---
name: Maturity Scorecard Template
description: Template for the deployed instance's MATURITY-SCORECARD.md. Full-fidelity audit output produced by the validate skill, encoding BOOTSTRAP-BRIEF Sections III, IV, X, and XI. Refreshed on validation runs, on material maturity changes, or quarterly minimum.
type: template
populated_from: validate skill output (Chunk E); refreshed against current state of policies/, kit/, platforms/, cross-platform/, decisions/, inbox/, sessions/
---

# Maturity Scorecard Template

Copy this file to `MATURITY-SCORECARD.md` at the deployed instance root. The scorecard is the audit-of-record; the OPERATING-MODEL.md surfaces summary state, this surfaces full state.

The validate skill (`skills/validate/SKILL.md`) produces this scorecard automatically. Hand-edits between validate runs are permissible for typos and clarity improvements; structural changes wait for the next validate run.

---

# Maturity Scorecard - {{instance_name}}

- **Last reviewed:** {{validate_run_date}}
- **Review cadence:** on every validate run (quarterly minimum, plus on every material change)
- **Status:** active
- **Generated by:** {{validate_skill_version}}

## Per-layer maturity

| Layer | State | Gap | Retrofit risk | Evidence |
|-------|-------|-----|---------------|----------|
| L0 Strategy | none / stubbed / partial / mature | ... | low / medium / high | path to artifact + last-reviewed date |
| L1 Brand posture | none / stubbed / partial / mature / N/A-explicit | ... | ... | ... |
| L2 Philosophy | ... | ... | ... | ... |
| L3 Framework contract | ... | ... | ... | ... |
| L4 Platform kit | ... | ... | ... | ... |
| L5 Instance dossiers | ... | ... | ... | one row per platform if needed |
| L6 Per-instance refinement | ... | ... | ... | typically reported per L5 dossier |
| L7 Cross-platform glue | ... | ... | ... | summary of six L7 concerns |

**Maturity scale rules** (from BOOTSTRAP-BRIEF Section III):
- **none** - layer has not been touched
- **stubbed** - placeholder artifact exists with the right shape but no real content
- **partial** - artifact exists with content but has known gaps
- **mature** - artifact is complete, current within cadence, and a capable replacement could operate from it
- **N/A-explicit** - layer does not apply; reason recorded (typically L1 for internal functions)

A stubbed layer reported as mature is a falsified audit. The scorecard refuses to mark a layer mature without naming the evidence.

## L7 cross-platform glue (six concerns)

| Concern | State | Owner | Last verified live |
|---------|-------|-------|--------------------|
| Shared memory | exists-mature / exists-partial / declared-not-built / none-applicable | ... | ... |
| Shared identity | ... | ... | ... |
| Handoff protocol | ... | ... | ... |
| Consent flow | ... | ... | ... |
| Alerting fabric | ... | ... | ... |
| Monitoring base | ... | ... | ... |

`unknown` is **not a permissible state** here per Q8's hard rule. Concerns marked `none-applicable` must include justification.

## Per-relationship classification

Every relationship the instance has, classified per BOOTSTRAP-BRIEF Section IV:

| Relationship | Type | Status | Last verified |
|-------------|------|--------|---------------|
| {{from}} -> {{to}} | mirror / inbox-outbox / handoff / cross-platform / inheritance | live / declared-but-inactive | {{date}} or never |
| ... | ... | ... | ... |

**Default assumption is declared-but-inactive until evidence of live.** A relationship reported as live must cite the evidence in the row.

## ADR catalog

One row per ADR; immutable order by number.

| Number | Title | Status | Date |
|--------|-------|--------|------|
| ADR-0001 | {{title}} | accepted | {{date}} |
| ADR-0002 | {{title}} | accepted | {{date}} |
| ADR-0003 | {{title}} | superseded by ADR-0007 | {{date}} |
| ... | ... | ... | ... |

### Visible decisions that should have ADRs but do not

The validate skill scans for decisions made in commits, session logs, or policy artifacts that meet ADR criteria from BOOTSTRAP-BRIEF Section VII but lack an ADR file. Each is a finding.

- {{decision_made_without_adr}} - {{where_observed}} - {{recommended_adr_title}}
- ...

If none, this section reads: "No undocumented decisions detected."

## Behavior trigger encoding check

Per BOOTSTRAP-BRIEF Section V, every trigger should be encoded somewhere persistent (a doc, a skill, a checklist, a runbook), not left to memory. The validate skill checks each trigger against the instance's artifacts.

| Trigger | Encoded where | Memory-only? |
|---------|---------------|--------------|
| Read brief at session start | OPERATING-MODEL "What to do if you are new here" | no |
| Write ADR for 2+-options decision | decisions/ folder + ADR-template | no |
| Doc Lifecycle frontmatter on every artifact | architect-lifecycle skill + this scorecard | no |
| Per-layer maturity not binary | MATURITY-SCORECARD format itself | no |
| Mark L1 N/A explicitly for internal functions | L1 brand-posture template N/A guidance | no |
| Mirror relationship default to declared-but-inactive | architect-kit-mirror skill | no |
| Concurrent-session lock-on-write | session-log template + concurrent-actor section | yes / no |
| Five-question decision framework | (where applied) | yes / no |

A trigger marked `memory-only` is a finding for the next session.

## Concurrent-actor surface review

| Surface | Protocol-safe? | Evidence |
|---------|----------------|----------|
| `policies/` artifacts | yes / no | ... |
| `kit/` components | yes / no | ... |
| `platforms/{{platform}}/` artifacts | yes / no | ... |
| `decisions/` (immutable) | yes (immutable by design) | ... |
| `BACKLOG.md` | yes / no | ... |
| `inbox/` | yes / no | ... |

Protocol-safe means: if two operators or sessions touched this surface concurrently, the discipline from BOOTSTRAP-BRIEF Section IX would catch the collision (lock-on-write, session log, signaling). Surfaces marked `no` are findings.

## Vocabulary consistency check

The validate skill scans for vocabulary drift across artifacts. Words from BOOTSTRAP-BRIEF Section VI (`layer`, `maturity`, `live`, `declared-but-inactive`, `ADR`, `mirror`, `pod`) must be used with their defined meanings.

Findings:

- {{drift_observed_a}} - {{path}} uses `{{word}}` with non-standard meaning
- ...

If none, this section reads: "Vocabulary consistent across audited artifacts."

## Failure-mode trigger check

For each named failure mode in BOOTSTRAP-BRIEF Section XI, the validate skill scans for instances:

| Failure mode | Detected? | Where | Severity |
|--------------|-----------|-------|----------|
| Path-to-layer pattern matching | yes / no | ... | high / medium / low |
| Binary existence checks | yes / no | ... | ... |
| Missing L7 awareness | yes / no | ... | ... |
| Static inventory vs. assessment | yes / no | ... | ... |
| Overclaimed completeness | yes / no | ... | ... |
| Floating concepts | yes / no | ... | ... |
| Untested relationships | yes / no | ... | ... |

Each detection is a finding. The validate skill flags severity based on whether the failure mode is reaching production behavior or is contained inside drafts.

## Single highest-leverage next move

The audit's job is to drive action, not produce a list. From every finding above, the **one** move that matures the most layers, repairs the most relationships, or closes the most behavior-trigger gaps:

{{Single recommendation. Specific. Owner. Closes-by date.}}

Example: "Move L7 consent flow from `declared-not-built` to `exists-partial` by stubbing the cross-platform/consent-flow.md artifact with a sketch of the consent-record schema. Owner: {{compliance_engineering}}. Closes-by: 2026-05-12. Unblocks: GDPR conformance demonstration; L5 dossiers can begin declaring participation."

## Cross-references

- `BOOTSTRAP-BRIEF.md` - the standard this scorecard audits against
- `OPERATING-MODEL.md` - summary state derived from this scorecard
- `policies/` through `cross-platform/` - the artifacts audited
- `decisions/` - ADR catalog source
- `inbox/` and `sessions/` - relationship and trigger evidence
- `skills/validate/` - the skill that generated this scorecard
- `skills/architect-audit/` - the layer-mapping skill the validator depends on
