# Requirements Checklist: Spec 437 - Exchange Comparable Promotion Slice 1 **Purpose**: Validate Spec 437 scope, prerequisites, comparable-only safety gates, no-promotion posture, and preparation completeness before implementation. **Created**: 2026-07-09 **Feature**: [spec.md](../spec.md) Unchecked runtime proof items below are implementation gates, not preparation failures. They must be checked only after Spec 437 code and tests provide evidence. ## Prerequisites - [x] Spec 436 PASS/merge-ready or merged state is required before implementation. - [x] `transportRule` content-backed evidence prerequisite is required. - [x] `remoteDomain` content-backed evidence prerequisite is required. - [x] `inboundConnector` content-backed evidence prerequisite is required. - [x] Spec 436 normalized payloads must be deterministic. - [x] Spec 436 evidence must remain append-only. ## Scope - [x] Comparable-only. - [x] Only `transportRule`. - [x] Only `remoteDomain`. - [x] Only `inboundConnector`. - [x] No renderable. - [x] No certification. - [x] No restore. - [x] No customer claim. - [x] No UI. - [x] No jobs/schedules/listeners. - [x] No migration. ## Comparable Input - [x] Uses `normalized_payload` only. - [x] Does not use `raw_payload`. - [x] Does not use raw stdout/stderr. - [x] Does not use PowerShell transcript. - [x] Does not use OperationRun context. - [x] Does not use logs. - [x] Does not use report/review-pack output. - [x] Stable material identity comes from `normalized_payload.source_identity`. - [x] `payload_hash` is required before comparable output is derived. - [x] `payload_hash` must be a valid SHA-256 hash before comparable output is derived. - [x] `evidence_state = content_backed` is required before comparable output is derived. - [x] `coverage_level = content_backed` is required before comparable output is derived. - [x] `capture_outcome = captured` is required before comparable output is derived. - [x] Safe evidence metadata does not override identity or provide material compare fields. ## Comparable Output - [x] Deterministic. - [x] Machine-readable. - [x] Stable identity field included. - [x] Stable identity exact value is not emitted. - [x] Scoped HMAC identity anchor is emitted instead of an exact value or unsalted hash. - [x] Material safe fields included. - [x] Material safe fields pass target-specific value policies before exact output. - [x] Volatile fields excluded. - [x] Provider ordering deterministic. - [x] Protected values redacted/omitted. - [x] Unexpected exact protected/sensitive values block comparable output. - [x] Malformed exact values on otherwise safe fields block comparable output. - [x] No customer-facing prose. - [x] No risk verdict. - [x] No certification label. ## Target Comparable - [x] `transportRule` comparable safe. - [x] `remoteDomain` comparable safe. - [x] `inboundConnector` comparable safe. - [x] `remoteDomain` domain-only identity blocked. - [x] `remoteDomain` display-only identity blocked. - [x] `remoteDomain` unsafe identity variants are blocked case/separator-insensitively. - [x] `inboundConnector` protected config not exposed. - [x] `transportRule` sensitive values not exposed. ## Evidence Immutability - [x] `raw_payload` unchanged. - [x] `normalized_payload` unchanged. - [x] `payload_hash` unchanged. - [x] `operation_run_id` unchanged. - [x] source metadata unchanged. - [x] persisted `coverage_level` unchanged. - [x] `TenantConfigurationResource.latest_*` state unchanged. - [x] `TenantConfigurationResourceType.default_coverage_level` unchanged. - [x] prior evidence rows not overwritten. - [x] evidence remains append-only. ## Empty / Missing / Unsafe - [x] Empty collection creates no comparable artifact. - [x] Missing evidence creates no comparable artifact. - [x] Unsafe identity creates no comparable artifact. - [x] Blocked target creates no comparable artifact. ## No Promotion Beyond Comparable - [x] No persisted comparable coverage-level promotion. - [x] No renderable state. - [x] No certified state. - [x] No restore-ready state. - [x] No customer-ready state. - [x] No customer-claimable state. - [x] No report output. - [x] No Review Pack output. - [x] No PDF output. ## Product Surface / Trigger - [x] No routes. - [x] No Filament pages. - [x] No Livewire components. - [x] No views. - [x] No navigation. - [x] No asset changes. - [x] No global search changes. - [x] No `CoverageV2ReadinessReadModel` render output. - [x] No job trigger. - [x] No schedule trigger. - [x] No listener trigger. - [x] Browser N/A. ## Architecture - [x] Uses Coverage v2 architecture. - [x] Uses Spec 436 normalized payloads. - [x] Does not use `GenericPayloadNormalizer`. - [x] Does not use `ExchangeTeamsComparablePayloadNormalizer` for Spec 436 Exchange PowerShell payloads. - [x] No Exchange-specific compare table. - [x] No `tenant_id` ownership truth. - [x] No Exchange mini-platform. - [x] No legacy shim. - [x] No fallback reader. - [x] No migration. - [x] No new OperationRun type. ## Validation - [x] Focused unit tests pass. - [x] Focused feature tests pass. - [x] Regressions pass. - [x] Pint passes. - [x] `git diff --check` passes. - [x] `git status --short` documented. ## Product Surface Contract - [x] No-legacy posture is explicit. - [x] Product Surface Impact is `N/A - no rendered product surface changed`. - [x] Browser proof is `N/A - no rendered UI surface changed`. - [x] Human Product Sanity is `N/A - no product surface changed`. - [x] Product Surface exceptions are `none`. - [x] Implementation report fields are required. - [x] Completed historical specs must not be rewritten. ## Review Outcome - [x] Review outcome class: acceptable-special-case for preparation because scope is backend comparable-only and all product-surface paths are explicitly N/A. - [x] Workflow outcome: keep. - [x] Final note location: `specs/437-exchange-comparable-promotion-slice-1/implementation-report.md`. ## Final Candidate Gate Preparation result: PASS. Implementation PASS requires all runtime validation items above to be checked with evidence. PASS WITH CONDITIONS is allowed only for bounded follow-ups that do not weaken comparable determinism, redaction, evidence immutability, no-renderable posture, no-customer-output posture, no-product-surface posture, ownership, or no-mini-platform posture. FAIL if renderable output is added; raw payload/stdout/stderr/transcript/OperationRun context is used as compare input; protected config leaks; evidence payload/provenance is mutated; certification/restore/customer claims appear; UI/routes/jobs/schedules/listeners are added; migration is added without amendment; `tenant_id` ownership truth is introduced; Exchange-specific compare table appears without approval; or tests do not prove comparable safety.