Requirements Library · One artifact, complete

RULE-004 — A detection claim carries its confidence, its provenance, and its observation time wherever it goes

A business rule worked through all fourteen sections of the library’s standard template. Chosen because a rule carries both acceptance criteria and measures, and because it is where the disagreement between the two source methods has to be resolved in practice rather than in principle.

0. Identity

1. Purpose

A detection produced by an automated sensing chain is a probabilistic claim. It becomes dangerous at the moment it stops being read as one — when a claim with a confidence value attached is relayed, summarised, exported and re-summarised until it arrives somewhere as a fact about the world, with the uncertainty stripped somewhere along the path and nobody able to say where.

This rule exists to make that stripping impossible rather than discouraged. It fixes what must travel with a detection to every surface that renders it, including surfaces outside the operating organisation, and it fixes the one direction confidence is allowed to move as a claim propagates. It is written because the failure it prevents is silent, cumulative, and only visible after a decision has already been made on a laundered claim.

2. Scope

In

• Any record asserting that a fire signature was observed, from any sensing modality, whether classified on board or after transmission.
• Every surface that renders such a record to a human, including primary consoles, field devices, and notification payloads.
• Every export of such a record to a system outside the operating organisation.
• Every derived record that restates or aggregates such a record.

Out

• The classifier itself. How confidence is computed, and whether the computation is any good, is governed under Category 5. This rule governs only what happens to the value once it exists.
• Confirmation policy. How many independent claims are required before a given action may be taken is a separate rule; conflating the two would let a confirmation threshold be met by re-reading one observation.
• Retention and disclosure of imagery a claim is derived from. Separate rule, separate lifecycle, separate statutory basis.
• Human-originated reports. A person telephoning a report is not covered here; the provenance model for human observation is different, and pretending otherwise would flatten a real distinction.

3. Context

Detection systems of this class produce far more candidate observations than real fires, and the candidates are handled by several parties in sequence: an automated triage step, a human dispositioning step, a duty officer deciding whether to commit a resource, and — where responsibility for the ground lies with another organisation — a counterparty acting inside its own systems and under its own procedures.

Each hand-off is a re-statement, and each re-statement is an opportunity to drop a qualifier. The pattern is well documented in adjacent domains: a hedged assessment written by an analyst arrives at a decision-maker as an unhedged assertion, having lost its hedge at a summarisation step nobody logged. The equivalent here is worse in one respect, because a detection claim’s uncertainty is numeric and therefore looks precise; a confidence value rendered without its label is easily read as a measurement rather than an estimate.

The programme’s exposure is concentrated at two points. The first is export: a receiving schema with no field for confidence will accept the claim anyway, and the claim then exists in that system as an unqualified fire report attributed to this programme. The second is aggregation: a summary that counts claims necessarily discards their individual confidences, and unless constrained it will present the count at a higher effective certainty than any of its members.

A separate and easily-missed hazard is time. A detection carries two distinct times — when the observation was made, and when the record arrived. Under a degraded communications link these can differ substantially. Every downstream latency measure, every staleness judgement, and every human decision about whether a claim is still current depends on which one is being read, and a system that carries only one of them will carry the wrong one.

4. Inputs and authority

5. Content

5.1 The rule

Stated declaratively. One subject, one modality, one obligation per clause. No clause names a mechanism; mechanisms are recorded separately at §5.2.

R1. A detection record must carry a confidence value produced by the classifying process at the time of classification.

R2. A detection record must carry the identity and modality of the sensing chain that produced it, and the version of the model or rule set that classified it.

R3. A detection record must carry the time at which the observation was made. Where the time of receipt is also recorded, it must be held as a separate attribute, and it must not be presented in place of observation time on any surface.

R4. Every surface that renders a detection record to a human must render that record’s confidence and observation time within the same view as the record itself, without requiring a further action to reveal them.

R5. Every export of a detection record to a system outside the operating organisation must carry confidence, sensing provenance and observation time as first-class fields. Where the receiving schema cannot represent all three, the export must be refused.

R6. A derived record that restates or aggregates one or more detection records must not assert a confidence higher than the lowest confidence carried by the records it restates.

5.2 Enforcement points — recorded as metadata, not as rule text

5.3 Known pressure points — where this rule will be pushed on

Recorded in advance, because a rule that has not predicted its own erosion will be eroded quietly.

1. R5 will be experienced as an integration failure. A counterparty whose system has no confidence field will read the refusal as this programme being difficult, and the pressure to add a “degrade and annotate” path will be immediate and reasonable-sounding. The rule refuses because an annotation lives in a comment field nobody parses, and the claim would then exist unqualified in a system the operating organisation does not control. The correct response is a schema conversation with the counterparty, and the refusal is what forces that conversation to happen.
2. R4 will be pushed on by screen space. Confidence and observation time compete with everything else for a field device’s display, and the first proposal will be to move them behind a tap. A qualifier that requires an action to reveal is a qualifier that will not be read under load.
3. R6 will be pushed on by summary readability. A district summary reading at the confidence of its weakest member looks pessimistic to its audience, and there will be a proposal to use an average instead. An average of confidences is not a confidence, and adopting one converts the whole rule into decoration at exactly the surface most likely to be quoted onward.
4. R3 will be satisfied in letter and defeated in practice if observation time is back-filled from the receipt clock whenever the true observation time is unavailable. The field would be populated, the constraint would pass, and the value would be wrong. This is the reason for the fourth measure at §9.

5.4 Related definitions

Defined in the register and used here in their register sense: detection record; confidence class; sensing provenance; observation time; receipt time; derived record; rendering surface; export. Any use of these terms elsewhere in the library that is inconsistent with the register entry is a defect in the other artifact, not a permitted local variation.

6. Constraints, assumptions, dependencies

Constraints

• Receiving organisations’ schemas are outside this programme’s control. R5 does not attempt to change them; it converts an invisible degradation into a visible refusal and pushes the problem to where it can be solved.
• The rule is expressible only over records this programme originates. A claim already laundered before it arrives cannot be un-laundered by this rule, and no clause pretends otherwise.

Assumptions

Dependencies

• The rendering-surface inventory, maintained under Category 6. Named owner required; an inventory without one will drift.
• The confidence-class vocabulary in the definitions register. If that vocabulary changes, R6’s comparison changes meaning and this rule must be re-examined rather than silently inheriting the change.

Risk restatement. The first assumption is restated in the risk register, because an uncalibrated confidence value satisfies every clause here while defeating the rule’s purpose entirely. That risk is owned outside this artifact, under Category 5.

7. Stakeholders and authority

The counterparty integrator row is the one that matters. This rule creates a real cost for a party with no authority over it and a legitimate objection to it, and recording that asymmetry here is what keeps the eventual negotiation honest.

8. Acceptance and verification

Acceptance criteria are pass/fail against this rule as the single candidate. Evaluation criteria — scaled comparisons between candidate classifiers or export formats — are deliberately not in this artifact; they live in the Category 5 evaluation set, and mixing them here would produce a scored rubric that cannot accept anything.

9. Measures

Why M-4 exists. M-1 to M-3 can all be satisfied by a system that populates observation time from the receipt clock. Every constraint would pass and every value would be wrong. M-4 is the only measure here that can detect that, and it detects it by watching a distribution rather than a threshold: a healthy system under a variable link produces a spread between the two times, and a rising share of exact matches means the spread is being manufactured. It is deliberately given no target, because a target would invite the number to be managed.

What these measures do not capture. None of them says whether the confidence values are any good. That is the first assumption at §6, it is owned elsewhere, and a perfect score on all four is fully compatible with the rule protecting nothing. Stated here because a measure set that does not declare its own blind spot invites the blind spot to be read as covered.

10. Evidence

What can be stated: the six enforcement mechanisms at §5.2 and the six acceptance criteria at §8 exist as written specifications, including the deliberately deficient input cases each refusal test requires. They have not been executed. A control observed only passing is unproven, and a control never observed at all is further back than that. This artifact’s claims about enforcement are therefore design claims, and are labelled as such wherever they appear.

11. Traceability

The conflicts-with-resolved link is retained on purpose. A resolved conflict deleted from the map reads, two years later, as a conflict that never existed, and the next person to propose degraded export will propose it without knowing it was already decided.

12. Method

Three techniques produced this artifact, and each affects how much the content should be trusted.

A constrained rule grammar. Each clause carries one subject, one modality and one obligation. The constraint is not stylistic: it is what makes a clause individually testable and individually amendable. A clause with two obligations cannot fail cleanly, because a partial failure has no verdict.

Failure-first rationale. The rule was written from the named failure — confidence laundering — outward to the clauses, rather than from a desired capability inward. The consequence is that every clause can be interrogated with “which part of the failure does this close,” and R4 through R6 exist only because that question exposed three propagation paths R1 to R3 did not cover.

Pre-registered erosion analysis. §5.3 was written before the rule was approved, not after it was challenged. The value is that the first person to propose an average at R6 is arguing against a position already considered. The cost is that a pressure point nobody predicted will be the one that succeeds, and §5.3 should be read as incomplete rather than as a survey.

13. History

Append-only. Never rewritten.