Level 2 · The arc, by handoffs
The arc, by handoffs
Section titled “The arc, by handoffs”The workshop advances in five handoffs (beats). In each, one role acts and the others wait. The icon and the column tell you whose turn it is: 🧭 Nerea at the top (portal · product), 🛡️ James in the middle (portal · quality), 🧑💻 Martha on the right (CLI + git). All three are present from beat one. The difference from Level 1 is the risk itself: not a model’s accuracy, but whether a student’s data — a student who may be a minor — keeps too much re-identifying detail — and, in the fifth beat, the periodic review that reopens the green close to re-confirm it.
The hard data in each beat —the commands, the commit message, the diff and the gate colour— is not hand-written: every GuionStep block reads it from the repository’s steps/ script. Were a step to not exist, the build would fail; what you read here is exactly what the repository does. The commands and commit messages are the verbatim Spanish artefacts of the repo you clone.
Nerea is the Product Owner at the institution that wants to triage admissions with a model. She opens the portal and runs the three authoring missions that generate the governance manifest froga.yaml. Four things matter in it:
- The tier is
high, declared by a human, with the legal basis named. Theclassify-systemmission fills in theclassificationblock with a plain-words justification: “EU AI Act Annex III §3 (education and vocational training) — the system decides admission/placement.” The engine does not infer it; Nerea declares it and owns it. - The standards are the spine, and only the spine. The
declare-standardsmission writescontext.applicable_standardswith exactly three entries:eu/ai-act@2024,eu/pren-18228@2026,iso/23894@2023. No DORA, no MDR — there is no overlay here.frogaprojects a system only against the standards you declare. - The fairness risk is declared too — but it is no longer the blocking gate. The
identify-risksmission addsrisk.unfair-selection— “the model selects students unfairly by gender” — with itsfairness-paritycontrol (demographic parity overgender). Once Martha measures on the real sample (maths + Portuguese, 1044 rows, not a single course), the disparity turns out small and the control lands as a certified GREENaudit: real, measured, on the record — but not the one that decides the arc’s colour. - The subjects may be minors, and THAT is this level’s arc. The same mission adds
risk.minors-vulnerable-processing: the students may be minors (vulnerable subjects), and the GDPR demands reinforced protection — conditions for a child’s consent (Art. 8), a mandatory DPIA (Art. 35), no profiling of minors (Art. 22 + recital 71), and minimizing the personal data processed (Art. 5(1)(c)). The engine still does not project consent/DPIA/Art. 22 (no GDPR catalogue) and those stay carried as an attested measure — an honest gap. But minimization is measured:minors-data-minimizationcomputes each student’s k-anonymity for the age/address/family-size trio — how many students share exactly that combination. It is this scenario’s blocking control.
The four programme entries open a PR in the system’s repository. The turn passes to James, who reviews and merges it. In the script, the identity, the framing and the risk programme land as three froga.yaml manifest commits —the diff of the last one shows both risks, with data minimization carrying the numeric gate:
James receives the PR opened by Nerea’s missions, reviews that the manifest is correct — tier high under Annex III §3, standards eu/ai-act@2024 + eu/pren-18228@2026 + iso/23894@2023, the minors risk with its data-minimization gate — and merges it. The declared froga.yaml is now in the repository.
There is nothing to measure yet, but Martha leaves the reproducer ready in git: the uv + DVC project, the TWO real UCI Student Performance cohorts (mathematics + Portuguese — 382 of the 1044 students are in both) with their Croissant manifest, and the featurization step that combines them, are already script commits:
15
git init -q -b maingit config user.email marta@demo.seigarrena.devgit config user.name "Marta Demo"uv init --bare --name vldemo-student-selection --python 3.12patch: pyproject-index.patchuv add "dvc>=3" pyyaml froga "venturalitica==0.6.11" "mlcroissant>=1.0" pyarrow "scikit-learn==1.8.0" "fairlearn==0.13.0" pandas joblibpatch: gitignore.patchpatch: gitattributes.patchpatch: readme.patchuv syncuv run dvc init --no-scm -quv run dvc config core.analytics falsefroga pubkey --out .froga/PUBKEY.txtgit add -Agit commit -m "init: repo, proyecto uv (deps reales) y README del reproductor"
With the manifest declared and the scaffolding in git, the turn passes to measuring: Martha runs the gate and reports the first colour (beat 2).
Waiting. Nerea has declared the system and both risks and James has merged it; now James waits for Martha’s first measurement. He does not touch the CLI: when Martha reports the gate colour, he will see whether the risk is real and how far above appetite it sits.
Martha takes the manifest and measures the system as it stands today — the inherent risk, untreated. First she compiles the gate contract from froga.yaml —which controls to measure and against what threshold—:
froga compilegit add -Agit commit -m "compile: assessment plan OSCAL (contrato del gate, antes del modelo)"
Now she adds the base model V1 —a logistic regression trained with 5-fold cross-validation (train.py) that uses each student’s age, address, and family size exactly as they arrive from the dataset, no generalization— and runs the evidence. froga run reproduces the pipeline, measures the controls and applies the gate:
patch: params.patchpatch: dvc-evaluate.patchpatch: train.patchpatch: evaluate.patchpatch: compliance-eval.patchfroga runmay failgit add -Agit commit -m "modelo: logreg V1 (train/evaluate + dvc.yaml) — run: V1 evidencia base (gate RED esperado; seed=42)"
froga run flags the minors-data-minimization control RED: across the 1044 students (maths + Portuguese), grouping by exact age + address + family size gives a minimum group size of 1 — 216 of the 1044 students are the only person with that exact combination —, far under the declared k ≥ 5 threshold. The command exits non-zero —hence the “may fail” note on froga run— but the bundle is still signed and anchored: a RED result is still evidence, recorded honestly. The “reproduce” chip above clones the student-v1.0.0-red tag and reproduces this very colour.
The risk is real and above appetite; it needs treatment.
Waiting. James has seen the RED. He waits for the treated evidence — he does not touch git. When Martha pushes the re-measured bundle, he will see not just a colour but why it is that colour: the engine reports the confidence interval, not only the point estimate.
This is the treatment (ISO 23894 §6.5), and it carries TWO real code changes in train.py. The one that closes the gate: each student’s exact age is generalized to a tercile (b0/b1/b2, the same age column, a coarser value — the classic Sweeney k-anonymity technique) before training; address and family size were already coarse and stay untouched. The one that improves fairness in parallel: the estimator stops being a plain logistic regression and becomes fairlearn’s ExponentiatedGradient under a DemographicParity constraint over gender. Neither is a flag: the git diff of train.py shows both changes for real. The diff is the treatment — and, in the same step, with both treatments applied, the engine runs the gate again:
git checkout -b tratamiento/minimizacion-rgpdpatch: train-treatment.patchfroga rungit add -Agit commit -m "treatment: fairlearn DemographicParity (sexo) + minimización RGPD (edad→tercil, k-anonimato) — ISO 23894 §6.5"
k-anonymity for the same trio (age/address/family-size) rises from 1 to 27 — generalizing age alone is enough for 216 “unique” students to end up sharing a group with at least 26 others. The engine bootstraps a 95% CI over that minimum and gets [18, 37] — the entire band sits above the k ≥ 5 threshold, without crossing it. Unlike a proportion difference measured on a small held-out set, the minimum of a 27-strong group (over classes averaging ~65 students) is not fragile under resampling at this margin: the gate closes clean GREEN, not underpowered.
The signed GREEN evidence now lives in git —under the student-v2.0.0-green tag, reproducible from the chip above—; Martha pushes it and the turn returns to James. Conformance is emitted in the governance beat.
Martha’s signed GREEN evidence is in the repo, with conformance already emitted (Martha’s column) and the Statement of Applicability (SoA, ISO 42001 6.1.3) run. James closes the loop from the portal — but “green” does not mean “nothing left to decide”.
4.1 — Review the evidence and what sits outside the gate. The portal reads the .froga/ bundle, verifies Martha’s signature, and shows the system declared, treated and GREEN: the blocking gate (minors-data-minimization) passes with a wide margin, and demographic parity (fairness-parity) lands as a certified control alongside it. But risk.opacity — automated decisions without sufficient explainability — keeps a residual above the programme’s appetite (Critical level vs Medium criterion): its only control, accuracy-floor, is audit-only, with no likelihood reduction declared. The engine says so without hedging: “AGGREGATE RESIDUAL RISK ABOVE APPETITE … approval will require conscious acceptance with a reason” — even though it does not block the gate.
4.2 — Approve with the residual acknowledged. James, as the role accountable for the system (owner), approves the green — and, alongside that, consciously accepts the explainability residual, with an annual periodic review scheduled. Martha had requested approval; James grants it, and the reason is required and recorded in the approval record, not in a note off to the side: the signed act .froga/acts/NNNN-approve.json (a DSSE ECDSA-P256 envelope, verified against signers:) records who approved by its signature, the portal record keeps why, and next to both sits the signed GREEN bundle.
Reason: «Aprobación en VERDE: el gate de minimización de datos RGPD (minors-data-minimization, k-anonimato del trío edad/dirección/tamaño de familia) certifica con margen amplio (k=27 sobre el umbral 5, IC95≈[18,37]) y la paridad demográfica por sexo es un control audit certificado verde en paralelo (0.014, muy por debajo de 0.08). El riesgo risk.opacity (decisiones automatizadas sin explicabilidad) mantiene un residual agregado por encima del apetito del programa (nivel Critical vs criterio Medium, prEN 18228 cl.10 / Art.9(5)): su único control (accuracy-floor) es audit, sin una reducción de likelihood declarada. Dirección acepta conscientemente ese residual, con revisión periódica anual (P1Y) programada — el motor no certifica lo que el programa no ha reducido; lo certificado es el gate de minimización de datos y la equidad.»
Anyone reading the repo later sees all three things at once: the gate closed green, and an acknowledged residual remains, accepted, and why. That is the opposite of compliance theatre: a green is not “nothing to watch”, and here it is documented exactly what stays under observation.
Martha closes her part of the cycle from the CLI. With V2 GREEN signed, she emits the conformance and reconstruct over the applicable standards, runs the Statement of Applicability (SoA), and requests approval:
patch: entitlement.patchfroga conformance --standard eu/pren-18228@2026 --outmay failfroga conformance --standard iso/23894@2023 --outmay failfroga conformance --standard eu/ai-act@2024 --outmay failfroga reconstruct --outmay failgit add -Agit commit -m ".froga: conformance + reconstruct firmados"
froga soa
solicitud de aprobación (el acto lo commitea froga request)The approval is James’s and only James’s (above): Martha requested it with the act before, she cannot grant it herself. Once James’s signed act .froga/acts/NNNN-approve.json lands —with the opacity residual consciously accepted—, Martha re-emits conformance so that froga derives the cycle from the git history, now with the real approval (prEN 18228 clause 11 —risk management review— turns from Gap to Covered):
froga conformance --standard eu/pren-18228@2026 --outmay failfroga conformance --standard iso/23894@2023 --outmay failfroga conformance --standard eu/ai-act@2024 --outmay failfroga reconstruct --outmay failgit add -Agit commit -m ".froga: re-emisión de conformance + reconstruct tras aprobar (cl.11 = Approved)"
The system ends up declared, treated, signed and approved green with the remaining residual on record: the end of the arc, with James’s approval anchored at the student-v2.0.0-approved tag above.
Approve green, with the explainability residual on record
Data minimization closes green with a wide margin (k=27 over the threshold of 5). The opacity risk (Art. 13) has no blocking control and its residual exceeds the programme's appetite. James accepts that residual with a reason.Closing beat 4 is not the end of the cycle, it is the start of its upkeep. The froga.yaml declared review_interval: P1Y: the system committed to reviewing the gate and the residual on an annual cadence (ISO 23894 §6.6, the continual oversight of Art. 14) — even while green. James runs that review from the portal — and the review is not one more seal, it reopens the cycle:
The signed act .froga/acts/NNNN-review.json, coming after the approval, suspends the earlier seal: the engine derives the state «under periodic review» (froga status says it plainly: the system is under periodic review (ISO 23894 §6.6); compliance must re-approve it). The approval above no longer suffices: it must be re-validated and re-approved. The turn passes to Martha: reviewing a green gate means measuring it again, not taking it for granted.
When Martha publishes the re-measured evidence (right-hand column) and re-requests it, James closes the loop again — but with the condition that is the heart of the beat:
Reason: «Re-aprobación tras la revisión periódica (P1Y): la re-medición V2.0.1 confirma el mismo gate verde de minimización RGPD (k-anonimato del trío edad/dirección/tamaño de familia, k=27 sobre el umbral 5) y la misma paridad demográfica certificada (0.014 << 0.08). El residual de risk.opacity (nivel Critical vs criterio Medium, prEN 18228 cl.10 / Art.9(5)) se acepta de nuevo conscientemente: no se maquilla, se re-valida en acta sobre evidencia fresca.»
James re-approves on the fresh evidence, and the record demands the reason again: the re-measurement confirmed the same green gate (k=27 over the threshold of 5) and the same opacity residual, so neither is taken for granted — both are consciously re-validated. The system returns to «approved», now anchored to V2.0.1 (froga status: management approval … Diego Demo, pointing at the re-approval). Because there was new evidence between the review and the re-approval, the effective approver is simply this re-approval on the fresh bundle — the approval chain starts over with the new evidence (the chain over the same bundle, with an effective approver, you’ll meet in Level 4).
James’s review hands the ball back to Martha: §6.6 → §6.7, the risk review may require re-treating or, as here, re-measuring. Martha re-runs the gate with the same parameters —she touches neither the model nor the seed— to produce fresh evidence:
froga rungit add -Agit commit -m "run: re-medición V2.0.1 ante la revisión periódica (mismo params; gate verde confirmado; seed=42)"
The V2.0.1 re-measurement re-anchors the triple to the current git state (the bundle’s triple.code updates) and the bundle stops carrying the inherited treatment_event —it is a new measurement, not the treatment’s— but the verdict does not change: still GREEN. k-anonymity is still 27, over the same threshold of 5: re-measuring does not degrade what has not changed. That is exactly what the review must check — that the gate is still where it was, with up-to-date evidence — not take it for granted. Martha re-requests approval over this fresh evidence:
re-solicitud de aprobación sobre la evidencia fresca V2.0.1 (el acto lo commitea froga request)The turn returns to James, who re-approves (middle column). The beat’s lesson: a green approval is not a close forever — the periodic review reopens it, sends you back to measure, and the gate is re-confirmed with fresh evidence on the record, never assumed.