31. External Quality communications, delivery and acknowledgement
Deliver one independently approved UNCLASSIFIED statement from an exact Quality source to controlled recipients with retry, dead-letter, acknowledgement, escalation and closure evidence.
Purpose
Deliver one independently approved UNCLASSIFIED statement from an exact Quality source to controlled recipients with retry, dead-letter, acknowledgement, escalation and closure evidence.
Quality Management Representative author/operator, two different QA Head users, external recipient and read-only Quality/programme/security/audit observers
QCM-… rejected v1 → approved v2 → recipient A SENT + recipient B DEAD_LETTER → requeue → two acknowledgements → separate-QA CLOSED.
Before you begin
- An eligible notification-required NCR, issued SCAR, Security-concurred counterfeit decision or approved product-escape decision exists
- SMTP and the Quality communication templates are configured
- At least one same-site ACTIVE, CLEAN internal evidence version exists
- QMR author/operator, releasing QA Head and closing QA Head are three different named users
- Every external recipient and internal escalation role is explicitly controlled
Bounded messaging, credential and escalation controls
The communication snapshots one exact eligible NCR, SCAR, counterfeit or product-escape source and stores a deterministic SHA-256 fingerprint. QA release is blocked after any authoritative source change.
Only the stored UNCLASSIFIED public title, summary, action, due time and secure link are rendered. No attachment, internal evidence, classified detail, source identifier or named-user history travels externally.
Each controlled email has its own dispatch, outbox event, notification delivery, strong-hash-only credential and append-only attempt history. One recipient's failure cannot falsely mark another as failed.
Retry backoff is bounded. Requeue is QMR-only and creates a fresh one-time link while the immutable attempt ledger retains prior RETRYING, DEAD_LETTER and SENT outcomes.
The delivery link redeems once into a short-lived hashed session. The representative email must exactly match the controlled recipient, and each dispatch accepts one immutable acknowledgement.
Dead-letter or overdue acknowledgement creates a level-bounded internal escalation to active users matching configured roles, site scope and classification clearance. Acknowledgement resolves open escalations.
Closure requires every released dispatch to be ACKNOWLEDGED and a QA Head different from both the QMR author and releasing QA Head.
Flow 25 never changes NCR, SCAR, counterfeit, product-escape, supplier, customer, item, configuration, inspection, current_stock or stock_ledger records.
Procedure
- 1
Author and submit immutable v1 as QMR; reject it as a different QA Head.
- 2
Create v2 and independently release only an unchanged source fingerprint and bounded UNCLASSIFIED public snapshot.
- 3
Process per-recipient delivery; prove an isolated dead letter, retained attempt evidence, escalation and QMR requeue with a fresh secure link.
- 4
Redeem and acknowledge once per recipient through the isolated page using the exact delivered email.
- 5
Process overdue escalation if required, then close as a second QA Head and reconcile unchanged Quality-source and custody facts as Auditor.
Expected result
- Lifecycle follows DRAFT → RELEASE_REVIEW → QUEUED/DELIVERING → SENT or DEAD_LETTER → ACKNOWLEDGED → CLOSED
- Author, releaser and closer are three different named internal users
- Rejected versions remain immutable and stale source fingerprints are rejected
- Each recipient has an independent dispatch, delivery outcome, token hash and acknowledgement
- Every retry, dead letter, requeue success and escalation delivery remains in the append-only attempt ledger
- Plaintext credentials appear only in outbound messages and public responses; only strong hashes are stored
- The public page exposes no tenant navigation, internal evidence, classified detail, source identifier or named-user history
- External email must exactly match the controlled recipient
- Flow 25 never changes any Quality source, supplier, configuration, inspection, inventory or ledger record
- Auditor mutation attempts are rejected