# Criterion Invalidation Under Construct Validation: The SC-2026-006 v1.0 Case

- **Artifact ID:** CHQ-SM-2026-018
- **Version:** v1.0
- **Status:** ISSUED
- **Public record:** https://record.cybersecurityhq.com/memoranda/chq-sm-2026-018
- **Machine-record SHA-256:** `7cd7d34c59e1c6953216d116d983247467dcce8b7d535aebc331d1accb036d3a`

## Complete structured record

```json
{
  "id": "CHQ-SM-2026-018",
  "title": "Criterion Invalidation Under Construct Validation: The SC-2026-006 v1.0 Case",
  "descriptor": "Criterion Invalidation Under Construct Validation: The SC-2026-006 v1.0 Case",
  "issued": "2026-09-22",
  "classification": "Analytical",
  "status": "ISSUED",
  "version": "v1.0",
  "memo_type": "SM",
  "authority_level": "ANALYTICAL",
  "referenced_by": [
    "CHQ-SC-2026-006",
    "CHQ-CGS-2026-001"
  ],
  "inherits_from": "CHQ-SM-2026-013, CHQ-ASC-2026-005",
  "related_artifacts": [
    "CHQ-SC-2026-006",
    "CHQ-CGS-2026-001"
  ],
  "doctrine_class": "Structural Memorandum",
  "precedent_constraints": [
    "CHQ-ASC-2026-002",
    "CHQ-ASC-2026-005"
  ],
  "governs_evidence_for": [
    "CHQ-SC-2026-006",
    "CGS-1",
    "CGS-4.3",
    "CGS-8"
  ],
  "citable_assertion": "Procedural consistency is not construct validity; a rating produced by an invalid instrument is voided rather than adjusted.",
  "purpose": "This memorandum records, as a single citable chain, the sequence by which a rating criterion was found to measure the wrong construct after producing a rating action, and how the record handled it. It exists so that the Criteria Governance Standard's invalidation provisions cite a case rather than a hypothetical.",
  "statement": "",
  "observability": "",
  "boundary": "",
  "reliance_language": "",
  "reliance_boundary": "",
  "revision_history": "v1.0 (September 22, 2026): Initial issuance",
  "structural_sections": [
    {
      "heading": "THE CHAIN",
      "items": [
        "Criterion v1.0, published 11 August 2026: one review cycle containing an instance whose identifier was assigned twelve or more months before listing moves the condition to Confirmed.",
        "Candidate one, Ray (CVE-2025-62593): reservation 16 October 2025, listing 17 August 2026, ten months; disqualified 25 August.",
        "Candidate two, Fortinet (CVE-2025-25249): reservation 5 February 2025, listing 9 September 2026, nineteen months; the criterion triggered and the condition was upgraded on 12 September.",
        "External review, 15 September: identifier reservation is not defender awareness; a reserved identifier can be private, and a vulnerability disclosed and fixed in January and listed in September is a remediation lag with awareness present, the boundary the condition excludes. The observable measured identification-to-confirmation lag.",
        "Disposition, 15 September: the upgrade was voided rather than reversed; prior state Strengthening restored; the condition placed under review; v2.0 declared for 24 September using exploitation documented before public disclosure, with both dates sourced; all v1.0 adjudications re-run; the Fortinet observation excluded from producing any action under v2.0.",
        "Constraint check, 22 September: CHQ-ASC-2026-005, issued 7 April, already held that disclosure timing cannot proxy exploitation onset. The v1.0 criterion conflicted with a constraint in force at activation; the audit standard now checks the constraint register before activation.",
        "The v2.0 validation test set includes Cisco FMC CVE-2026-20131 from ASC-005's derivation — exploitation 26 January 2026, disclosure 4 March 2026, a 36-day interval — alongside FortiClient EMS and PaperCut."
      ]
    },
    {
      "heading": "WHAT THE CASE ESTABLISHES",
      "content": "Procedural consistency is not construct validity: the same field, applied identically, disqualified Ray and qualified Fortinet, and neither result had standing. A rating produced by an invalid instrument is voided, not adjusted."
    },
    {
      "heading": "RELATIONSHIP TO DERIVED ARTIFACTS",
      "content": "CGS-1 (validation before activation), CGS-4.3 (replacement), and CGS-8.1 through 8.6 (invalidation and review states) cite this memorandum as their founding case. SC-2026-006's page cites it for the v1.0 to v2.0 transition."
    }
  ],
  "revision_conditions": "Revised if the 24 September review or a later one finds a further defect in v2.0; the chain is extended, not rewritten.",
  "attestation": "This memorandum records that the record kept the invalid rule, the voided action, and the replacement visible together, and did not use the observation that exposed the defect to produce the answer the defect had prevented."
}
```