Level 1 · The arc, by handoffs

The arc, by handoffs

The workshop advances in four handoffs (beats). In each, one role acts and the others wait. The icon and the column tell you whose turn it is: 🧭 Nerea at the top (portal · product), 🛡️ James in the middle (portal · quality), 🧑‍💻 Martha on the right (CLI + git). All three are present from beat one.

The hard data in each beat —the commands, the commit message, the diff and the gate colour— is not hand-written: every GuionStep block reads it from the repository’s steps/ script. Were a step to not exist, the build would fail; what you read here is exactly what the repository does. The commands and commit messages are the real Spanish artefacts of the repo you clone, shown verbatim.

1Declare the system and the risk

🧭 Nerea

Nerea is the Product Owner at a botanical garden that wants to auto-label iris specimens by species. She opens the portal and runs the two authoring missions that generate the governance manifest froga.yaml. The mission does not edit the file directly: Nerea fills in a form, the portal validates the data and opens a PR with the resulting froga.yaml. Three things matter in it:

1. The framework is ISO 23894 — and only ISO 23894. No EU AI Act, no prEN, no sector law. The classify-system mission writes the context.applicable_standards block with a single entry: iso/23894@2023. (froga gates a system only against the standards you declare; declaring just ISO means just the ISO process applies.)
2. The tier is declared minimal — by a human. The same mission fills in the classification block with a plain-language justification: “classifying flower species decides nothing about any person; it is outside Annex III of the EU AI Act.” The engine does not infer this — a person declares it and owns it.
3. The risk, in full ISO vocabulary. The identify-risks mission adds risk.species-confusion — “the model confuses versicolor with virginica*.”* It records its likelihood (LIKELY, with sepal features only), its impact on the three axes (individual LOW, society LOW, organization MEDIUM — a wrong catalogue, nobody harmed), the appetite line (organization: MEDIUM), and the treatment plan (add the discriminative features) with the control that will confirm the residual: species-recall, a macro-recall gate set at > 0.90.

The two missions open a PR in the system’s repository. The turn passes to James, who reviews and merges it. In the script, the identity, the framing and the risk programme land as three froga.yaml manifest commits —the diff of the last one shows the risk with its numeric gates fixed before any model exists:

Identidad del sistema (froga init + patch)🧭 Nerea

Contexto, estándares aplicables y encuadre🧭 Nerea

Programa de riesgos con gates numéricos (antes del modelo)🧭 Nerea

Why ISO 23894 and nothing else

ISO 23894 is the international standard for the process of managing AI risk — identify, analyze, evaluate, treat, monitor. It is process guidance, not law: it tells you how to manage risk, never that you must. Level 1 uses it alone, on a system no law touches, to make one point cleanly: the method is worth running on its own merits. When real legislation arrives in Level 2, you will already know the process it leans on — because Article 9 of the EU AI Act points straight back to this same risk-management loop.

See the starting point

The initial state — the manifest, the sepal-only pipeline, before any treatment — is frozen at the tag vldemo-iris/tree/iris-v0.1.0-red. Every beat below links to the tag that captures it, so you can read the exact repository state at each step.

🛡️ James

James receives the PR opened by Nerea’s mission, reviews that the manifest is correct — ISO 23894 framework, minimal tier justified, risk in full vocabulary — and merges it. The declared froga.yaml is now in the repository.

Declared by Nerea Demo · Approved by Diego Demo — in the live portal

You can see this screen live: at demo.venturalitica.ai/demo/systems/iris the portal shows the row «Declared by Nerea Demo · Approved by Diego Demo» exactly as it appears after running this beat with the demo users.

↓ relevo calidad → dev · system + risk declared (ISO 23894 only)

🧑‍💻 Martha

There is nothing to measure yet, but Martha is not idle: she leaves the reproducer ready in git so that, the moment the risk is declared, measuring is immediate. The repository with a uv + DVC project, Fisher’s Iris dataset (public domain) with its Croissant manifest, and the featurization step are already script commits:

Repo, identidad, proyecto uv (uv init + deps), DVC, pubkey y README del reproductor🧑‍💻 Martha

Commands⧉ copy

15

• git init -q -b main
• git config user.email marta@demo.seigarrena.dev
• git config user.name "Marta Demo"
• uv init --bare --name vldemo-iris --python 3.12
• patch: pyproject-index.patch
• uv add "dvc>=3" pyyaml froga "venturalitica==0.6.11" "mlcroissant>=1.0" pyarrow "scikit-learn==1.8.0" pandas joblib
• patch: gitignore.patch
• patch: gitattributes.patch
• patch: readme.patch
• uv sync
• uv run dvc init --no-scm -q
• uv run dvc config core.analytics false
• froga pubkey --out .froga/PUBKEY.txt
• git add -A
• git commit -m "init: repo, proyecto uv (deps reales) y README del reproductor"

Dataset Iris + manifiesto Croissant + versionado DVC🧑‍💻 Martha

Pipeline de rasgos sobre el dataset Iris — escribe Y corre (dvc repro)🧑‍💻 Martha

With the manifest declared and the scaffolding in git, the turn passes to measuring: Martha runs the gate and reports the first colour (beat 2).

Venturalítica·demo.venturalitica.ai

DeclaredNext: run and measure

Venturalítica·demo.venturalitica.ai

Which Annex III category applies?

Education and vocational trainingHR and hiringEssential public servicesCredit scoringHealthcare servicesWelfare services

Which MDR class applies to the device?

Class I (low risk; self-certified)Class I sterile (NB for sterilization)High-risk AIClass I with measurement (NB for metrology)High-risk AIClass IIa (medium risk; NB required)High-risk AIClass IIb (medium-high risk; NB required)High-risk AIClass III (high risk; NB + design dossier)High-risk AI

Any additional regime?

DORA (financial entity)GDPR (personal data)MDR (medical device)ET Art. 64.4.d (employment algorithms)Law 15/2022 (equality)

Venturalítica·demo.venturalitica.ai

Significant risks

IDTitleLikelihoodIndividual impactSocietal impactOrganizational impactAssign treatment to (optional)

1

ID

Title

LikelihoodRareUnlikelyPossibleLikelyAlmost certain

Individual impactLowMediumHighCritical

Societal impactLowMediumHighCritical

Organizational impactLowMediumHighCritical

Assign treatment to (optional)

2Measure V1: the gate comes out red

🛡️ James

Waiting. Nerea has declared the system and the risk; now James waits for Martha’s first measurement. He does not touch the CLI: when Martha reports the gate colour, he will see whether the risk is real and how far above appetite it sits.

↓ relevo calidad → dev · gate RED: macro recall 0.81 < 0.90

🧑‍💻 Martha

Martha takes the manifest and measures the system as it stands today — the inherent risk, untreated. First she compiles the gate contract from froga.yaml —which controls to measure and against what threshold—:

Compilar el plan de evaluación OSCAL (antes del modelo)🧑‍💻 Martha

Commands⧉ copy

• froga compile
• git add -A
• git commit -m "compile: assessment plan OSCAL (contrato del gate, antes del modelo)"

Now she adds the base model —a logreg that, at V1, trains on the sepal measurements alone (FEATURES = ["sepal_length", "sepal_width"] in train.py)— and runs the evidence. froga run reproduces the pipeline, measures the controls and applies the gate:

Modelo logreg base V1 — escribe Y corre (gate RED esperado)🧑‍💻 MarthaExpected verdictRED

📍 reproducir iris-v0.1.0-red

git clone https://github.com/Venturalitica/vldemo-iris
cd vldemo-iris
git switch -c try iris-v0.1.0-red

⧉ copiar

Commands⧉ copy

• patch: params.patch
• patch: dvc-evaluate.patch
• patch: train.patch
• patch: evaluate.patch
• patch: compliance-eval.patch
• froga runmay fail
• git add -A
• git commit -m "modelo: logreg V1 solo-sépalo (train/evaluate + dvc.yaml) — run: V1 evidencia base (gate RED esperado; seed=42)"
• git push -u origin main

You only re-run froga compile when the manifest’s risk: section changes; the treatment (beat 3) changes train.py —not the risk—, so there froga run alone is enough.

The sepal is the green outer leaf — and it is the weak feature: in sepal space, versicolor and virginica genuinely overlap. So the model confuses them. froga run flags the species-recall control RED: macro recall comes out 0.81, below the > 0.90 gate. (Macro recall averages the recall across all three species, so the easy setosa cannot mask the confusion between the other two.) The command exits non-zero —hence the “may fail” note on froga run— but the bundle is still signed and anchored: a RED result is still evidence, recorded honestly. The “reproduce” chip above clones the iris-v0.1.0-red tag and reproduces this very colour.

This RED is real, not a strawman

The failure is an intrinsic property of the data, not a model we crippled on purpose to make a point. Versicolor and virginica overlap in sepal measurements — that is a fact about the flowers (Fisher, 1936). A model that only sees the sepal genuinely cannot tell them apart reliably. The honest move is to surface that as RED, not to lower the bar until it passes.

The risk is real and above appetite; it needs treatment.

Venturalítica·demo.venturalitica.ai

1 action pending

Treat the recall riskmacro recall 0.81 < 0.90

3Treat the risk: the gate turns green

🛡️ James

Waiting. James has seen the RED. He waits for the evidence that the risk has been treated and the residual brought back to appetite — he does not touch git. When Martha pushes the signed GREEN bundle, he will review and approve (beat 4).

↑ relevo dev → calidad · git carries the signed GREEN evidence

🧑‍💻 Martha

This is the heart of the workshop: the treatment. The risk gate is a contract, and Martha only changes the colour by changing something in git — never by editing the threshold. The fix is to give the model the petal measurements (petal_length, petal_width): the petal is the inner coloured leaf, the feature that actually separates versicolor from virginica. In this repo that switch is adding those two columns to the FEATURES list in train.py — the diff is the treatment, and in a single step Martha treats and runs the gate again:

Abre la rama de tratamiento + añade las features de pétalo (§6.5) — escribe Y corre (gate VERDE)🧑‍💻 MarthaExpected verdictGREEN

📍 reproducir iris-v0.2.0-green

git clone https://github.com/Venturalitica/vldemo-iris
cd vldemo-iris
git switch -c try iris-v0.2.0-green

⧉ copiar

Commands⧉ copy

• git checkout -b tratamiento/anadir-petalos
• patch: train-petals.patch
• froga run
• git add -A
• git commit -m "treatment: añade las features de pétalo (las discriminativas) — ISO 23894 §6.5"
• git push -u origin tratamiento/anadir-petalos
• froga pr open --base main --title "iris V2: features de pétalo (cierra el gate de recall)"

Adding the petal columns to FEATURES is the treatment (ISO 23894 §6.5, “risk treatment”): a versioned change in git —the model goes from sepal-only (V1) to all-four-features (V2)— that the engine attributes the risk’s closure to. With the petals in the model, versicolor and virginica separate cleanly. The species-recall control now measures 0.95, comfortably above the > 0.90 gate → GREEN. The engine records the control going RED → GREEN as a treatment event attributed to the treatment commit: the residual is now confirmed by a passing control (the hybrid residual), not merely declared. The signed GREEN evidence now lives in git —under the iris-v0.2.0-green tag, reproducible from the chip above—; Martha pushes it and the turn returns to James. Conformance is emitted in the governance beat.

What Martha just did — and what she did NOT do

Martha closed a complete ISO 23894 treatment loop: she treated the risk with a versioned commit, re-measured, and signed the GREEN evidence. She does not approve the release. Signing proves who produced the evidence and that it is intact; approval is a separate management act that only James can perform. Martha could not approve even if she tried — the next beat shows why.

Venturalítica·demo.venturalitica.ai

●Treated · GREEN

4Governance: conformance, approval and close

🛡️ James

Martha’s signed GREEN evidence is in the repo, with conformance already emitted (Martha’s column). James closes the loop from the portal. Waiting becomes review.

4.1 — Review the evidence. The portal reads the .froga/ bundle through the connection, verifies Martha’s signature with her registered public key, and shows the system declared, treated and GREEN: the species-recall control passed at 0.95, the residual is confirmed at or below appetite, the ISO 23894 loop is closed. The signature check is what lets James trust the evidence came from Martha and was not altered.

4.2 — Approve. James, as the role accountable for the system (owner), approves the release. Martha had requested the approval; James grants it, and the act lands as a signed file in the ledger —.froga/acts/NNNN-approve.json, a DSSE (ECDSA-P256) envelope verifiable against James’s public key declared in signers:— committed by froga:

Aprobar🛡️ James

📍 reproducir iris-v1.0.0-approved

git clone https://github.com/Venturalitica/vldemo-iris
cd vldemo-iris
git switch -c try iris-v1.0.0-approved

⧉ copiar

🖊️ James approves

Reason: «Aprobación: el gate bloqueante de recall (risk.species-confusion) certifica en VERDE tras el tratamiento sépalo→pétalo (V2, recall macro ≈ 0.95 por encima del umbral) — no queda residual pendiente de aceptar.»

The approval is not a row in a database — that signed act is the evidence of approval: it travels with the repo, it is attributable by its signature, and anyone can verify it later.

Martha literally cannot approve

Separation of duties here is not a convention — it is enforced. Martha produces and signs the evidence with her key; the engine will not count an approval act signed with that same key (the cryptographic four-eyes: you do not approve your own request). The approval is signed by James with HIS key declared in signers:. If Martha ran froga approve with her key, it would not count: the person who produced the evidence is not the person who accepts the residual risk. (In a one-person garden the same human can hold both keys, but the two acts remain two separate, attributed signed acts — it is separation of duties recorded in git as signed acts, a four-eyes by key, not a check on declared identity.)

↓ relevo calidad → dev · the signed act .froga/acts/NNNN-approve.json = the approval

🧑‍💻 Martha

Martha closes her part of the cycle from the CLI. With V2 GREEN, she emits the signed conformance and reconstruct —the projection of the bundle onto the ISO 23894 catalogue and the deterministic replay of the cycle— and requests approval:

Conformance + reconstruct firmados🧑‍💻 Martha

Commands⧉ copy

• froga conformance --standard iso/23894@2023 --outmay fail
• froga reconstruct --outmay fail
• git add -A
• git commit -m ".froga: conformance + reconstruct firmados"

Solicitar aprobación (froga request)🧑‍💻 Martha

📍 reproducir iris-v1.0.0-request

git clone https://github.com/Venturalitica/vldemo-iris
cd vldemo-iris
git switch -c try iris-v1.0.0-request

⧉ copiar

git commitsolicitud de aprobación (el acto lo commitea froga request)

The approval is James’s and only James’s (above): Martha requested it with the act before, she cannot grant it herself. Once James’s signed act .froga/acts/NNNN-approve.json lands, Martha re-emits conformance so that froga derives the cycle from the git history —now with the real approval— and re-signs the aggregate over the Approved state:

Re-emitir conformance tras aprobar🧑‍💻 Martha

Commands⧉ copy

• froga conformance --standard iso/23894@2023 --outmay fail
• froga reconstruct --outmay fail
• git add -A
• git commit -m ".froga: re-emisión de conformance + reconstruct tras aprobar"

The system ends up declared, treated, signed and approved: marketable, with James’s signed approval act anchored at the iris-v1.0.0-approved tag above. That is the end of the arc.

Venturalítica·demo.venturalitica.ai

Undeclared

Declared

Assured

Tested

Treated

Approved

Marketable

Venturalítica·demo.venturalitica.ai

Approve the release

Martha produced the evidence; James, as owner, accepts the residual and approves.Reason (optional)

CancelApprove

Practice and recapRun the full arc on your laptop and self-check what you learned.