ahmido/TenantAtlas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity
feat/438-exchange-internal-render-model-slice-1
TenantAtlas/specs/437-exchange-comparable-promotion-slice-1/checklists/requirements.md
ahmido ff1a545c31 Spec 437: Exchange comparable promotion slice 1 (#504) 
## Summary
- add Spec 437 package for Exchange comparable promotion slice 1
- add ExchangePowerShellComparablePayloadBuilder for normalized-payload-only comparable artifacts
- add focused Pest unit/feature coverage for comparable safety, determinism, redaction, and no product-surface promotion

## Validation
- cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent: PASS
- cd apps/platform && ./vendor/bin/sail artisan test --filter=Spec437 --compact: failed with Symfony Process signal 9
- cd apps/platform && php artisan test --filter=Spec437 --compact: PASS, 34 tests / 225 assertions
- git diff --check: PASS

## Product Surface / Deployment
- UI impact: N/A - no rendered UI surface changed
- Browser proof: N/A - no rendered UI surface changed
- Destructive/high-impact actions: none
- Assets: none; no filament:assets requirement introduced
- Deployment impact: no env vars, migrations, queues, scheduler, storage, assets, routes, jobs, listeners, commands, or Dokploy runtime behavior changes

Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #504
2026-07-09 20:32:52 +00:00

6.6 KiB
Raw Permalink Blame History

Requirements Checklist: Spec 437 - Exchange Comparable Promotion Slice 1

Purpose: Validate Spec 437 scope, prerequisites, comparable-only safety gates, no-promotion posture, and preparation completeness before implementation. Created: 2026-07-09 Feature: spec.md

Unchecked runtime proof items below are implementation gates, not preparation failures. They must be checked only after Spec 437 code and tests provide evidence.

Prerequisites

  • Spec 436 PASS/merge-ready or merged state is required before implementation.
  • transportRule content-backed evidence prerequisite is required.
  • remoteDomain content-backed evidence prerequisite is required.
  • inboundConnector content-backed evidence prerequisite is required.
  • Spec 436 normalized payloads must be deterministic.
  • Spec 436 evidence must remain append-only.

Scope

  • Comparable-only.
  • Only transportRule.
  • Only remoteDomain.
  • Only inboundConnector.
  • No renderable.
  • No certification.
  • No restore.
  • No customer claim.
  • No UI.
  • No jobs/schedules/listeners.
  • No migration.

Comparable Input

  • Uses normalized_payload only.
  • Does not use raw_payload.
  • Does not use raw stdout/stderr.
  • Does not use PowerShell transcript.
  • Does not use OperationRun context.
  • Does not use logs.
  • Does not use report/review-pack output.
  • Stable material identity comes from normalized_payload.source_identity.
  • payload_hash is required before comparable output is derived.
  • payload_hash must be a valid SHA-256 hash before comparable output is derived.
  • evidence_state = content_backed is required before comparable output is derived.
  • coverage_level = content_backed is required before comparable output is derived.
  • capture_outcome = captured is required before comparable output is derived.
  • Safe evidence metadata does not override identity or provide material compare fields.

Comparable Output

  • Deterministic.
  • Machine-readable.
  • Stable identity field included.
  • Stable identity exact value is not emitted.
  • Scoped HMAC identity anchor is emitted instead of an exact value or unsalted hash.
  • Material safe fields included.
  • Material safe fields pass target-specific value policies before exact output.
  • Volatile fields excluded.
  • Provider ordering deterministic.
  • Protected values redacted/omitted.
  • Unexpected exact protected/sensitive values block comparable output.
  • Malformed exact values on otherwise safe fields block comparable output.
  • No customer-facing prose.
  • No risk verdict.
  • No certification label.

Target Comparable

  • transportRule comparable safe.
  • remoteDomain comparable safe.
  • inboundConnector comparable safe.
  • remoteDomain domain-only identity blocked.
  • remoteDomain display-only identity blocked.
  • remoteDomain unsafe identity variants are blocked case/separator-insensitively.
  • inboundConnector protected config not exposed.
  • transportRule sensitive values not exposed.

Evidence Immutability

  • raw_payload unchanged.
  • normalized_payload unchanged.
  • payload_hash unchanged.
  • operation_run_id unchanged.
  • source metadata unchanged.
  • persisted coverage_level unchanged.
  • TenantConfigurationResource.latest_* state unchanged.
  • TenantConfigurationResourceType.default_coverage_level unchanged.
  • prior evidence rows not overwritten.
  • evidence remains append-only.

Empty / Missing / Unsafe

  • Empty collection creates no comparable artifact.
  • Missing evidence creates no comparable artifact.
  • Unsafe identity creates no comparable artifact.
  • Blocked target creates no comparable artifact.

No Promotion Beyond Comparable

  • No persisted comparable coverage-level promotion.
  • No renderable state.
  • No certified state.
  • No restore-ready state.
  • No customer-ready state.
  • No customer-claimable state.
  • No report output.
  • No Review Pack output.
  • No PDF output.

Product Surface / Trigger

  • No routes.
  • No Filament pages.
  • No Livewire components.
  • No views.
  • No navigation.
  • No asset changes.
  • No global search changes.
  • No CoverageV2ReadinessReadModel render output.
  • No job trigger.
  • No schedule trigger.
  • No listener trigger.
  • Browser N/A.

Architecture

  • Uses Coverage v2 architecture.
  • Uses Spec 436 normalized payloads.
  • Does not use GenericPayloadNormalizer.
  • Does not use ExchangeTeamsComparablePayloadNormalizer for Spec 436 Exchange PowerShell payloads.
  • No Exchange-specific compare table.
  • No tenant_id ownership truth.
  • No Exchange mini-platform.
  • No legacy shim.
  • No fallback reader.
  • No migration.
  • No new OperationRun type.

Validation

  • Focused unit tests pass.
  • Focused feature tests pass.
  • Regressions pass.
  • Pint passes.
  • git diff --check passes.
  • git status --short documented.

Product Surface Contract

  • No-legacy posture is explicit.
  • Product Surface Impact is N/A - no rendered product surface changed.
  • Browser proof is N/A - no rendered UI surface changed.
  • Human Product Sanity is N/A - no product surface changed.
  • Product Surface exceptions are none.
  • Implementation report fields are required.
  • Completed historical specs must not be rewritten.

Review Outcome

  • Review outcome class: acceptable-special-case for preparation because scope is backend comparable-only and all product-surface paths are explicitly N/A.
  • Workflow outcome: keep.
  • Final note location: specs/437-exchange-comparable-promotion-slice-1/implementation-report.md.

Final Candidate Gate

Preparation result: PASS.

Implementation PASS requires all runtime validation items above to be checked with evidence. PASS WITH CONDITIONS is allowed only for bounded follow-ups that do not weaken comparable determinism, redaction, evidence immutability, no-renderable posture, no-customer-output posture, no-product-surface posture, ownership, or no-mini-platform posture.

FAIL if renderable output is added; raw payload/stdout/stderr/transcript/OperationRun context is used as compare input; protected config leaks; evidence payload/provenance is mutated; certification/restore/customer claims appear; UI/routes/jobs/schedules/listeners are added; migration is added without amendment; tenant_id ownership truth is introduced; Exchange-specific compare table appears without approval; or tests do not prove comparable safety.