docs operator profile review

Profile claim review — operator runbook

Scope: human review of station representation claims (profile-v1). Server decisions are final; reviewers never grant outside the DecideAtomically path. Staffing levels stay P23-T03-owned; this runbook defines the procedure, not headcount.

1. Review queue

• Source: pending claims with active declarations (ClaimStore open states). Order: oldest declaration first; impersonation flags first.
• Each review records: decision (approved/denied), reason (required for denial), evidence outcomes (signature + authority), reviewer id. Denial without reason is rejected by the service (ErrVerifyReason).

2. Approval checklist

1. Signature outcome valid (independent verifier, not the uploader).
2. Authority sufficient for the exact branch/CNPJ (no joint-authority assumption; mismatch or stale operator evidence → deny/stale).
3. Account live; no self-review (requester ≠ reviewer, enforced).
4. Scopes within the claim's role; grants stay narrow to claim scopes.

3. Urgent impersonation review

• Rival or fraudulent claim flags pause auto-processing for that station (disable intake flag for the station, keep reads).
• Both competing cases stay private; never disclose one claimant to the other. Escalate to the station operator channel when available.

4. Suspension and revocation

• Grant revocation/suspension takes effect on next capability check; in-flight edits fail closed (DeniedRevoked/ServerRefused, no replay). Contested access follows the same path via ContestAccess + fresh auth.
• Revoked PII/proof follows the 24 h all-copy purge (docs/operator/retention.md); deletion-ledger replay restores the revocation on recovery.

5. Disable and rollback

• Feature disable: turn off the claim/management capability flags; public unclaimed reads keep working (no profile deletion).
• Binary rollback: restore the previous verified backend build; grants and revocations persist in the database (never rolled back with the binary). Re-run the P33-T01/T02 suites on the restored build.

6. Contact and rights

• Source/document rights: registry/DOU snapshots and reviewer notes stay within their licensed scope; private proof bytes are never published or attached to public responses (all error paths are no-store).