# Isis governed-generation workbenches — design

**Status:** current-state record, generated. **Not ratified** — see §12.

<!-- GENERATED FILE. Do not edit by hand.
     Regenerate: pnpm exec tsx scripts/v1-workbenches/generate-isis-design-doc.mts
     Verified byte-for-byte by `pnpm verify:inventory:v1-workbenches`. -->

This document answers I0.13 of `V1_DOMAIN_WORKBENCHES_TODOS_2026-07-23.md`. Its first child fixes the standard for all eleven sections: the current state must be **code-derived**. So every number and every list below is read out of a committed artifact under `evidence/v1-workbenches` when this file is generated, and §13 lists every one of those reads. A design document rots and a measurement does not: this one is checked byte-for-byte in CI, so a route that appears, a package that is retired or a gate that starts passing makes it stale **loudly** rather than quietly wrong.

Where a section's subject is a decision nobody has taken, it says so and names the cell that owns the decision. The document does not manufacture an authority it does not have.

## 1. Current state (I0.13.a)

**Source:** `evidence/v1-workbenches/isis-package-inventory.json`, `evidence/v1-workbenches/isis-page-inventory.json`, `evidence/v1-workbenches/isis-persistence-inventory.json`, `evidence/v1-workbenches/isis-route-register.json`.

Isis is **77 packages**, **26 operator SPA pages** and **24 declared persistence aggregates**. It is not one page and it is not one service, which is why every section below is keyed by *audience* and *host* rather than by feature.

### 1.1 Packages and their disposition

| Disposition | Packages |
| --- | --- |
| `refactor-candidate` | 4 |
| `retire-candidate` | 29 |
| `reuse` | 44 |

**29 packages have no consumer at all**: `@isis/3d-comfyui-nodes`, `@isis/3d-control`, `@isis/3d-scene-assembly`, `@isis/3d-semantic-editing`, `@isis/3d-video-diffusion` … (24 more). **2 have no test**: `@isis/anomaly-detection`, `@isis/comfyui-sdk`. A package with no consumer is not a reuse candidate however good its code is, so the disposition column and the consumer column are kept separate.

### 1.2 Pages, and the ones no route reaches

24 of 26 pages are routed. The unrouted ones are `JobSubmissionStudio`, `WorkflowControlBlendPanel` — built, tested, and unreachable. `evidence/v1-workbenches/isis-page-walkthrough.json` then asks the harder question, whether a routed page's API calls are *served*: of 127 distinct operations, **92 are built and unserved**, and only 1 of 4 client namespaces reaches the service it was written for. AN ENDPOINT THAT EXISTS AND ONE THAT ARRIVES ARE DIFFERENT CLAIMS.

### 1.3 Live, fixture, or dead

Page behaviour, measured by driving the surfaces rather than by reading them:

- `live`: 9 pages
- `not-configured`: 15 pages
- `partial`: 2 pages

Fixture mechanisms found: **0**. No surface here stands in a fixture for missing data; where a surface has none it returns a `not-configured` contract, which is the honest form and is counted as such above.

### 1.4 Contracts, jobs and providers

Contract paths: `generation`, `models`, `outputs`, `workflows`. **30 AI providers** are implemented, across 9 provider kinds (`anthropic`, `openai`, `google`, `xai`, `ollama`, `elevenlabs`, `runcomfy`, `civitai`, `runpod`). Endpoint modules: `dead-letter`, `health-monitor`, `queue-metrics`, `registry`, `router`, with 16 operator UI components over them.

The workflow job machine has 4 states (`DRAFT`, `PUBLISHED`, `DEPRECATED`, `ARCHIVED`) and 8 implemented transitions: `create`, `edit`, `activate`, `deprecate`, `archive`, `restore`, `version`, `publish`. Transitions intended and **not** implemented: `submit`, `review`, `approve`, `revoke`.

An endpoint's implemented lifecycle dimension is **health**, with 4 states (`healthy`, `degraded`, `unhealthy`, `unknown`). This matters for §6: the dispatch *model* derived in I1.3.b–e names a richer lifecycle including `disabled` (`unconfigured`, `configured`, `validating`, `ready`, `draining`, `maintenance`, `disabled`, `retired`), and **no enum in source implements it** — the only endpoint states the code has are the four health states above. A PROPOSED LIFECYCLE IS NOT A CONTROL: a reader who takes `disabled` from the model would conclude that an operator can disable a provider, and §6 records that nobody can.

## 2. Audience (I0.13.b)

**Source:** `evidence/v1-workbenches/isis-audience-capability-matrix.json`, `evidence/v1-workbenches/isis-tier-decision-rows.json`, `evidence/v1-workbenches/isis-curated-payload-leak.json`.

Four audiences: `operator-admin`, `aaa-creator`, `curated-creator`, `contemplative`. The boundary between them is the product, not a convenience: an operator may see a raw graph and a curated creator may not.

**6 distinct audience alphabets** exist in the estate and **2 of them cannot name every audience.** An alphabet that cannot say `contemplative` cannot deny it either, so a capability expressed in that alphabet has a hole where the narrowest audience should be.

The capability matrix is 42 capabilities × 4 audiences = 168 cells, with no blank cell (`noBlankCells: true`):

- `allow`: 96 cells
- `deny`: 68 cells
- `not-expressible`: 4 cells

`not-expressible` is a separate verdict from `deny` on purpose. **4 cells** are cases where the alphabet in force cannot state the audience, which is not the same as stating that it is refused.

### 2.1 Enforcement layers

3 layers are declared, and **1 has no producer**: `route`. A declared layer with nothing writing into it enforces nothing.

Operator endpoint scopes: `admin:*`, `admin:studio`, `admin:workspace:isis`, admitted by the rule `scope === 'admin:*' || scope.startsWith('admin:')`. 22 scopes were probed against it and 2 were elevated and still refused — so the rule is not a rubber stamp.

**1 contradiction** remains in the matrix. A contradiction names a pair of sources that disagree; it does not name a culprit, and resolving it is a decision (see §12).

## 3. Hosts and routes (I0.13.c)

**Source:** `evidence/v1-workbenches/isis-route-register.json`, `evidence/v1-workbenches/isis-route-dispositions.json`, `evidence/v1-workbenches/isis-operator-surface-matrix.json`.

Isis has four hosts, and they are not interchangeable:

- **Operator SPA** (`apps/isis/web`): 27 routes.
- **Oshun admin** (`apps/oshun/admin`): 9 Isis routes, 9 of them guarded by the workspace scope.
- **Oshun Studio** (`apps/oshun/web`): 88 Isis-segment routes.
- **BFF operator API** (`apps/oshun/bff/src/isis`): 77 modules.

### 3.1 The Studio boundary

The boundary authority is `libs/isis/entitlements/src/studio-boundary.ts`. Its allowlist is **empty** (`allowListEmpty: true`), and every one of the 88 Studio Isis routes is therefore blocked (`studioIsisAllBlocked: true`). AN EMPTY ALPHABET MEANS WHATEVER THE FIELD IT FEEDS MEANS: here it means "deny all", which is the safe reading, and it also means the allowlist has never been exercised.

Of the 87 blocked segments, **56 are undocumented** — blocked by an allowlist that names nothing and described by no cell: `account-protection`, `ai-video`, `ai-video-generation`, `analytics-and-reporting`, `anomaly-detection`, `artifact-detection`, `automated-quality-scoring`, `benchmarking` … (48 more). 31 AAA segments are documented.

### 3.2 Operator surface coverage

14 operator families are declared. Measured against them:

- Families whose every verdict is `not-configured`: `I0.18.a`, `I0.18.b`, `I0.18.c`, `I0.18.e`, `I0.18.f`, `I0.18.g`.
- Families with **no operator page**: `I0.18.h`, `I0.18.i`, `I0.18.j`, `I0.18.l`, `I0.18.m`.
- Families with **no operator API**: `I0.18.e`, `I0.18.f`, `I0.18.h`.
- BFF modules claimed by no family: 48 of 77.
- Operator SPA routes claimed by no family: 8.

**0 rows carry a page, an API and a verdict together.** A page with no API and an API with no page are different failures and neither is a working surface.

## 4. Data contracts, stores and retention (I0.13.d)

**Source:** `evidence/v1-workbenches/isis-asset-kind-registry.json`, `evidence/v1-workbenches/isis-schema-gap.json`, `evidence/v1-workbenches/isis-data-classification-matrix.json`, `evidence/v1-workbenches/isis-output-format-matrix.json`.

### 4.1 Asset kinds: seventeen enums and no taxonomy

11 asset kinds are named by the product requirements and **0 have a registry row**. 17 asset-kind enums exist in the estate and 1 is on the Isis surface; **there is no registry module at all**. The best overlap any single enum achieves with the required kinds is **6 of 11**. A NAME IS NOT THE THING IT NAMES: seventeen enumerations of asset kinds do not constitute a taxonomy, because none of them is authoritative for the others.

Kinds with no product contract: `image`, `portrait`, `texture`, `video`, `audio`, `foley`, `voice`, `mesh`, `rig`, `gaussian splat`, `composite scenes`. Asset families declaring a kind: **0 of 32**.

### 4.2 Stores

24 aggregates are declared in `libs/isis/database/prisma/schema.prisma`. There are, however, **two schema authorities**: that Prisma schema, and the raw SQL the deployed `apps/isis/output-registry` service issues at start-up. They resolve the same connection string and they do not agree on table names. §8.3 records what that costs.

Contract-to-column gaps, from the schema-gap sweep: **14 contracts** and **131 fields** checked; record types blocked on a missing tenancy column: `gate-verdict`, `release`, `run`, `stage`.

### 4.3 Retention and classification

7 data classes are named by the product requirements. **1 has no row in the canonical artifact register** (`I0.11.b`) and **4 have only part of one** (`I0.11.a`, `I0.11.c`, `I0.11.d`, `I0.11.f`). The Isis schema declares **0 classification columns** and **0 modules on the Isis path name a data-classification vocabulary**, while the estate declares 6 classification alphabets elsewhere. Every one of those is a ladder of sensitivity *values*; A SENSITIVITY LEVEL IS AN ANSWER AND THIS DOMAIN HAS NOT ASKED THE QUESTION.

Of 98 lifecycle cells (class × attribute), **30 are defined**, 14 cannot be started because the class has no register row at all, and 54 name an attribute the register has no field for.

### 4.4 Output and interchange formats

19 formats are declared; 17 use the shared artifact manifest, and **0 carry all ten required columns**. Columns carried by no format at all: `quality`, `downstreamIngest`, `authorizedHost`. Formats with no registry symbol: `I0.19.o`.

## 5. Services, APIs and contracts (I0.13.e)

**Source:** `evidence/v1-workbenches/isis-read-contracts.json`, `evidence/v1-workbenches/isis-endpoint-dispatch-model.json`, `evidence/v1-workbenches/isis-mutation-envelope.json`, `evidence/v1-workbenches/isis-read-authorization.json`.

### 5.1 Read contracts

Route dispositions across the swept globs: 

- `not-configured`: 8 routes
- `other`: 21 routes
- `reads-store`: 63 routes
- `static-context`: 42 routes

**47 contract dimensions are absent.** Every cell is classified and every dimension states its own duty (`everyCellIsClassified: true`, `everyDimensionStatesItsDuty: true`), so an absent dimension is a measured absence rather than an unexamined one.

Some dimensions are **not derivable from source** and say so rather than guessing: `pagination determinism`, `authorization behaviour`, `handler bodies past the next route registration`.

### 5.2 Query shapes and indexes

`evidence/v1-workbenches/isis-workload-catalog.json` derives the query workload from source. Every query has a shape and names a table (`everyQueryHasAShape: true`). Deep-page-risk queries: **1**. Unindexed filter hotspots: 8 tables; unindexed sort hotspots: 1. Cardinalities are **not derivable from source** and are recorded as such, not estimated.

## 6. Jobs, operations and emergency controls (I0.13.f)

**Source:** `evidence/v1-workbenches/isis-workflow-state-machine.json`, `evidence/v1-workbenches/isis-replay-execution.json`, `evidence/v1-workbenches/isis-emergency-controls.json`.

### 6.1 Emergency controls

A CONTROL IS A VERB, and the five required controls differ not in how complete each is but in what kind of thing each is:

| Control | Kind |
| --- | --- |
| model quarantine | `absent` |
| output recall | `operator-command` |
| provider disable | `absent` |
| spend kill switch | `frozen-literal` |
| workflow revoke | `absent` |

**1 of 5 is an operator command** (`output recall`); 3 are absent (`provider disable`, `workflow revoke`, `model quarantine`). Of 33 scope dimensions the requirements name, **2 are expressible**, and 18 cannot be measured at all because the control they would scope does not exist.

Two consequences are worth stating plainly because they are easy to misread as partial implementations rather than as different things:

- **The spend kill switch is not a switch.** Its evaluator returns an *armed* status and no field that could stop anything, and the curated-card flag is a frozen literal — assigning to it raises `Cannot assign to read only property`. A SWITCH THAT ONLY A DEPLOY CAN THROW IS NOT AN EMERGENCY CONTROL. The enforcement gate is correct and denies when the flag is set, so the gap is the switch and not the gate.
- **Provider disable is an automatic breaker.** It trips on consecutive failures, in process, with no operator trigger and no authority. AN AUTOMATIC BREAKER ANSWERS "IS IT FAILING" AND AN EMERGENCY CONTROL ANSWERS "STOP USING IT": a provider that is healthy and unsafe passes it.

Output recall, the one real command, cannot cascade: `takedownCascade: 'unavailable'`, and the output record carries no lineage field, so a dependent derivative is not merely unreached — it is unexpressible on the shape.

Two of the three absent controls are corroborated by artifacts that were not looking for them, which is the strongest form the evidence takes here. The workflow job machine's unimplemented transitions are `submit`, `review`, `approve`, `revoke` — `revoke` among them, measured independently of §6. And the endpoint dispatch model names a `disabled` state that no source enum implements (§1.4), so the one place `disabled` appears is a proposal.

A reverse dependency index exists (`evidence/v1-workbenches/blast-radius.json`) and **0 controls consult it**. No game-day artifact rehearses any of the five (`controlsWithARehearsal: 0`).

## 7. Workspace and UI (I0.13.g)

**Source:** `evidence/v1-workbenches/isis-page-inventory.json`, `evidence/v1-workbenches/isis-comparison-nonvisual.json`, `evidence/v1-workbenches/isis-continuity-presentation.json`.

The operator SPA is 26 pages; 20 use the Isis client and 15 use React Query. Roles:

- `apiParityMonitor`: 1
- `auditLogs`: 1
- `dashboard`: 1
- `featureFlags`: 1
- `jobs`: 2
- `models`: 3
- `outputs`: 5
- `providers`: 1
- `public`: 2
- `runpod`: 2
- `unrouted`: 2
- `workflows`: 5

Pages with no test: `LoginPage`, `NotFoundPage`, `UnauthorizedPage`, `WorkflowControlBlendPanel`, `WorkflowsPage`.

Non-visual alternatives are a product requirement for this domain, not an afterthought: an output that can only be judged by looking at it cannot be reviewed by everyone who has to review it. `evidence/v1-workbenches/isis-comparison-nonvisual.json` records what the comparison surfaces offer.

## 8. Trust: threats, safety, rights and provenance (I0.13.h)

**Source:** `evidence/v1-workbenches/isis-threat-mitigation-map.json`, `evidence/v1-workbenches/isis-data-classification-matrix.json`, `evidence/v1-workbenches/isis-provenance-recovery.json`, `evidence/v1-workbenches/isis-gate-lineage-plans.json`.

### 8.1 Threat model

10 threats are modelled. **9 have a control on the Isis path** (`brief injection`, `workflow injection`, `malicious graphs`, `model supply chain`, `unsafe media` … (4 more)); **1 is controlled only in another domain** (`training rights`), which means the estate has the control and this path does not call it; and **0 are mapped to a test id**, against a stated bar of "mitigations map to test IDs". 0 artifacts anywhere map a threat to a test. A CONTROL, A TEST, AND A MAPPING FAIL SEPARATELY, so "no unmapped high-risk scenario" is currently unevaluable rather than satisfied.

### 8.2 Data classification

See §4.3. The short form: the schema has no classification column, no module on this path names a classification vocabulary, and six of seven data classes have no complete row in the canonical register.

### 8.3 The subject-erasure path addresses a table nothing produces

This is the sharpest live defect in the current state, and it is a defect rather than an open decision. The account-deletion fan-out erases `generated_outputs` through the Isis Prisma client. Of the 24 models the schema declares, 6 have a producer among that client's consumers, and all of them are the `pipeline_state_*` family. The deployed output-registry writes its own raw-SQL tables on the same connection string, and the eraser and the service share **0 tables**. A zero-row erasure is indistinguishable from a subject who owned nothing, so the fan-out signs success. `apps/oshun/bff/src/isis/output-lineage-store.ts` already records the same boundary — "No production generation path writes those normalized tables" — so the estate contains its own answer and the erasure path did not read it.

Fixing it means either repointing a GDPR deletion path or re-plumbing a deployed service's storage. Both have blast radius across a signed-attestation contract, so it is recorded here and pinned by a ratchet test rather than changed silently.

## 9. Migration and rollout (I0.13.i)

**Source:** `evidence/v1-workbenches/isis-route-dispositions.json`, `evidence/v1-workbenches/isis-shared-package-gate.json`, `evidence/v1-workbenches/isis-promotion-transfer.json`, `evidence/v1-workbenches/isis-release-binding-probe.json`.

Migration here is mostly *disposition*: which of the four hosts owns a surface, and what happens to the copies. The route dispositions artifact carries that assignment, and the package inventory carries the library half — 29 retire candidates and 4 refactor candidates.

Two constraints bind every rollout step and both are measured elsewhere in this document: no Studio Isis route is reachable while the boundary allowlist is empty (§3.1), and the operator API is only *arriving* for one of four client namespaces (§1.2). A rollout plan that assumes either is already solved will report progress it has not made.

The rollout **cohorts, SLOs, support model and DR posture** that I0.13.i also asks for are decisions, not measurements. They are listed as open in §12 rather than drafted here.

## 10. Standards and environment (I0.13.i, continued)

Environment and standards conformance is measured outside this domain’s artifacts and is referenced rather than restated: see `evidence/v1-workbenches/isis-shared-package-gate.json` for the shared-vs-domain boundary and `evidence/v1-workbenches/isis-index-rationale.json` for the barrel policy.

## 11. Verification posture

1173 test files cover 77 packages and 20505 public symbols. That ratio is not a quality claim: §1.1 lists the packages with no test at all, and §1.2 lists the pages and operations that are built and unreachable. A test suite measures what it was pointed at.

## 12. Decision appendix (I0.13.j)

**Source:** `V1_DOMAIN_WORKBENCHES_TODOS_2026-07-23.md`.

Every Phase I cell whose own evidence bar names a decision, an approval or a ratification is listed below. All 29 are **open**: the cell is unchecked, so by construction no decision has been recorded. The `options` and `consequences` a decision record needs are held in the evidence artifacts this document cites; the **approver and the review are empty, and a generator cannot fill them in**. Recording an approver that does not exist is the exact failure this lane was built to catch, so the column is left blank rather than defaulted.

The **blocker** split is part of the record and not decoration. "decision appendix", "decision tests" and "threshold decision record" all contain the word *decision* and none of them is a decision anybody has to take — they are engineering work that happens to be about decisions. Mixing the two would make this table useless for the one thing it is for: knowing what is waiting on a person.

The rule is stated so it can be audited rather than trusted. Three signals: **(1)** the instruction's leading verb asks somebody to give something (`Obtain`, `Ratify`); **(2)** the bar names an authorization as its deliverable (approval, signoff, ratification, or a trailing "decision"); **(3)** the bar names an artifact (test, schema, matrix, ledger, record, policy, contract). Then `human-approval` = (1 or 2) and not 3; `engineering-artifact` = 3 and neither 1 nor 2; `both` = everything else. Boundary cases land in `both`, which is the safe direction: it says a person is probably needed and does not claim to know that engineering is finished.

### 12.1 Waiting on a named person (14)

| Cell | Bar | Subject |
| --- | --- | --- |
| `I0.6.h` | path check and domain-owner signoff | Reconcile every filesystem package to exactly one or more capability rows with no unclassified library. |
| `I0.7.f` | ratified ADR | Record the chosen decision, rejected options, consequences, compatibility, review date, and named architecture/Isis approval. |
| `I0.11` | privacy/security approval | Define data classification and retention for prompts, references, biometric embeddings, model artifacts, outputs, logs, and provenance. |
| `I0.12` | authority and blast-radius decisions | Define the operator emergency controls for provider disable, workflow revoke, model quarantine, output recall, and spend kill switch. |
| `I0.12.a` | provider control decision | Define provider disable scope by provider/endpoint/operation/ model/class/region/tenant/global, trigger, in-flight/queued behavior, fallback prohibiti |
| `I0.12.b` | workflow control decision | Define workflow revoke scope by template/version/class/audience/ host, future dispatch, active jobs, outputs/releases, cache, replacement, and restora |
| `I0.12.c` | quarantine decision | Define model quarantine scope by model/version/checkpoint/adapter/ LoRA, intake/evaluation/dispatch/training/outputs/derivatives, evidence, investigat |
| `I0.12.d` | recall decision | Define output recall scope by artifact/run/ingredient/model/ workflow/release/target, dependent derivatives, gallery/catalog/cache, notifications/tomb |
| `I0.12.e` | spend control decision | Define spend kill scope by actor/project/tenant/provider/model/ operation/resource/global, reservation/new dispatch/in-flight/retry/ queued behavior,  |
| `I8.4` | post-approval mutation invalidates approval | Lock approved release candidates to exact revisions and hashes. |
| `I9.19.c` | named decision | Obtain security/privacy decision over threat model, tests, findings/exceptions, data flows, retention, tenancy, biometrics, and incident readiness. |
| `I9.19.d` | named decisions | Obtain trust-and-safety/rights decision over child/identity/ voice/moderation/originality/consent/licenses/provenance/recall evidence. |
| `I9.19.e` | named decision | Obtain engineering decision over architecture, migrations, reliability/SLO, capacity/performance, operations/DR, tests, and known limitations. |
| `I9.20` | human signoff remains separate for operator, AAA, and curated surfaces | Obtain named product launch approval per audience and host. |

### 12.2 Waiting on a person AND on engineering work (10)

| Cell | Bar | Subject |
| --- | --- | --- |
| `I0.11.i` | approvals and data lifecycle tests | Obtain named privacy/security/safety/rights/domain approval and test enforcement against stores/providers/logs/exports/deletion. |
| `I0.13.k` | approval record and closed comment ledger | Run source link/schema/route/inventory/requirement consistency checks, obtain named reviews, resolve every comment, and ratify exact document revision |
| `I8.3.a` | signoff schemas | Define distinct signoff contracts for safety, rights/consent, identity, quality, brand/editorial, and technical/target dimensions with required eviden |
| `I8.4.c` | approval binding tests | Bind every review/signoff/exception/confirmation to the manifest digest and immutable candidate identity. |
| `I9.3.e` | ratified error-budget policy | Define error-budget consumption, release/rollout/freeze policy, exception authority, recovery criteria, and historical amendments. |
| `I9.19` | human approval records | Obtain named security/privacy, trust-and-safety, rights, and engineering approvals. |
| `I9.19.a` | approval matrix | Define each approver role/person, authority/scope, required packet sections, independence/conflict rules, decision options, conditions, and expiry. |
| `I9.19.b` | approval subject manifest | Freeze the exact commit/build/config/environment/host/audience/ capability/target readiness packet presented for approval. |
| `I9.19.f` | approval lifecycle tests | Record approve/reject/conditional/request-changes separately, bind conditions/exceptions/expiry, and invalidate on material subject or evidence change |
| `I9.20.c` | separate human approval records | Obtain a named authorized product decision independently for each cell rather than inheriting another audience/host’s signoff. |

### 12.3 Engineering work about decisions, not a decision (5)

| Cell | Bar | Subject |
| --- | --- | --- |
| `I0.13.j` | decision appendix | Record every product/architecture/security/privacy/safety/rights/ host/ownership/standard decision with options/evidence/rationale/ consequences/appro |
| `I1.8.g` | decision integration tests | Link selection/rejection/decision/rationale/evidence and preserve all considered members. |
| `I7.6.g` | decision tests | Implement select/reject/park/regenerate/comment decisions against exact revisions with stale/concurrent state handling. |
| `I8.3.d` | decision tests | Implement approve/reject/request-changes/abstain with immutable decision, rationale, conditions, and no cross-dimension authority. |
| `I9.6.f` | threshold decision record | Select fail/review/pass bands against ratified harm/cost criteria using threshold corpus only, then verify held-out performance. |

## 13. Source ledger and consistency checks (I0.13.k)

This document makes **123 distinct measured claims** drawn from **19 evidence artifacts**. Every claim is a dotted-path read that **throws when the path is absent**, so a field that moves breaks the build instead of interpolating `undefined` into a design document. Every repo path cited above is checked to exist. The whole file is compared byte-for-byte in `pnpm verify:inventory:v1-workbenches`.

| Artifact | Claims |
| --- | --- |
| `evidence/v1-workbenches/isis-asset-kind-registry.json` | 9 |
| `evidence/v1-workbenches/isis-audience-capability-matrix.json` | 14 |
| `evidence/v1-workbenches/isis-data-classification-matrix.json` | 14 |
| `evidence/v1-workbenches/isis-emergency-controls.json` | 10 |
| `evidence/v1-workbenches/isis-endpoint-dispatch-model.json` | 1 |
| `evidence/v1-workbenches/isis-endpoint-state-machine.json` | 6 |
| `evidence/v1-workbenches/isis-generation-controls.json` | 2 |
| `evidence/v1-workbenches/isis-operator-surface-matrix.json` | 8 |
| `evidence/v1-workbenches/isis-output-format-matrix.json` | 5 |
| `evidence/v1-workbenches/isis-package-inventory.json` | 6 |
| `evidence/v1-workbenches/isis-page-inventory.json` | 7 |
| `evidence/v1-workbenches/isis-page-walkthrough.json` | 6 |
| `evidence/v1-workbenches/isis-persistence-inventory.json` | 1 |
| `evidence/v1-workbenches/isis-read-contracts.json` | 5 |
| `evidence/v1-workbenches/isis-route-register.json` | 12 |
| `evidence/v1-workbenches/isis-schema-gap.json` | 3 |
| `evidence/v1-workbenches/isis-threat-mitigation-map.json` | 6 |
| `evidence/v1-workbenches/isis-workflow-state-machine.json` | 4 |
| `evidence/v1-workbenches/isis-workload-catalog.json` | 4 |

### 13.1 Coverage against each child, and what is still missing

Each of I0.13.a–k names a list of subjects. The table below says which sections answer it and **what the child asks for that this document does not contain**. The "missing" column is a judgment, stated here so it can be argued with; it is the reason every I0.13 cell is still unchecked, and it is the list a later pass has to close.

| Child | Answered in | Not yet contained |
| --- | --- | --- |
| `I0.13.a` | §1.1–§1.4, §11 | Component-level inventory below the page (§1.2 counts pages, not components); per-route current state lives in §3 rather than §1. |
| `I0.13.b` | §2, §2.1 | The forbidden-detail and forbidden-action lists per audience, and the approval matrix — both are decisions (I0.2.e, I0.2.g). |
| `I0.13.c` | §3, §3.1, §3.2 | Deep links, embeds, handoffs, proxies and redirects are not enumerated; migration from noncanonical surfaces is a disposition decision (I0.3.g). |
| `I0.13.d` | §4.1–§4.4 | Per-record migration plans, and the retention rules themselves — a policy choice (I0.11). |
| `I0.13.e` | §5.1, §5.2, §1.4 | Idempotency, concurrency, rate limits, error taxonomy, health and compatibility are not enumerated per API; events, bundles and publishers are absent. |
| `I0.13.f` | §6.1, §1.4 | Queue, worker, resource, cost, cancel, retry and checkpoint operations are not documented; only the emergency half is. |
| `I0.13.g` | §7 | Workspace hierarchy, responsive behaviour, states, localization and utility copy; the accessibility and non-visual alternatives are referenced, not documented. |
| `I0.13.h` | §8.1–§8.3, §4.3 | Safety/child/impersonation and rights/consent detail, gates and overrides, and the incident/recall runbook. |
| `I0.13.i` | §9, §10 | Rollback, deprecation/deletion, verification, cohorts, SLO, support and DR — all decisions rather than measurements. |
| `I0.13.j` | §12.1–§12.3 | The approver and the review for every entry. No generator can supply either. |
| `I0.13.k` | §13, §13.1, §13.2 | Named reviews, a resolved comment ledger, and a ratified revision. |

### 13.2 What is checked, and what is not

**Checked mechanically:** every artifact exists; every cited path inside it resolves; every repo path cited exists; the generated bytes match the committed bytes.

**Not checked, and not claimable:** I0.13.k also asks to "obtain named reviews, resolve every comment, and ratify exact document revision". No generator can obtain a review. This document is therefore **unratified**, and Phase I stands at 758 of 1583 cells checked. The absence of a ratification is stated here so that the presence of a thorough current-state section is not mistaken for approval of it.