Skip to main content

Protection Policy Generator — FINAL ship/no-ship verification (Fable 5.1, 2026-09-25)

Reviewer: independent Fable 5.1 session (did not author the rules or the revision). Inputs: sources/protection-policy/{rules.yaml, clause-library.yaml, test-cases.yaml, open-questions.md} at sha256 d2f22515…d581a6 / 4e3b21e9…939e32 / 6d20ec6a…0aacbd5e; protection-policy-2026-09-25-resolutions.md; the opus, fable and codex reviews. Sources were not edited except for two temporary breaks, both restored byte-exact (sha256 re-checked) — see §5.

VERDICT: PASS​

All 5 critical, 1 blocker and 26 major findings are actually fixed in the clause text (not only in the resolutions table). Every duty-to-report and vulnerable-adult clause survives the frightened-volunteer read. Eleven statute passages were re-verified verbatim against the official consolidations. The generation gate blocks on every blank required contact. No REFER clause states a binding rule. The validator passes, and fails loudly when broken. Four minor wording nits remain (§6); none changes what a volunteer does.

1. Critical / blocker / major findings — confirmed against the current clause text​

idverdictevidence in the current text
OPUS C-01FIXEDC-11-DUTY-BC/AB/NS: "Make the report yourself. Do not rely on anyone else, including a church leader or {{safeguarding_coordinator_name}}, to make it for you; telling them is in addition, never instead." "or confirm that" is in every C-11 must_not_contain, globally forbidden, and regex FP-02 fires on the old sentence (positive control checked).
OPUS C-02 / FABLE F-02 / CODEX F-08, F-09FIXEDC-04: "YOU report it yourself, now, to the child-protection authority and the police under section 11. If anyone is in immediate danger, call {{emergency_number}}. Then tell the Safeguarding Coordinator in addition … it is not the church's decision whether the law is engaged." C-09: "YOU report it immediately under section 11 — do not wait for a meeting or a review … call {{emergency_number}} first … show it to the Safeguarding Coordinator … in addition, after you have reported." "where the law requires it" and "the same day" forbidden; TC-23 + FP-10.
OPUS C-03FIXEDEvery C-11 and C-10: "If the person you suspect is a church staff member, volunteer or leader, or anyone other than the child's parent or caregiver, report to [agency] AND the police; the [agency] may tell you it is a police matter, so call the police in either case." ON paraphrase keeps "by the person having charge of the child, or by another person where the person having charge 'knows or should know … and fails to protect the child'". AB clause: "the Act's grounds centre on the guardian, so do not assume the director alone will act" (TC-28).
OPUS C-04FIXEDC-10 "DO NOT WARN ANYONE. Do not tell the child's parents, caregiver or family, do not contact or confront the person the child named, and do not tell anyone who might warn them, before you report." Same sentence in all six C-11 variants; children_youth.must_contain requires it; FP-08 regex + forbidden_normalised.
OPUS C-05FIXEDC-12-VA-AB is LAW and quotes PPCA s.7(1) "every individual … shall report … (a) to a complaints officer, (b) to a police service", s.8(1), s.7(5), s.24(1)-(2); "you report it yourself … Telling the Safeguarding Coordinator does not replace this report"; "reasonable grounds to believe" throughout, "any suspicion" forbidden. Verified against the King's Printer PDF (§3).
CODEX F-01FIXEDAll four C-12 clauses: external report first, "Internal notice never replaces the/an external report" (required by the vulnerable_adults invariant), contact variables hard-gated (GATE-04/05).
FABLE F-01 / CODEX F-07FIXED22 variables declared, all required_nonblank; generation_gate renders NOTHING while any applicable variable is blank; GATE-01..12; fixtures use values, never placeholder literals; all_cases.must_not_contain: "{{". "(24 hours)" gone and forbidden.
FABLE F-03FIXEDSections 10 and 11 render for every ministry type; C-10A-DISCLOSURE-VA (vulnerable_adults only) is the only clause that says "section 12"; universal clauses say "the vulnerable-adults section of this policy". Validator resolves every unquoted "section N" in all 33 cases.
OPUS M-01 / FABLE F-04FIXEDVerified ages in derived_values.child_age_statement (ON younger than 18; BC under 19; AB under 18; NS under nineteen); BC and NS clauses say "so this duty covers 18-year-olds in our youth ministry"; C-02 "protects everyone under 18 and, where the law … treats older persons as children, everyone the law defines as a child"; TC-06/07 REQUIRE "under 19"; C-08 no longer "(ages 13-17)".
OPUS M-02FIXEDFP-11 phone regex applied to every clause template (positive controls "1-800-387-KIDS", "310-1234", "416-555-0199" fire); no template carries a number.
OPUS M-03 / CODEX F-06FIXEDNS-03 (s.25) added; C-11-DUTY-NS is a LAW variant quoting ss.23(1), 25(2), 24(2), 25A, 3(1)(e), 22(2) — all verbatim (§3). CA-OTHER no longer applies to CA-NS; "member of the clergy" forbidden there.
OPUS M-04 / FABLE F-06 / CODEX F-02FIXEDall_cases / children_youth (when: ministry_type in [children, youth]) / vulnerable_adults blocks; the VA block requires both "If a vulnerable adult is in immediate danger, call 911" and (because s.11 renders) "If a child is in immediate danger, call 911". TC-31 is the deliberately broken fixture and the validator confirms it fails.
OPUS M-05 / FABLE F-12, F-25FIXED11 regex patterns with positive controls; forbidden_normalised; "you do not need" required in every children/youth output; template-only rendering contract in the header. I injected "Tell your leader, who will contact the director for you." into the BC clause: FP-01 fired in five cases (§5).
OPUS M-06 / FABLE F-23 / CODEX F-05FIXEDC-12-VA-ON is LAW; LTC paragraph: "You make that report yourself, immediately, to the Director's reporting line … Telling the Safeguarding Coordinator does not replace it"; s.28(4)/(5) scope and s.28(6) stated (one over-breadth nit, §6). RHA s.75 paragraph added and verified.
OPUS M-07 / FABLE F-13, F-14FIXEDC-02 and CA-SCREEN-01/VA-ALL-01 carry the full s.6.3(1) definition ending "of being harmed by a person in a position of trust or authority towards them"; C-03 states the trust/authority condition, "member of a police force or other authorized body", the pardoned-record scope and the s.6.3(8) use limit.
OPUS M-08FIXEDC-11-DUTY-US: "Also call the police … if a crime is suspected, if the child is in danger, or if the person you suspect is a church staff member…"; "Calling the police alone is not assumed to satisfy a State reporting duty." "or to police" forbidden.
OPUS M-09 / FABLE F-08FIXEDC-11-DUTY-CA-OTHER: "Every Canadian province and territory has child-protection legislation with provisions about reporting … This policy does not state the {{province_or_state}} rule — who must report, to whom, within what time, or the penalties." Label rule restated; my scan of all three REFER clauses found zero binding must/shall sentences outside quotation (§4).
FABLE F-05 / CODEX F-03FIXEDstatute_display_name (+ _verified) on every jurisdiction rule; derived_values.provincial_statute_name maps all nine CA-OTHER codes; validator asserts derived coverage and that no source_title/notes text appears in any clause; "prior knowledge", "not verified", "confidence:", "REFER" globally forbidden.
FABLE F-07FIXEDalternate_safeguarding_contact required (GATE-09; GATE-10 rejects a value equal to the Coordinator). My sweep: no clause names {{safeguarding_coordinator_name}} without also naming the alternate.
FABLE F-09, F-10, F-11FIXED"The full list of circumstances" (15 items confirmed in the consolidation, §3); s.125(10) quoted with the two-part test, "in good faith" forbidden; "limit discussion to people who need to know (you may and should speak with the society, the police, and your own lawyer or counsellor)" in every C-11 and C-10.
CODEX F-04FIXEDEvery clause built on VA-ALL-01 has contains_recommended_practice: true and the banner; validator enforces.

All 27 minor findings were also spot-checked against the text (thirteen→full list, good faith, 24 hours, low threshold, promptly→immediately, consent-where-capable, 16-17 police line, section 14 cross-ref, US screening label, s.125(4) condition, s.14(1.1), $10 000 house style, s.4(5) wording, ministry names removed, generation_date, gather-evidence regex, Nunavut emergency number). All present as described.

2. Frightened-volunteer read of every duty-to-report and vulnerable-adult clause​

Read as rendered (fixture values), for C-04, C-09, C-10, C-10A, C-11-DUTY-ON/BC/AB/NS/CA-OTHER/US, C-12-VA-ON/BC/AB/GENERIC, C-13:

could the wording lead a volunteer to…result
delay a reportNo. "now" / "immediately" / "forthwith" / "Report first" in every path; "do not wait for a meeting or a review" (C-09); "the same day" survives only as "tell the Coordinator the same day you report / in addition", and FP-10 guards the substitute form.
report only internallyNo. Every internal-notice sentence is "in addition — never instead"; C-02 defines the Coordinator that way; "Telling a church leader … is never a substitute for your own report" (C-04); "Internal notice never replaces …" required in every VA policy. Ontario VA outside LTC/RH is the one place the external route is police-only (see nit 6.2).
tell the parent or the suspect firstNo. "DO NOT WARN ANYONE …" in C-10 and every C-11; C-10A "do not confront or alert the person suspected, and do not alert relatives who may be involved".
investigateNo. "DO NOT INVESTIGATE … do not try to learn more on your own; report first" (C-10); "Do not investigate. Report first." in every C-11; "the church will not investigate on its own" required globally.
believe someone else will report for themNo. ON quotes s.125(3); BC/AB/NS "Make the report yourself. Do not rely on anyone else, including a church leader or [Coordinator]"; CA-OTHER/US "you report it yourself, immediately"; C-14 training names it.
skip 911 when a child is in immediate dangerNo. Line 1 of all ten C-11/C-12 clauses is the emergency line (script-checked); C-04, C-09, C-10, C-10A each carry "call {{emergency_number}}"; the Nunavut case blocks until the church confirms its local number and never prints "911".

3. Statute spot-verification (primary sources, 9 WebFetch calls; binaries text-extracted locally with pdftotext / antiword)​

passagesourceresult
NS CFSA s.3(1)(e) "child" under nineteen; s.23(1)-(3); s.25(1)-(3),(5); s.25Anslegislature.ca Legislative Counsel PDF, consolidated to April 9, 2026 (amendments to 2026, c. 4, s. 6)verbatim match to NS-01/03/04 and C-11-DUTY-NS
AB PPCA s.1(1)(b) "client", s.1(1)(m) "service provider", s.7(1)-(3),(5),(6), s.8(1), s.10(4), s.24(1)-(2)kings-printer.alberta.ca p29p1.pdf, current as of December 18, 2025verbatim match to VA-AB-01 and C-12-VA-AB (incl. "$10 000", "as soon as reasonably practicable")
BC AGA s.46(1)-(3)bclaws 96006_01, current to September 22, 2026verbatim match; "may report" — permissive, as the clause says
ON FLTCA s.28(1)-(7)ontario.ca/laws/docs/21f39_e.doc, consolidation period from Dec 11, 2025verbatim match incl. s.28(4) paras 1-3, s.28(5) paras 1-6, s.28(6) "paragraph 1, 2, 3 or 4 of subsection (5)"
ON RHA s.75(1)-(4)ontario.ca/laws/docs/10r11_e.doc, consolidation period from June 28, 2024verbatim match; no member-of-public offence in s.75, as VA-ON-03 notes
ON CYFSA s.2(1) "child" younger than 18; s.125(1) paras 1-13 incl. 4.1, 4.2; s.125(2)-(12); history notes (2020, c. 25; 2021, c. 21; 2024, c. 17)ontario.ca/laws/docs/17c14_e.doc, consolidation period from July 1, 2026verbatim match to ON-01..08; s.125(6)(c) reads "a religious official;"; 15 listed items confirmed

Two fetch failures worth recording: r.jina.ai renders of the e-Laws pages are truncated and the fetch model invented an opening for s.125(1) ("Every person who has reasonable grounds to believe…") — never quote from that route; use the .doc exports. bclaws/King's Printer/nslegislature PDFs are fine once extracted locally.

4. Generation gate and REFER rule​

  • Gate sweep (script): 680 jurisdiction × ministry × applicable-variable combinations; every one is required_nonblank; all 7 REPORTING-CONTACT variables are rendered by a clause in every combination they apply to; GATE-01..10 block and name the variable; GATE-12 positive control renders with no "{{". The alternate == coordinator case is treated as blank (GATE-10).
  • REFER clauses (C-11-DUTY-CA-OTHER, C-11-DUTY-US, C-12-VA-GENERIC): scan for must/shall/required-to + report/call outside quotation marks → the only hits are the "does not state … who must report" sentences. No fine, age or binding rule stated. Church rules are banner-labelled.
  • Caveat for the product team: the gate is specified in the sources and proven in the mini-harness. The real generator must implement generation_gate exactly (block, document: null, name the blanks) — that is an implementation acceptance test, not a source finding.

5. Validator​

  • validate_protection_policy.py on the committed sources: PASS (rules 54 · clauses 26 · render cases 33 · gate cases 12 · variables 22 · patterns 11; LAW child ON/BC/AB/NS; LAW VA ON/BC/AB), exit 0.
  • Break 1 — reference: C-05-TWO-ADULT rules: [RP-03] → [RP-99]: validator fails, exit 1 (via KeyError: 'RP-99' at line 87 — loud, but a crash rather than the collected error list; see nit 6.4). Restored; sha256 d2f22515… re-matched; PASS.
  • Break 2 — content: injected "Tell your leader, who will contact the director for you." into C-11-DUTY-BC: validator fails with FP-01 hits in TC-06, TC-07, TC-08, TC-21, TC-26, exit 1. Restored; sha256 re-matched; PASS.

6. Minor wording nits (do not block ship)​

  1. C-12-VA-ON, s.28(6) over-breadth. "anyone in the s. 28(5) list who discourages or coerces you not to report commits an offence (s. 28(6))" — the statute limits (6) to paragraphs 1-4 of (5) (licensee/manager, officers and directors, board members, staff), not the professional service providers in paragraphs 5-6. Fix: "anyone in paragraphs 1 to 4 of that list (the home's licensee or manager, its officers and directors, board members and staff)".
  2. C-12-VA-ON "Other settings" / church rule. Outside LTC and retirement homes the only external route is "call the police where a crime is suspected (assault, theft, fraud, sexual contact)". Neglect of a dependent adult is also a Criminal Code offence (failure to provide necessaries of life). Fix: add "neglect that endangers life or health" to the bracketed examples so a volunteer does not read neglect as "not a crime, so Coordinator only".
  3. derived_values.provincial_statute_name CA-QC prints "(reports go to the Director of Youth Protection for your region)". QC-01 is confidence low / unverified; this is an unverified routing fact in a REFER clause (it is almost certainly true, and the church-filled intake number is the operative instruction). Fix: "(confirm with the Director of Youth Protection for your region)" — same wording QC-01's own note asks for.
  4. Validator robustness. An unknown rule id crashes at line 87 before the error list is printed. Guard rp_kinds[r] with .get so the run reports the collected errors and still exits 1.

7. Not re-verified this pass (unchanged from the resolutions file; not required for PASS)​

NL/MB/NB text (REFER, names printed as verified by the author), QC/SK/PE/YT/NT/NU (nothing printed but the generic phrase), US CWIG PDF, CRA s.6.3 (verified by both prior reviewers), BC CFCSA and AB CYFEA (verified by both prior reviewers), RCMP Nunavut page. The consolidation period of the CYFSA .doc is now "from July 1, 2026", later than the author's 2026-06-24 save; s.125's amendment history is unchanged, so nothing in the clause is affected.

Fetch budget: 9 of 12 used. No source file was left modified (sha256 of all three files identical to the start of the review).