# Concerted Engineering: evidence and adoption governance

[claim:CE-GOV-01] Spec 0.3.1-draft.1 · Experimental · Field exit criteria pending

[claim:CE-GOV-01] This reference is generated from the canonical bundle. Default thresholds and synthetic exercises are E0, not observed pilot results. Download the [portable specification](/downloads/concerted-engineering-spec.zip) for schemas, data files, the reconciliation ADR and unfilled adoption templates.

## Tenets

- [claim:CE-GOV-01] Begin with a measurable customer or explicitly bounded research problem.
- [claim:CE-GOV-01] Maintain one authoritative accepted revision of intent; preserve superseded history.
- [claim:CE-GOV-01] Separate desired outcomes and hard invariants from implementation instructions.
- [claim:CE-GOV-01] Grant the smallest necessary, expiring execution authority.
- [claim:CE-GOV-01] Generation cannot control protected verification policy, evidence signing or admission.
- [claim:CE-GOV-01] Evidence applies only to the exact artifact and governing revisions assessed.
- [claim:CE-GOV-01] Material change invalidates affected plans and evidence.
- [claim:CE-GOV-01] Prefer reversible decisions and progressive exposure.
- [claim:CE-GOV-01] Every contract, signal and exception has a named accountable human owner.
- [claim:CE-GOV-01] Measure verified customer outcomes and total system cost, not generated activity.
- [claim:CE-GOV-01] Production observation is part of verification.
- [claim:CE-GOV-01] Exceptions are explicit, scoped, temporary, recorded and independently reviewed.

## Evidence ladder

| Level | Label | Meaning |
| --- | --- | --- |
| [claim:CE-GOV-01] E0 | Illustrative / design default | Synthetic scenarios, proposed thresholds and observation windows; never observed results. |
| [claim:CE-GOV-01] E1 | Anecdote | Attributed account without a standardized baseline; consent required. |
| [claim:CE-GOV-01] E2 | Observed | Recorded baseline and before/after measurement; no control, no causal claim. |
| [claim:CE-GOV-01] E3 | Controlled | Preregistered matched or randomized/staggered comparison; state design and causal limits. |
| [claim:CE-GOV-01] X | External | Third-party study; cite the primary source and its causal limits. |

[claim:CE-GOV-01] A level identifies provenance, not a quality score. E3 is not an automatic causal guarantee. Named testimony requires written consent and a data sheet. Conflicting anecdotes open an investigation; they do not override measured results. Dates, identifiers, formula constants and reading estimates are metadata/definitions, not outcome evidence. Quantitative editorial claims and defaults carry visible labels and are checked before publication.

## Canonical roles

| Responsibility | Owns |
| --- | --- |
| [claim:CE-GOV-01] Product Manager | Customer intent and outcome hypotheses; a named delegate may fulfill the responsibility. |
| [claim:CE-GOV-01] Software Engineer | Bounded implementation and routine reversible decisions. |
| [claim:CE-GOV-01] Verification Owner | Independent acceptance oracles, required evidence and substantiated release blocks. |
| [claim:CE-GOV-01] Principal Engineer | Architecture, cross-boundary decisions and first arbitration. |
| [claim:CE-GOV-01] Engineering Leader | Capacity, incentives, escalation and funded verification. |
| [claim:CE-GOV-01] Agent | Scoped delegated work; no self-admission or policy authority. |
| [claim:CE-GOV-01] Stakeholder | Customer evidence, domain constraints and outcome interpretation. |
| [claim:CE-GOV-01] Operations Owner | Independent production admission, exposure, halt and recovery. |

## Analogy sidebar

| Plain responsibility | Optional metaphor |
| --- | --- |
| [claim:CE-GOV-01] Product Manager | Conductor of customer intent |
| [claim:CE-GOV-01] Software Engineer | Performer |
| [claim:CE-GOV-01] Verification Owner | Independent listener |
| [claim:CE-GOV-01] Principal Engineer | Section lead |
| [claim:CE-GOV-01] Engineering Leader | Ensemble leader |
| [claim:CE-GOV-01] Agent | Assisted performer |
| [claim:CE-GOV-01] Stakeholder | Audience |
| [claim:CE-GOV-01] Operations Owner | Live sound and recovery |

[claim:CE-GOV-01] These metaphors are explanatory only. They confer no permissions, job titles or ceremonies. The Operations Owner remains explicit to preserve separate admission and recovery.

## Risk tiers

| Tier | Eligibility | Records and assurance | Effort / approval |
| --- | --- | --- | --- |
| [claim:CE-GOV-01] T0 — Routine low impact | Reversible, no runtime/security/data/API/dependency behavior change; never classify by diff size alone. | Intent: Parent accepted intent/ticket plus exact references. Execution: Inherited approved repository policy. Evidence: Protected standard checks and current bindings. ADR: Only if a significant decision changes | E0 default: no additional bespoke form; actual effort is measured, never assumed zero. Human-confirmed eligibility under an approved routine policy |
| [E0] [claim:CE-GOV-01] T1 — Bounded reversible | Single service, recoverable in one deploy, no material data/API/auth boundary change. | Intent: Problem, behavior/invariants, outcome window, risk/tier and owner; inherit exact references. Execution: Accepted service profile plus narrow scope delta. Evidence: Default checks plus independent targeted oracle. ADR: Only if a significant decision changes | E0 default: 15 minutes active authoring; two weekly overruns trigger simplification review. Named engineer within preapproved delegation; no standing meeting |
| [E0] [claim:CE-GOV-01] T2 — Material coordinated change | Customer-visible behavior, multiple services, schema/API effects, or changed important assumptions. | Intent: Full record plus customer announcement and FAQ. Execution: Explicit permissions, limits, rollback and owner. Evidence: Independent owner-approved oracles, diverse methods and rollout stops. ADR: For new or changed significant decisions | E0 default: 2 hours authoring, excluding assurance work; re-register locally. Human tier confirmation and affected owners |
| [claim:CE-GOV-01] T3 — High consequence | Irreversible migration/deletion, removed public API, security boundary or hard-to-recover effect. | Intent: Full record, customer announcement/FAQ and narrative risk memo. Execution: T2 plus demonstrated recovery or explicit irreversible-effect constraints. Evidence: Independent cross-team expert review, sandbox fault exercise and approved risk controls. ADR: Principal-reviewed decision record for the significant decision | Assurance-driven; no time target overrides a required check. Human tier confirmation, Principal Engineer and independent risk/admission owners |

[claim:CE-GOV-01] [E0] Budget defaults are planning probes. Register local values before intervention; a 10% contract cost-share ceiling or two weekly T1 budget overruns can trigger stop-and-refine, never permission to skip a required check. Measure actual T0 effort. A dependency bump or one-line authorization change may require a higher tier.

## Decision rights

| Decision | Decides | Consulted | Informed |
| --- | --- | --- | --- |
| [claim:CE-GOV-01] Intent approval | Product Manager and accountable engineering owner | Verification Owner; Stakeholder | Operations Owner |
| [claim:CE-GOV-01] Tier assignment | Delegated Software Engineer for T0/T1; human affected owners for T2/T3 | Principal Engineer; Verification Owner | Operations Owner |
| [claim:CE-GOV-01] Scope expansion | Execution owner with affected Intent/risk owners | Verification Owner; Operations Owner | Engineering Leader |
| [claim:CE-GOV-01] Evidence policy change | Verification Owner plus separate risk owner; no self-approval | Principal Engineer; Operations Owner | Product Manager; Software Engineer |
| [claim:CE-GOV-01] Release admission | Independent Operations Owner / protected service identity | Verification Owner | Product Manager; Engineering Leader |
| [claim:CE-GOV-01] Halt and rollback | Named Operations/incident owner under preapproved recovery policy | Verification Owner; Software Engineer | Engineering Leader; Stakeholder |
| [claim:CE-GOV-01] ADR supersession | Accountable decision owner; Principal review for T3 | Affected owners; recorded dissenters | Engineering Leader |

[claim:CE-GOV-01] [E0] Proposed arbitration clocks: Principal Engineer within one business day, then Engineering Leader within two. Use a short memo with both positions and current evidence. A missed deadline escalates resources/priority, never automatic approval. A clause-based block names failed/missing evidence; credible new risk can create a temporary safety hold and urgent amendment. Disagree-and-commit remains within current permissions and hard constraints; record dissent in the ADR.

## Maturity ladder

| Level | Agents may | Exit conditions |
| --- | --- | --- |
| [claim:CE-GOV-01] L0 — Assisted | Agents suggest; humans commit. Human/mentor-authored invariants. | Named service owner/runbook, working CI, recorded baseline and explicit risk requirements. |
| [claim:CE-GOV-01] L1 — Supervised | Sandbox PRs; human review and admission. Mentor-owned evidence. | Demonstrated denied effects, risk-appropriate check adequacy, recovery exercise and stable safety window. |
| [claim:CE-GOV-01] L2 — Bounded | Enforced scopes; human review of diffs and independently collected evidence. | Seeded-defect catch floor and overhead budget met with declared sample/coverage; no unresolved hard gap. |
| [claim:CE-GOV-01] L3 — Concerted | Pull within accepted priorities and finite delegations; protected admission remains separate. | Sustained preregistered guardrails for an agreed period; regression revokes autonomy. |

[claim:CE-GOV-01] Thresholds and observation windows are preregistered per service; a green CI rate or mutation percentage alone cannot authorize advancement. Pair assisted/supervised teams with a named mentor. Revoke autonomy when guardrails regress.

## Measurement and review mechanisms

[claim:CE-GOV-01] Every metric card has a type, owner, formula, sources, cadence, paired counter-metrics and anti-gaming rules. Weekly reviews prioritize inputs and guardrails; output trends are read monthly or at their registered horizon. Use the same dashboard order: integrity/coverage, safety, waiting, contract/rework effort, check adequacy, investigations/action closure. Unexplained variance opens a ticket with one owner/date. No individual performance or compensation use; add newly found gaming vectors to the card.

[claim:CE-GOV-01] [E0] The historical dry-run target is at least 80% of registered cards with reproducible sources. No historical dataset is supplied; coverage is currently unknown, not a passing result. Session tools record start/pause/resume/done events without content/keystroke capture and expose incomplete work and idle/coverage limitations. Protect ledgers, suppress small survey groups and retain correction provenance.

## Drift and verifier calibration

[claim:CE-GOV-01] The reference helper compares open changes with an accepted snapshot and identifies invariants lacking check links. Integrate it into a protected CI/nightly job before claiming enforcement; the package has no installed service integration. Semantic coverage, policy provenance and protected reuse approval remain human/runtime responsibilities.

[claim:CE-GOV-01] [E0] Review a record without linked work after a locally registered stale window, starting at 60 days; review is not automatic archive. Calibrate a verifier with realistic sandboxed seeded defects monthly and cross-team T3 reviewers quarterly as planning defaults. Publish seed denominators, clean controls, false positives, surviving defects and configuration versions. Loss of the registered catch floor suspends that configuration until fixed; it does not transfer release authority to the generator.

[claim:CE-GOV-01] The [synthetic exercise report](/downloads/concerted-engineering-spec/seeded-defects-E0.json) exposes caught and missed expiry defects. This is E0 demonstration evidence only, not independent organizational validation or a production verifier catch rate. Real auth/race/data-loss faults, protected signer/runner checks, recovery game days and incident actions remain required pilot work.

## Pilot protocol and templates

[claim:CE-GOV-01] [E0] Start with at least four weeks of comparable baseline observation as a planning default, then preregister hypotheses, primary translation-share metric, counter-metrics, sample/precision, analysis, comparison and stops before day 1. A day-1 pre-mortem records the top five failure risks. Weekly input reviews, a monthly written memo and a day-90 expand/refine/stop memo are defaults; follow each release through its registered horizon and longer maintenance windows.

[claim:CE-GOV-01] The package contains working-backwards, preregistration, data-sheet and review/decision templates. All are unfilled; role assignments require named humans before the pilot. Publish authorized null/negative findings and guardrail activations. A real observed report requires consent, source queries and an evidence-level review.

## Workstream ownership and completion

| Workstream | Accountable duty to assign | Exit evidence / current status |
| --- | --- | --- |
| [claim:CE-GOV-01] Evidence integrity | Method author | Removed unsupported testimony; labels and build lint. Consent/data sheets await real results. |
| [claim:CE-GOV-01] Specification/change control | Spec owner | One source, generated package, reconciliation ADR and drift checks; external review pending. |
| [claim:CE-GOV-01] Metrics and overhead | Metrics owner | Cards and timestamp/coverage tools; historical dry run and weekly measured cost pending. |
| [claim:CE-GOV-01] Protected tooling/drift | Tooling owner | Local schema/reference/drift tests; pilot write protection, revision gate and nightly execution pending. |
| [claim:CE-GOV-01] Verification | Verification owner | E0 seeded exercise only; representative calibration, game day and protected-runtime denials pending. |
| [claim:CE-GOV-01] Pilot and publication | Pilot lead | Templates and protocol; named team, registration, E2+ report and field exit criteria pending. |

[claim:CE-GOV-01] One named human must accept each workstream before execution. This table assigns duties, not fictional appointments. The mock announcement supplies adopter outcomes to trace against each workstream. The overall remediation exit is not complete: the real baseline, installed controls, overhead/verification measurements and an authorized E2+ pilot with null results remain absent.

## Incremental learning and projection lineage

[claim:CE-GOV-01] Reduce unmanaged divergence, not useful translation. Audience-specific documents remain purposeful projections of shared, versioned content. Learning stages S0–S4 describe literacy and integration, not authority. They are distinct from readiness L0–L3 and risk T0–T3. Keep baseline, safety and cost collection from the start; all applicable release requirements remain mandatory. See the [field guide](https://concertedengineering.com/implementation/#incremental-adoption-without-weaker-release-gates) and [projection registry](https://concertedengineering.com/implementation/#projection-registry-and-contract-lint).

## Licensing and commercial disclosure

[claim:CE-GOV-01] Dr. Joel He, OpenKedge founder, authors the method. OpenKedge develops KedgeFlow, a related product; its existence does not demonstrate full profile conformance or validate outcomes. No product or paid service is required. Original spec/data/schemas/templates in the package use [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/); original reference code uses [MIT](https://opensource.org/license/mit). Third-party material, marks and the rest of either site retain their terms. Self-citations are marked in the essay references. External practitioner co-review is invited but has not occurred.