# TRANSCRIPT-TIERS.md

**Status:** FROZEN · v1.0 · 10 Jun 2026
**Governs:** `account` (`c:\projects\account`, SoR / issuance authority) · `mathapi` (`c:\allgifted\mathapi11v2`, attainment + floor)
**Supersedes:** the `transcript-d7563006` sample — see §6. That document is now structurally unreachable.

Both repos build to this definition. Neither side invents a third document, a fourth issuer, or a shortcut around the gate. Same discipline that made the federation contract pass: freeze it, then build to it.

---

## 0. Principle (non-negotiable)

**The document tier mirrors the data tier.** Provisional attainment may never wear accredited-credential chrome. Certification is an *event under controlled conditions*, not a threshold on a running average. There are exactly two documents. The engine never blends them.

---

## 1. The two documents (canonical names — use verbatim)

| | **A · Provisional Progress Report** | **B · Accredited Transcript** |
|---|---|---|
| Tier | 1 — Verified Mastery surface | 2 — AGS Accredited Credential |
| Audience | Any learner, any org | Student-of-record at an accreditation-floor org |
| Nature | **Live render** of current attainment | **Render of an immutable issuance record** |
| Issuer | Automated (AllGifted Math) | All Gifted School, by Registrar |
| Authority | None claimed | ACS WASC · MSA-CESS |
| Frozen? | No — regenerable any time | Yes — frozen at issuance, supersede/revoke only |

---

## 2. Document A — Provisional Progress Report

**Nature:** a *live* render of current attainment. Not an issuance. No frozen record, no ledger entry. Regenerated freely from the attainment read-model.

**Issuer line (verbatim):**
> Generated automatically by AllGifted Math · {date}

**MUST NOT carry:**
- "ACS WASC · MSA-CESS accredited"
- "Official academic record"
- "Registrar" / any registrar signature
- any accreditation seal or AGS-as-authority framing

**Carries:**
- Header: **"Provisional Progress Report"** + standing badge **"Provisional · not a certified credential"**
- Maxile, band, growth, on-track status, delivering org
- Provenance: record hash, verify URL, append-only, portable · learner-owned (these attest the *data*, not accreditation)

**Verified checkpoints:** omit, or show "not yet assessed under verified conditions." Never dressed as a result.

**Emits:** automatically, any time, for any learner. This is the only document the engine may auto-emit.

---

## 3. Document B — Accredited Transcript

**Nature:** a render of an **immutable issuance record** — the frozen summary, registrar-attributed, hash-anchored (incl. `earned_at_grade`), correctable only by supersession, terminable only by revoke. B is never a live view of current data; it is a snapshot fixed at the moment of issuance.

### The gate (all four required)

**Eligibility (1–3 make a student *eligible*):**
1. **Verified checkpoint exists** — ≥1 invigilated/certified checkpoint in account's certified substrate. (Attainment does not count, ever.)
2. **Accreditation floor met** — org clears the floor for this subject (`AccreditationComplianceService` signal).
3. **Student-of-record** — genuine enrolment + verified identity at the delivering org.

**Issuance (4 *issues* it):**
4. **Registrar issuance event** — a human AGS registrar acts; logged in the certification audit ledger with `issuance_id`, actor, org, timestamp.

A student satisfying 1–3 enters the registrar's issuance queue. B does not exist until 4 fires.

**Issuer line (verbatim):**
> Issued by {registrar_name}, Registrar, All Gifted School · {date} · ref {issuance_id}

**Carries:**
- Header: **"All Gifted School — Official Academic Record"** + **"ACS WASC · MSA-CESS accredited"**
- Certified-checkpoint results, drawn from **certified sources only** — never from attainment, never from engagement
- Maxile present as *secondary supporting context*, clearly labelled provisional
- Full provenance + registrar attribution in the record hash

**Emits:** only through a registrar issuance event, only after eligibility. Never auto.

---

## 4. The gate — enforcement

The engine chooses the document **by gate, not by label.** One authoritative branch, implemented identically both sides:

```
selectDocument(student, org, subject):
    if  certifiedCheckpointCount(student, subject) >= 1     # §3.1  (account)
    and accreditationFloorMet(org, subject)                 # §3.2  (mathapi signal)
    and isStudentOfRecord(student, org)                     # §3.3  (account)
    and registrarIssuance.exists(student, subject):         # §3.4  (account ledger)
        return ACCREDITED_TRANSCRIPT          # Document B
    else:
        return PROVISIONAL_PROGRESS_REPORT    # Document A
```

**Hard rules:**
- There is **no code path** that emits Document B except through an issuance record.
- B's renderer **refuses to run without an `issuance_id`.** Calling it directly with live data is impossible by construction (defense in depth — the gate is not the only guard).
- Below the bar the engine is *structurally incapable* of emitting B. Alice at 0/0 can only ever receive A.

---

## 5. Ownership split

**account owns:**
- both document renders (all human UI lives here)
- gate evaluation (§4)
- the issuance record, frozen summary, certification audit ledger, registrar action
- the verify page (it distinguishes provisional vs accredited)

**mathapi owns:**
- attainment data feeding A, and B's secondary Maxile context (read-model)
- the **accreditation-floor-met signal** for gate condition §3.2
- renders nothing · issues nothing

**Floor re-home note:** the accreditation floor config currently lives in `mathapi`. When subject #2 lands it re-homes to `account`. The gate contract in §4 is **unchanged** by that move — only the source of the §3.2 signal changes.

---

## 6. Retired — the anti-pattern this kills

`transcript-d7563006` (Alice, Primary 3): **0/0 verified checkpoints** + **"Official academic record · ACS WASC · MSA-CESS accredited"** headline + **"Registrar, All Gifted School"** signature. All-provisional content wearing Tier-2 chrome. That exact combination is now forbidden and unreachable: 0 checkpoints fails gate §3.1, so the engine can only emit Document A for that learner — which carries no accreditation headline and no registrar line.

---

## 7. Consistency with prior frozen decisions

- **Attainment vs certified** — held. B's certified panel never pulls attainment.
- **Engagement never feeds certified** — held. B never shows engagement.
- **Corrections by supersession; revoke ≠ supersede** — apply to B (an issued artifact). A is a live render, simply regenerated.
- **`earned_at_grade` in the record hash** — applies to B at issuance.
- **Grade progression orthogonal** — enrolment-only; does not gate issuance.

---
_Source: authored in `account` (SoR); mirrored here for mathapi contributors. account is canonical if they diverge._