Prompt 14A - Scoring governance, verification separation, and safe report rendering

Prompt

Turn the current results tools into a governed reporting system. Separate participant interpretation from methodology administration and technical diagnostics.

1. Scoring policy governance

Create a versioned scoring-policy object covering:

• scale and anchors
• Not observed handling
• relationship weights
• statement-to-construct mapping
• aggregation and rounding
• minimum-group suppression
• imported-source transformations
• benchmark use, if any

A campaign/report must reference an immutable published policy version.

Ordinary subjects must not change peer, manager, or other rater weights for an official report. Scenario analysis, if retained, must be clearly labelled, permission-gated, non-destructive, and never confused with the published result.

2. Verification and diagnostics

Move "run verify," raw JSON status, recompute controls, and internal export diagnostics into an authorized methodology or support surface.

The subject report should show a plain-language integrity/status message only when useful. It must not expose implementation-level controls.

3. Safe report rendering

Prefer native product components for interactive reports and wiki/help content.

If server-generated HTML remains:

• sanitize it
• use a restrictive iframe sandbox
• define CSP
• prevent script access to parent/session data
• define origin and navigation behavior
• test keyboard, screen reader, zoom, print, and PDF
• prevent imported HTML or comments from executing

Do not insert untrusted HTML into same-origin srcdoc without an approved security design.

4. Export boundary

Exports must not require a private key in a URL or expose it to server logs. Generate/decrypt at the approved trust boundary and audit the export without logging report content or secrets.

5. Tests

• immutable policy/version linkage
• unauthorized weight change
• scenario versus official result separation
• suppression under alternate weights
• report HTML injection
• iframe escape/navigation
• export secret leakage
• chart/table equivalence
• imported-report lineage

Acceptance gates

• A published score can be reproduced from its versioned policy and evidence.
• A participant cannot alter the official result.
• No private key appears in report/export URLs or service logs.
• Interactive report rendering meets the approved security and accessibility model.