# YSD-20030 — Provider due-diligence matrix

- **Status:** approved (2026-08-14)
- **Priority:** EXT — non-blocking (an undeclared provider capability is denied,
  so no provider surface operates on an unread term)
- **Decision owner:** @GreyChimp
- **Drafted:** 2026-08-11 by Claude Code (Opus 5)
- **Approval:** approved as recommended by @GreyChimp on 2026-08-14; outcome
  recorded in decision-log.json; review by 2027-08-14

## Question

Which providers are targeted, in which territories, and what does each one's
terms actually authorize across playback, source identity, token lifecycle,
captions, deep links, analysis and derivative rights, sharing, teaching, export,
retention, and deletion?

Twelve columns and no rows. The register that holds the answers exists and is
empty, which means every provider capability currently resolves the same way,
and that sameness is doing real work: it is the difference between "we read the
terms and they allow this" and "nobody has looked".

## Recommendation

Populate the matrix one provider at a time, and treat a row as complete only
when every column is either a quoted term or an explicit "the terms are silent".
Silence is a recorded finding, not an empty cell — an empty cell is
indistinguishable from an unread document, and this programme has already paid
for that confusion twice (YSD-14172, YSD-20036).

## Options considered

- **Ship provider surfaces against a permissive default and narrow on
  complaint** — rejected: that is the proposed-default-as-approval failure, and
  the complaint arrives from the provider's lawyers.
- **Complete all twelve columns for all target providers before any provider
  work** — rejected: the register is per-capability, so a provider with three
  read columns can honestly serve those three.
- **Row at a time, silence recorded explicitly** — recommended.

## Consequences

- Provider work is gated on reading, and the reading has a shelf life: a stance
  older than the review interval reports as stale rather than current.
- A territory the terms do not name is not authorized, so worldwide is never
  inferred from silence.

## Machine-enforced outcome

Each provider capability resolves against the recorded stance, its storage
reality, and the rights grant together, and every blocker is reported rather
than the first one found.

## Control in force

Approval settled the METHOD, not the matrix, and the matrix was empty for three
days after it because the decision's own question had a first clause nobody had
answered: which providers are targeted. **@GreyChimp named two on 2026-08-14 —
the Internet Archive and Wikimedia Commons — and both rows are now populated**
in `policies/provider-due-diligence.ts`: twelve columns each, every cell a
quotation with its source URL and read date, or an explicit silence naming the
words searched for and the documents searched.

The control is unchanged for everything not in the matrix. `providerStanceFor`
returns `undeclared` for a provider with no recorded authorization, and
`resolveProviderCapability` refuses with `provider-undeclared` — _an undeclared
capability is not an approved capability_. A provider surface cannot operate on
a term nobody has read, and a row counts only when every column is a quoted term
or an explicit "the terms are silent".

The matrix is re-read rather than remembered.
`provider-due-diligence.network.spec.ts` (`YSD_PROVIDER_TERMS_NETWORK=1`)
fetches all ten documents, asserts each of the eighteen quoted terms is still on
the page it was read from, asserts a mutated quotation stops matching, and
re-runs every recorded silence against the live text — because a stance older
than the review interval is meant to report as stale rather than current, and a
quotation nobody re-reads is evidence about whenever it was taken.

Three findings from reading, recorded here because they change what the matrix
is for:

- **Both providers are hosts, not licensors.** The Archive states that it "does
  not assert any new copyright or other proprietary rights over any of the
  material in its database"; Commons tells reusers to read the file's licence.
  Five cells in the whole matrix authorize anything and every one is about
  access — reading an API, hotlinking a file, downloading bytes — never about
  rights over the work. Provider authorization is therefore not where permission
  lives for these two, and the row says so rather than manufacturing a
  permission out of a disclaimer.
- **Silence is not "the word is absent".** Re-running the searches over the live
  documents turned up "captions" in the Internet Archive's own search dropdown
  ("Search TV news captions") and "download" thirteen times as an operation the
  service performs. Neither is a term. A silent cell therefore records
  `dismissed` occurrences by word and document with the reason each is
  furniture, and the row check refuses a dismissal naming a word or a document
  the cell does not read — a suppression that suppresses nothing is the shape of
  diligence without its content.
- **A document that cannot be read is neither quoted nor silent.** The Archive's
  canonical Terms of Use renders only through JavaScript, so the row sat at
  eleven columns under an `unreadable` finding until the Terms were located in a
  Wayback capture addressed by timestamp. Reading them added four terms no help
  or developer page carries, including "Access to the Archive's Collections is
  provided at no cost to you and is granted for scholarship and research
  purposes only", which conditions every other cell in that row.