When we are the ones who were wrong

1. Automated status hold — within 4 hours

   The platform API toggles every affected notary record to REVIEW REQUIRED via an automated kill-switch. Anyone who checks a held manifest at /verify sees the hold immediately. This step needs no human on a weekend; that is why it is automated and why the earlier “4-hour manual root-cause analysis” promise was withdrawn (audit finding #41).

2. Customer written notification — within 24 business hours

   Formal notice to the client CDAO or VP Data: what was found, which bundles are affected, what the hold means for any decision taken on them, and what happens next.

3. Re-evaluation and root-cause analysis — within 5 business days

   The test battery is re-run at zero charge. A formal RCA and an updated, re-signed audit bundle are delivered. The new bundle references the recalled one; the recalled one is never edited or deleted.

What triggers a recall

• An invariant in the shared catalogue is found to be wrong (a false positive or, worse, a false negative pattern).
• A benchmark scoring error is found in the sequestered or external partition that affects a release gate.
• A runner build is found to have a defect that could have affected results, or a signing key is compromised.
• A rater on a Sev-1 adjudication is found, through gold canaries, to have been below the qualification gate at the time.

What does not trigger a recall

• A customer disagreeing with a finding. That is adjudication (Tier 4), tracked in the Finding Overturn Rate, and the outcome is recorded in the bundle.
• A subsequent schema change that makes an old finding moot. That is a new bundle lineage.

Reporting a suspected flaw

Customers, reviewers and third parties can report a suspected method flaw to [email protected]. We acknowledge within 2 business days. If a report from outside EvalQA leads to a recall, we credit the reporter in the RCA if they wish.

Where holds are visible

Only in the notary and in the customer’s own notification. We do not publish a list of held manifests, because a held manifest is customer-identifying to anyone who already holds the bundle and meaningless to anyone who does not.

Check a manifest → Independence Charter