Skip to content

Commit 54595b4

Browse files
RiverbraidRiverbraid
committed
docs: add domain expert review lanes
1 parent 12356e0 commit 54595b4

1 file changed

Lines changed: 244 additions & 0 deletions

File tree

‎docs/DOMAIN_EXPERT_REVIEW_LANES.md‎

Lines changed: 244 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,244 @@
1+
# Domain Expert Review Lanes
2+
3+
**Status**: DRAFT / STRUCTURAL REFERENCE
4+
**Scope**: lane-scoped review guidance
5+
**Protocol mutation**: NONE
6+
7+
## Purpose
8+
9+
Riverbraid's behavioral boundaries span multiple domains. No single reviewer can assess all of them.
10+
11+
This document defines review lanes: which expertise is relevant to which part of the system, what those reviewers are asked to assess, and what they are not asked to assess.
12+
13+
A reviewer in one lane does not speak for another lane's scope.
14+
15+
## How to use these lanes
16+
17+
Each lane defines:
18+
19+
- required expertise
20+
- assessment scope
21+
- non-scope
22+
- most relevant repositories
23+
- useful finding shape
24+
25+
Reviewers should produce bounded findings: what was observed, which claim is relevant, and whether the claim is supported, unsupported, or outside the reviewer's lane.
26+
27+
## Lane 1 - Security
28+
29+
Expertise: application security, infrastructure security, supply-chain security, or cryptographic security.
30+
31+
Asked to assess:
32+
33+
- branch protection and rulesets
34+
- GitHub Actions permission model
35+
- secret scanning and push protection configuration
36+
- Dependabot configuration
37+
- signing consistency
38+
- dependency supply-chain risk
39+
- Docker base image posture
40+
- workflow timeout and concurrency controls
41+
- guardian key ceremony design
42+
43+
Not asked to assess:
44+
45+
- legal compliance
46+
- domain-specific behavioral correctness
47+
- prose quality
48+
- whether Riverbraid should exist
49+
50+
Most relevant repositories:
51+
52+
- Riverbraid-Core
53+
- Riverbraid-Harness-Gold
54+
- Riverbraid-GPG-Gold
55+
- Riverbraid-Evaluation-Kit
56+
- Riverbraid-Secrets-Safe
57+
- Riverbraid-Security-Gold
58+
59+
## Lane 2 - Law and policy
60+
61+
Expertise: technology law, AI governance policy, regulatory compliance, public-sector procurement, or adjacent governance review.
62+
63+
Asked to assess:
64+
65+
- claim-language accuracy
66+
- non-claim adequacy
67+
- compatibility language
68+
- proof-of-concept boundary defensibility
69+
- certification boundary language
70+
- adaptation separation from canonical authority
71+
72+
Not asked to assess:
73+
74+
- verifier implementation
75+
- cryptographic soundness
76+
- infrastructure operations
77+
78+
Most relevant repositories:
79+
80+
- Riverbraid-Documentation
81+
- Riverbraid-Governance
82+
- Riverbraid-Evaluation-Kit
83+
- `.github`
84+
85+
## Lane 3 - Infrastructure and operations
86+
87+
Expertise: cloud infrastructure, CI/CD, container security, DevOps, or reproducibility.
88+
89+
Asked to assess:
90+
91+
- Docker digest and base image policy
92+
- runner version policy
93+
- workflow reproducibility
94+
- environment lock accuracy
95+
- local/Docker reproduction path
96+
- npm and Cargo dependency consistency
97+
98+
Not asked to assess:
99+
100+
- behavioral domain boundaries
101+
- legal language
102+
- governance authority
103+
104+
Most relevant repositories:
105+
106+
- Riverbraid-Evaluation-Kit
107+
- Riverbraid-Build-V5
108+
- Riverbraid-Gold-V2
109+
- Riverbraid-Types
110+
- riverbraid-tsh
111+
- Riverbraid-Wasm-Bridge
112+
113+
## Lane 4 - Cryptography
114+
115+
Expertise: applied cryptography, GPG/PGP infrastructure, signing systems, or key ceremony design.
116+
117+
Asked to assess:
118+
119+
- guardian key ceremony design
120+
- GPG binding in Harness-Gold
121+
- signing model and immutability claims
122+
- mutable timestamp or mutable evidence fields
123+
- cryptographic surfaces in related support repositories
124+
125+
Not asked to assess:
126+
127+
- non-cryptographic behavioral boundaries
128+
- legal language
129+
- infrastructure operations
130+
131+
Most relevant repositories:
132+
133+
- Riverbraid-Harness-Gold
134+
- Riverbraid-GPG-Gold
135+
- Riverbraid-Crypto-Gold
136+
- Riverbraid-Core
137+
- riverbraid-tsh
138+
- Riverbraid-Wasm-Bridge
139+
140+
## Lane 5 - Energy, water, and physical infrastructure
141+
142+
Expertise: data-center operations, energy systems, water systems, grid management, or infrastructure governance.
143+
144+
Asked to assess:
145+
146+
- data-center / AI infrastructure evidence surfaces
147+
- heat reuse, water use, grid flexibility, and compute commons evidence categories
148+
- public benefit ledger concept
149+
- agency responsibility map
150+
- failure behavior in physical infrastructure governance contexts
151+
152+
Not asked to assess:
153+
154+
- cryptographic implementation
155+
- GitHub security settings
156+
- legal compliance
157+
158+
Most relevant surfaces:
159+
160+
- Riverbraid-Documentation applied profiles
161+
- future infrastructure templates
162+
163+
## Lane 6 - Education and research
164+
165+
Expertise: educational technology, AI in education, research integrity, or academic AI governance.
166+
167+
Asked to assess:
168+
169+
- education AI oversight profile scope
170+
- research reproducibility profile evidence requirements
171+
- proof-of-concept framing for academic reviewers
172+
- first-reader document accessibility
173+
174+
Not asked to assess:
175+
176+
- cryptographic implementation
177+
- infrastructure operations
178+
- legal compliance
179+
180+
Most relevant repositories:
181+
182+
- Riverbraid-Documentation
183+
- Riverbraid-Evaluation-Kit
184+
185+
## Lane 7 - Accessibility and inclusion
186+
187+
Expertise: accessibility standards, inclusive design, or public-facing communication design.
188+
189+
Asked to assess:
190+
191+
- first-reader documentation accessibility
192+
- glossary completeness
193+
- adoption tier clarity
194+
- readability for non-technical readers
195+
196+
Not asked to assess:
197+
198+
- technical implementation
199+
- legal language
200+
- cryptographic soundness
201+
202+
Most relevant repository:
203+
204+
- Riverbraid-Documentation
205+
206+
## Lane 8 - Creative systems
207+
208+
Expertise: creative AI, generative art governance, creative rights, or provenance.
209+
210+
Asked to assess:
211+
212+
- creative AI provenance evidence surfaces
213+
- witness-not-judgment principle in creative domains
214+
- provenance framing for creative practitioners
215+
216+
Not asked to assess:
217+
218+
- infrastructure security
219+
- supply-chain hardening
220+
- unrelated legal frameworks
221+
222+
Most relevant surface:
223+
224+
- future Creative AI Provenance profile
225+
226+
## What happens with reviewer findings
227+
228+
1. Findings are recorded in a review tracking issue.
229+
2. Each finding is classified as accepted, under review, deferred, or out of scope.
230+
3. Dissenting findings are preserved.
231+
4. Findings do not automatically change registry entries, verifiers, or claim language.
232+
5. No reviewer speaks outside their lane in official finding records.
233+
234+
A review does not constitute an audit. A finding does not constitute certification.
235+
236+
## How to engage as a reviewer
237+
238+
Open an issue in Riverbraid-Documentation describing the review lane, background, and scope.
239+
240+
Lane-scoped review is more useful than surface-level review of everything.
241+
242+
## Non-claim
243+
244+
This document does not claim review has occurred and does not create certification, audit, or production-readiness status.

0 commit comments

Comments
 (0)