← Packages
Context and assumptions (3) →Findings (0) →

Read-mostly. Today the console holds SELECT only, per the grants in 001_packages_and_console.sql and the VAL-CHER-PLANE-001 boundary test.

Holds no authority. It decides nothing, records no approval outcome, and writes nothing to governance, evidence or audit.

EEP-CHER-CONSOLE-001 · v1.4.0

SupersedesEEP-CHER-CONSOLE-001 v1.3.0digest verified against the fixture provenance71b66aebf7596deb

Status
APPROVED
Version
1.4.0
Architecture style
MODULAR_MONOLITH
Knowledge snapshot - the basis this package is judged against
KS-2d4a1d596a27c2e1

Business intent

Build the thin CHER Experimental V1 that can take one business intent, derive privacy and security controls from knowledge packs, compile a schema-valid Engineering Execution Package, dispatch it to a software factory, validate what comes back against eight machine-checkable rules, and produce an evidence pack with a complete proof chain.

Governance gates

A gate is a definition. Its state is what one run made of it, so every state below is read from that gate's outcome and carries the source it came from.

Where these gate states come from

PACKAGE_FALLBACK

At least one state below is the package's own assertion as issued, not something a run observed. It carries no run, no observation time and no verification anyone executed.

Outcomes
3
Runs
none
Gates with no outcome
0
Fixture declares
PACKAGE_FALLBACK

▮ PRE_DISPATCH

Evaluated before the package may be dispatched. A blocked gate here stops the work.

GATE-CHER-GEO-001

Processing geography (inherited)

blockingPASSED

Engine, evidence and audit remain in the home jurisdiction and every other path has an established ground.

PACKAGE_FALLBACKno run · no observation time

Not observed. This is the package's own gate state as issued: no run, no observation time, and no verification anyone executed.

Method
Human determination that engine, evidence and audit remain in the home jurisdiction, and that the one foreign path (operator identity to the console platform's EU region) rests on POPIA s72(1)(b) with per-operator written consent.
Environment
Design-time determination. No deployment was inspected.
At
2026-08-27T16:00:00Z
Ran by
person:engineering-lead@cher
Truth class
DECLARED
Does not cover
Design-time only. No running system has been inspected for undeclared egress; the console's webfont path was found later by a factory report, not by this determination.
GATE-CHER-CTX-001

Context readiness (inherited)

blockingPASSED

No decision-changing assumption remains unconfirmed.

PACKAGE_FALLBACKno run · no observation time

Not observed. This is the package's own gate state as issued: no run, no observation time, and no verification anyone executed.

Method
Review of every recorded assumption for unconfirmed decision-changing materiality.
Environment
Design-time review of the package.
At
2026-08-27T16:00:00Z
Ran by
person:engineering-lead@cher
Truth class
DECLARED
Does not cover
Covers assumptions recorded in the package. An assumption nobody wrote down is not covered.

▯ POST_EXECUTION

Evaluated after execution, against the running system. Open is the normal state until validation runs.

GATE-CONSOLE-PLANE-001

Console holds no write path

blockingPASSED

VAL-CHER-PLANE-001 passes against the deployed console: its database roles hold no INSERT, UPDATE or DELETE grant on governance, evidence or audit, and a live attempt from each console role is refused.

PACKAGE_FALLBACKno run · no observation time

Not observed. This is the package's own gate state as issued: no run, no observation time, and no verification anyone executed.

Method
verify_console_boundary.py, 16 of 16. Sixteen operations attempted live as the cher_console role and every one refused, including a write through a view to its base table and a cross-tenant read.
Environment
Local PostgreSQL 17.9 development cluster, UTF8, stood up by bootstrap.sh. Not a governance database under the programme's control.
At
2026-08-30T00:00:00Z
Ran by
person:engineering-lead@cher
Truth class
OBSERVED
Does not cover
Carries only as far as this deployment. ADR-CHER-003 is satisfied in form, in that this is not the factory platform's own database, but no production or programme-owned governance database has been tested. The gate must be re-run, and this record replaced, against any environment that holds real evidence.

Findings that block no gate

This package holds no finding that blocks no gate.