# VRX-PACK-BASELINE-001 — URS 36–41 Controlled Baseline Map

| Field | Value |
|---|---|
| Document ID | VRX-PACK-BASELINE-001 |
| Purpose | Operationalizes PACK-COR-001. Pins one controlled code baseline (or a signed per-module baseline map) for the URS 36–41 pack so module-level current-state evidence is traceable and not pooled across moving branches. |
| Status | **DRAFT — for QA + CSV/CSA + Engineering sign-off. Not approved.** |
| Date | 2026-06-07 |
| Repository | `verixaai/verixa` (private; default branch `main`) |
| Enumeration method | Read-only `git for-each-ref` over the local clone's `origin/*` remote-tracking refs (2026-06-08 sync). **Live `git fetch --all` returned rc=1 in this sandbox (network-limited)** — the branch list below reflects the local clone's refs and **shall be re-confirmed against GitHub** before freeze. |
| Owners | Engineering (baseline capture) · CSV/CSA + QA (approve) |

> **Rule (binding once approved):** No URS 36–41 module may claim "verified current state," "built," "present," or any file:line evidence **unless it cites a row in this map**. A claim pinned to a moving branch without a commit SHA is **not** acceptable current-state evidence.

---

## 1. Branch enumeration (repository reality)

- **Total `origin/*` branches: 122** (excluding `origin/HEAD`). Full enumeration retained as the evidence artifact for this map; key branches below.
- The pack is **not** built on the default branch. `origin/main` HEAD is `346f835b` (2026-03-18) — months behind the pack's cited baselines.

| Branch | HEAD (short) | Date | Relevance to pack |
|---|---|---|---|
| `origin/main` | `346f835b` | 2026-03-18 | Default branch — **stale**; not the pack baseline |
| `origin/development` | `59a6ced4` | 2026-04-03 | Integration — stale vs pack |
| `origin/dev-vimal-audit-2` | **`3bd2fe47`** | 2026-05-28 | **Frozen audit branch** — URS-40 + URS-39B baseline |
| `origin/dev-vimal-deploy` | **`9829330b`** | **2026-06-08** | **LIVE / moving** — URS-37(corrected), URS-41, URS-36 reference this branch |
| `origin/feat/urs-36-licensing-entitlements` | `29401892` | 2026-05-13 | URS-36 feature lineage |
| `origin/feat/engineer-b-licensing-subscription-commercial` | `8e63b3ab` | 2026-05-14 | URS-36 commercial lineage |
| `origin/fix/urs-36-license-tenant-isolation` | `4aea7504` | 2026-05-25 | **URS-36 BLK-36-01 (RLS/isolation) — audit this branch** |
| `origin/fix/spec-alignment-substrate-verify-21cfr11` | `0ac09565` | 2026-06-04 | Part 11 substrate alignment (relevant to PACK-COR-005) |

**Verified ancestry:** `d8ccdb97` (the commit URS-41 cites and URS-37 PATCH-002 verified against) **is an ancestor of** the live `dev-vimal-deploy @ 9829330b`. So `d8ccdb97` is a real, reachable point on the deploy branch — but the branch has since advanced by one or more commits as of 2026-06-08.

## 2. Per-module baseline pins (verified)

| Module | Cited baseline (verbatim source) | Commit pinned? | Verified vs repo | Classification |
|---|---|---|---|---|
| URS-36 | "Verixa Platform Architecture (**dev-vimal-deploy branch**)", 2026-05-13; ADR-004 / VX-FLOW-038 | **No SHA** | Branch exists; no commit | **UNPINNED — not acceptable as current-state evidence** |
| URS-37 (v1.2 → corrected) | v1.2 claimed greenfield; corrected by VRX-URS37-PATCH-002 to **`dev-vimal-deploy @ d8ccdb97`** | Yes (via PATCH-002) | GMP substrate verified at `d8ccdb97` | **PINNED (moving branch)** |
| URS-38 | Documents existing `dashboard` module; "subject to repository verification" | **No SHA** | Branch/module not pinned | **UNPINNED** |
| URS-39A | None (non-GxP demo) | N/A | N/A | **N/A (no code baseline)** |
| URS-39B | "**`dev-vimal-audit-2 @ 3bd2fe47`** (READ-ONLY static audit, 2026-05-31)" | Yes | Matches `origin/dev-vimal-audit-2` exactly | **PINNED (frozen branch)** ✓ |
| URS-40 | "branch **`dev-vimal-audit-2`** · commit **`3bd2fe47ba70…2df4`** (2026-05-28)" | Yes | Matches exactly | **PINNED (frozen branch)** ✓ |
| URS-41 | "Branch reviewed: **`dev-vimal-deploy` · HEAD `d8ccdb97`**; prior `3bd2fe47` historical" | Yes | `d8ccdb97` is ancestor of live `9829330b` | **PINNED (moving branch — now stale vs HEAD)** |

## 3. The divergence problem (precise)

Three different baseline regimes are mixed in one launch pack:

1. **Frozen-branch pins (good):** URS-40, URS-39B → `dev-vimal-audit-2 @ 3bd2fe47`. Reproducible; line pins stable.
2. **Moving-branch pins (hazard):** URS-37(corrected), URS-41 → `dev-vimal-deploy @ d8ccdb97`, which is **already behind** live HEAD `9829330b` (2026-06-08). "Verified present/current" on a moving branch decays the moment the branch advances.
3. **Unpinned (not acceptable):** URS-36, URS-38 → branch name only, no commit. Cannot be reproduced or re-verified.

A coordinated validation package **cannot** pool evidence across (1)+(2)+(3). Either freeze one reference commit, or pin every module to an explicit SHA with a stale-evidence rule.

## 4. Controlled baseline decision (recommended)

**Option A (preferred) — single frozen pack baseline.** Choose ONE commit as the pack's current-state reference (recommend cutting a **frozen tag**, e.g. `urs-36-41-baseline-v1 @ <SHA>` off `dev-vimal-deploy` at a controlled point), and re-pin every module's current-state evidence to that tag. Eliminates moving-target drift.

**Option B — signed per-module baseline map (this document).** Keep per-module pins but (a) convert every UNPINNED row to an explicit SHA, (b) for moving-branch pins, record the SHA **and** a re-verification trigger, (c) QA + CSV/CSA + Engineering sign the map. Acceptable only with §5 rules enforced.

Either option requires: no module cites a branch without a SHA; `main`/`development` are explicitly **not** the baseline; and the chosen baseline is recorded under change control (URS-13).

## 5. Re-verification triggers & stale-evidence rule

| Trigger | Action |
|---|---|
| Any module cites a moving branch (`dev-vimal-deploy`) | Re-verify all of that module's file:line claims against the current branch HEAD before freeze; record the new SHA. |
| Branch HEAD advances past the pinned SHA | Module current-state evidence is marked **STALE**; status reverts to `Draft / blockers open / not executed / not approved` until re-verified. |
| Baseline re-pointed for any reason | All dependent modules' line numbers re-confirmed; map re-signed. |
| Validation package creation | The package **shall** reference this map as its baseline-control input; every file:line evidence row traces to one map row. |
| Pack freeze | Live `git fetch` + branch re-enumeration against GitHub (this map's enumeration was sandbox-local, fetch rc=1). |

**Stale-evidence rule:** evidence pinned to a moving branch is valid **only** at the named SHA. The moment `dev-vimal-deploy` advances (it advanced to `9829330b` on 2026-06-08), URS-37 and URS-41 "verified present" claims at `d8ccdb97` are **provisional** until re-confirmed at the new HEAD or against a frozen tag.

## 6. Required actions

1. Decide Option A vs B (recommend A — frozen pack tag). [Engineering + CSV/CSA + QA]
2. Convert URS-36 and URS-38 from branch-only to explicit SHA (or the frozen tag). [Engineering]
3. Re-verify URS-37 + URS-41 file:line evidence at the chosen baseline (they currently sit at `d8ccdb97`, now behind HEAD). [Engineering + CSV/CSA]
4. Re-confirm the 122-branch enumeration against GitHub live (sandbox fetch was rc=1). [Engineering]
5. Record the chosen baseline under URS-13 change control and sign this map. [QA + CSV/CSA + Engineering]

| Boundary Check | Result |
|---|---|
| Primary lens | CSV/CSA (baseline qualification) + Product/Engineering Architect |
| Owned deliverable | Controlled baseline map + re-verification triggers + stale-evidence rule |
| Out-of-scope (deferred) | Final QA approval → Head of QA; the frozen-tag cut → Engineering under change control |
| Repo | Read-only; enumeration from local clone refs; live fetch rc=1 (re-confirm before freeze) |
| Final status | Draft — controlled change required (URS-13); Head of QA + CSV/CSA sign-off required |

*Verified read-only against `verixaai/verixa` local clone (origin refs synced 2026-06-08). No repo files modified. No claim of validation, compliance, or approval.*