Add AEAS visual system and strengthen review readiness

.github/workflows/verify.yml

@@ -7,6 +7,7 @@ on:
     branches:
       - main
       - "agent/**"
+      - "docs/**"
 
 permissions:
   contents: read

CHANGELOG.md

@@ -3,9 +3,21 @@
 All material public changes will be recorded here. Published releases are
 append-only; corrections create a successor release.
 
+## Unreleased
+
+- Improved the public record's short-form orientation and claim traceability.
+- Added a repository social-preview asset with Ata Nasseri's accountable role.
+- Added the AEAS visual system, four claim-bounded explanatory diagrams,
+  audience-specific reading paths, and text fallbacks.
+- Added machine-readable visual metadata plus SVG, PNG, accessibility, source,
+  claim, non-claim, and Markdown-image verification.
+- Strengthened the independent technical review scope, object identity,
+  evidence-handling requirements, and statement template.
+- Extended CI verification to documentation branches.
+- Left Release `v1.0.0`, its immutable assets, and its DOI unchanged.
+
 ## 1.0.0 - 2026-08-19
 
 - Prepared the initial public technical system record.
 - Added the publication boundary, evidence index, assurance method, release
   controls, DOI guidance, and independent-review package.
-

PUBLICATION_GATE.md

@@ -1,5 +1,7 @@
 # Publication Gate
 
+<!-- public-claims: REL-001 -->
+
 > **Repository decision:** AUTHORIZED FOR PUBLIC REPOSITORY DEPLOYMENT
 >
 > **Release decision:** APPROVED FOR PUBLICATION OF `v1.0.0`

README.md

@@ -2,19 +2,55 @@
 
 [![DOI](https://zenodo.org/badge/1339810888.svg)](https://doi.org/10.5281/zenodo.22019207)
 
-<!-- public-claims: AUD-002 AUD-003 SYS-001 TST-001 -->
+<!-- public-claims: ARC-001 AUD-001 AUD-002 AUD-003 AUD-004 AUD-005 BND-001 GOV-001 GOV-002 REL-001 REL-003 REV-001 SYS-001 TST-001 -->
 
 > **Governance, Auditability, and Release Integrity for AI-Assisted Software Engineering**
 
-The Agentic Engineering Assurance System is a governed approach to long-running,
-AI-assisted software delivery. It separates implementation, technical review,
-human authority, evidence, and release so that important decisions remain
-traceable after the conversation that produced them has ended.
+The Agentic Engineering Assurance System is a governed system for long-running,
+AI-assisted software delivery. It keeps implementation, read-only technical
+audit, human authority, evidence, and release distinct so that material
+decisions remain attributable and reviewable after the conversation that
+produced them has ended.
 
-This repository is the public technical system record. It explains the design,
-the implemented control model, the recorded outcomes, and the known limits in a
-form that can be reviewed without exposing the private operating environment or
-its sealed evidence archive.
+This repository is the bounded public technical record. It documents the
+design, implemented control model, recorded outcomes, release evidence, and
+known limitations without disclosing the private operating environment or its
+sealed evidence archive.
+
+## In 30 seconds
+
+| Question | Short answer |
+| --- | --- |
+| **What is this?** | A governed system for long-running, AI-assisted software delivery, documented as a public technical record. |
+| **What does it separate?** | Human authority, implementation, read-only technical audit, durable evidence, and release. |
+| **How is it controlled?** | Bounded work packages, pinned source, explicit finding disposition, owner gates, and a separate release step. |
+| **What can a reader inspect?** | [Public claims and their boundaries](docs/04-public-evidence-index.md), [Release v1.0.0](https://github.com/Atanasseri/agentic-engineering-assurance-system/releases/tag/v1.0.0), [publication metadata](evidence/publication.json), and the [version DOI](https://doi.org/10.5281/zenodo.22019208). |
+| **Who is accountable?** | **Ata Nasseri, System Designer and Assurance Owner.** |
+| **What is the current boundary?** | Evidence-backed and publicly released; independent technical review has not yet been performed, and no external certification is claimed. |
+
+## Choose your reading path
+
+| If you are… | Start here | Then inspect | Primary question answered |
+| --- | --- | --- | --- |
+| A product or system leader | This README and the [System Overview](docs/01-system-overview.md) | [Limitations and Reassessment](docs/05-limitations-and-reassessment.md) | What is governed, who decides, and where are the boundaries? |
+| A technical reviewer | [Implementation Record](docs/02-implementation-record.md) | [Assurance Method](docs/03-assurance-method.md) and [Public Evidence Index](docs/04-public-evidence-index.md) | What was recorded, how was it reviewed, and how strong is each claim? |
+| A risk, governance, or assurance reader | [Assurance Method](docs/03-assurance-method.md) | [Public Evidence Index](docs/04-public-evidence-index.md) and [Limitations](docs/05-limitations-and-reassessment.md) | Which decisions remain human, and what is explicitly not established? |
+| A release or provenance specialist | [Current assurance status](#current-assurance-status) | [Signing and Release](release/SIGNING_AND_RELEASE.md), [publication metadata](evidence/publication.json), and [DOI guidance](release/DOI_AND_ARCHIVAL.md) | Which exact public object is citable, persistent, and integrity-bound? |
+| A prospective independent reviewer | [Independent Review Brief](review/REVIEW_BRIEF.md) | [Review Checklist](review/REVIEW_CHECKLIST.md), [review status](docs/06-independent-review.md), and the immutable [`v1.0.0` GitHub Release](https://github.com/Atanasseri/agentic-engineering-assurance-system/releases/tag/v1.0.0) with its signed Git objects | What must be independently checked before any external conclusion is published? |
+
+## Professional accountability
+
+**Ata Nasseri, System Designer and Assurance Owner**
+
+The accountable scope represented here includes translating objectives and
+constraints into bounded acceptance criteria; defining authority boundaries;
+authorizing audit rounds; deciding criteria changes and residual risk; and
+governing release. AI implementation and audit roles operated within those
+human-defined boundaries.
+
+This describes accountable system and assurance leadership. It does not claim
+sole authorship of every implementation artifact or independent certification
+of one's own work.
 
 ## Why it exists
 
@@ -34,23 +70,24 @@ records, evidence-qualified claims, and controlled release.
 
 ## System at a glance
 
-```mermaid
-flowchart TD
-    O["Owner authority"] --> W["Bounded work package"]
-    W --> I["Implementation"]
-    I --> P["Pinned source and handoff"]
-    P --> A["Read-only technical audit"]
-    A --> D["Resolution and owner gate"]
-    D --> R["Controlled release"]
-```
+![AEAS system map showing human authority above a bounded implementation, read-only audit, disposition, approval, and separate release lifecycle, with durable records below](assets/visuals/system-map.svg)
+
+[Open the full-size system map](assets/visuals/system-map.svg).
 
 The owner defines objectives, acceptance criteria, continuation authority,
 residual-risk decisions, and release approval. The implementation role changes
 the system. The audit role inspects a pinned source position without modifying
-it. Git provides the durable evidence surface connecting all three.
+it. Git provides the durable evidence surface connecting all three. In text,
+the governed sequence is: bounded work package → implementation → exact source
+checkpoint and integrity-bound handoff → read-only audit → finding disposition
+→ owner decision → terminal approval → separate release action.
 
 ## Recorded outcomes
 
+![AEAS recorded outcomes showing bounded report, review, finding, disposition, correction, and per-tier test counts with evidence-class labels](assets/visuals/recorded-outcomes.svg)
+
+[Open the full-size recorded-outcomes visual](assets/visuals/recorded-outcomes.svg).
+
 The sealed private evidence baseline supports the following public statements:
 
 - seven audit reports were preserved across three governed reviews;
@@ -59,6 +96,8 @@ The sealed private evidence baseline supports the following public statements:
   with no CRITICAL finding recorded;
 - resolution records mark 32 findings as fixed and one as settled through an
   owner-ratified criteria revision;
+- each of the six substantive audit reports recorded a changes-required
+  verdict;
 - the final delivery review used two authorized rounds and reported eleven
   MEDIUM findings;
 - three final-round findings were defects introduced by earlier corrective
@@ -97,19 +136,40 @@ constitute external certification.
 | [Independent Review](docs/06-independent-review.md) | Scope and status of third-party review |
 | [References](docs/07-references.md) | External standards and platform mechanisms used by the public release process |
 | [Publication Charter](PUBLICATION_CHARTER.md) | Public/private disclosure boundary |
+| [Visual System](assets/VISUAL_SYSTEM.md) | Semantic color, typography, connector, accessibility, and change-control rules for public visuals |
+| [Visual Manifest](assets/visuals/manifest.json) | Machine-readable claims, sources, dimensions, non-claims, and approval status for every visual asset |
 
 Release and external-review materials are kept separate from the system
 description:
 
 | Package | Purpose |
 | --- | --- |
 | [Publication Gate](PUBLICATION_GATE.md) | Separate repository-deployment, Release, archival, and review gates |
-| [Signing and Release](release/SIGNING_AND_RELEASE.md) | Signed commit, annotated tag, immutable release, and provenance process |
+| [Signing and Release](release/SIGNING_AND_RELEASE.md) | Signed release commit, signed annotated tag, immutable GitHub Release, and provenance process |
 | [DOI and Archival](release/DOI_AND_ARCHIVAL.md) | Zenodo and persistent citation process |
 | [Independent Review Brief](review/REVIEW_BRIEF.md) | Scope for a qualified external reviewer |
-| [Assurance Statement Template](review/ASSURANCE_STATEMENT_TEMPLATE.md) | Required structure of the signed external conclusion |
+| [Independent Review Checklist](review/REVIEW_CHECKLIST.md) | Evidence, identity, method, and conclusion checks for the reviewer |
+| [Independent Technical Review Statement Template](review/ASSURANCE_STATEMENT_TEMPLATE.md) | Required structure of the signed external conclusion |
+
+## Evidence and release chain
+
+![AEAS evidence and release chain separating public claim discipline, the later public release record, and independent scrutiny](assets/visuals/evidence-release-chain.svg)
+
+[Open the full-size evidence-and-release visual](assets/visuals/evidence-release-chain.svg).
+
+The visual deliberately shows three separate groups rather than one unbroken
+proof chain:
+
+1. a public claim is bounded by its identifier, evidence class, source, and
+   explicit non-claims;
+2. the later publication record identifies the signed release commit and
+   signed annotated tag for `v1.0.0`, the immutable GitHub Release, checksums
+   and provenance workflow, and persistent version DOI without changing those
+   released objects; and
+3. independent scrutiny remains `NOT_PERFORMED` until a qualified reviewer
+   publishes a scoped conclusion under their own control.
 
-## Evidence relationship
+## Private evidence relationship
 
 This public record derives from a sealed private baseline identified as
 `PTE-2026-08-19-v1.0.1`. The baseline manifest is committed here only by its
@@ -123,21 +183,21 @@ The digest is a commitment to a specific private manifest. It does not reveal
 the manifest, independently validate its contents, or grant public access to
 the underlying evidence.
 
-## Professional accountability
-
-**Ata Nasseri — System Designer and Assurance Owner**
-
-Accountability included objectives, constraints, acceptance criteria,
-authority boundaries, audit authorization, owner decisions, residual-risk
-acceptance, and release governance. AI implementation and audit roles operated
-within those human-defined boundaries.
-
-## Assurance statement
-
-This repository is evidence-backed but is not yet externally certified. The
-independent-review package is prepared so that a qualified reviewer can assess
-a precise signed release and publish a scoped assurance statement without
-overstating what was examined.
+## Current assurance status
+
+Release `v1.0.0` has verified signed Git objects and an immutable GitHub
+Release. Its release assets have SHA-256 checksums and GitHub artifact
+attestations; Zenodo provides a separate persistent version DOI. Independent
+technical review has not yet been performed, and no external certification is
+claimed. The [independent-review package](review/REVIEW_BRIEF.md) is prepared
+so that a qualified reviewer can assess that precise release commit, signed
+annotated tag, and immutable GitHub Release, then publish a scoped conclusion
+tied to them.
+
+The immutable `v1.0.0` GitHub Release remains the citable release object, bound
+to a signed release commit and signed annotated tag. The default branch
+contains later publication-record and documentation refinements; they do not
+alter those signed Git objects, the Release assets, or the DOI.
 
 ## Use and citation
 

assets/README.md

@@ -1,16 +1,38 @@
 # Visual Assets
 
-This directory is reserved for the approved public visual system.
+This directory contains the repository's public visual assets.
 
-The planned visual set is:
+## Repository social preview
 
-1. system context and responsibility boundary;
-2. work-to-release evidence chain;
-3. audit state and owner gates;
-4. trust and assurance boundaries; and
-5. outcomes and engineering lessons.
+[`visuals/social-preview.png`](visuals/social-preview.png) is the primary
+1280×640 social preview for the repository. It presents the system's governance,
+audit, evidence, and release flow as a conceptual visual; it is not evidence and
+does not reconstruct the private operating topology.
 
-Markdown diagrams in the current documents are structural working visuals. The
-final branded assets will be produced only after the written system record is
-approved, so design does not outrun evidence.
+The composition identifies the accountable professional role used throughout
+the public record:
 
+> **Ata Nasseri, System Designer and Assurance Owner**
+
+To activate it on GitHub, upload the PNG under **Settings → General → Social
+preview** after the signed documentation change is merged.
+
+## Implemented explanatory visuals
+
+| Asset | Purpose | Primary placement |
+| --- | --- | --- |
+| [`visuals/system-map.svg`](visuals/system-map.svg) | Governed work-to-release lifecycle and durable-record spine | Repository README |
+| [`visuals/recorded-outcomes.svg`](visuals/recorded-outcomes.svg) | Bounded recorded outcomes with evidence-class labels and visible non-claims | Repository README |
+| [`visuals/evidence-release-chain.svg`](visuals/evidence-release-chain.svg) | Separation of claim discipline, the later public release record, and independent scrutiny | Repository README and Assurance Method |
+| [`visuals/authority-matrix.svg`](visuals/authority-matrix.svg) | Decision rights, role limits, and durable controls | System Overview |
+
+The [AEAS Visual System](VISUAL_SYSTEM.md) defines the semantic palette,
+typography, connector grammar, accessibility contract, and change controls.
+The machine-readable [`visuals/manifest.json`](visuals/manifest.json) registers
+every PNG and SVG with its dimensions, claim identifiers, sources, explicit
+non-claims, independent-review status, and owner-approval status.
+
+Each explanatory visual has adjacent Markdown text or a table as a fallback.
+New visuals enter the manifest as `DRAFT`. Only the Assurance Owner may change
+their status to `OWNER_APPROVED` after reviewing the exact renders in an
+authorized change.