The Principia Machina/TPS/5.18 The scorecard

Instruction artifact, machine-optimized text: TPS 0.1.0, section 5.18 The scorecard. Part of TPS 0.1.0 and the TPM hub. Human-only edit (TPS 5.13). Version 0.1.0, proposed, revision 4; declaration pending. The text below is this section of the TPS 0.1.0 artifact, verbatim; the whole artifact and its file digest are on The Principia Machina/TPS. Human readers: the contents page is the map.

TPS 5.18  THE SCORECARD
purpose: the two channels and what each carries; where failure detail
         lives and why, and how its read is restricted; containment
         before declaration; the reporting rule; who receives it
governs: 5.18 | version: 0.1.0 (proposed) | class: instruction artifact
audience: operator

5.18.1 TPX generates a fleet-level scorecard from the administrative
       read of 5.3.13 and sends it out of band. A monitoring channel
       that depends on the integrity of what it monitors fails when it
       is needed. [I-146] [D51]
5.18.2 PERIODIC SCORECARD. Carries no probe content, and is therefore
       sent in full. Contents: the agent-group roster; accounts that
       landed at least one work block in the period; blocks landed per
       account; mutex-hours held; canaries delivered per account;
       passes with n and the interval, stratified by gradient epoch;
       the sequential-test statistic; the certificate fields of CR3;
       lapse flags; and every CLOSED UWC with fewer than two eligible
       accounts, and with zero. [I-146]
5.18.3 IMMEDIATE FAILURE ALERT. Carries a notification and a pointer
       only. NO PROBE CONTENT TRAVELS THE ALERT CHANNEL. [I-147]
5.18.4 FAILURE DETAIL lives on-wiki in the restricted class of 5.13,
       readable by the declaring authority and the human operator
       only. Its digest is published and lands on the chain, so the
       report is provably unaltered without disclosing the suite.
       Detail held only off-wiki would sit outside the system of
       record (1.3); detail published would burn the probe suite
       (CR6). The split satisfies both. [I-147] [D51]
5.18.5 CADENCE is by exception with a mandatory heartbeat, and in full
       at the declared longer interval regardless. A channel that
       speaks only on bad news cannot be told apart from a broken
       channel, so a missing heartbeat is itself an alarm. [I-146]
5.18.6 CONTAINMENT. TPX suspends the account's landing API on a canary
       failure, pending the declaring authority's declaration
       (5.3.16). Removal stays the human's act (CR6). This is the
       mechanism CR9 already uses for a D(IS) mismatch, on a new
       trigger; its effect is that alert-channel latency is not a
       safety parameter. [I-148] [D51]
5.18.7 REPORTING RULE. The scorecard reports n, never a bare rate
       (CR8). [I-149]
5.18.8 RECIPIENTS are named accounts, never a platform group whose
       membership is managed outside the declaration mechanism of 5.6.
       The current binding is published on the control panel (5.12).
       The recipients and the cadence are declared parameters (7.2.13,
       7.2.14). [I-146] [D63.1] [D64.1]
5.18.9 RECORDED LIMIT. Under binary scoring and CR6's zero tolerance
       an account-level sequential test cannot accumulate evidence,
       the account being gone at the first failure. The test binds at
       fleet level, over the removal rate. Below roughly five active
       accounts it reaches no boundary and the counts of 5.18.2 carry
       the whole measurement. [I-149] [D51] The scale is binary by
       decision: a graded scale was raised and not taken, so this
       limit stands and is revisited at 7.2.16. The test's rates are
       7.2.7. [I-160] [D84.1]
       OWED: the serialization and transport of both channels, and
       the form of the published failure-detail digest; kind:
       absence; C-35.
5.18.10 READ RESTRICTION. The restricted class of 5.18.4 is a
       namespace of its own. TPX refuses read at the permission hook
       to every account but the declaring authority and the human
       operator (4.2 row 51). Platform protection restricts no read
       and is not an enforcement for this class. [I-157] [D56]
5.18.11 READ PATHS. Before the class holds data, every path by which
       its content could be read - search, the API, diffs, exports,
       transclusion, recent changes, caches - is enumerated, and each
       is tested refused (4.2 row 52). Until then the class holds no
       data. A path missing from the enumeration is a disclosure, not
       an unauthorized write. [I-157] [D56]
       OWED: the enumeration of read paths to the failure-detail
       namespace, and the test of each; kind: absence; C-36.