# Five-Signal Scope-Creep Inventory (E6)

**Owner:** Audit Charter Lock. Private Evaluator.
**Purpose:** specify the five scope-creep signals evaluated on every cross-component message and component output. Each has distinct detection / classification / response. No composite "drift score."
**Empirical basis:** E-S05 / E-R5.2 -- Power (1997), Pawson (2013), PMI (2018), Local Law 144 / FAccT 2025, DSA audit literature.

## Signal 1 -- new-artifact-type-without-rebaseline
**Detect:** compare artifact-type metadata of every message and consumption against charter `target_ram_artifacts`. Covers external citation AND internal consumption (Anti-Example 2).
**Trigger:** type absent from list AND no amendment covers it.
**Class:** Tier-1. Warning on first fire; escalate on repeat or concurrent signal.
**Respond:** Ledger `scope-creep-warning`; quarantine artifact (audit does NOT consume); notify producer.
**Override:** permitted with recorded rationale.

## Signal 2 -- undefined-term
**Detect:** when a term is load-bearing (removing it changes the operation's truth condition), check charter for operational definition. Synonyms and non-exhaustive ostensive examples do not count.
**Trigger:** load-bearing term lacks operational definition.
**Class:** Tier-1. Warning on first fire; escalate if a divergent interpretation of the same term appears later.
**Respond:** Ledger `scope-creep-warning`; log `charter-interpretation` entry; subsequent operations must reuse it.
**Override:** permitted with recorded rationale.

## Signal 3 -- stakeholders-added-midaudit [NON-OVERRIDABLE]
**Detect:** scan every operation envelope for stakeholder fields (questioner, evidence-source) against charter `stakeholders`. Passive observers excluded.
**Trigger:** non-observer stakeholder not in list participates.
**Class:** AUTO-ESCALATE regardless of concurrent count.
**Respond:** Ledger `scope-creep-escalation`; halt; escalation envelope with recommended response (amend-with-rebaseline OR refuse).
**Override:** **NONE.** Only paths are formal amendment with full re-baseline, or refusal. Non-overridability is deliberate: stakeholder additions are the highest-leverage scope expansion and the easiest to rationalize under pressure.

## Signal 4 -- evidence-class-shift-without-reauthorization [NON-OVERRIDABLE]
**Detect:** classify every piece of evidence consumed by E2 / E5 / E4 against charter `evidence_classes_admissible`. Within-class shifts are not signals. Across-class ARE: test data -> behavioral logs; static -> runtime; Tier-A peer-reviewed -> Tier-D blog; declared -> undeclared corpus.
**Trigger:** class outside admissible list is consumed.
**Class:** AUTO-ESCALATE regardless of concurrent count.
**Respond:** Ledger `scope-creep-escalation`; halt; envelope naming the RAM-side change that caused the shift.
**Override:** **NONE.** A class shift changes what the Evaluator can validly audit -- structural, not operational. Defends against the Local Law 144 / FAccT 2025 test-data-substitution pattern.

## Signal 5 -- finding-cites-out-of-scope-artifact
**Detect:** trace every load-bearing citation in E4 draft verdict and E5 findings to its source artifact; check against `target_ram_artifacts`. Background mentions don't count; evidentiary citations do.
**Trigger:** load-bearing citation to out-of-scope artifact.
**Class:** Tier-1. Response targets the FINDING, not the artifact.
**Respond:** **REJECT THE FINDING.** Direct producer to re-anchor OR escalate scope. Ledger `scope-creep-warning` keyed to the finding.
**Override:** permitted with recorded rationale (operator may amend to admit the artifact; triggers re-baseline).

## Cross-signal rules

- **Concurrency:** 2+ signals -> escalate one tier. Any {3, 4} in set -> escalate-to-operator regardless.
- **Repeat:** same signal twice within `repeat_window` (default: same cycle) -> escalate one tier.
- **Non-collapse:** Ledger records specific signal(s) fired. No composite score. Schema validation rejects collapsed entries.
- **Non-overridability invariant:** Signals 3 and 4 are NEVER overridable. Override attempts are themselves integrity events surfaced to the Self-Audit Resistance Monitor.
