nikolai-v0.2Current2026-09-19
Mapping Declarations and Assurance roles
N10 (Assurance roles) populated for the first time — all ten tracks now carry seeded elements — and the "declare your mapping" mechanism v0.1's own REST validator referred to as "a separate, publicly-tracked process" is now live: a named organisation can prove control of an email at its own domain, then file an official Mapping Declaration confirming, disputing, or adding to a NIKOLAI crosswalk row, reviewed by a CASRAI editor before it can change a row's status from shadow mapping to declared.
Shipped
- 6 new nikolai_element entries under N10 (Declaring Representative, CASRAI Declaration Reviewer, Corroborating Evaluator, Declaration Disputant, Declaration Accuracy Steward, Declaration Role Statement) — CASRAI's own editorial synthesis, structurally modelled on the real ANSI/NISO Z39.104-2022 (CRediT) contributor-role standard rather than a literal reuse of its 14 authorship roles, and checked against N9's existing mapping-declaration and accountable-decision-maker elements to avoid duplicating either. 64 elements total.
- New mu-plugin casrai-nikolai-declarations.php: domain-matched-email account verification (a lab or regulator account activates immediately on verification; an evaluator account additionally requires manual CASRAI admin acceptance, since evaluators are held to a higher bar than an organisation describing its own framework), a nikolai_declaration CPT, and an admin-moderation metabox wired to the same REST routes rather than a direct post-meta save.
- Every declaration, from every organisation type, sits at pending_review until a CASRAI editor approves it — the one and only code path anywhere in this codebase that can set a crosswalk row's declared_by to non-null. The seed importer's own write endpoint still unconditionally rejects one, unchanged.
- Schema correction: NikolaiCrosswalkRow.isShadow now reads the real stored value instead of hard-coding true, and gained a declaredAt field. Still safe — every write path except the new admin-gated approval still hard-rejects is_shadow:false. A new declarations field on NikolaiElement exposes published declarations only.
- /nikolai/declare (explainer), /nikolai/declare/signup, /nikolai/declare/verify, and /nikolai/declare/dashboard shipped, plus a "Declared, not just shadow-mapped" section on the element page for elements with a published declaration.
- A same-day critical audit (before this feature saw its first real declaration) found and fixed several real bugs: approval matched crosswalk rows by organisation name alone and could silently flip every row from that org on an element, not just the one a declaration concerned — fixed with a stable row_id per row; a filed "dispute" had zero differentiated effect from a "confirm" — a dispute now replaces the targeted row's content with the org's own correction and is permanently flagged; the declaration-filing surface had no rate limiting despite the codebase's own established limiter existing for exactly this abuse class — added; the read-modify-write in approve() had no lock — wrapped in the same mutex pattern already used once for a prior seed-race incident; a "confirm" needed no citation at all — now required for every declaration type. Also corrected the stale institutional name "UK AI Safety Institute" (renamed to the UK AI Security Institute in Feb 2025) across six crosswalk rows and two track intros.
Explicitly not included in this release
- No corroboration/dispute UI beyond the plain declaration_type field — a Corroborating Evaluator or Declaration Disputant role (N10) is not yet a distinct step in the submission form itself.
- Admin moderation is a wp-admin metabox, not a dedicated review dashboard.
- The org-domain list is a hand-curated ~20-organisation set (researched, not exhaustively hand-verified against DNS/MX records) — an organisation not on it cannot sign up without a CASRAI editor adding it first.
