# Requirements Checklist: Exchange PowerShell Production Runner Boundary and Runtime Gate **Purpose**: Preparation and implementation-readiness checklist for Spec 432. **Created**: 2026-07-07 **Feature**: `specs/432-exchange-powershell-production-runner-boundary-runtime-gate/spec.md` ## Prerequisites - [x] Spec 431 is PASS or PASS WITH CONDITIONS with no merge-blocking findings. - [x] Spec 431 provider-operation start bypass is closed. - [x] Spec 431 capability/admin-consent issue is closed. - [x] Spec 431 invalid parameter persistence is sanitized. - [x] Spec 431 disabled runner remains default. - [x] Spec 431 no evidence, no UI, no migration, no `tenant_id`, and no mini-platform proof exists. - [x] OperationRun/provider operation/capability path is registered. ## Scope - [x] Only `transportRule` is included from Exchange transport rules. - [x] Only `remoteDomain` is included from Exchange remote domains. - [x] Only `inboundConnector` is included from Exchange connectors. - [x] No `outboundConnector`. - [x] No `acceptedDomain`. - [x] No `organizationConfig`. - [x] No `mailboxPlan`. - [x] No `sharingPolicy`. - [x] No Teams. - [x] No Exchange Admin API. - [x] No mutation commands. - [x] No evidence. - [x] No compare/render. - [x] No certification. - [x] No restore. - [x] No customer claim. - [x] No UI. - [x] No migration. - [x] No jobs/schedules/listeners that can invoke production runner. ## Runner Binding - [x] Disabled runner remains default. - [x] Production runner is not selected by default. - [x] Explicit production-runner config flag exists and defaults false. - [x] Existing invocation gate is required. - [x] Production-runner gate is required. - [x] Missing credential evidence blocks. - [x] Missing permission evidence blocks. - [x] Config-cache-style behavior is tested. ## Runtime Readiness - [x] Runtime readiness checker exists. - [x] PowerShell availability check is non-invasive. - [x] Exchange module check is non-invasive. - [x] No Microsoft connection. - [x] No tenant session import. - [x] No module installation or download. - [x] No env dump. - [x] No interactive prompt. - [x] Runtime environment allowlist is checked. - [x] Timeout policy is checked. - [x] Process executor availability is checked. - [x] Temp policy is checked if temp files are used. ## Credential Handling - [x] Credential resolver exists. - [x] Credential handling is reference-only. - [x] `client_secret` blocks by default. - [x] Certificate state is tested. - [x] Federated state is tested. - [x] Managed-identity state is tested. - [x] Missing credential blocks. - [x] Expired credential blocks. - [x] Inaccessible credential blocks. - [x] Unsupported credential blocks. - [x] Unknown credential kind blocks. - [x] Credential material is not stored/logged. ## Permission Evidence - [x] Admin consent alone is not sufficient. - [x] Missing Exchange permission evidence blocks. - [x] Unvalidated evidence blocks. - [x] Stale evidence blocks. - [x] Wrong workspace evidence blocks. - [x] Wrong managed environment evidence blocks. - [x] Wrong provider connection evidence blocks. - [x] Unsupported evidence blocks. - [x] Verified evidence only allows the next gate. - [x] No evidence/readiness/customer claim promotion occurs from permission proof. ## Process / Command Safety - [x] Process executor abstraction exists. - [x] Fake process executor is used in tests. - [x] Argument vector / structured process call is used. - [x] Raw shell strings are rejected. - [x] Pipes, script fragments, semicolons, and redirection are rejected. - [x] Aliases and profile loading are rejected. - [x] Operator-supplied command text is rejected. - [x] Mutation commands are rejected. - [x] Unknown parameters are rejected. - [x] Invalid parameter names are not persisted raw. ## Output Guards - [x] Oversized stdout blocks safely. - [x] Oversized stderr blocks safely. - [x] Non-JSON/scalar output blocks safely. - [x] Warning-prefixed output is handled safely. - [x] Non-UTF8/binary output blocks safely. - [x] Non-zero exit with stdout blocks safely. - [x] Timeout cleanup is tested. - [x] Concurrency lock cleanup is tested. - [x] Temp files are absent or cleaned safely. - [x] Raw stdout/stderr is not persisted. ## OperationRun - [x] Public invocation returns OperationRun or safe blocker. - [x] `provider_connection_id` remains context-only. - [x] No `provider_connection_id` migration. - [x] `managed_environment_id` uses existing repo pattern. - [x] Safe summary counts only. - [x] Safe failure category only. - [x] No raw stdout/stderr. - [x] No provider payload. - [x] No secrets. - [x] Transient envelopes are not persisted. - [x] Status/outcome transitions remain service-owned. ## No Promotion - [x] No evidence rows. - [x] No raw evidence payload. - [x] No normalized evidence payload. - [x] No content-backed state. - [x] No comparable state. - [x] No renderable state. - [x] No certified state. - [x] No restore-ready state. - [x] No customer-ready state. - [x] No report output. - [x] No Review Pack output. ## Product Surface / Triggers - [x] No routes. - [x] No Filament pages. - [x] No Livewire components. - [x] No navigation. - [x] No UI action. - [x] No dashboard/readiness badge. - [x] No asset changes. - [x] No global search changes. - [x] No job trigger. - [x] No schedule trigger. - [x] No listener trigger. - [x] Browser proof is `N/A - no rendered UI surface changed`. - [x] Human Product Sanity is N/A. ## Architecture - [x] Uses Spec 431 OperationRun path. - [x] Uses provider operation/capability path. - [x] Uses Spec 430 Coverage v2 source contracts. - [x] No migration. - [x] No `tenant_id` in Spec 432 changed runtime artifacts. - [x] No Exchange mini-platform. - [x] No legacy shim. - [x] No fallback reader. - [x] No dual write. - [x] No customer-facing readiness vocabulary. ## Validation - [x] Focused Spec 432 unit tests pass. - [x] Focused Spec 432 feature tests pass. - [x] Spec 431 regressions pass. - [x] Spec 430 regressions pass. - [x] Selected Spec 426/427 no-promotion/source-contract regressions pass. - [x] Selected Spec 417/419/420 identity/registry/generic evidence regressions pass. - [x] Pint passes. - [x] `git diff --check` passes. - [x] `git status --short` is documented. ## Final Candidate Gate Choose one during implementation close-out: - [x] PASS - [x] PASS WITH CONDITIONS - [x] FAIL PASS requires disabled default, explicit production-runner gate, non-invasive runtime checks, safe credential handling, verified permission-evidence requirement or safe block, process executor abstraction, no-shell command construction, output guards, timeout/concurrency cleanup, sanitized OperationRun context, no evidence, no product promotion, no UI/trigger surface, no migration, no `tenant_id`, no mini-platform, and focused tests/regressions passing. PASS WITH CONDITIONS is allowed only for bounded follow-ups that do not weaken runner binding, runtime safety, credential safety, permission evidence, OperationRun ownership, redaction, provider scope, no-evidence posture, no-claim posture, no-trigger posture, or no-mini-platform posture. FAIL if production runner activates by default, client-secret or admin-consent-only enables live invocation, raw shell strings or mutation commands can execute, live invocation bypasses OperationRun/provider scope, credential material or raw output persists, evidence/product promotion appears, routes/UI/jobs/schedules/listeners are added, migration or `tenant_id` appears without amendment, or tests do not prove runner boundary and safe-block behavior.