Skip to content

LLND — Build Rulings 01

The ratified 2026-07-10 build decision batch for the LLND tile — the reconciliation of the design-ruling candidates (RC-1/2/3) against the ratified llnd-02-spec, plus the build-sequencing decisions the spec left to bind-at-build. Nine items: where the ratified spec already spoke, these rulings record the confirmation; where it was silent, they rule. The spec remains governing on everything it covers; the spec-touching items below are carried into llnd-02-spec as marked amendments ("AMENDED 2026-07-10 per llnd-build-rulings-01") by the same brief that files this document.

1. Instrument provision (RC-1) — RATIFIED

Confirmed as already settled by the ratified spec: instrument versioning and sealing (llnd-02 §4.4 — instrument + bar + framework versions, audit replay); register-don't-author as the external-result intake (§4.5 — source, date, level, document, grade = external); the wrapper/config customisation split (§5); the consequential policy as RTO-owned configuration (§5, §9.4); the no-pass/fail copy discipline (§9.5).

New rulings:

  • Instrument authorship. Instruments are RTOpacks-authored against the pinned frameworks and published sealed. No blank-slate authoring surface exists. No item-level customer editing exists — an edited assessment item silently destroys its framework mapping, leaving the system asserting a mapping it cannot stand behind. Contextualised variants (e.g. care- vs construction-flavoured item contexts) are RTOpacks-authored and RTOpacks-mapped. Customer customisation lives in the wrapper — branding, welcome text, delivery settings, variant choice — and in the RTO's consequential policy configuration (support thresholds, referral triggers).
  • Honesty constraint. What RTOpacks provides is a structured screening indicator mapped to published frameworks — never claimed as a validated psychometric test. ACER's core charge against the DLSF was "unvalidated"; the same standard binds our own artefact. Validation is a maturity step once usage data accrues, never a launch claim. This lands as a §9.5 copy constraint.

2. Judgement placement (RC-2) — RATIFIED

Confirmed as already settled: deterministic rubric-proposed advice (§6.1); human issue (§6.2); the system tick as a completeness gate only (§3.2 COMPLETE); required verdict payloads (§6.3); recorded delivery as part of the discharge (§6.5).

New rulings:

  • Divergence is loud. Where the issuing identity amends away from the rubric-proposed advice, the advice record carries an explicit divergence marker — recorded and surfaced. The signer may know more than the instrument; the divergence is legitimate, and it becomes a discrete, visible, signed fact rather than archaeology in a snapshot diff.
  • Rater identity. Results from human-rated components (the oral observation below; any open-response marking) record rater identity + rubric version on the result.
  • Oral-communication capture — option (b) at launch. A structured observation checklist: an operator-conducted component inside the versioned instrument, anchored to ACSF oral-communication performance features, recorded in-tile with rater identity + rubric version. No candidate-side AV machinery at launch. The AV recorded task is day-two — no technical design now — and lands into already-named disciplines: consent-per-anchor, sealed custody, its own retention posture, and a non-AV alternative path. Per-product omission stays available where the bar honestly does not gate on oral (or an external result covers it). Retooling is clean by construction: instruments are versioned wholes (§4.4) and independently commissionable (§4.7) — the AV variant arrives as a new instrument version; historical screenings stay pinned.

3. Process metadata (RC-3) — RATIFIED

Four binding disciplines govern any process/behavioural capture by the instrument, now and later:

  1. Facts, not verdicts. The system records observable process facts and never emits authenticity conclusions. Judgement is the human's. (AI-detection heuristics carry false-positive rates that fall hardest on non-native speakers and low-literacy candidates — the exact population the instrument serves.)
  2. Disclosed, never covert. All capture declared to the candidate up front, plainly, with purpose (support / reasonable adjustment). Collection-notice obligations apply.
  3. Signals inform, never gate. No auto-blocking, no mid-flight flags, nothing shown to the candidate. Signals ride quietly to the assessor as context beside the profile.
  4. Two strata, strictly separated. Framework-mapped scores feed the indicative profile; process metrics live in a clearly-labelled auxiliary stratum that never enters the ACSF/DigComp computation.

Launch capture is limited to the anchors that already exist (session recording + sealed response sets). Extended telemetry (paste provenance, response timing, revision behaviour) is day-two, born under these disciplines. Binding at launch regardless: all intake consent and disclosure text must be readable at ACSF Pre Level 1 — an LLND instrument whose consent text demands Level 4 reading fails its own subject matter.

4. Access posture (§9.3) — FALLBACK BOUND

ONBOARDING-PERMISSION-USI-RECON-01 (2026-07-08, read-only, on bytes + live prod reads) found the per-review operator-assignment concept ABSENT — no operator↔candidate edge exists anywhere in substrate or code. The ratified §9.3 fallback therefore binds at launch: sensitive results gate T4-only (org-scoped, bindable today via the ADR-061 pattern). The assigned-T4A refinement is a later increment gated on building the assignment edge.

5. Event-ledger home — RATIFIED, resolve-once for all tiles

Each regulated tile's discharging-events ledger is a table in the tile's own Peel store — llnd_event in rtopacks-llnd, and the same pattern for RPL and TAS when they build. Resolved once at the first tile build per tas-02 §14.3. Rationale: the ledger is regulated tile-domain data — events reference tile fields, clause traces live on those fields, and the ledger travels with the domain under HARD SEPARATION. The shared rtopacks-audit-* store (ADR-045 activity stream) remains platform activity attribution; a non-authoritative cross-post is permitted but never the compliance record. Recorded as ADR-064 in the same filing.

6. Seven screening states (ACSF Pre Level 1) — RATIFIED

ACSF Pre Level 1 divides into stages 1A and 1B (2017 supplement; per the ACER review). The LLN result enumeration carries seven states per skill — Pre 1A, Pre 1B, Levels 1–5. The bar (§5.2) stays Levels 1–5: no product demands Pre-Level-1, and any below-Level-1 result reads shortfall against any bar — which is exactly the case where the support posture bites hardest. The ACSF framework_ref pin names the main framework (2019) and the Pre Level 1 supplement (2017) as the pinned frame. Spec amendment at §4.2.

7. USI sequencing — CONFIRMED INDEPENDENT

The LLND build proceeds independently of the USI Developer/M2M kit. Launch needs format-validation only (usi-module contract); USI optional at LLND intake (llnd-02 §2.3); registry operations are day-two behind the EXT-API doc. The recon confirms the candidate USI is spec-only today and the module contract's only built touch-point is People.

8. DLSF residuals — CLOSED

(i) The DigComp 2.2 ratification did weigh the domestic framework family: llnd-02 §4.3 carries the three-way comparison (DigComp 2.2 / ADCF / DLSF) with DLSF named as the alternative weighed and not chosen. No rationale backfill owed. The 2026-07-09/10 source captures corroborate the ratification: ACER Rec 1 (replace the DLSF; do not add digital as a sixth ACSF core skill) and the ADCF's verified DigComp 2.1 lineage show the domestic trajectory converging on DigComp. (ii) The ADCF cross-walk (area-level mapping table for funding-context legibility) is a day-two named candidate, revisited at instrument commissioning alongside the spec's DigComp 3.0 watch.

9. Straggler confirmations — IN RATIFIED SCOPE

Third-party instrument registration is the §4.5 external-result intake. Course demand profiles are llnd_product_capability_config (launch via guided setup; derivation assist day-two, propose-never-determine).

Build notes carried with the batch

  • The shared spine stores (candidates / intake / capture) exist and were independently verified live on 2026-07-10 (UUIDs match the SHARED-SPINE-STORES-01 close). The LLND build binds, never re-creates (rpl-02 §2.1 first-binding honoured).
  • No intake-pipeline-02 exists: the LLND build carries the pipeline's spec-grade calls as first consumer — token lifetime defaults, the email-channel assumption to verify, COMMS-REGISTRY-01 entries owed before any surface ships, session-recording mechanics, capture access posture.
  • The LLND sources set files under sources/ (verification-only per Tim's originals-in-repo ruling, 2026-07-10) with the DigComp 2.2 CSV extraction produced from digest-verified bytes.

Ratified by Tim 2026-07-10, whole batch. Filed via LLND-BUILD-01 Op A1. The candidates precursor (llnd-design-ruling-candidates-2026-07-10) is superseded and historical. Where this document and the amended llnd-02-spec both speak, the spec's amended text governs the build surface; this document records the rulings and their reasoning.