Disciplines · Proposals

YSD-20030 — Provider due-diligence matrix

Which providers are targeted, in which territories, and what does each one's terms actually authorize across playback, source identity, token lifecycle, captions, deep links, analysis and derivative rights, sharing, teaching, export,

6sections4 minread
Markdown source
On this page
  • Status: approved (2026-08-14)
  • Priority: EXT — non-blocking (an undeclared provider capability is denied, so no provider surface operates on an unread term)
  • Decision owner: @GreyChimp
  • Drafted: 2026-08-11 by Claude Code (Opus 5)
  • Approval: approved as recommended by @GreyChimp on 2026-08-14; outcome recorded in decision-log.json; review by 2027-08-14

Question#

Which providers are targeted, in which territories, and what does each one's terms actually authorize across playback, source identity, token lifecycle, captions, deep links, analysis and derivative rights, sharing, teaching, export, retention, and deletion?

Twelve columns and no rows. The register that holds the answers exists and is empty, which means every provider capability currently resolves the same way, and that sameness is doing real work: it is the difference between "we read the terms and they allow this" and "nobody has looked".

Recommendation#

Populate the matrix one provider at a time, and treat a row as complete only when every column is either a quoted term or an explicit "the terms are silent". Silence is a recorded finding, not an empty cell — an empty cell is indistinguishable from an unread document, and this programme has already paid for that confusion twice (YSD-14172, YSD-20036).

Options considered#

  • Ship provider surfaces against a permissive default and narrow on complaint — rejected: that is the proposed-default-as-approval failure, and the complaint arrives from the provider's lawyers.
  • Complete all twelve columns for all target providers before any provider work — rejected: the register is per-capability, so a provider with three read columns can honestly serve those three.
  • Row at a time, silence recorded explicitly — recommended.

Consequences#

  • Provider work is gated on reading, and the reading has a shelf life: a stance older than the review interval reports as stale rather than current.
  • A territory the terms do not name is not authorized, so worldwide is never inferred from silence.

Machine-enforced outcome#

Each provider capability resolves against the recorded stance, its storage reality, and the rights grant together, and every blocker is reported rather than the first one found.

Control in force#

Approval settled the METHOD, not the matrix, and the matrix was empty for three days after it because the decision's own question had a first clause nobody had answered: which providers are targeted. @GreyChimp named two on 2026-08-14 — the Internet Archive and Wikimedia Commons — and both rows are now populated in policies/provider-due-diligence.ts: twelve columns each, every cell a quotation with its source URL and read date, or an explicit silence naming the words searched for and the documents searched.

The control is unchanged for everything not in the matrix. providerStanceFor returns undeclared for a provider with no recorded authorization, and resolveProviderCapability refuses with provider-undeclared — an undeclared capability is not an approved capability. A provider surface cannot operate on a term nobody has read, and a row counts only when every column is a quoted term or an explicit "the terms are silent".

The matrix is re-read rather than remembered. provider-due-diligence.network.spec.ts (YSD_PROVIDER_TERMS_NETWORK=1) fetches all ten documents, asserts each of the eighteen quoted terms is still on the page it was read from, asserts a mutated quotation stops matching, and re-runs every recorded silence against the live text — because a stance older than the review interval is meant to report as stale rather than current, and a quotation nobody re-reads is evidence about whenever it was taken.

Three findings from reading, recorded here because they change what the matrix is for:

  • Both providers are hosts, not licensors. The Archive states that it "does not assert any new copyright or other proprietary rights over any of the material in its database"; Commons tells reusers to read the file's licence. Five cells in the whole matrix authorize anything and every one is about access — reading an API, hotlinking a file, downloading bytes — never about rights over the work. Provider authorization is therefore not where permission lives for these two, and the row says so rather than manufacturing a permission out of a disclaimer.
  • Silence is not "the word is absent". Re-running the searches over the live documents turned up "captions" in the Internet Archive's own search dropdown ("Search TV news captions") and "download" thirteen times as an operation the service performs. Neither is a term. A silent cell therefore records dismissed occurrences by word and document with the reason each is furniture, and the row check refuses a dismissal naming a word or a document the cell does not read — a suppression that suppresses nothing is the shape of diligence without its content.
  • A document that cannot be read is neither quoted nor silent. The Archive's canonical Terms of Use renders only through JavaScript, so the row sat at eleven columns under an unreadable finding until the Terms were located in a Wayback capture addressed by timestamp. Reading them added four terms no help or developer page carries, including "Access to the Archive's Collections is provided at no cost to you and is granted for scholarship and research purposes only", which conditions every other cell in that row.