How the register works

SPEC-001 Section B.1 fixes five independent axes. They are independent in the strict sense: no value on one axis implies a value on another. A contract can be public or client-only; a disclosure can be bilateral or internal; a form can sit in stage 2 or stage 13.

Axis 1: Kind

Kind decides how a document is rendered, whether it is printable, which letterhead it takes and whether it can be signed at all.

Axis 3: Direction

Direction is the axis that predicts schedule risk. Everything Pensieve produces, Pensieve controls. Everything the hospital produces is a dependency Pensieve cannot control, so those artefacts are minimised, bundled into a single Hospital Input Pack issued at stage 2 rather than dribbled out over weeks, pre-filled wherever a value can be inferred, and tracked with per-item ageing.

Axis 4: Lifecycle stage

Fourteen stages, sequential in dependency and deliberately not sequential in wall-clock time. Fourteen days is only reachable by running the stages in parallel swim-lanes, so several stages are in progress at once. Every stage has a named exit gate, because a stage with no gate has no measurable cycle time and therefore cannot be compressed.

The seven lanes

Stages are the dependency graph; execution runs in seven concurrent lanes. Every artefact is tagged with exactly one lane, which is what makes it possible to say who is blocked and on what without reading anything.

Tier is the axis a visitor feels. Pensieve is unknown and has to buy credibility, and since August 2026 it does that with speed rather than with volume: the public tier is a closed list of seventeen documents, and everything else opens on a click-through NDA with a four business hour target. A gate is still a cost, so the ladder is built to make that cost hours instead of days, to print the latency on the lock, and to ask no sales question at any point.

The first four axes describe the artefact. The fifth describes one instance of it, bound to one hospital and one deal. A template has no state; the instance rendered from it does.

Sub-states

Two kinds carry their own state machine in addition to the one above, because their real lifecycle is not a document lifecycle.

Every artefact has one identifier. It is stable, it is never reused, and it is not recycled when a document is withdrawn: a superseded ID stays pointing at the superseded document so that a contract citing it in 2031 still resolves.

<FAMILY>-<JURISDICTION>-<SEQ>[-<VARIANT>]

FAMILY        3 to 4 characters, from the fixed set below
JURISDICTION  GL | IN | AU | EU | DK | NO | AE
SEQ           three digits, allocated in order, never reused
VARIANT       DM1 | DM2 | DM3 | DM4: a deployment-model-specific variant

MSA-IN-001    Master Services Agreement, India master, first in sequence
DPA-GL-001    Data Processing Agreement, global, first in sequence
WPR-GL-003    Whitepaper, global, third in sequence

Family prefixes

2 records do not conform to the scheme. They are internal index records that predate it, so they are not named here. They are counted rather than tidied out of the total, because a register that quietly excludes its own exceptions is not a register.

Families: the shelf an artefact sits on

Separately from the ID prefix, every artefact belongs to one of sixteen numbered families. The prefix says what shape the document is; the family says what part of the relationship it governs.

Jurisdictions

GL is the global master. A national code means the substance genuinely differs in that jurisdiction: a different statute, a different regulator, a different invoicing format, not that the master was reprinted with a new flag on it.

A trust centre full of documents dated two years ago destroys more trust than no trust centre at all. So every artefact carries a review date, the date is public, and the badge on the document tells the truth about its age whether or not that is flattering.

Review cadence

A review is a decision, recorded: no change required, revised, withdrawn with a successor named, or superseded. “Reviewed” without one of those four outcomes is not a review. A document is also reviewed immediately, regardless of cadence, on a change in law, a security incident engaging it, a sub-processor change, a deployment-model change, or a customer or auditor identifying an error in it.

What the badge shows, and when

Point-in-time reports are governed separately: an assessment, penetration test or attestation shows the date of the activity rather than the date it was uploaded, and where the activity is older than its stated validity period the document is marked expired and the replacement’s status is stated, including “not yet commissioned” where that is the fact.

Beyond the five axes, every row carries the attributes that make the register operational rather than decorative. These are the columns that answer “what is blocking this deal”, “what does this cost in stamp duty” and “which public page breaks if this changes”.