Evidence Freshness Management

Manages evidence freshness by identifying stale decisions and providing governance actions. Implements FPF B.3.4 (Evidence Decay).

Key principle: Evidence is perishable. Decisions built on expired evidence carry hidden risk.

---

Quick Concepts

What is "stale" evidence?

Every piece of evidence has a valid_until date. A benchmark from 6 months ago may no longer reflect current system performance. A security audit from before a major dependency update doesn't account for new vulnerabilities.

When evidence expires, the decision it supports becomes questionable - not necessarily wrong, just unverified.

What is "waiving"?

Waiving = "I know this evidence is stale, I accept the risk temporarily."

Use it when:

• You're about to launch and don't have time to re-run all tests
• The evidence is only slightly expired and probably still valid
• You have a scheduled date to refresh it properly

A waiver is NOT ignoring the problem - it's explicitly documenting that you know about the risk and accept it until a specific date.

The Three Actions

Situation	Action	What it does
Evidence is old but decision is still good	Refresh	Re-run the test, get fresh evidence
Decision is obsolete, needs rethinking	Deprecate	Downgrade hypothesis, restart evaluation
Accept risk temporarily	Waive	Record the risk acceptance with deadline

---

Action (Run-Time)

Step 1: Generate Freshness Report

1. List all evidence files in .fpf/evidence/
2. For each evidence file:
   • Read valid_until from frontmatter
   • Compare with current date
   • Classify as FRESH, STALE, or EXPIRED

Step 2: Present Report

## Evidence Freshness Report

### EXPIRED (Requires Action)