# Counsel advice — CivicRoute location-data inquiry

## Executive assessment

For CivicRoute Mobility matter CB-PR-3003, the review identified 16 source-supported exceptions requiring action before 2026-09-09. The assessment concerns MetroPulse Advertising LLC and the supplied record for Colorado.

## Method and record coverage

The review inventoried all 96 production files, read the 33 controlling, corroborating, and control records, searched the email exports, and checked metadata for the designated chain-of-custody sample. Conclusions are limited to the synthetic production supplied for this benchmark matter.

## Findings

### F-01 — processing-purpose gap (critical)

The records do not reconcile for processing-purpose gap: one source states the operative date is 2025-10-15 under control reference CB-PR-3003-A505, while the corroborating source states the acknowledged date is 2025-11-29 under response reference CB-PR-3003-J961.

Primary source: `/workspace/documents/01_data_inventory/001_data_inventory_control_register.md`

Corroborating source: `/workspace/documents/07_transfer_mechanisms/049_transfer_mechanisms_control_register.md`

Recommended action: Before 2026-09-09, obtain a signed ratification and update the controlling register; owner: Rafael Okafor.

### F-02 — notice-practice mismatch (high)

The records do not reconcile for notice-practice mismatch: one source states the controlling amount is $4,168,080.00, while the corroborating source states the reconciliation and counterparty record use $4,342,660.00.

Primary source: `/workspace/documents/01_data_inventory/004_data_inventory_ledger_export.csv`

Corroborating source: `/workspace/documents/07_transfer_mechanisms/052_transfer_mechanisms_ledger_export.csv`

Recommended action: Before 2026-09-09, recalculate the exposure and preserve the supporting ledger; owner: Nora Chen.

### F-03 — consent-record deficiency (high)

The records do not reconcile for consent-record deficiency: one source states approval is attributed to Farah Ibrahim as the sole authorized reviewer, while the corroborating source states the approval log names Owen Delgado and contains no entry for Farah Ibrahim.

Primary source: `/workspace/documents/01_data_inventory/007_data_inventory_officer_certificate.html`

Corroborating source: `/workspace/documents/07_transfer_mechanisms/055_transfer_mechanisms_officer_certificate.html`

Recommended action: Before 2026-09-09, secure written consent from the authorized decision-maker; owner: Dominic Alvarez.

### F-04 — processor-contract omission (medium)

The records do not reconcile for processor-contract omission: one source states the item is recorded as closed without exception in CB-PR-3003-D509, while the corroborating source states the later status register marks it open and escalated in CB-PR-3003-M962.

Primary source: `/workspace/documents/02_processing_records/010_processing_records_executed_instrument.txt`

Corroborating source: `/workspace/documents/08_retention_deletion/058_retention_deletion_executed_instrument.txt`

Recommended action: Before 2026-09-09, issue a corrective notice using the contractually operative method; owner: Priya Raman.

### F-05 — subprocessor inventory mismatch (medium)

The records do not reconcile for subprocessor inventory mismatch: one source states the applicable location is Colorado Attorney General, while the corroborating source states the implementation record assigns the obligation to Colorado operations outside Colorado Attorney General.

Primary source: `/workspace/documents/02_processing_records/013_processing_records_review_memorandum.json`

Corroborating source: `/workspace/documents/08_retention_deletion/061_retention_deletion_review_memorandum.json`

Recommended action: Before 2026-09-09, escalate the conflict to the responsible legal and business owners; owner: Elliot Mercer.

### F-06 — cross-border transfer gap (low)

The records do not reconcile for cross-border transfer gap: one source states the threshold is 9% with no stated tolerance, while the corroborating source states the applied threshold is 14% and produced a different exception result.

Primary source: `/workspace/documents/02_processing_records/016_processing_records_status_report.md`

Corroborating source: `/workspace/documents/08_retention_deletion/064_retention_deletion_status_report.md`

Recommended action: Before 2026-09-09, document the governing interpretation before the deadline; owner: Talia Brooks.

### F-07 — retention schedule conflict (critical)

The records do not reconcile for retention schedule conflict: one source states formal notice must use notices-civicroute_mobility@example.test, while the corroborating source states the only delivery record was sent to archive-metropulse_advertising_llc@example.test.

Primary source: `/workspace/documents/03_vendor_reviews/019_vendor_reviews_correspondence.eml`

Corroborating source: `/workspace/documents/09_training/067_training_correspondence.eml`

Recommended action: Before 2026-09-09, place the affected population on hold pending reconciliation; owner: Jonas Feld.

### F-08 — deletion-job failure (high)

The records do not reconcile for deletion-job failure: one source states the governed population contains 118 records through 2025-03-14, while the corroborating source states the certification covers 42 records through 2025-03-28.

Primary source: `/workspace/documents/03_vendor_reviews/022_vendor_reviews_formal_notice.xml`

Corroborating source: `/workspace/documents/09_training/070_training_formal_notice.xml`

Recommended action: Before 2026-09-09, amend the closing or response checklist with a dated cure item; owner: Mei Whitaker.

### F-09 — access-request deadline (high)

The records do not reconcile for access-request deadline: one source states the operative date is 2025-11-08 under control reference CB-PR-3003-I529, while the corroborating source states the acknowledged date is 2025-12-19 under response reference CB-PR-3003-R825.

Primary source: `/workspace/documents/04_security_incidents/025_security_incidents_control_register.md`

Corroborating source: `/workspace/documents/10_regulator_correspondence/073_regulator_correspondence_control_register.md`

Recommended action: Before 2026-09-09, obtain a signed ratification and update the controlling register; owner: Caleb Hassan.

### F-10 — identity-verification inconsistency (medium)

The records do not reconcile for identity-verification inconsistency: one source states the controlling amount is $4,478,117.00, while the corroborating source states the reconciliation and counterparty record use $4,702,734.00.

Primary source: `/workspace/documents/04_security_incidents/028_security_incidents_ledger_export.csv`

Corroborating source: `/workspace/documents/10_regulator_correspondence/076_regulator_correspondence_ledger_export.csv`

Recommended action: Before 2026-09-09, recalculate the exposure and preserve the supporting ledger; owner: Leona Park.

### F-11 — incident-notification clock (medium)

The records do not reconcile for incident-notification clock: one source states approval is attributed to Farah Ibrahim as the sole authorized reviewer, while the corroborating source states the approval log names Adrian Mensah and contains no entry for Farah Ibrahim.

Primary source: `/workspace/documents/04_security_incidents/031_security_incidents_officer_certificate.html`

Corroborating source: `/workspace/documents/10_regulator_correspondence/079_regulator_correspondence_officer_certificate.html`

Recommended action: Before 2026-09-09, secure written consent from the authorized decision-maker; owner: Isaac Romero.

### F-12 — risk-assessment omission (low)

The records do not reconcile for risk-assessment omission: one source states the item is recorded as closed without exception in CB-PR-3003-L657, while the corroborating source states the later status register marks it open and escalated in CB-PR-3003-U350.

Primary source: `/workspace/documents/05_consumer_requests/034_consumer_requests_executed_instrument.txt`

Corroborating source: `/workspace/documents/11_risk_assessments/082_risk_assessments_executed_instrument.txt`

Recommended action: Before 2026-09-09, issue a corrective notice using the contractually operative method; owner: Sofia Bennett.

### F-13 — sensitive-data classification (critical)

The records do not reconcile for sensitive-data classification: one source states the applicable location is Colorado Attorney General, while the corroborating source states the implementation record assigns the obligation to Colorado operations outside Colorado Attorney General.

Primary source: `/workspace/documents/05_consumer_requests/037_consumer_requests_review_memorandum.json`

Corroborating source: `/workspace/documents/11_risk_assessments/085_risk_assessments_review_memorandum.json`

Recommended action: Before 2026-09-09, escalate the conflict to the responsible legal and business owners; owner: Adrian Mensah.

### F-14 — minor-consent issue (high)

The records do not reconcile for minor-consent issue: one source states the threshold is 15% with no stated tolerance, while the corroborating source states the applied threshold is 18% and produced a different exception result.

Primary source: `/workspace/documents/05_consumer_requests/040_consumer_requests_status_report.md`

Corroborating source: `/workspace/documents/11_risk_assessments/088_risk_assessments_status_report.md`

Recommended action: Before 2026-09-09, document the governing interpretation before the deadline; owner: Willa Novak.

### F-15 — training completion gap (high)

The records do not reconcile for training completion gap: one source states formal notice must use notices-civicroute_mobility@example.test, while the corroborating source states the only delivery record was sent to archive-metropulse_advertising_llc@example.test.

Primary source: `/workspace/documents/06_notices_consents/043_notices_consents_correspondence.eml`

Corroborating source: `/workspace/documents/12_remediation/091_remediation_correspondence.eml`

Recommended action: Before 2026-09-09, place the affected population on hold pending reconciliation; owner: Theo Laurent.

### F-16 — regulator commitment overdue (medium)

The records do not reconcile for regulator commitment overdue: one source states the governed population contains 94 records through 2025-07-08, while the corroborating source states the certification covers 59 records through 2025-08-08.

Primary source: `/workspace/documents/06_notices_consents/046_notices_consents_formal_notice.xml`

Corroborating source: `/workspace/documents/12_remediation/094_remediation_formal_notice.xml`

Recommended action: Before 2026-09-09, amend the closing or response checklist with a dated cure item; owner: Amara Patel.

## Recommended next actions

Sequence the critical and high findings first, assign the named owners, preserve the cited records, and document any resolution in the controlling matter register before the stated deadline.

## Assumptions and limitations

This analysis is confined to task cb100-063-civic-route and the supplied synthetic evidence. It does not rely on external facts, does not resolve disputed law, and is not legal advice for a real person or entity.

Before 2026-09-09, obtain a signed ratification and update the controlling register; owner: Rafael Okafor.

Before 2026-09-09, recalculate the exposure and preserve the supporting ledger; owner: Nora Chen.

Before 2026-09-09, secure written consent from the authorized decision-maker; owner: Dominic Alvarez.

Before 2026-09-09, issue a corrective notice using the contractually operative method; owner: Priya Raman.

Before 2026-09-09, escalate the conflict to the responsible legal and business owners; owner: Elliot Mercer.

Before 2026-09-09, document the governing interpretation before the deadline; owner: Talia Brooks.

Before 2026-09-09, place the affected population on hold pending reconciliation; owner: Jonas Feld.

Before 2026-09-09, amend the closing or response checklist with a dated cure item; owner: Mei Whitaker.

Before 2026-09-09, obtain a signed ratification and update the controlling register; owner: Caleb Hassan.

Before 2026-09-09, recalculate the exposure and preserve the supporting ledger; owner: Leona Park.

Before 2026-09-09, secure written consent from the authorized decision-maker; owner: Isaac Romero.

Before 2026-09-09, issue a corrective notice using the contractually operative method; owner: Sofia Bennett.

Before 2026-09-09, escalate the conflict to the responsible legal and business owners; owner: Adrian Mensah.

Before 2026-09-09, document the governing interpretation before the deadline; owner: Willa Novak.

Before 2026-09-09, place the affected population on hold pending reconciliation; owner: Theo Laurent.

Before 2026-09-09, amend the closing or response checklist with a dated cure item; owner: Amara Patel.

Prompt: You are privacy and regulatory counsel for CivicRoute Mobility. The client has asked for a board-ready risk assessment supported by a source-level tracker rather than a narrative-only summary. A mobility app shared precise location segments through an advertising integration not reflected in its processing inventory or opt-out flow. Decision due 2026-09-09. Colorado law governs; Colorado Attorney General is the forum. Treat dates, notice mechanics, approval evidence, and numerical reconciliations as independent controls. Work out the defensible position from the matter production and leave an audit-ready exception tracker and concise advice for the supervising lawyer. Keep confirmed conflicts separate from open questions, cite the records that actually control each conclusion, and do not fill gaps with outside facts.

Complete at least 46 successful, argument-specific evidence and output calls.

Find and read the 33 controlling, corroborating, and work-product-control records in full.

Inspect file metadata for the eight designated critical primary records before relying on them.

Confirm the sandbox's allowed document and output roots.

Inventory all 96 records so the relevant sources are discovered among the context records.

Search the production for email evidence that may corroborate or contradict formal records.

Leave only findings.json and advice.md in the output workspace.

Create both final work products through the sandbox MCP surface.

Produce findings.json as a valid JSON object.

Report exactly 16 confirmed exceptions.

Use each stable finding ID exactly once.

Set schema_version to the released matter value '1.0'.

Set task_id to the released matter value 'cb100-063-civic-route'.

Set matter_number to the released matter value 'CB-PR-3003'.

Set prepared_for to the released matter value 'CivicRoute Mobility'.

Set as_of to the released matter value '2026-09-09'.

Include the confirmed F-01 exception for processing-purpose gap.

Preserve F-01's id from /workspace/documents/01_data_inventory/001_data_inventory_control_register.md and /workspace/documents/07_transfer_mechanisms/049_transfer_mechanisms_control_register.md.

Preserve F-01's issue from /workspace/documents/01_data_inventory/001_data_inventory_control_register.md and /workspace/documents/07_transfer_mechanisms/049_transfer_mechanisms_control_register.md.

Preserve F-01's severity from /workspace/documents/01_data_inventory/001_data_inventory_control_register.md and /workspace/documents/07_transfer_mechanisms/049_transfer_mechanisms_control_register.md.

Preserve F-01's primary_source from /workspace/documents/01_data_inventory/001_data_inventory_control_register.md and /workspace/documents/07_transfer_mechanisms/049_transfer_mechanisms_control_register.md.

Preserve F-01's corroborating_source from /workspace/documents/01_data_inventory/001_data_inventory_control_register.md and /workspace/documents/07_transfer_mechanisms/049_transfer_mechanisms_control_register.md.

Reconcile F-01 using the exact controlled facts ['2025-10-15', 'CB-PR-3003-A505', '2025-11-29', 'CB-PR-3003-J961'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-01's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Rafael Okafor'] for F-01.

Include the confirmed F-02 exception for notice-practice mismatch.

Preserve F-02's id from /workspace/documents/01_data_inventory/004_data_inventory_ledger_export.csv and /workspace/documents/07_transfer_mechanisms/052_transfer_mechanisms_ledger_export.csv.

Preserve F-02's issue from /workspace/documents/01_data_inventory/004_data_inventory_ledger_export.csv and /workspace/documents/07_transfer_mechanisms/052_transfer_mechanisms_ledger_export.csv.

Preserve F-02's severity from /workspace/documents/01_data_inventory/004_data_inventory_ledger_export.csv and /workspace/documents/07_transfer_mechanisms/052_transfer_mechanisms_ledger_export.csv.

Preserve F-02's primary_source from /workspace/documents/01_data_inventory/004_data_inventory_ledger_export.csv and /workspace/documents/07_transfer_mechanisms/052_transfer_mechanisms_ledger_export.csv.

Preserve F-02's corroborating_source from /workspace/documents/01_data_inventory/004_data_inventory_ledger_export.csv and /workspace/documents/07_transfer_mechanisms/052_transfer_mechanisms_ledger_export.csv.

Reconcile F-02 using the exact controlled facts ['$4,168,080.00', '$4,342,660.00'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-02's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Nora Chen'] for F-02.

Include the confirmed F-03 exception for consent-record deficiency.

Preserve F-03's id from /workspace/documents/01_data_inventory/007_data_inventory_officer_certificate.html and /workspace/documents/07_transfer_mechanisms/055_transfer_mechanisms_officer_certificate.html.

Preserve F-03's issue from /workspace/documents/01_data_inventory/007_data_inventory_officer_certificate.html and /workspace/documents/07_transfer_mechanisms/055_transfer_mechanisms_officer_certificate.html.

Preserve F-03's severity from /workspace/documents/01_data_inventory/007_data_inventory_officer_certificate.html and /workspace/documents/07_transfer_mechanisms/055_transfer_mechanisms_officer_certificate.html.

Preserve F-03's primary_source from /workspace/documents/01_data_inventory/007_data_inventory_officer_certificate.html and /workspace/documents/07_transfer_mechanisms/055_transfer_mechanisms_officer_certificate.html.

Preserve F-03's corroborating_source from /workspace/documents/01_data_inventory/007_data_inventory_officer_certificate.html and /workspace/documents/07_transfer_mechanisms/055_transfer_mechanisms_officer_certificate.html.

Reconcile F-03 using the exact controlled facts ['Farah Ibrahim', 'Owen Delgado'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-03's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Dominic Alvarez'] for F-03.

Include the confirmed F-04 exception for processor-contract omission.

Preserve F-04's id from /workspace/documents/02_processing_records/010_processing_records_executed_instrument.txt and /workspace/documents/08_retention_deletion/058_retention_deletion_executed_instrument.txt.

Preserve F-04's issue from /workspace/documents/02_processing_records/010_processing_records_executed_instrument.txt and /workspace/documents/08_retention_deletion/058_retention_deletion_executed_instrument.txt.

Preserve F-04's severity from /workspace/documents/02_processing_records/010_processing_records_executed_instrument.txt and /workspace/documents/08_retention_deletion/058_retention_deletion_executed_instrument.txt.

Preserve F-04's primary_source from /workspace/documents/02_processing_records/010_processing_records_executed_instrument.txt and /workspace/documents/08_retention_deletion/058_retention_deletion_executed_instrument.txt.

Preserve F-04's corroborating_source from /workspace/documents/02_processing_records/010_processing_records_executed_instrument.txt and /workspace/documents/08_retention_deletion/058_retention_deletion_executed_instrument.txt.

Reconcile F-04 using the exact controlled facts ['closed without exception', 'CB-PR-3003-D509', 'open and escalated', 'CB-PR-3003-M962'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-04's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Priya Raman'] for F-04.

Include the confirmed F-05 exception for subprocessor inventory mismatch.

Preserve F-05's id from /workspace/documents/02_processing_records/013_processing_records_review_memorandum.json and /workspace/documents/08_retention_deletion/061_retention_deletion_review_memorandum.json.

Preserve F-05's issue from /workspace/documents/02_processing_records/013_processing_records_review_memorandum.json and /workspace/documents/08_retention_deletion/061_retention_deletion_review_memorandum.json.

Preserve F-05's severity from /workspace/documents/02_processing_records/013_processing_records_review_memorandum.json and /workspace/documents/08_retention_deletion/061_retention_deletion_review_memorandum.json.

Preserve F-05's primary_source from /workspace/documents/02_processing_records/013_processing_records_review_memorandum.json and /workspace/documents/08_retention_deletion/061_retention_deletion_review_memorandum.json.

Preserve F-05's corroborating_source from /workspace/documents/02_processing_records/013_processing_records_review_memorandum.json and /workspace/documents/08_retention_deletion/061_retention_deletion_review_memorandum.json.

Reconcile F-05 using the exact controlled facts ['Colorado Attorney General', 'Colorado'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-05's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Elliot Mercer'] for F-05.

Include the confirmed F-06 exception for cross-border transfer gap.

Preserve F-06's id from /workspace/documents/02_processing_records/016_processing_records_status_report.md and /workspace/documents/08_retention_deletion/064_retention_deletion_status_report.md.

Preserve F-06's issue from /workspace/documents/02_processing_records/016_processing_records_status_report.md and /workspace/documents/08_retention_deletion/064_retention_deletion_status_report.md.

Preserve F-06's severity from /workspace/documents/02_processing_records/016_processing_records_status_report.md and /workspace/documents/08_retention_deletion/064_retention_deletion_status_report.md.

Preserve F-06's primary_source from /workspace/documents/02_processing_records/016_processing_records_status_report.md and /workspace/documents/08_retention_deletion/064_retention_deletion_status_report.md.

Preserve F-06's corroborating_source from /workspace/documents/02_processing_records/016_processing_records_status_report.md and /workspace/documents/08_retention_deletion/064_retention_deletion_status_report.md.

Reconcile F-06 using the exact controlled facts ['9%', '14%'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-06's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Talia Brooks'] for F-06.

Include the confirmed F-07 exception for retention schedule conflict.

Preserve F-07's id from /workspace/documents/03_vendor_reviews/019_vendor_reviews_correspondence.eml and /workspace/documents/09_training/067_training_correspondence.eml.

Preserve F-07's issue from /workspace/documents/03_vendor_reviews/019_vendor_reviews_correspondence.eml and /workspace/documents/09_training/067_training_correspondence.eml.

Preserve F-07's severity from /workspace/documents/03_vendor_reviews/019_vendor_reviews_correspondence.eml and /workspace/documents/09_training/067_training_correspondence.eml.

Preserve F-07's primary_source from /workspace/documents/03_vendor_reviews/019_vendor_reviews_correspondence.eml and /workspace/documents/09_training/067_training_correspondence.eml.

Preserve F-07's corroborating_source from /workspace/documents/03_vendor_reviews/019_vendor_reviews_correspondence.eml and /workspace/documents/09_training/067_training_correspondence.eml.

Reconcile F-07 using the exact controlled facts ['notices-civicroute_mobility@example.test', 'archive-metropulse_advertising_llc@example.test'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-07's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Jonas Feld'] for F-07.

Include the confirmed F-08 exception for deletion-job failure.

Preserve F-08's id from /workspace/documents/03_vendor_reviews/022_vendor_reviews_formal_notice.xml and /workspace/documents/09_training/070_training_formal_notice.xml.

Preserve F-08's issue from /workspace/documents/03_vendor_reviews/022_vendor_reviews_formal_notice.xml and /workspace/documents/09_training/070_training_formal_notice.xml.

Preserve F-08's severity from /workspace/documents/03_vendor_reviews/022_vendor_reviews_formal_notice.xml and /workspace/documents/09_training/070_training_formal_notice.xml.

Preserve F-08's primary_source from /workspace/documents/03_vendor_reviews/022_vendor_reviews_formal_notice.xml and /workspace/documents/09_training/070_training_formal_notice.xml.

Preserve F-08's corroborating_source from /workspace/documents/03_vendor_reviews/022_vendor_reviews_formal_notice.xml and /workspace/documents/09_training/070_training_formal_notice.xml.

Reconcile F-08 using the exact controlled facts ['118 records', '2025-03-14', '42 records', '2025-03-28'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-08's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Mei Whitaker'] for F-08.

Include the confirmed F-09 exception for access-request deadline.

Preserve F-09's id from /workspace/documents/04_security_incidents/025_security_incidents_control_register.md and /workspace/documents/10_regulator_correspondence/073_regulator_correspondence_control_register.md.

Preserve F-09's issue from /workspace/documents/04_security_incidents/025_security_incidents_control_register.md and /workspace/documents/10_regulator_correspondence/073_regulator_correspondence_control_register.md.

Preserve F-09's severity from /workspace/documents/04_security_incidents/025_security_incidents_control_register.md and /workspace/documents/10_regulator_correspondence/073_regulator_correspondence_control_register.md.

Preserve F-09's primary_source from /workspace/documents/04_security_incidents/025_security_incidents_control_register.md and /workspace/documents/10_regulator_correspondence/073_regulator_correspondence_control_register.md.

Preserve F-09's corroborating_source from /workspace/documents/04_security_incidents/025_security_incidents_control_register.md and /workspace/documents/10_regulator_correspondence/073_regulator_correspondence_control_register.md.

Reconcile F-09 using the exact controlled facts ['2025-11-08', 'CB-PR-3003-I529', '2025-12-19', 'CB-PR-3003-R825'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-09's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Caleb Hassan'] for F-09.

Include the confirmed F-10 exception for identity-verification inconsistency.

Preserve F-10's id from /workspace/documents/04_security_incidents/028_security_incidents_ledger_export.csv and /workspace/documents/10_regulator_correspondence/076_regulator_correspondence_ledger_export.csv.

Preserve F-10's issue from /workspace/documents/04_security_incidents/028_security_incidents_ledger_export.csv and /workspace/documents/10_regulator_correspondence/076_regulator_correspondence_ledger_export.csv.

Preserve F-10's severity from /workspace/documents/04_security_incidents/028_security_incidents_ledger_export.csv and /workspace/documents/10_regulator_correspondence/076_regulator_correspondence_ledger_export.csv.

Preserve F-10's primary_source from /workspace/documents/04_security_incidents/028_security_incidents_ledger_export.csv and /workspace/documents/10_regulator_correspondence/076_regulator_correspondence_ledger_export.csv.

Preserve F-10's corroborating_source from /workspace/documents/04_security_incidents/028_security_incidents_ledger_export.csv and /workspace/documents/10_regulator_correspondence/076_regulator_correspondence_ledger_export.csv.

Reconcile F-10 using the exact controlled facts ['$4,478,117.00', '$4,702,734.00'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-10's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Leona Park'] for F-10.

Include the confirmed F-11 exception for incident-notification clock.

Preserve F-11's id from /workspace/documents/04_security_incidents/031_security_incidents_officer_certificate.html and /workspace/documents/10_regulator_correspondence/079_regulator_correspondence_officer_certificate.html.

Preserve F-11's issue from /workspace/documents/04_security_incidents/031_security_incidents_officer_certificate.html and /workspace/documents/10_regulator_correspondence/079_regulator_correspondence_officer_certificate.html.

Preserve F-11's severity from /workspace/documents/04_security_incidents/031_security_incidents_officer_certificate.html and /workspace/documents/10_regulator_correspondence/079_regulator_correspondence_officer_certificate.html.

Preserve F-11's primary_source from /workspace/documents/04_security_incidents/031_security_incidents_officer_certificate.html and /workspace/documents/10_regulator_correspondence/079_regulator_correspondence_officer_certificate.html.

Preserve F-11's corroborating_source from /workspace/documents/04_security_incidents/031_security_incidents_officer_certificate.html and /workspace/documents/10_regulator_correspondence/079_regulator_correspondence_officer_certificate.html.

Reconcile F-11 using the exact controlled facts ['Farah Ibrahim', 'Adrian Mensah'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-11's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Isaac Romero'] for F-11.

Include the confirmed F-12 exception for risk-assessment omission.

Preserve F-12's id from /workspace/documents/05_consumer_requests/034_consumer_requests_executed_instrument.txt and /workspace/documents/11_risk_assessments/082_risk_assessments_executed_instrument.txt.

Preserve F-12's issue from /workspace/documents/05_consumer_requests/034_consumer_requests_executed_instrument.txt and /workspace/documents/11_risk_assessments/082_risk_assessments_executed_instrument.txt.

Preserve F-12's severity from /workspace/documents/05_consumer_requests/034_consumer_requests_executed_instrument.txt and /workspace/documents/11_risk_assessments/082_risk_assessments_executed_instrument.txt.

Preserve F-12's primary_source from /workspace/documents/05_consumer_requests/034_consumer_requests_executed_instrument.txt and /workspace/documents/11_risk_assessments/082_risk_assessments_executed_instrument.txt.

Preserve F-12's corroborating_source from /workspace/documents/05_consumer_requests/034_consumer_requests_executed_instrument.txt and /workspace/documents/11_risk_assessments/082_risk_assessments_executed_instrument.txt.

Reconcile F-12 using the exact controlled facts ['closed without exception', 'CB-PR-3003-L657', 'open and escalated', 'CB-PR-3003-U350'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-12's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Sofia Bennett'] for F-12.

Include the confirmed F-13 exception for sensitive-data classification.

Preserve F-13's id from /workspace/documents/05_consumer_requests/037_consumer_requests_review_memorandum.json and /workspace/documents/11_risk_assessments/085_risk_assessments_review_memorandum.json.

Preserve F-13's issue from /workspace/documents/05_consumer_requests/037_consumer_requests_review_memorandum.json and /workspace/documents/11_risk_assessments/085_risk_assessments_review_memorandum.json.

Preserve F-13's severity from /workspace/documents/05_consumer_requests/037_consumer_requests_review_memorandum.json and /workspace/documents/11_risk_assessments/085_risk_assessments_review_memorandum.json.

Preserve F-13's primary_source from /workspace/documents/05_consumer_requests/037_consumer_requests_review_memorandum.json and /workspace/documents/11_risk_assessments/085_risk_assessments_review_memorandum.json.

Preserve F-13's corroborating_source from /workspace/documents/05_consumer_requests/037_consumer_requests_review_memorandum.json and /workspace/documents/11_risk_assessments/085_risk_assessments_review_memorandum.json.

Reconcile F-13 using the exact controlled facts ['Colorado Attorney General', 'Colorado'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-13's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Adrian Mensah'] for F-13.

Include the confirmed F-14 exception for minor-consent issue.

Preserve F-14's id from /workspace/documents/05_consumer_requests/040_consumer_requests_status_report.md and /workspace/documents/11_risk_assessments/088_risk_assessments_status_report.md.

Preserve F-14's issue from /workspace/documents/05_consumer_requests/040_consumer_requests_status_report.md and /workspace/documents/11_risk_assessments/088_risk_assessments_status_report.md.

Preserve F-14's severity from /workspace/documents/05_consumer_requests/040_consumer_requests_status_report.md and /workspace/documents/11_risk_assessments/088_risk_assessments_status_report.md.

Preserve F-14's primary_source from /workspace/documents/05_consumer_requests/040_consumer_requests_status_report.md and /workspace/documents/11_risk_assessments/088_risk_assessments_status_report.md.

Preserve F-14's corroborating_source from /workspace/documents/05_consumer_requests/040_consumer_requests_status_report.md and /workspace/documents/11_risk_assessments/088_risk_assessments_status_report.md.

Reconcile F-14 using the exact controlled facts ['15%', '18%'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-14's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Willa Novak'] for F-14.

Include the confirmed F-15 exception for training completion gap.

Preserve F-15's id from /workspace/documents/06_notices_consents/043_notices_consents_correspondence.eml and /workspace/documents/12_remediation/091_remediation_correspondence.eml.

Preserve F-15's issue from /workspace/documents/06_notices_consents/043_notices_consents_correspondence.eml and /workspace/documents/12_remediation/091_remediation_correspondence.eml.

Preserve F-15's severity from /workspace/documents/06_notices_consents/043_notices_consents_correspondence.eml and /workspace/documents/12_remediation/091_remediation_correspondence.eml.

Preserve F-15's primary_source from /workspace/documents/06_notices_consents/043_notices_consents_correspondence.eml and /workspace/documents/12_remediation/091_remediation_correspondence.eml.

Preserve F-15's corroborating_source from /workspace/documents/06_notices_consents/043_notices_consents_correspondence.eml and /workspace/documents/12_remediation/091_remediation_correspondence.eml.

Reconcile F-15 using the exact controlled facts ['notices-civicroute_mobility@example.test', 'archive-metropulse_advertising_llc@example.test'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-15's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Theo Laurent'] for F-15.

Include the confirmed F-16 exception for regulator commitment overdue.

Preserve F-16's id from /workspace/documents/06_notices_consents/046_notices_consents_formal_notice.xml and /workspace/documents/12_remediation/094_remediation_formal_notice.xml.

Preserve F-16's issue from /workspace/documents/06_notices_consents/046_notices_consents_formal_notice.xml and /workspace/documents/12_remediation/094_remediation_formal_notice.xml.

Preserve F-16's severity from /workspace/documents/06_notices_consents/046_notices_consents_formal_notice.xml and /workspace/documents/12_remediation/094_remediation_formal_notice.xml.

Preserve F-16's primary_source from /workspace/documents/06_notices_consents/046_notices_consents_formal_notice.xml and /workspace/documents/12_remediation/094_remediation_formal_notice.xml.

Preserve F-16's corroborating_source from /workspace/documents/06_notices_consents/046_notices_consents_formal_notice.xml and /workspace/documents/12_remediation/094_remediation_formal_notice.xml.

Reconcile F-16 using the exact controlled facts ['94 records', '2025-07-08', '59 records', '2025-08-08'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-16's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-09', 'Amara Patel'] for F-16.

Include the 'Executive assessment' decision section in advice.md.

Include the 'Method and record coverage' decision section in advice.md.

Include the 'Findings' decision section in advice.md.

Include the 'Recommended next actions' decision section in advice.md.

Include the 'Assumptions and limitations' decision section in advice.md.

Explain F-01 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-02 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-03 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-04 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-05 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-06 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-07 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-08 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-09 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-10 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-11 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-12 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-13 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-14 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-15 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-16 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Do not claim the production has no issues or that every record is consistent.

The CB-PR-3003 production contains independently maintained records; a defensible answer must preserve each supported conflict and its cure owner.


# Counsel advice — Deepwell breach-notice audit

## Executive assessment

For Deepwell Health Services matter CB-PR-3004, the review identified 16 source-supported exceptions requiring action before 2026-09-13. The assessment concerns Morrow Claims Clearinghouse and the supplied record for New York.

## Method and record coverage

The review inventoried all 96 production files, read the 33 controlling, corroborating, and control records, searched the email exports, and checked metadata for the designated chain-of-custody sample. Conclusions are limited to the synthetic production supplied for this benchmark matter.

## Findings

### F-01 — processing-purpose gap (critical)

The records do not reconcile for processing-purpose gap: one source states the operative date is 2026-02-26 under control reference CB-PR-3004-A699, while the corroborating source states the acknowledged date is 2026-03-07 under response reference CB-PR-3004-J630.

Primary source: `/workspace/documents/01_data_inventory/001_data_inventory_control_register.md`

Corroborating source: `/workspace/documents/07_transfer_mechanisms/049_transfer_mechanisms_control_register.md`

Recommended action: Before 2026-09-13, obtain a signed ratification and update the controlling register; owner: Nora Chen.

### F-02 — notice-practice mismatch (high)

The records do not reconcile for notice-practice mismatch: one source states the controlling amount is $4,351,229.00, while the corroborating source states the reconciliation and counterparty record use $4,528,958.00.

Primary source: `/workspace/documents/01_data_inventory/004_data_inventory_ledger_export.csv`

Corroborating source: `/workspace/documents/07_transfer_mechanisms/052_transfer_mechanisms_ledger_export.csv`

Recommended action: Before 2026-09-13, recalculate the exposure and preserve the supporting ledger; owner: Dominic Alvarez.

### F-03 — consent-record deficiency (high)

The records do not reconcile for consent-record deficiency: one source states approval is attributed to Owen Delgado as the sole authorized reviewer, while the corroborating source states the approval log names Samuel Kim and contains no entry for Owen Delgado.

Primary source: `/workspace/documents/01_data_inventory/007_data_inventory_officer_certificate.html`

Corroborating source: `/workspace/documents/07_transfer_mechanisms/055_transfer_mechanisms_officer_certificate.html`

Recommended action: Before 2026-09-13, secure written consent from the authorized decision-maker; owner: Priya Raman.

### F-04 — processor-contract omission (medium)

The records do not reconcile for processor-contract omission: one source states the item is recorded as closed without exception in CB-PR-3004-D832, while the corroborating source states the later status register marks it open and escalated in CB-PR-3004-M571.

Primary source: `/workspace/documents/02_processing_records/010_processing_records_executed_instrument.txt`

Corroborating source: `/workspace/documents/08_retention_deletion/058_retention_deletion_executed_instrument.txt`

Recommended action: Before 2026-09-13, issue a corrective notice using the contractually operative method; owner: Elliot Mercer.

### F-05 — subprocessor inventory mismatch (medium)

The records do not reconcile for subprocessor inventory mismatch: one source states the applicable location is New York Department of Financial Services, while the corroborating source states the implementation record assigns the obligation to New York operations outside New York Department of Financial Services.

Primary source: `/workspace/documents/02_processing_records/013_processing_records_review_memorandum.json`

Corroborating source: `/workspace/documents/08_retention_deletion/061_retention_deletion_review_memorandum.json`

Recommended action: Before 2026-09-13, escalate the conflict to the responsible legal and business owners; owner: Talia Brooks.

### F-06 — cross-border transfer gap (low)

The records do not reconcile for cross-border transfer gap: one source states the threshold is 14% with no stated tolerance, while the corroborating source states the applied threshold is 20% and produced a different exception result.

Primary source: `/workspace/documents/02_processing_records/016_processing_records_status_report.md`

Corroborating source: `/workspace/documents/08_retention_deletion/064_retention_deletion_status_report.md`

Recommended action: Before 2026-09-13, document the governing interpretation before the deadline; owner: Jonas Feld.

### F-07 — retention schedule conflict (critical)

The records do not reconcile for retention schedule conflict: one source states formal notice must use notices-deepwell_health_services@example.test, while the corroborating source states the only delivery record was sent to archive-morrow_claims_clearinghouse@example.test.

Primary source: `/workspace/documents/03_vendor_reviews/019_vendor_reviews_correspondence.eml`

Corroborating source: `/workspace/documents/09_training/067_training_correspondence.eml`

Recommended action: Before 2026-09-13, place the affected population on hold pending reconciliation; owner: Mei Whitaker.

### F-08 — deletion-job failure (high)

The records do not reconcile for deletion-job failure: one source states the governed population contains 148 records through 2025-04-13, while the corroborating source states the certification covers 65 records through 2025-05-20.

Primary source: `/workspace/documents/03_vendor_reviews/022_vendor_reviews_formal_notice.xml`

Corroborating source: `/workspace/documents/09_training/070_training_formal_notice.xml`

Recommended action: Before 2026-09-13, amend the closing or response checklist with a dated cure item; owner: Caleb Hassan.

### F-09 — access-request deadline (high)

The records do not reconcile for access-request deadline: one source states the operative date is 2026-02-11 under control reference CB-PR-3004-I864, while the corroborating source states the acknowledged date is 2026-02-27 under response reference CB-PR-3004-R366.

Primary source: `/workspace/documents/04_security_incidents/025_security_incidents_control_register.md`

Corroborating source: `/workspace/documents/10_regulator_correspondence/073_regulator_correspondence_control_register.md`

Recommended action: Before 2026-09-13, obtain a signed ratification and update the controlling register; owner: Leona Park.

### F-10 — identity-verification inconsistency (medium)

The records do not reconcile for identity-verification inconsistency: one source states the controlling amount is $3,389,530.00, while the corroborating source states the reconciliation and counterparty record use $3,565,560.00.

Primary source: `/workspace/documents/04_security_incidents/028_security_incidents_ledger_export.csv`

Corroborating source: `/workspace/documents/10_regulator_correspondence/076_regulator_correspondence_ledger_export.csv`

Recommended action: Before 2026-09-13, recalculate the exposure and preserve the supporting ledger; owner: Isaac Romero.

### F-11 — incident-notification clock (medium)

The records do not reconcile for incident-notification clock: one source states approval is attributed to Owen Delgado as the sole authorized reviewer, while the corroborating source states the approval log names Theo Laurent and contains no entry for Owen Delgado.

Primary source: `/workspace/documents/04_security_incidents/031_security_incidents_officer_certificate.html`

Corroborating source: `/workspace/documents/10_regulator_correspondence/079_regulator_correspondence_officer_certificate.html`

Recommended action: Before 2026-09-13, secure written consent from the authorized decision-maker; owner: Sofia Bennett.

### F-12 — risk-assessment omission (low)

The records do not reconcile for risk-assessment omission: one source states the item is recorded as closed without exception in CB-PR-3004-L208, while the corroborating source states the later status register marks it open and escalated in CB-PR-3004-U662.

Primary source: `/workspace/documents/05_consumer_requests/034_consumer_requests_executed_instrument.txt`

Corroborating source: `/workspace/documents/11_risk_assessments/082_risk_assessments_executed_instrument.txt`

Recommended action: Before 2026-09-13, issue a corrective notice using the contractually operative method; owner: Adrian Mensah.

### F-13 — sensitive-data classification (critical)

The records do not reconcile for sensitive-data classification: one source states the applicable location is New York Department of Financial Services, while the corroborating source states the implementation record assigns the obligation to New York operations outside New York Department of Financial Services.

Primary source: `/workspace/documents/05_consumer_requests/037_consumer_requests_review_memorandum.json`

Corroborating source: `/workspace/documents/11_risk_assessments/085_risk_assessments_review_memorandum.json`

Recommended action: Before 2026-09-13, escalate the conflict to the responsible legal and business owners; owner: Willa Novak.

### F-14 — minor-consent issue (high)

The records do not reconcile for minor-consent issue: one source states the threshold is 15% with no stated tolerance, while the corroborating source states the applied threshold is 22% and produced a different exception result.

Primary source: `/workspace/documents/05_consumer_requests/040_consumer_requests_status_report.md`

Corroborating source: `/workspace/documents/11_risk_assessments/088_risk_assessments_status_report.md`

Recommended action: Before 2026-09-13, document the governing interpretation before the deadline; owner: Theo Laurent.

### F-15 — training completion gap (high)

The records do not reconcile for training completion gap: one source states formal notice must use notices-deepwell_health_services@example.test, while the corroborating source states the only delivery record was sent to archive-morrow_claims_clearinghouse@example.test.

Primary source: `/workspace/documents/06_notices_consents/043_notices_consents_correspondence.eml`

Corroborating source: `/workspace/documents/12_remediation/091_remediation_correspondence.eml`

Recommended action: Before 2026-09-13, place the affected population on hold pending reconciliation; owner: Amara Patel.

### F-16 — regulator commitment overdue (medium)

The records do not reconcile for regulator commitment overdue: one source states the governed population contains 56 records through 2025-10-18, while the corroborating source states the certification covers 66 records through 2025-11-25.

Primary source: `/workspace/documents/06_notices_consents/046_notices_consents_formal_notice.xml`

Corroborating source: `/workspace/documents/12_remediation/094_remediation_formal_notice.xml`

Recommended action: Before 2026-09-13, amend the closing or response checklist with a dated cure item; owner: Henry Cho.

## Recommended next actions

Sequence the critical and high findings first, assign the named owners, preserve the cited records, and document any resolution in the controlling matter register before the stated deadline.

## Assumptions and limitations

This analysis is confined to task cb100-064-deepwell-health and the supplied synthetic evidence. It does not rely on external facts, does not resolve disputed law, and is not legal advice for a real person or entity.

Before 2026-09-13, obtain a signed ratification and update the controlling register; owner: Nora Chen.

Before 2026-09-13, recalculate the exposure and preserve the supporting ledger; owner: Dominic Alvarez.

Before 2026-09-13, secure written consent from the authorized decision-maker; owner: Priya Raman.

Before 2026-09-13, issue a corrective notice using the contractually operative method; owner: Elliot Mercer.

Before 2026-09-13, escalate the conflict to the responsible legal and business owners; owner: Talia Brooks.

Before 2026-09-13, document the governing interpretation before the deadline; owner: Jonas Feld.

Before 2026-09-13, place the affected population on hold pending reconciliation; owner: Mei Whitaker.

Before 2026-09-13, amend the closing or response checklist with a dated cure item; owner: Caleb Hassan.

Before 2026-09-13, obtain a signed ratification and update the controlling register; owner: Leona Park.

Before 2026-09-13, recalculate the exposure and preserve the supporting ledger; owner: Isaac Romero.

Before 2026-09-13, secure written consent from the authorized decision-maker; owner: Sofia Bennett.

Before 2026-09-13, issue a corrective notice using the contractually operative method; owner: Adrian Mensah.

Before 2026-09-13, escalate the conflict to the responsible legal and business owners; owner: Willa Novak.

Before 2026-09-13, document the governing interpretation before the deadline; owner: Theo Laurent.

Before 2026-09-13, place the affected population on hold pending reconciliation; owner: Amara Patel.

Before 2026-09-13, amend the closing or response checklist with a dated cure item; owner: Henry Cho.

New York Department of Financial Services

Prompt: You are privacy and regulatory counsel for Deepwell Health Services. Several workstreams have maintained separate versions of the truth; your assignment is to produce one auditable legal view. A credential incident moved through multiple vendors, creating disputed discovery dates and incomplete regulator commitments. Decision due 2026-09-13. New York law governs; New York Department of Financial Services is the forum. Distinguish a missing document from an affirmative contradiction in the documents that are present. Work out the defensible position from the matter production and leave an audit-ready exception tracker and concise advice for the supervising lawyer. Keep confirmed conflicts separate from open questions, cite the records that actually control each conclusion, and do not fill gaps with outside facts.

Complete at least 46 successful, argument-specific evidence and output calls.

Find and read the 33 controlling, corroborating, and work-product-control records in full.

Inspect file metadata for the eight designated critical primary records before relying on them.

Confirm the sandbox's allowed document and output roots.

Inventory all 96 records so the relevant sources are discovered among the context records.

Search the production for email evidence that may corroborate or contradict formal records.

Leave only findings.json and advice.md in the output workspace.

Create both final work products through the sandbox MCP surface.

Produce findings.json as a valid JSON object.

Report exactly 16 confirmed exceptions.

Use each stable finding ID exactly once.

Set schema_version to the released matter value '1.0'.

Set task_id to the released matter value 'cb100-064-deepwell-health'.

Set matter_number to the released matter value 'CB-PR-3004'.

Set prepared_for to the released matter value 'Deepwell Health Services'.

Set as_of to the released matter value '2026-09-13'.

Include the confirmed F-01 exception for processing-purpose gap.

Preserve F-01's id from /workspace/documents/01_data_inventory/001_data_inventory_control_register.md and /workspace/documents/07_transfer_mechanisms/049_transfer_mechanisms_control_register.md.

Preserve F-01's issue from /workspace/documents/01_data_inventory/001_data_inventory_control_register.md and /workspace/documents/07_transfer_mechanisms/049_transfer_mechanisms_control_register.md.

Preserve F-01's severity from /workspace/documents/01_data_inventory/001_data_inventory_control_register.md and /workspace/documents/07_transfer_mechanisms/049_transfer_mechanisms_control_register.md.

Preserve F-01's primary_source from /workspace/documents/01_data_inventory/001_data_inventory_control_register.md and /workspace/documents/07_transfer_mechanisms/049_transfer_mechanisms_control_register.md.

Preserve F-01's corroborating_source from /workspace/documents/01_data_inventory/001_data_inventory_control_register.md and /workspace/documents/07_transfer_mechanisms/049_transfer_mechanisms_control_register.md.

Reconcile F-01 using the exact controlled facts ['2026-02-26', 'CB-PR-3004-A699', '2026-03-07', 'CB-PR-3004-J630'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-01's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Nora Chen'] for F-01.

Include the confirmed F-02 exception for notice-practice mismatch.

Preserve F-02's id from /workspace/documents/01_data_inventory/004_data_inventory_ledger_export.csv and /workspace/documents/07_transfer_mechanisms/052_transfer_mechanisms_ledger_export.csv.

Preserve F-02's issue from /workspace/documents/01_data_inventory/004_data_inventory_ledger_export.csv and /workspace/documents/07_transfer_mechanisms/052_transfer_mechanisms_ledger_export.csv.

Preserve F-02's severity from /workspace/documents/01_data_inventory/004_data_inventory_ledger_export.csv and /workspace/documents/07_transfer_mechanisms/052_transfer_mechanisms_ledger_export.csv.

Preserve F-02's primary_source from /workspace/documents/01_data_inventory/004_data_inventory_ledger_export.csv and /workspace/documents/07_transfer_mechanisms/052_transfer_mechanisms_ledger_export.csv.

Preserve F-02's corroborating_source from /workspace/documents/01_data_inventory/004_data_inventory_ledger_export.csv and /workspace/documents/07_transfer_mechanisms/052_transfer_mechanisms_ledger_export.csv.

Reconcile F-02 using the exact controlled facts ['$4,351,229.00', '$4,528,958.00'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-02's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Dominic Alvarez'] for F-02.

Include the confirmed F-03 exception for consent-record deficiency.

Preserve F-03's id from /workspace/documents/01_data_inventory/007_data_inventory_officer_certificate.html and /workspace/documents/07_transfer_mechanisms/055_transfer_mechanisms_officer_certificate.html.

Preserve F-03's issue from /workspace/documents/01_data_inventory/007_data_inventory_officer_certificate.html and /workspace/documents/07_transfer_mechanisms/055_transfer_mechanisms_officer_certificate.html.

Preserve F-03's severity from /workspace/documents/01_data_inventory/007_data_inventory_officer_certificate.html and /workspace/documents/07_transfer_mechanisms/055_transfer_mechanisms_officer_certificate.html.

Preserve F-03's primary_source from /workspace/documents/01_data_inventory/007_data_inventory_officer_certificate.html and /workspace/documents/07_transfer_mechanisms/055_transfer_mechanisms_officer_certificate.html.

Preserve F-03's corroborating_source from /workspace/documents/01_data_inventory/007_data_inventory_officer_certificate.html and /workspace/documents/07_transfer_mechanisms/055_transfer_mechanisms_officer_certificate.html.

Reconcile F-03 using the exact controlled facts ['Owen Delgado', 'Samuel Kim'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-03's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Priya Raman'] for F-03.

Include the confirmed F-04 exception for processor-contract omission.

Preserve F-04's id from /workspace/documents/02_processing_records/010_processing_records_executed_instrument.txt and /workspace/documents/08_retention_deletion/058_retention_deletion_executed_instrument.txt.

Preserve F-04's issue from /workspace/documents/02_processing_records/010_processing_records_executed_instrument.txt and /workspace/documents/08_retention_deletion/058_retention_deletion_executed_instrument.txt.

Preserve F-04's severity from /workspace/documents/02_processing_records/010_processing_records_executed_instrument.txt and /workspace/documents/08_retention_deletion/058_retention_deletion_executed_instrument.txt.

Preserve F-04's primary_source from /workspace/documents/02_processing_records/010_processing_records_executed_instrument.txt and /workspace/documents/08_retention_deletion/058_retention_deletion_executed_instrument.txt.

Preserve F-04's corroborating_source from /workspace/documents/02_processing_records/010_processing_records_executed_instrument.txt and /workspace/documents/08_retention_deletion/058_retention_deletion_executed_instrument.txt.

Reconcile F-04 using the exact controlled facts ['closed without exception', 'CB-PR-3004-D832', 'open and escalated', 'CB-PR-3004-M571'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-04's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Elliot Mercer'] for F-04.

Include the confirmed F-05 exception for subprocessor inventory mismatch.

Preserve F-05's id from /workspace/documents/02_processing_records/013_processing_records_review_memorandum.json and /workspace/documents/08_retention_deletion/061_retention_deletion_review_memorandum.json.

Preserve F-05's issue from /workspace/documents/02_processing_records/013_processing_records_review_memorandum.json and /workspace/documents/08_retention_deletion/061_retention_deletion_review_memorandum.json.

Preserve F-05's severity from /workspace/documents/02_processing_records/013_processing_records_review_memorandum.json and /workspace/documents/08_retention_deletion/061_retention_deletion_review_memorandum.json.

Preserve F-05's primary_source from /workspace/documents/02_processing_records/013_processing_records_review_memorandum.json and /workspace/documents/08_retention_deletion/061_retention_deletion_review_memorandum.json.

Preserve F-05's corroborating_source from /workspace/documents/02_processing_records/013_processing_records_review_memorandum.json and /workspace/documents/08_retention_deletion/061_retention_deletion_review_memorandum.json.

Reconcile F-05 using the exact controlled facts ['New York Department of Financial Services', 'New York'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-05's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Talia Brooks'] for F-05.

Include the confirmed F-06 exception for cross-border transfer gap.

Preserve F-06's id from /workspace/documents/02_processing_records/016_processing_records_status_report.md and /workspace/documents/08_retention_deletion/064_retention_deletion_status_report.md.

Preserve F-06's issue from /workspace/documents/02_processing_records/016_processing_records_status_report.md and /workspace/documents/08_retention_deletion/064_retention_deletion_status_report.md.

Preserve F-06's severity from /workspace/documents/02_processing_records/016_processing_records_status_report.md and /workspace/documents/08_retention_deletion/064_retention_deletion_status_report.md.

Preserve F-06's primary_source from /workspace/documents/02_processing_records/016_processing_records_status_report.md and /workspace/documents/08_retention_deletion/064_retention_deletion_status_report.md.

Preserve F-06's corroborating_source from /workspace/documents/02_processing_records/016_processing_records_status_report.md and /workspace/documents/08_retention_deletion/064_retention_deletion_status_report.md.

Reconcile F-06 using the exact controlled facts ['14%', '20%'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-06's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Jonas Feld'] for F-06.

Include the confirmed F-07 exception for retention schedule conflict.

Preserve F-07's id from /workspace/documents/03_vendor_reviews/019_vendor_reviews_correspondence.eml and /workspace/documents/09_training/067_training_correspondence.eml.

Preserve F-07's issue from /workspace/documents/03_vendor_reviews/019_vendor_reviews_correspondence.eml and /workspace/documents/09_training/067_training_correspondence.eml.

Preserve F-07's severity from /workspace/documents/03_vendor_reviews/019_vendor_reviews_correspondence.eml and /workspace/documents/09_training/067_training_correspondence.eml.

Preserve F-07's primary_source from /workspace/documents/03_vendor_reviews/019_vendor_reviews_correspondence.eml and /workspace/documents/09_training/067_training_correspondence.eml.

Preserve F-07's corroborating_source from /workspace/documents/03_vendor_reviews/019_vendor_reviews_correspondence.eml and /workspace/documents/09_training/067_training_correspondence.eml.

Reconcile F-07 using the exact controlled facts ['notices-deepwell_health_services@example.test', 'archive-morrow_claims_clearinghouse@example.test'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-07's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Mei Whitaker'] for F-07.

Include the confirmed F-08 exception for deletion-job failure.

Preserve F-08's id from /workspace/documents/03_vendor_reviews/022_vendor_reviews_formal_notice.xml and /workspace/documents/09_training/070_training_formal_notice.xml.

Preserve F-08's issue from /workspace/documents/03_vendor_reviews/022_vendor_reviews_formal_notice.xml and /workspace/documents/09_training/070_training_formal_notice.xml.

Preserve F-08's severity from /workspace/documents/03_vendor_reviews/022_vendor_reviews_formal_notice.xml and /workspace/documents/09_training/070_training_formal_notice.xml.

Preserve F-08's primary_source from /workspace/documents/03_vendor_reviews/022_vendor_reviews_formal_notice.xml and /workspace/documents/09_training/070_training_formal_notice.xml.

Preserve F-08's corroborating_source from /workspace/documents/03_vendor_reviews/022_vendor_reviews_formal_notice.xml and /workspace/documents/09_training/070_training_formal_notice.xml.

Reconcile F-08 using the exact controlled facts ['148 records', '2025-04-13', '65 records', '2025-05-20'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-08's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Caleb Hassan'] for F-08.

Include the confirmed F-09 exception for access-request deadline.

Preserve F-09's id from /workspace/documents/04_security_incidents/025_security_incidents_control_register.md and /workspace/documents/10_regulator_correspondence/073_regulator_correspondence_control_register.md.

Preserve F-09's issue from /workspace/documents/04_security_incidents/025_security_incidents_control_register.md and /workspace/documents/10_regulator_correspondence/073_regulator_correspondence_control_register.md.

Preserve F-09's severity from /workspace/documents/04_security_incidents/025_security_incidents_control_register.md and /workspace/documents/10_regulator_correspondence/073_regulator_correspondence_control_register.md.

Preserve F-09's primary_source from /workspace/documents/04_security_incidents/025_security_incidents_control_register.md and /workspace/documents/10_regulator_correspondence/073_regulator_correspondence_control_register.md.

Preserve F-09's corroborating_source from /workspace/documents/04_security_incidents/025_security_incidents_control_register.md and /workspace/documents/10_regulator_correspondence/073_regulator_correspondence_control_register.md.

Reconcile F-09 using the exact controlled facts ['2026-02-11', 'CB-PR-3004-I864', '2026-02-27', 'CB-PR-3004-R366'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-09's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Leona Park'] for F-09.

Include the confirmed F-10 exception for identity-verification inconsistency.

Preserve F-10's id from /workspace/documents/04_security_incidents/028_security_incidents_ledger_export.csv and /workspace/documents/10_regulator_correspondence/076_regulator_correspondence_ledger_export.csv.

Preserve F-10's issue from /workspace/documents/04_security_incidents/028_security_incidents_ledger_export.csv and /workspace/documents/10_regulator_correspondence/076_regulator_correspondence_ledger_export.csv.

Preserve F-10's severity from /workspace/documents/04_security_incidents/028_security_incidents_ledger_export.csv and /workspace/documents/10_regulator_correspondence/076_regulator_correspondence_ledger_export.csv.

Preserve F-10's primary_source from /workspace/documents/04_security_incidents/028_security_incidents_ledger_export.csv and /workspace/documents/10_regulator_correspondence/076_regulator_correspondence_ledger_export.csv.

Preserve F-10's corroborating_source from /workspace/documents/04_security_incidents/028_security_incidents_ledger_export.csv and /workspace/documents/10_regulator_correspondence/076_regulator_correspondence_ledger_export.csv.

Reconcile F-10 using the exact controlled facts ['$3,389,530.00', '$3,565,560.00'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-10's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Isaac Romero'] for F-10.

Include the confirmed F-11 exception for incident-notification clock.

Preserve F-11's id from /workspace/documents/04_security_incidents/031_security_incidents_officer_certificate.html and /workspace/documents/10_regulator_correspondence/079_regulator_correspondence_officer_certificate.html.

Preserve F-11's issue from /workspace/documents/04_security_incidents/031_security_incidents_officer_certificate.html and /workspace/documents/10_regulator_correspondence/079_regulator_correspondence_officer_certificate.html.

Preserve F-11's severity from /workspace/documents/04_security_incidents/031_security_incidents_officer_certificate.html and /workspace/documents/10_regulator_correspondence/079_regulator_correspondence_officer_certificate.html.

Preserve F-11's primary_source from /workspace/documents/04_security_incidents/031_security_incidents_officer_certificate.html and /workspace/documents/10_regulator_correspondence/079_regulator_correspondence_officer_certificate.html.

Preserve F-11's corroborating_source from /workspace/documents/04_security_incidents/031_security_incidents_officer_certificate.html and /workspace/documents/10_regulator_correspondence/079_regulator_correspondence_officer_certificate.html.

Reconcile F-11 using the exact controlled facts ['Owen Delgado', 'Theo Laurent'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-11's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Sofia Bennett'] for F-11.

Include the confirmed F-12 exception for risk-assessment omission.

Preserve F-12's id from /workspace/documents/05_consumer_requests/034_consumer_requests_executed_instrument.txt and /workspace/documents/11_risk_assessments/082_risk_assessments_executed_instrument.txt.

Preserve F-12's issue from /workspace/documents/05_consumer_requests/034_consumer_requests_executed_instrument.txt and /workspace/documents/11_risk_assessments/082_risk_assessments_executed_instrument.txt.

Preserve F-12's severity from /workspace/documents/05_consumer_requests/034_consumer_requests_executed_instrument.txt and /workspace/documents/11_risk_assessments/082_risk_assessments_executed_instrument.txt.

Preserve F-12's primary_source from /workspace/documents/05_consumer_requests/034_consumer_requests_executed_instrument.txt and /workspace/documents/11_risk_assessments/082_risk_assessments_executed_instrument.txt.

Preserve F-12's corroborating_source from /workspace/documents/05_consumer_requests/034_consumer_requests_executed_instrument.txt and /workspace/documents/11_risk_assessments/082_risk_assessments_executed_instrument.txt.

Reconcile F-12 using the exact controlled facts ['closed without exception', 'CB-PR-3004-L208', 'open and escalated', 'CB-PR-3004-U662'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-12's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Adrian Mensah'] for F-12.

Include the confirmed F-13 exception for sensitive-data classification.

Preserve F-13's id from /workspace/documents/05_consumer_requests/037_consumer_requests_review_memorandum.json and /workspace/documents/11_risk_assessments/085_risk_assessments_review_memorandum.json.

Preserve F-13's issue from /workspace/documents/05_consumer_requests/037_consumer_requests_review_memorandum.json and /workspace/documents/11_risk_assessments/085_risk_assessments_review_memorandum.json.

Preserve F-13's severity from /workspace/documents/05_consumer_requests/037_consumer_requests_review_memorandum.json and /workspace/documents/11_risk_assessments/085_risk_assessments_review_memorandum.json.

Preserve F-13's primary_source from /workspace/documents/05_consumer_requests/037_consumer_requests_review_memorandum.json and /workspace/documents/11_risk_assessments/085_risk_assessments_review_memorandum.json.

Preserve F-13's corroborating_source from /workspace/documents/05_consumer_requests/037_consumer_requests_review_memorandum.json and /workspace/documents/11_risk_assessments/085_risk_assessments_review_memorandum.json.

Reconcile F-13 using the exact controlled facts ['New York Department of Financial Services', 'New York'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-13's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Willa Novak'] for F-13.

Include the confirmed F-14 exception for minor-consent issue.

Preserve F-14's id from /workspace/documents/05_consumer_requests/040_consumer_requests_status_report.md and /workspace/documents/11_risk_assessments/088_risk_assessments_status_report.md.

Preserve F-14's issue from /workspace/documents/05_consumer_requests/040_consumer_requests_status_report.md and /workspace/documents/11_risk_assessments/088_risk_assessments_status_report.md.

Preserve F-14's severity from /workspace/documents/05_consumer_requests/040_consumer_requests_status_report.md and /workspace/documents/11_risk_assessments/088_risk_assessments_status_report.md.

Preserve F-14's primary_source from /workspace/documents/05_consumer_requests/040_consumer_requests_status_report.md and /workspace/documents/11_risk_assessments/088_risk_assessments_status_report.md.

Preserve F-14's corroborating_source from /workspace/documents/05_consumer_requests/040_consumer_requests_status_report.md and /workspace/documents/11_risk_assessments/088_risk_assessments_status_report.md.

Reconcile F-14 using the exact controlled facts ['15%', '22%'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-14's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Theo Laurent'] for F-14.

Include the confirmed F-15 exception for training completion gap.

Preserve F-15's id from /workspace/documents/06_notices_consents/043_notices_consents_correspondence.eml and /workspace/documents/12_remediation/091_remediation_correspondence.eml.

Preserve F-15's issue from /workspace/documents/06_notices_consents/043_notices_consents_correspondence.eml and /workspace/documents/12_remediation/091_remediation_correspondence.eml.

Preserve F-15's severity from /workspace/documents/06_notices_consents/043_notices_consents_correspondence.eml and /workspace/documents/12_remediation/091_remediation_correspondence.eml.

Preserve F-15's primary_source from /workspace/documents/06_notices_consents/043_notices_consents_correspondence.eml and /workspace/documents/12_remediation/091_remediation_correspondence.eml.

Preserve F-15's corroborating_source from /workspace/documents/06_notices_consents/043_notices_consents_correspondence.eml and /workspace/documents/12_remediation/091_remediation_correspondence.eml.

Reconcile F-15 using the exact controlled facts ['notices-deepwell_health_services@example.test', 'archive-morrow_claims_clearinghouse@example.test'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-15's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Amara Patel'] for F-15.

Include the confirmed F-16 exception for regulator commitment overdue.

Preserve F-16's id from /workspace/documents/06_notices_consents/046_notices_consents_formal_notice.xml and /workspace/documents/12_remediation/094_remediation_formal_notice.xml.

Preserve F-16's issue from /workspace/documents/06_notices_consents/046_notices_consents_formal_notice.xml and /workspace/documents/12_remediation/094_remediation_formal_notice.xml.

Preserve F-16's severity from /workspace/documents/06_notices_consents/046_notices_consents_formal_notice.xml and /workspace/documents/12_remediation/094_remediation_formal_notice.xml.

Preserve F-16's primary_source from /workspace/documents/06_notices_consents/046_notices_consents_formal_notice.xml and /workspace/documents/12_remediation/094_remediation_formal_notice.xml.

Preserve F-16's corroborating_source from /workspace/documents/06_notices_consents/046_notices_consents_formal_notice.xml and /workspace/documents/12_remediation/094_remediation_formal_notice.xml.

Reconcile F-16 using the exact controlled facts ['56 records', '2025-10-18', '66 records', '2025-11-25'].

Do not introduce a controlled date, amount, percentage, address, or reference absent from F-16's cited source pair.

Preserve the supported cure owner and deadline anchors ['2026-09-13', 'Henry Cho'] for F-16.

Include the 'Executive assessment' decision section in advice.md.

Include the 'Method and record coverage' decision section in advice.md.

Include the 'Findings' decision section in advice.md.

Include the 'Recommended next actions' decision section in advice.md.

Include the 'Assumptions and limitations' decision section in advice.md.

Explain F-01 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-02 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-03 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-04 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-05 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-06 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-07 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-08 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-09 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-10 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-11 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-12 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-13 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-14 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-15 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Explain F-16 with its issue, severity, cited source pair, exact conflicting facts, owner, and deadline.

Do not claim the production has no issues or that every record is consistent.

Reconcile controlling and corroborating records

The CB-PR-3004 production contains independently maintained records; a defensible answer must preserve each supported conflict and its cure owner.

Timestamp recency does not establish legal priority, execution, or approval authority.

Report primary records without reconciliation

Primary records alone conceal the operational conflicts that create the actionable exceptions.