---
name: tenantpilot-evidence-anchor-contract
description: Hard-gate evidence anchor currentness, scope, fallback behavior, and proof/customer-safety boundaries.
---

## Purpose

Use this skill to ensure evidence anchors and evidence-backed claims point to scoped, current, explicit evidence instead of falling back to latest, unrelated, stale, or internal-only proof.

## Activate When

- Touching evidence snapshots, evidence anchors, evidence resolvers, baseline evidence, review pack evidence, evidence overview, currentness, proof links, or evidence-backed statuses.
- Adding evidence source providers, anchor IDs, artifact references, evidence publication, or evidence currentness claims.
- Changing customer/auditor evidence visibility.

## Do Not Activate When

- The task does not touch evidence, proof, currentness, review/report output, or evidence-backed UI/state.
- The task only reads historical evidence as context.

## Maturity

L4 hard gate.

## Gate Type

hard-gate.

## Source Evidence

- `.specify/memory/constitution.md`
- `docs/product/standards/product-surface-contract.md`
- `specs/400-product-contract-spec-completeness-audit/spec.md`
- `specs/415-generic-content-backed-capture/implementation-report.md`
- `apps/platform/app/Services/Evidence/EvidenceAnchorResolver.php`
- `apps/platform/app/Services/Evidence/EvidenceSnapshotResolver.php`
- `apps/platform/app/Services/Evidence/EvidenceSnapshotService.php`
- `apps/platform/app/Policies/EvidenceSnapshotPolicy.php`
- `apps/platform/app/Models/TenantConfigurationResourceEvidence.php`
- `apps/platform/tests/Unit/Evidence/Spec393EvidenceAnchorResolverTest.php`
- `apps/platform/tests/Feature/Monitoring/Spec403EvidenceCurrentnessRuntimeClosureTest.php`

## External Anchors

Not applicable.

## Required Repo Context

- Evidence-producing source and lifecycle.
- Scope columns and ownership for evidence and target subject.
- Currentness and freshness contract.
- Customer/operator/support visibility of proof.
- Resolver fallback behavior.
- Tests for missing, stale, wrong-scope, and current evidence.

## Execution Checklist

- Resolve evidence by explicit anchor and same workspace/managed-environment/provider scope.
- Keep append-only evidence immutable unless the active spec explicitly permits a lifecycle transition.
- Distinguish evidence payload truth from OperationRun execution truth.
- Do not fallback to latest evidence unless the active spec explicitly approves and discloses the behavior.
- Mark stale, expired, historical, or superseded evidence with Product Surface canonical vocabulary where rendered.
- Keep raw evidence payloads hidden by default and capability-gated when exposed.
- Add tests for wrong-scope, missing-anchor, stale, and current evidence behavior where runtime changes.

## Stop Conditions

- Resolver falls back to latest evidence when requested evidence is missing.
- Evidence anchor can point to the wrong workspace, managed environment, provider connection, or subject.
- Raw OperationRun/evidence is treated as customer-safe proof by default.
- Released or historical evidence is claimed as live current.
- Stale proof is displayed as current without disclosure.
- Evidence payloads, secrets, or raw provider data leak into logs, notifications, OperationRun context, or customer output.

## Required Evidence After Use

- Anchor resolution path and scope proof.
- Currentness/staleness behavior.
- Customer/operator/support disclosure boundary.
- Tests or static proof for fallback and wrong-scope behavior.
- Confirmation that evidence proof does not rely on OperationRun alone.

## Common Failure Modes

- Reconstructing proof from whichever snapshot is newest.
- Treating completed runs as evidence currentness.
- Rendering raw JSON because it is convenient support proof.
- Duplicating evidence status logic in a page instead of the evidence contract.
- Linking customer users directly to technical evidence artifacts.

## Quarantined Rules

Full Spec 416 quarantine list applies. Especially quarantined here: fallback-to-latest evidence; OperationRun as default customer proof; raw provider/evidence payload default display; Coverage v1 vocabulary as customer truth; historical audits as current truth.

## Review / Expiry

Review whenever evidence resolver, publication, currentness, customer-proof, or evidence storage contracts change. No planned expiry.