# Tasks: Spec 427 - Exchange / Teams Verified Source Contract Enablement **Input**: Design documents from `/specs/427-exchange-teams-verified-source-contract-enablement/` **Prerequisites**: `spec.md`, `plan.md`, `checklists/requirements.md` ## Test Governance Checklist - [x] Lane assignment is named and is the narrowest sufficient proof for the changed behavior. - [x] New or changed tests stay in the smallest honest family, and any heavy-governance or browser addition is explicit. - [x] Shared helpers, factories, seeds, fixtures, and context defaults stay cheap by default; any widening is isolated or documented. - [x] Planned validation commands cover the change without pulling in unrelated lane cost. - [x] Browser proof is explicitly `N/A - no rendered UI surface changed`. - [x] Human Product Sanity and Product Surface close-out are `N/A - no rendered UI surface changed`. - [x] Any material budget, baseline, trend, or escalation note is recorded in the active spec or implementation report. ## Phase 1: Preflight And Dependency Guardrails **Purpose**: Confirm the implementation can proceed without rewriting completed specs or drifting into runtime promotion. - [x] T001 Capture branch, HEAD, and `git status --short` in `specs/427-exchange-teams-verified-source-contract-enablement/implementation-report.md`. - [x] T002 Confirm Specs 414, 415, 417, 419, 420, and 426 are completed dependency context only and do not modify their artifacts. - [x] T003 Verify current canonical resource names in `apps/platform/app/Services/TenantConfiguration/ResourceTypeRegistry.php` and document the mapping from `exchange.*` / `teams.*` labels to repo keys. - [x] T004 Verify current fail-safe resolver behavior for `transportRule`, `acceptedDomain`, `appPermissionPolicy`, and `meetingPolicy` in `apps/platform/app/Services/TenantConfiguration/CoverageSourceContractResolver.php`. - [x] T005 Confirm no UI, route, navigation, Filament provider, browser proof, OperationRun, real provider capture, evidence promotion, compare/render promotion, certification, restore, or customer output is required by this spec. - [x] T006 Confirm no `tenant_id`, legacy adapter, fallback reader, dual write, or Coverage v1 vocabulary path is needed. ## Phase 2: Source Contract State Model **Purpose**: Make the verified-or-blocked contract result precise without creating a parallel source-of-truth layer. - [x] T007 [P] Add or update unit coverage for contract state mapping in `apps/platform/tests/Unit/Support/TenantConfiguration/Spec427ExchangeTeamsSourceContractStateTest.php`. - [x] T008 Define or map `contract_verified_pending_capture`, `contract_blocked_missing_source`, `contract_blocked_permission_unclear`, `contract_blocked_beta_only`, `contract_blocked_response_shape_unsafe`, `contract_blocked_repo_adapter_missing`, `contract_blocked_identity_unsafe`, and `contract_blocked_redaction_unsafe` in `apps/platform/app/Services/TenantConfiguration/CoverageSourceContractResolver.php` and `apps/platform/app/Services/TenantConfiguration/CoverageSourceContractDecision.php`. - [x] T009 Ensure any new state/reason values have behavior or follow-up consequences and are documented in `specs/427-exchange-teams-verified-source-contract-enablement/implementation-report.md`. - [x] T010 Ensure existing `apps/platform/app/Support/TenantConfiguration/CaptureOutcome.php` values remain compatible; do not create ambiguous duplicate truth between capture outcomes and source-contract states. ## Phase 3: Per-Type Contract Verification **Purpose**: Verify each target contract or block it with an exact safe reason. - [x] T011 [P] Add `transportRule` contract verification tests in `apps/platform/tests/Unit/Support/TenantConfiguration/Spec427ExchangeTransportRuleContractTest.php`. - [x] T012 [P] Add `acceptedDomain` contract verification tests in `apps/platform/tests/Unit/Support/TenantConfiguration/Spec427ExchangeAcceptedDomainContractTest.php`. - [x] T013 [P] Add `appPermissionPolicy` contract verification tests in `apps/platform/tests/Unit/Support/TenantConfiguration/Spec427TeamsAppPermissionPolicyContractTest.php`. - [x] T014 [P] Add `meetingPolicy` contract verification tests in `apps/platform/tests/Unit/Support/TenantConfiguration/Spec427TeamsMeetingPolicyContractTest.php`. - [x] T015 Verify or block the `transportRule` source contract through existing resolver/registry files: `apps/platform/app/Services/TenantConfiguration/CoverageSourceContractResolver.php` and, only if repo-safe, `apps/platform/config/graph_contracts.php`. - [x] T016 Verify or block the `acceptedDomain` source contract through existing resolver/registry files: `apps/platform/app/Services/TenantConfiguration/CoverageSourceContractResolver.php` and, only if repo-safe, `apps/platform/config/graph_contracts.php`. - [x] T017 Verify or block the `appPermissionPolicy` source contract through existing resolver/registry files: `apps/platform/app/Services/TenantConfiguration/CoverageSourceContractResolver.php` and, only if repo-safe, `apps/platform/config/graph_contracts.php`. - [x] T018 Verify or block the `meetingPolicy` source contract through existing resolver/registry files: `apps/platform/app/Services/TenantConfiguration/CoverageSourceContractResolver.php` and, only if repo-safe, `apps/platform/config/graph_contracts.php`. - [x] T019 Prove the existing provider adapter path for any `repo_existing_provider_adapter` source class, or assert `contract_blocked_repo_adapter_missing` in the relevant per-type test; document the final source class, source contract name/version, permission model, response shape, identity handoff, redaction rules, provider adapter proof/blocker, and final blocker/verified state for all four types in `specs/427-exchange-teams-verified-source-contract-enablement/implementation-report.md`. ## Phase 4: Permission, Response Shape, Identity, And Redaction Safety **Purpose**: Ensure verified contracts are safe enough for a later capture spec and unsafe contracts stay blocked. - [x] T020 [P] Add permission metadata tests in `apps/platform/tests/Unit/Support/TenantConfiguration/Spec427SourceContractPermissionMetadataTest.php`. - [x] T021 [P] Add response-shape tests in `apps/platform/tests/Unit/Support/TenantConfiguration/Spec427SourceContractResponseShapeTest.php`. - [x] T022 [P] Add identity handoff tests in `apps/platform/tests/Unit/Support/TenantConfiguration/Spec427SourceContractIdentityHandoffTest.php`. - [x] T023 [P] Add redaction metadata tests in `apps/platform/tests/Unit/Support/TenantConfiguration/Spec427SourceContractRedactionTest.php`. - [x] T024 Ensure unclear required permissions block verification, do not widen provider scopes in `apps/platform/app/Services/TenantConfiguration/CoverageSourceContractResolver.php` or `apps/platform/config/graph_contracts.php`, and capture static/diff proof that no provider OAuth scope, provider capability, or permission productization config changed outside this bounded contract metadata path. - [x] T025 Ensure unsafe response semantics block verification in `apps/platform/app/Services/TenantConfiguration/CoverageSourceContractResolver.php` when empty, denied, unsupported, unavailable, and malformed responses cannot be distinguished. - [x] T026 Ensure display-name-only, order/hash-only, or otherwise unstable identity blocks verification using existing `apps/platform/app/Services/TenantConfiguration/CoverageIdentityStrategyRegistry.php` and `apps/platform/app/Services/TenantConfiguration/CanonicalIdentityResolver.php`. - [x] T027 Ensure sensitive fields and permission context have redaction rules in `apps/platform/app/Services/TenantConfiguration/CoveragePayloadRedactor.php` or source-contract metadata before any contract is marked verified pending capture. ## Phase 5: No-Promotion And Architecture Guards **Purpose**: Preserve Spec 426 fail-safe behavior and prevent premature readiness claims. - [x] T028 [P] Add no-evidence-promotion tests in `apps/platform/tests/Feature/TenantConfiguration/Spec427ExchangeTeamsNoEvidencePromotionTest.php`. - [x] T029 [P] Add no compare/render/certification tests in `apps/platform/tests/Feature/TenantConfiguration/Spec427ExchangeTeamsNoCompareRenderCertificationTest.php`. - [x] T030 [P] Add no customer/restore claim tests in `apps/platform/tests/Feature/TenantConfiguration/Spec427ExchangeTeamsNoCustomerRestoreClaimTest.php`. - [x] T031 [P] Add no `tenant_id` ownership regression in `apps/platform/tests/Feature/TenantConfiguration/Spec427ExchangeTeamsNoTenantIdTest.php`. - [x] T032 [P] Add no Exchange/Teams mini-platform regression in `apps/platform/tests/Feature/TenantConfiguration/Spec427ExchangeTeamsNoMiniPlatformTest.php`. - [x] T033 Ensure verified contracts remain `pending_capture` only and do not create `TenantConfigurationResource` or `TenantConfigurationResourceEvidence` rows through `apps/platform/app/Services/TenantConfiguration/GenericContentEvidenceCaptureService.php`, `apps/platform/app/Models/TenantConfigurationResource.php`, or `apps/platform/app/Models/TenantConfigurationResourceEvidence.php` in this spec. - [x] T034 Ensure no new Exchange/Teams-specific migration, model, route, Filament Resource/Page/Widget, dashboard, report, export, Review Pack output, PDF output, restore action, or customer surface is introduced under `apps/platform/database/`, `apps/platform/app/Models/`, `apps/platform/app/Filament/`, `apps/platform/routes/`, or `apps/platform/resources/`. ## Phase 6: Regression And Validation **Purpose**: Prove Spec 427 did not weaken completed Coverage v2 prerequisites. - [x] T035 Run focused Spec 427 unit tests with `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Unit/Support/TenantConfiguration/Spec427ExchangeTeamsSourceContractStateTest.php tests/Unit/Support/TenantConfiguration/Spec427ExchangeTransportRuleContractTest.php tests/Unit/Support/TenantConfiguration/Spec427ExchangeAcceptedDomainContractTest.php tests/Unit/Support/TenantConfiguration/Spec427TeamsAppPermissionPolicyContractTest.php tests/Unit/Support/TenantConfiguration/Spec427TeamsMeetingPolicyContractTest.php tests/Unit/Support/TenantConfiguration/Spec427SourceContractPermissionMetadataTest.php tests/Unit/Support/TenantConfiguration/Spec427SourceContractResponseShapeTest.php tests/Unit/Support/TenantConfiguration/Spec427SourceContractIdentityHandoffTest.php tests/Unit/Support/TenantConfiguration/Spec427SourceContractRedactionTest.php`. - [x] T036 Run focused Spec 427 feature tests with `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/TenantConfiguration/Spec427ExchangeTeamsNoEvidencePromotionTest.php tests/Feature/TenantConfiguration/Spec427ExchangeTeamsNoCompareRenderCertificationTest.php tests/Feature/TenantConfiguration/Spec427ExchangeTeamsNoCustomerRestoreClaimTest.php tests/Feature/TenantConfiguration/Spec427ExchangeTeamsNoTenantIdTest.php tests/Feature/TenantConfiguration/Spec427ExchangeTeamsNoMiniPlatformTest.php`. - [x] T037 Run Spec 426 source/fail-safe regressions with `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Unit/Support/TenantConfiguration/Spec426ExchangeTeamsSourceContractResolverTest.php tests/Feature/TenantConfiguration/Spec426ExchangeTeamsCoreEvidenceReadinessTest.php`. - [x] T038 Run Spec 417 identity and Spec 420 generic evidence regressions with `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Unit/Support/TenantConfiguration/Spec417CoverageIdentityStrategyRegistryTest.php tests/Unit/Support/TenantConfiguration/Spec420M365CaptureSourceContractResolverTest.php tests/Feature/TenantConfiguration/Spec420M365GenericEvidenceCaptureTest.php`. - [x] T039 Run `cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent`. - [x] T040 Run `git diff --check`. - [x] T041 If any combined `--filter=Spec427` or regression filter is killed by Signal 9, document the combined command, Signal 9 result, direct-file runs, pass counts, assertion counts, and regression pass counts in `specs/427-exchange-teams-verified-source-contract-enablement/implementation-report.md`. ## Phase 7: Product Surface, Filament, Deployment, And Close-Out **Purpose**: Finish the active spec without implying application implementation readiness beyond the bounded contract slice. - [x] T042 Record Product Surface result as `N/A - no rendered UI surface changed` in `specs/427-exchange-teams-verified-source-contract-enablement/implementation-report.md`. - [x] T043 Record Livewire v4 compliance, provider registration location, global search posture, destructive/high-impact action posture, asset strategy, tests/browser result, deployment impact, visible complexity outcome, and no completed-spec rewrite assertion in `specs/427-exchange-teams-verified-source-contract-enablement/implementation-report.md`. - [x] T044 Complete the required source contract matrix and no-promotion matrix in `specs/427-exchange-teams-verified-source-contract-enablement/implementation-report.md`. - [x] T045 Document deferred work: content-backed evidence promotion, compare/render promotion, certified compare pack, customer reporting claims, restore/apply, provider permission productization, and optional resource expansion. ## Dependencies & Execution Order - Phase 1 blocks all implementation. - Phase 2 must complete before per-type contract verification. - Phase 3 and Phase 4 tests can be developed in parallel by file. - Phase 5 no-promotion guards must pass before claiming any target type is verified pending capture. - Phase 6 validation and Phase 7 close-out are final gates. ## Parallel Opportunities - T011-T014 can run in parallel after T007-T010. - T020-T023 can run in parallel after the contract metadata shape is decided. - T028-T032 can run in parallel because they cover separate guard files. ## Implementation Strategy 1. Preserve current fail-safe behavior first. 2. Add exact blocker/verified metadata without promoting evidence. 3. Verify each target independently. 4. Run no-promotion guards before any regression close-out. 5. Stop if implementation requires UI, live provider calls, new permissions, migrations, or customer claims. ## Stop Conditions - A target contract can only be "verified" through endpoint guessing or runtime docs fetch. - A verified state would require provider permission widening not already productized. - Implementation needs real provider capture or OperationRun creation. - Evidence, compare/render, certification, restore, customer output, UI, route, navigation, or report output becomes necessary. - `tenant_id`, legacy adapters, fallback readers, dual writes, or a new Exchange/Teams mini-platform appear.