Implement ESI Wave 4D exemption and authority controls

[hrtechifyed]

What changed

• promotes the final two ESI profiles from governance fallback to feature-specific deterministic governance and authority-source reviews:
  • exemption governance and source controls
  • enforcement-authority source routing
• adds a governed Wave 4D retrieval catalogue using eight controlled source identities and ten reason-code-scoped chunks
• changes the stacked runtime mix from 42 substantive / 15 fallback to 44 substantive / 13 fallback profiles
• adds six complete, reported-gap and missing-information boundary scenarios
• adds a strict privacy-safe browser client and explicit in-memory two-feature v3 review panel
• adds focused Chromium coverage and a Wave 4D all-laws acceptance suite
• updates product, architecture and human-verifiable validation documentation

Source-governance boundary

• the Code on Social Security, Social Security (Central) Rules, commencement notification and corrigendum remain controlled central sources
• S.O. 2350(E), S.O. 2353(E), S.O. 2354(E) and S.O. 2356(E) are registered only as controlled authority-source records
• those notifications do not prove customer-specific delegation, service, limitation, jurisdiction, document authenticity, liability or legal effect
• establishment-specific exemption notifications, benefit-comparison evidence, compliance history, customer notices and orders, signatures, findings and recovery records remain unresolved specialist dependencies

Deliberately not decided

Wave 4D does not grant, validate, renew, withdraw or interpret an exemption; authenticate a notice, order, officer or signature; decide liability, default, recovery, limitation, penalty, prosecution or jurisdiction; or calculate an enforcement amount.

Authority and privacy boundary

• deterministic rules decide before retrieval or provider execution
• complete and reported-gap outcomes remain specialist-review; absent facts return more-information-needed
• retrieval and provider output cannot create facts, supply customer-specific instruments, validate authority or documents, decide enforcement consequences, alter status or expand source scope
• names, contact details, Aadhaar, insurance numbers, wages, payroll and contribution records, exemption documents, notices, orders, signatures, inspection findings, recovery amounts, dispute narratives and evidence bodies are prohibited
• the panel makes no automatic request, writes no browser storage and does not modify stable report, PDF or email contracts
• all Wave 4D catalogues remain needs-legal-review

Validation target

• all 57 profiles remain callable
• 44 substantive profiles and 13 governance-fallback profiles
• two Wave 4D profiles and six deterministic scenarios
• eight governed source identities and ten reason-code-scoped chunks
• strict payload minimisation, source-scope integrity and decision/explanation fingerprint preservation
• dedicated browser test plus all existing assessment, report, homepage and workspace regressions

Current validation status

The first browser run reached Playwright and exposed a brittle citation-number assertion; the rendered source title and all authority/privacy behavior were otherwise correct. The assertion now checks the stable source title instead of punctuation-sensitive notification text.

Corrected final head: b7b6300e317e4d59689ae41a910678206f6a7b02.

GitHub has created fresh All-Laws RAG, Executive Assessment, M4 Report Integration and M7 Hardening runs for the corrected head. All four are currently queued without runner assignment, so none is represented as passed or failed yet.

Review gates still open

This stacked PR targets the integrated Wave 4C head on agent/esi-wave4b-coverage-routing. Qualified legal, privacy, RAG, security, test and release approvals remain required. Passing software tests is not legal approval.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b7b6300e31

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Retrieve the selected order-authentication source

For order-authentication-context requests using the default lexical route, retrieval uses only the static profile terms and this five-chunk cap; the ranking returns the inspector, central-rules, Code, recovery-officer, and authorised-officer chunks, omitting esi-orders-authentication-wave4d-001 and its S.O. 2354(E) citation. Consequently, an order-authentication review does not cite the controlled source that specifically governs the selected context; increase the cap or make the declared context influence retrieval.

Useful? React with 👍 / 👎.