# RAID log template pack

This original pack models one governed RAID ledger. Its frozen convention is:

- `R` = risks
- `A` = assumptions
- `I` = issues
- `D` = dependencies

Each category has its own required fields. A cross-link may record that a risk, assumption, or dependency materialized into an issue. Decisions stay in external decision records: this ledger stores only a decision record ID, owner, and safe relative path.

## Files

- `raid-log-template.md`: editable review-first template
- `raid-log-example.md`: completed fictional Markdown example
- `raid-log-example.json`: machine-readable fictional example
- `raid-issue-log.csv`: issue-only RFC4180 projection for Excel or Google Sheets
- `raid-log.schema.json`: closed JSON Schema Draft 2020-12 contract
- `validate-raid-log.mjs`: dependency-free structural and cross-record validator
- `validate-raid-log.test.mjs`: positive, mutation, graph, and security tests
- `build-pack.mjs`: deterministic allowlisted ZIP builder
- `pack-manifest.mjs`: single exact archive allowlist

## Verify

Use Node.js 22 or newer:

```sh
npm run check
npm run build
```

The validator deliberately checks more than JSON Schema alone: exact keys, category prefixes, owner and reference integrity, materialization direction and source state, date order, valid IANA timezone identifiers, contiguous revisions, false authority boundaries, safe relative paths, and common secret or spreadsheet-formula shapes. It also requires the CSV to be the exact deterministic projection of canonical JSON issues, with RFC4180 CRLF rows and no formulas, embedded newlines, personal contacts, decision fields, or non-issue category rows. The CSV can open in Excel or Google Sheets; it is not an XLSX file or a native integration. The builder uses Node.js only and writes fixed, uncompressed ZIP records, so host ZIP settings cannot alter the bytes.

## Boundary

This pack coordinates RAID records. It does not own detailed risk scoring or treatment history, decision content or approval, status-report narrative, action execution, defect reproduction and retest, incident or SLA workflow, schedule commitments, security or compliance certification, release authorization, production authorization, or business outcomes. The example is fictional and uses reserved identities. For a real project, replace every example value with minimum-purpose, approved data; choose an allowed classification; keep evidence in an authorized store; and obtain the accountable reviews required by your organization.