# Requirements Checklist: Exchange PowerShell Invocation Operation Registration and Execution Gate

**Purpose**: Validate Spec 431 preparation and later implementation against operation registration, invocation safety, no-promotion, and no-surface requirements.  
**Created**: 2026-07-05  
**Feature**: `specs/431-exchange-powershell-invocation-operation-registration-gate/spec.md`

## Applicability And Low-Impact Gate

- [x] CHK001 The change explicitly says no rendered UI surface is affected.
- [x] CHK002 The spec, plan, and tasks carry the same no-UI/no-product-surface decision.
- [x] CHK029 The spec includes exactly one coherent UI Surface Impact decision: `No UI surface impact`.
- [x] CHK037 Browser proof is `N/A - no rendered UI surface changed`.
- [x] CHK038 Human Product Sanity is N/A because no product surface changes.
- [x] CHK040 Completed historical specs were not rewritten or stripped of implementation history.

## Spec Package

- [x] `spec.md` exists.
- [x] `plan.md` exists.
- [x] `tasks.md` exists.
- [x] `checklists/requirements.md` exists.
- [x] `implementation-report.md` exists and records implementation validation.

## Scope

- [x] Only `transportRule`.
- [x] Only `remoteDomain`.
- [x] Only `inboundConnector`.
- [x] Only `Get-TransportRule`.
- [x] Only `Get-RemoteDomain`.
- [x] Only `Get-InboundConnector`.
- [x] No Teams.
- [x] No Exchange Admin API.
- [x] No live provider execution.
- [x] No evidence.
- [x] No compare/render.
- [x] No certification.
- [x] No restore.
- [x] No customer claim.
- [x] No UI.
- [x] No migration.

## Proportionality

- [x] New operation type justified.
- [x] New catalog entry justified.
- [x] New provider operation justified.
- [x] New capability justified.
- [x] New runner interface justified.
- [x] No mini-platform planned.
- [x] No new persisted status framework planned.

## Operation Registration

- [x] OperationRunType registered.
- [x] OperationCatalog registered.
- [x] ProviderOperationRegistry registered.
- [x] ProviderCapabilityRegistry registered.
- [x] OperationRunCapabilityResolver mapping exists.
- [x] Tests prove all mappings.

## Summary Counts

- [x] Existing allowed keys reused or new keys explicitly added.
- [x] SummaryCountsNormalizer preserves emitted keys.
- [x] Unknown keys remain dropped.
- [x] No raw output in summary counts.
- [x] No secrets in summary counts.

## Failure Sanitization

- [x] Invocation blocker reasons sanitized.
- [x] Invocation failure reasons sanitized.
- [x] Unknown failures sanitized.
- [x] Secret-like values redacted.
- [x] Raw stderr/stdout not persisted.

## Invocation Gate

- [x] Verified contract required.
- [x] Allowlisted command required.
- [x] OperationRun required before fake runner execution.
- [x] Provider scope required.
- [x] Capability required.
- [x] Actor capability is `Capabilities::PROVIDER_RUN` or a spec amendment documents a narrower dedicated capability.
- [x] Feature gate `tenantpilot.features.exchange_powershell_invocation` required and default disabled.
- [x] Provider identity/credential reference required or fake-runner-only mode documented.
- [x] Bypass calls rejected.

## Runner Safety

- [x] Structured runner interface.
- [x] Fake runner.
- [x] Production runner disabled/inert.
- [x] Raw command strings rejected.
- [x] Mutation commands rejected.
- [x] Unknown parameters rejected.
- [x] No shell execution in unit tests.
- [x] No Microsoft service calls in tests.

## OperationRun Safety

- [x] OperationRun created before fake invocation.
- [x] Status transitions owned by `OperationRunService`.
- [x] Numeric/safe summary counts only.
- [x] Safe failure category only.
- [x] `provider_connection_id` only in safe context.
- [x] No `provider_connection_id` migration.
- [x] No raw stdout/stderr.
- [x] No raw provider payload.
- [x] No secrets.

## Credential / Provider Scope

- [x] Provider connection scoped to workspace/environment.
- [x] Credential reference source is existing `ProviderIdentityResolver` / `ProviderConnection::credential` / `ProviderCredential` truth, not a new persistence path.
- [x] Missing credential reference blocks.
- [x] Unsupported credential kind blocks.
- [x] Missing permission evidence blocks or stays unvalidated.
- [x] Username/password blocked.
- [x] No plaintext secret fields.
- [x] Capability checks enforced.

## Shape Validation

- [x] Structured collection accepted.
- [x] Empty collection distinguished from permission failure.
- [x] Malformed result blocks.
- [x] Missing identity fields block or fail safe.
- [x] Text/scalar output fails safe.

## No Promotion

- [x] No evidence rows.
- [x] No raw evidence payload.
- [x] No normalized evidence payload.
- [x] No content-backed state.
- [x] No comparable state.
- [x] No renderable state.
- [x] No certified state.
- [x] No restore-ready state.
- [x] No customer-ready state.

## Product Surface

- [x] No routes planned.
- [x] No Filament pages planned.
- [x] No Livewire components planned.
- [x] No navigation planned.
- [x] No global search changes planned.
- [x] No asset changes planned.
- [x] Browser N/A.

## Architecture

- [x] Uses OperationRun architecture.
- [x] Uses provider operation/capability architecture.
- [x] Uses Coverage v2 source contract architecture.
- [x] No `tenant_id`.
- [x] No Exchange mini-platform.
- [x] No legacy shim.
- [x] No fallback reader.

## Validation

- [x] Focused unit tests pass.
- [x] Focused feature tests pass.
- [x] Regressions pass.
- [x] Pint passes.
- [x] `git diff --check` passes.
- [x] `git status --short` documented.

## Review Outcome

- [x] Review outcome class: implementation gate passed for backend-only slice.
- [x] Workflow outcome: keep.
- [x] Final note location: `implementation-report.md`.

## Final Candidate Gate

PASS for implementation. Runtime checklist items are checked against the implementation report and validation runs.