_context": "",
    "test_account_state": "",
    "test_date": "",
    "data_flow_scope": "",
    "retention_scope": "",
    "policy_or_authority_title": "",
    "policy_or_authority_locator": "",
    "approving_body_or_role": "",
    "approval_date": "",
    "effective_date": "",
    "authority_scope": "",
    "vendor_clause_scope": "",
    "emergency_exception_scope": "",
    "sunset_or_expiry": "",
    "data_or_inference_class": "",
    "deletion_rule": "",
    "deletion_method": "",
    "deletion_completed_on": "",
    "deletion_verification_method": "",
    "downstream_deletion_status": "",
    "deletion_receipt_or_log": "",
    "exceptions_or_holds": "",
    "finding_or_issue_id": "",
    "remediation_owner_role": "",
    "remediation_action": "",
    "priority_or_gate": "",
    "due_date": "",
    "retest_method": "",
    "retest_date": "",
    "challenge_or_appeal_state": "",
    "closure_evidence_locator": "",
    "residual_risk": "",
    "incident_trigger": "",
    "trigger_threshold": "",
    "observed_on": "",
    "incident_owner_role": "",
    "containment_action": "",
    "affected_evidence_area_ids": "",
    "notification_or_notice_duty": "",
    "reaudit_scope": "",
    "incident_record_locator": "",
    "last_reviewed_on": "",
    "next_review_date": "YYYY-MM-DD",
    "review_cadence": "",
    "material_change_triggers": "",
    "lifecycle_assumptions": "",
    "monitoring_owner_role": "",
    "supersedes_record_id": "",
    "superseded_by_record_id": "",
    "review_outcome": "",
    "confidentiality_basis": "",
    "known_unknowns": "[State unresolved questions]",
    "unavailable_evidence": "[State requested but unavailable evidence]",
    "critical_gate_failures": "[List failed critical domain IDs or write none established]",
    "limitations": "[State scope and limits]",
    "prepared_by_role": "[Role, not unnecessary personal data]",
    "last_updated": "YYYY-MM-DD"
  },
  "records": [],
  "recording_instruction": "Copy template_record into records once per bounded control or claim. Preserve unknowns, unavailable evidence, limitations, critical-gate failures, and supersession links. Do not enter raw private inquiry content."
}