{
  "schema_version":"0.1",
  "control_id":"MNT12A",
  "reviewed_on":"2026-09-16",
  "status":"implemented_portable_external_review_protocol",
  "purpose":"Define a privacy-safe, portable handoff from the source inventory to network observation and named review without treating technical reachability as approval.",
  "stages":[
    {"id":"source_inventory","control":"MNT09","state":"implemented","evidence":"registered destination group, exposure state, authority claim, audience, privacy boundary, hooks, and replacement path"},
    {"id":"network_observation","control":"MNT12B","state":"completed_with_declared_transport_limits","evidence":"public/external-network-observations.json"},
    {"id":"authority_funding_safeguarding_review","control":"MNT12C","state":"blocked_named_reviewers","evidence":"dated decisions by the reviewer roles required for the destination audience and use class, with expiry and limitations"}
  ],
  "record_schema":{"required":["registered_group_id","registered_state","observed_at","executor_class","observation_class","network_result","redirect_chain","same_registered_origin","tls_observed","audience","contains_personal_data","reviewer_roles","decision","limitations","expires_on"],"nullable":["observed_at","tls_observed","expires_on"],"network_results":["success","redirect","client_error","server_error","timeout","tls_error","dns_error","not_run"],"audiences":["general","research","student","adult_applicant","software_test"],"reviewer_roles":["safeguarding","funding_currency","privacy","source_authority"],"data_boundary":"Public nonpersonal observations only. Never include credentials, user identifiers, drafts, application data, browsing histories, or student information."},
  "network_observation_schema":{"required":["registered_group_id","registered_url","registered_state","use_class","observed_at","executor_class","observation_class","network_result","dns_observation","tls_observation","response_observation","status_code","redirect_chain","effective_origin","effective_path","same_registered_origin","resolver_target_identity_preserved","audience","contains_personal_data","reviewer_roles","decision","required_next_reviews","limitations","expires_on"]},
  "decision_states":["network_observed_not_approved","resolver_target_observed_not_approved","review_required_same_origin_redirect","quarantine_cross_origin_redirect","stale_or_unavailable","blocked_safeguarding_review","blocked_funding_review","reject_nonpublic_reference","reject_privacy"],
  "human_review_decision_states":["approved_with_expiry","approved_with_conditions","remove_or_quarantine","defer_pending_evidence"],
  "human_review_schema":{"required":["registered_group_id","reviewed_at","reviewer_roles","decision","public_rationale","limitations","expires_on"],"boundary":"Reviewer roles and a nonpersonal public rationale may be recorded; reviewer personal information, private deliberation, student data, grant drafts, credentials, and application data must not be stored in public artifacts."},
  "human_review_preparation":{"control":"MNT12CP","state":"implemented_without_review","evidence":"public/external-human-review-worklist.json","boundary":"The worklist may define roles, questions, checks, ordering, coverage, and expiry rules; it cannot appoint reviewers or record decisions."},
  "human_review_validation":{"control":"MNT12CV","state":"implemented_synthetic_validator","evidence":"public/external-human-review-fixtures.json","boundary":"Synthetic cases may validate schema and rejection behavior; they cannot become live review evidence or approve a destination."},
  "rules":[
    "HTTP or TLS success never equals approval, authority, age suitability, eligibility, policy currency, or safety.",
    "A cross-origin redirect is quarantined except for an active citation_resolver whose persistent DOI identity is preserved at the observed target; that narrow resolver outcome remains not approved and requires source-authority and privacy review. A same-origin redirect requires review before any registry update.",
    "Student destinations require a named safeguarding reviewer; funding destinations require a named funding-currency reviewer.",
    "Test-only and internal-only registry entries cannot become public destinations through an observation record.",
    "Records containing personal, credential, draft, application, or student data are rejected.",
    "Persistent identifiers such as DOI values remain identifiers even if a resolver changes.",
    "Every accepted human decision has a review expiry; stale evidence re-enters the applicable stage."
  ],
  "hooks":["funding.opportunity.changed","student.external_link.changed","privacy.expectation.changed","research.parent.changed","platform.access.changed"],
  "change_authority":"The automated validator is report-only and fail-closed. It cannot approve, publish, remove, redirect, or reclassify a destination.",
  "limitations":["Synthetic fixtures do not demonstrate live availability.","The available observation channels do not expose independent DNS answers, TLS certificate chains, or reliable HTTP status codes; every accepted record must state those transport limits.","Network observations cannot establish authority, safety, eligibility, funding currency, or age suitability.","Named review is not complete until dated evidence names the applicable reviewer role and expiry."],
  "successor_path":"Run this and any replacement protocol together on the complete synthetic fixture set and one privacy-safe external evidence package; preserve stricter quarantine, reviewer, expiry, and non-approval rules until every consumer migrates."
}