Governance
A dataset generation is admitted, not written.
Changing the public dataset requires a proposal against a named base, independent approvals up to a threshold, and a receipt. Every document is signed and hash-linked to the one before it.
The chain
- 1proposalproposed against a named base manifest
- 2reviewtwo independent approvals
- 3promotionreceipt issued at threshold
- 4manifestgeneration 2 becomes public
- 5citationcitable, with its own hash
Proposal
- proposal_id
proposal:mmrf-schema-v09- purpose
- Add a public derived wheel30_class column while preserving L0-only safety and full shard provenance.
- migration profile
MMRF-SCHEMA-0.8-TO-0.9- base manifest
85a884be5c88359357852619…- candidate manifest
73015c5329ae71900ef3f4ac…- proposal sha256
2bb5d20ee32708de87b0462fb48173c90caf80c1024bcdf012229c4dc2ca2c6d
The proposal declares its own safety classification, and every cryptanalytic capability is declared false in the document itself — not in a policy page that the code never reads.
classificationL0_PUBLIC_MATH
source_factor_relationsfalse
rsa_target_endpointfalse
factor_candidate_endpointfalse
range_narrowing_endpointfalse
exact_prime_list_endpointfalse
raw_factor_exportfalse
Reviews
2 of 2 required approvals, from reviewers with different remits — one checking the mathematics, one checking the safety boundary.
reviewer_mathAPPROVE
- wheel30_class is a deterministic function of residue_30
- logical content CIDs replay identically
726e3dfa89eb113915f965d1…reviewer_securityAPPROVE
- no source-factor relations
- all cryptanalytic endpoints remain disabled
492e3eaf3053e2a817b09b28…Promotion receipt
- promotion_id
promotion:d382373c-b8c2-4ea9-9f6e-cb8b2762ff5f- approvals
- 2 / 2
- promoted at
- 2026-07-29 13:59:44 UTC
- receipt sha256
6ad7c85305f45cef095f72eb55ae9f097d9a70388615e5f609fbb83f024c0658
Provenance graph
8 nodes, 8 edges. Each node is a content hash, so the graph can be checked against the documents rather than believed.
| Node | Type | Content sha256 |
|---|---|---|
manifest:v08 | dataset manifest | 85a884be5c8835935785… |
manifest:v09 | dataset manifest | 73015c5329ae71900ef3… |
migration:08-to-09 | schema migration | 14c5f7d50852313a2a61… |
promotion:v09 | promotion receipt | 6ad7c85305f45cef095f… |
proposal:v09 | dataset proposal | 2bb5d20ee32708de87b0… |
review:math | dataset review | 726e3dfa89eb113915f9… |
review:security | dataset review | 492e3eaf3053e2a817b0… |
workflow:v08-baseline | workflow run | e872be3d0627da0aaeee… |
What governance does not cover
- Reviewers approve a schema change; they do not vote on whether the safety boundary applies. The forbidden fields are enforced in code, ahead of the data layer, and are not a governance parameter.
- Controlled datasets never enter this site, so no promotion path leads from them to a public page.
- A promotion admits a new generation. It never edits an existing one — the prior manifest hash stays valid forever.