TenantAtlas/specs/250-decision-governance-inbox/checklists/requirements.md

Preparation Review Checklist: Decision-Based Governance Inbox v1

Purpose: Validate the governance inbox preparation package against the repo's guardrail, disclosure, shared-family, and close-out workflow before implementation
Created: 2026-04-28
Feature: spec.md

Applicability And Low-Impact Gate

• CHK001 The package explicitly treats this as an operator-facing workspace decision surface, so the low-impact N/A path is not used.
• CHK002 The spec, plan, and tasks carry the same native/shared-primitives-first classification, shared-family relevance, state ownership, and close-out targeting without inventing second wording.

Native, Shared-Family, And State Ownership

• CHK003 The inbox remains a native Filament page that reuses existing source surfaces instead of introducing a fake-native task console or separate monitoring shell.
• CHK004 Shared families remain shared: findings, operations, alerts, and review follow-up stay on their existing source pages, while the new page stays a routing and decision layer.
• CHK005 Page and URL-query state owners are named once, and the package does not collapse them into new persisted workflow state.
• CHK006 The likely next operator action and primary inspect/open model stay coherent: each section has one dominant source CTA and the page owns no mutation lane.

Shared Pattern Reuse

• CHK007 Cross-cutting interaction classes are explicit, and the shared reuse path is named once through CanonicalNavigationContext, RelatedNavigationResolver, OperateHubShell, OperationRunLinks, BadgeRenderer, UiEnforcement, and the existing source pages.
• CHK008 The package extends existing shared paths where they are sufficient, and any fallback to a bounded Support/GovernanceInbox/ seam is explicitly constrained as a last resort rather than a new default abstraction.
• CHK009 The package does not create a parallel operator UX language for claim, acknowledge, stale-run handling, or review follow-up; it routes into the current source-family vocabulary.

OperationRun Start UX Contract

• CHK019 The package explicitly states that the inbox only deep-links into existing OperationRun detail and does not start, queue, or complete runs.
• CHK020 Canonical operation URLs are delegated to the shared OperationRunLinks path rather than recomposed locally on the inbox page.
• CHK021 No queued DB-notification or terminal-notification behavior is added because the slice is read-only.
• CHK022 No OperationRun exception is required; if implementation later adds local run-start or blocked-run messaging, that would be out-of-scope drift.

Provider Boundary And Vocabulary

• CHK010 The package keeps provider-specific semantics behind existing normalized governance, alerting, and review seams and does not spread provider language into a new platform-core contract.
• CHK011 No retained provider-specific shared boundary is introduced; the slice stays inside existing workspace, tenant, operations, findings, alerts, and review vocabulary.

Signals, Exceptions, And Test Depth

• CHK012 The triggered repository signal is explicitly handled as review-mandatory, with no hidden hard-stop drift accepted into the package.
• CHK013 No bounded exception is required in the preparation package; if implementation proves a bounded assembly helper is necessary, it must be recorded in the active feature close-out entry.
• CHK014 The required surface test profile is explicit: global-context-shell.
• CHK015 The chosen lane mix is the narrowest honest proof for this slice: focused Unit plus Feature coverage only.

Audience-Aware Disclosure And Decision Hierarchy

• CHK023 Default-visible content stays decision-first and clearly separated from deeper diagnostics and support or raw evidence.
• CHK024 The inbox default path does not expose raw JSON, copied payloads, provider diagnostics, or other debug semantics by default.
• CHK025 Exactly one dominant next action remains primary per section or entry: open the relevant existing source surface.
• CHK026 Duplicate visible blocker, status, or next-action summaries are avoided by keeping proof and detailed reasoning on the source pages.
• CHK027 Support/raw sections remain off the inbox page entirely, and the page stays within Filament visual language, progressive disclosure, and calm read-only presentation.

Review Outcome

• CHK016 Review outcome class: acceptable-special-case
• CHK017 Workflow outcome: keep
• CHK018 The final note location is explicit: the active feature PR close-out entry Guardrail / Exception / Smoke Coverage records any bounded assembly-seam exception and the final proof outcome.

Notes

• This checklist validates the preparation package only: spec.md, plan.md, tasks.md, and supporting design artifacts. It does not claim application code exists.
• The slice remains bounded to one read-only workspace decision surface in the current admin plane. No new task engine, no new attention state, and no local mutation lane are approved by this package.
• If implementation later proves that a bounded Support/GovernanceInbox/ seam is necessary, that must stay derived and page-scoped rather than becoming a generalized workflow framework.

Guardrail / Exception / Smoke Coverage

• Implementation status: complete for the bounded v1 slice.
• Guardrail result: PASS. The implemented page stayed native, read-only, shared-primitives-first, and inside the existing admin plane without adding a new task engine, persisted inbox truth, or local mutation lane.
• Bounded exception result: document-in-feature. apps/platform/app/Support/GovernanceInbox/GovernanceInboxSectionBuilder.php was added as the smallest readable cross-family assembly seam.
• Validation result: the focused unit and feature proof command passed with 10 passed (53 assertions), and dirty-only Pint passed.
• Smoke result: PASS. A manual integrated-browser run on /admin/governance/inbox verified route load, canonical operations drill-through with nav context, and successful return to the inbox.