← E2T System V1 portal

18 — REV — HUMAN REVIEW

Resolve defined questions against original evidence without mutating frozen candidate artifacts.

Scope

An authorised human reviewer is shown the original page or crop beside the exact captured value and its context, and answers a typed question. Answers are append-only and attributable. A correction is stored in a separate adjudication layer and never written back over CAP-RAW.

This role is allowed to

• Inspect original evidence
• Correct a candidate in a separate adjudication layer

How it works

The human-review website

https://review.marsoom.app verified reachable 2026-09-04

The bare root is deliberate: the review client has no URL routing, so a deep path would 404 against its static asset map. That site belongs to a different session; nothing here modifies, redeploys or writes to it.

Human review contract

Who may review

An authorised human only. The review site is private and owner-only, and reviewer sign-up is closed server-side — it is gated on an access-policy row that does not exist, and a missing row reads as closed. Anyone else following the link reaches a sign-in they cannot pass.

Reviewer instructions and calibration

Defined by the review contract, not by this repository. The site deliberately withholds the model's confidence from the reviewer until after they answer, so the machine cannot lead the witness.

Question types

Seven closed dimensions: grouping, label, title, subtitle, spelling, date, furniture. Each answer is addressed to an item id of the form ITEM:<dimension>:<id>. Free-form commentary is not a review answer.

What the reviewer is shown

The original page or crop — unaltered source pixels — beside the exact captured value and its surrounding context. The printed page reaches the reviewer unmodified; nothing rendered or reconstructed is substituted for it.

Allowed outcomes

CONFIRMED, CORRECTED, UNREADABLE, DEFERRED, CONFLICT. The export additionally carries cannot_determine and an excluded_by code (E1–E6: cannot-determine, illegible, owner void, integrity failure, subtitle true-negative, overlap duplicate) so an exclusion is always attributable to a stated reason rather than a silent drop.

Reviewer identity policy

assignment.reviewer_ref is an opaque id and, by contract, never a username. Reviewer identity must not appear in this repository, in the portal, or in any public artifact.

Timestamp policy

Every answer records answered_at, and an approved correction records approved_at, in UTC ISO-8601. Timestamps are written once at the moment of the decision. There is no update path that rewrites them, so the order of events stays reconstructable.

Append-only answers

One immutable official submission per assignment; it is never overwritten. A practice run is a separate mode and is marked as such, so practice can never be mistaken for an official result.

Conflict and adjudication

Where reviewers disagree, or a reviewer marks CONFLICT, the item goes to adjudication rather than to a majority vote. Both positions are retained. A correction carries status of proposed, approved or rejected, and only approved may reach designer feedback or training.

Escalation

UNREADABLE and DEFERRED escalate to the owner rather than resolving themselves. An unanswered or unreadable item is never converted into an accept by omission, and no downstream step may treat it as one. If the original evidence itself is insufficient, the escalation is against the source, not the reviewer.

Corrections stay separate from CAP-RAW

A corrected value is written to a separate adjudication layer keyed to the candidate. CAP-RAW is never edited. The captured text and the human's correction remain two distinct, independently readable facts.

Import contract — the identifier trap

marsoom.human-review-import.v47.profile-review-site-1 is the schema document's $id. The payload's schema field must read exactly marsoom.human-review-import.v47 — bare, with no profile suffix. The import gate compares that string and rejects the entire file at G1.1 if it differs; nothing is loaded, not even partially. The payload must also carry presentation_status: "HOLD" (gate G1.2). Two identifiers, two different jobs. (Confirmed by the VER V1 session, 2026-09-04.)

Export contract

marsoom.review-answers-export.v1 — here the $id and the emitted schema field are the same string. Owner-only, at GET /api/owner/export. Not public, so this portal cannot read it.

What human review does NOT authorise

Nothing automatic. A human decision is not audit acceptance, not release, and not production, and it does not by itself authorise training on the corrected data. Those are four further gates, each requiring its own explicit approval. spelling_metric.recall is a hard constant not_measured in the export contract — no code path may compute or display one.

Non-scope — what this role does NOT own

• Overwriting CAP-RAW
• Turning unanswered items into accepts
• Self-authorising training, release or production
• Automatic AI verification

Explicitly forbidden

• Overwrite CAP-RAW
• Turn unanswered items into accepts
• Self-authorize training, release or production

Dependencies and position

Starts

When a role emits a reviewable HOLD or when acceptance sampling is required.

Previous step

17 SPELL

Next step

19 EXTRACT

Hands off to

Adjudicated truth layer, Separate acceptance/release policy

Exact inputs

• Original page/crop
• Exact candidate value and context
• Typed question, alternatives and evidence lineage

Exact outputs

• Append-only answer and reviewer identity
• CONFIRMED, CORRECTED, UNREADABLE or DEFERRED decision
• Optional corrected value stored separately from CAP

Performer and AI/ML boundary

Performer

Authorized human owner/reviewer.

Class

Human

AI boundary

None as human authority.

Training information

Not a model. Reviewer instructions, calibration and the closed question set are defined by the review contract. The review site deliberately withholds model confidence from the reviewer before they answer, so the machine cannot lead the witness.

Deterministic validation and acceptance gates

• Every decision is attributable and source-bound
• Candidate, human truth, audit acceptance and release remain separate

HOLD and failure behaviour

Failure codes this step may emit:

• REVIEW_SOURCE_MISSING
• REVIEW_ANSWER_UNBOUND
• REVIEW_CONFLICT
• REVIEW_INCOMPLETE

Downstream handoff

Adjudicated truth layer, Separate acceptance/release policy

Active tool

Status

Active tool

Run / inspect

python BUILDER_STAGE_A.py then BUILDER_STAGE_B.py to build the immutable review package; the package is then imported into the review website

Input

marsoom.human-review-import.v47 — see contract_identifier_warning

Output

marsoom.review-answers-export.v1

Dependencies

• Python 3.12 (NOT installed on this machine)
• review.marsoom.app — a separate system, read-only to this repository

Why this is the active version

V005 is the highest version under review_packages/issue_4547 and was built 2026-09-04T06:34Z, AFTER the V004 pixel audit found V004's confidence heuristic yielded only 33.8 percent real errors. V005 replaces that heuristic with the trained SPELL detector plus SUPPRESSED_CANDIDATES.json and VERIFIER_REGISTRY_V3.json. The two contract schemas are the canonical copies placed by the review-site owner in the Human review Tool folder.

Copied files — source receipt

9 file(s), all hash-verified against the original. Full detail in tool/SOURCE_RECEIPT.json. Copy-only: the historical source is never modified.

Archived versions

3 archived version(s). Historical packages are never deleted or mutated; large ones are referenced with verified paths rather than copied, because the source archive is 11 GB.

Known limitations

• Access is private and owner-only. Reviewer sign-up is closed server-side, so anyone else following the link reaches a sign-in they cannot pass.
• The site runs under presentation status HOLD and refuses to start outside it. Nothing from it may be presented as an accepted result or a measured accuracy figure.
• No run has been submitted and no score exists.
• Spelling recall is a hard constant `not_measured` in the export contract — no code path may compute or display one.
• Human review does NOT by itself authorise training, audit acceptance, release or production. Those are four further, separate gates.

Security and privacy

Reviewer identity is an opaque id and never a username. Owner-only fields such as model confidence are stripped server-side for non-owner responses. Private reviewer detail must never appear in this repository or in the portal.

Cost behaviour

Human reviewer time. No metered provider cost.

Copying a tool into this repository does not authorise running it, retraining it, calling a model, or processing a new issue. No paid call may be made without the owner's explicit authorisation and a hard cost cap.

Provenance

Registry

registry/roles.json (schema marsoom.e2t.roles.v1)

Derivation

28 legacy roles - VER - HUMAN + REV = 27 active steps

Legacy role id

HUMAN

Legacy source SHA-256

6f5d5d7ed8869e45307424c2193f95ffab84abc44a6a188f5c7f98c2a48ec64d

Generated

2026-09-04T22:13:12.433Z

Feedback and decisions

Feedback is recorded per source and never merged into an invented consensus. Where sources disagree, both positions stand and the owner decides.

Recorded events

No feedback events recorded yet. The ledger exists and is append-only: feedback/FEEDBACK_LEDGER.jsonl.

Editing feedback is not possible: a change is a new event whose supersedes names the one it replaces, and the original stays exactly as written.

---

Generated from registry/roles.json by tools/build-reports.mjs. Do not hand-edit — edit the registry and rebuild.
Original page pixels are the visual authority. CAP owns the exact captured text.