Claims Register - Truth Audit System

Overview¶

The Claims Register is a strict audit trail mapping every material security, privacy, and operational claim made in FirstTry documentation to:

1. Proof Type: EVIDENCE (file in repo) or ATLASSIAN (Atlassian docs reference)
2. Proof Pointer: Exact file path or URL where proof exists
3. Validation Rule: How the claim is verified (deterministic, fail-closed)
4. Owner: Team responsible for claim accuracy

All claims not in this register that use absolute language ("no", "guaranteed", "always", "never", "certified", etc.) will fail automated Truth Audit validation.

Claims Register Table¶

Banned Absolute Phrases¶

The following phrases are forbidden unless the exact claim is registered above:

• "no pii" (use: "minimize PII; Jira may contain PII")
• "automatically deleted" (use: "deletion workflow; 30-day SLA; Forge platform dependent")
• "no subprocessors" (use: "no independent subprocessors; Atlassian Forge is the processor")
• "guaranteed" (use: "best-effort", "SLA", "support response times")
• "certified" (use: "control mapping", "claims register", "evidence documentation")
• "compliant" (use: "aligned with", "control mapping")
• "cloud fortified" (banned term; do not use)

Any banned phrase found in docs/**/*.md must correspond to a registered claim in this table, or Truth Audit will fail.

Truth Audit Procedure¶

1. Parse: truth_claims_gate.mjs reads this table
2. Validate EVIDENCE proofs: File must exist at ProofPointer and contain keyword validations
3. Validate ATLASSIAN proofs: ProofPointer must be https://developer.atlassian.com/ URL
4. Scan docs: Search all docs/**/*.md for banned phrases
5. Cross-reference: Every banned phrase must map to a registered claim
6. Fail-closed: Non-zero exit if any error; detailed error messages logged
7. Deterministic: Same input always yields same output

Proof Inventory¶

EVIDENCE Proofs (Must Exist in Repo)¶

ATLASSIAN Proofs (External References)¶

Claim Review Schedule¶

Version History¶

Amendment Procedure¶

To add a new claim:

1. Gather evidence (file path or Atlassian docs URL)
2. Define ValidationRule (what determines if claim is true)
3. Add row to Claims Register Table
4. Run truth_claims_gate.mjs to validate
5. Commit with message: "Truth Audit: add claim CXxx - [description]"

To modify existing claim:

1. Update ClaimText, ProofPointer, or ValidationRule
2. Re-run truth_claims_gate.mjs
3. Update LastReviewed with today's date
4. Commit with message: "Truth Audit: update claim CXxx - [reason]"