TenantAtlas/specs/426-exchange-teams-core-evidence-identity-readiness/implementation-report.md

Implementation Report: Spec 426 - Exchange / Teams Core Evidence & Stable Identity Readiness

Branch: 426-exchange-teams-core-evidence-identity-readiness
HEAD: 33e496c1 feat: complete spec 425 enta certified compare pack (#492)
Implementation date: 2026-07-02
Result: PASS WITH CONDITIONS for Spec 426 closure; FAIL-safe for source-backed evidence readiness

Gate Result

• Activated skills/gates: pest-testing, Spec Readiness Gate, provider-freshness semantics, and TCM cutover guard for the post-review fix. Earlier implementation work also used workspace/RBAC/OperationRun/evidence/customer-output/Product Surface gates.
• Closure gate: PASS WITH CONDITIONS.
• Condition: Spec 426 proves fail-safe behavior for Exchange/Teams source-backed evidence. It does not prove readiness, capture support, compare support, render support, or certification. Typed normalizer/hash tests are future-contract helper proof only.
• Source-backed evidence readiness gate: FAIL-safe/blocked because no verified production-safe source contract exists for the four mandatory types.
• Completed dependency specs 414, 415, 417, 418, 419, 420, 422, and 425 remain read-only context. No completed spec artifacts were rewritten.
• Review correction: removed unverified Graph v1.0 endpoint claims for mailFlowRule, acceptedDomains, teamsAppPermissionPolicy, and teamsMeetingPolicy.
• Final dirty state: runtime service/config/test changes plus active Spec 426 artifacts, as expected for this active spec.

Files Changed

• Source contracts and capture:
  • apps/platform/app/Services/TenantConfiguration/CoverageSourceContractResolver.php
  • apps/platform/app/Services/TenantConfiguration/GenericContentEvidenceCaptureService.php
  • apps/platform/config/graph_contracts.php was verified to contain no unverified final Spec 426 contract entries; it has no final diff in this correction.
• Stable identity:
  • apps/platform/app/Services/TenantConfiguration/CoverageIdentityStrategyRegistry.php
• Tests:
  • Focused Spec 426 unit and feature tests under apps/platform/tests/Unit/Support/TenantConfiguration/ and apps/platform/tests/Feature/TenantConfiguration/
  • Updated Spec 417/420 expectations so the four Exchange/Teams types remain fail-closed until verified contracts exist
• Spec artifacts:
  • spec.md, plan.md, tasks.md, this implementation report

Source Contract Matrix

Type	Contract key	Endpoint	Source class	Outcome
transportRule	none	none	none	capture_blocked_missing_contract
acceptedDomain	none	none	none	capture_blocked_missing_contract
appPermissionPolicy	none	none	none	capture_blocked_missing_contract
meetingPolicy	none	none	none	capture_blocked_missing_contract

No endpoint guessing, direct HTTP, runtime documentation lookup, provider bypass, or guessed Microsoft Graph source contract remains. Capture attempts stop before ProviderGateway / GraphClientInterface calls for these four types.

Evidence Matrix

Type	Capture outcome	Provider call	Resource row	Evidence row	Empty/fake behavior
transportRule	capture_blocked_missing_contract	no	no	no	no fake resource/evidence
acceptedDomain	capture_blocked_missing_contract	no	no	no	no fake resource/evidence
appPermissionPolicy	capture_blocked_missing_contract	no	no	no	no fake resource/evidence
meetingPolicy	capture_blocked_missing_contract	no	no	no	no fake resource/evidence

OperationRun summaries remain flat numeric counts. Blocked runs record sanitized blocked outcomes only; no raw payload, provider response body, secret, mail content, Teams content, or raw permission context is placed in run context or audit metadata.

Identity Matrix

Type	Strategy	Stable identity inputs	Explicitly rejected
transportRule	tcm.exchange.transport_rule.v1	id, sourceId, Guid, RuleId	Identity, display/name fields, order, payload hash
acceptedDomain	tcm.exchange.accepted_domain.v1	id, sourceId, DomainName, domainName	Identity, display/name fields, domain type/default flag
appPermissionPolicy	tcm.teams.app_permission_policy.v1	id, sourceId, policyId	Identity, display/name fields, settings/app hash
meetingPolicy	tcm.teams.meeting_policy.v1	id, sourceId, policyId	Identity, display/name fields, settings hash

CanonicalIdentityResolver remains the only identity path. Identity-only payloads resolve to missing_external_id, not stable identity.

Readiness Matrix

Type	content_backed	identity_strategy_hardened	compare_render_ready	certified	restore_ready	customer_claimable
transportRule	no	yes	no	no	no	no
acceptedDomain	no	yes	no	no	no	no
appPermissionPolicy	no	yes	no	no	no	no
meetingPolicy	no	yes	no	no	no	no

Typed normalizer/hash/redaction tests remain as helper proof for future valid source payloads. They are not used to claim source-backed evidence or certification readiness. Post-review coverage now also proves that typed helper output keeps stable source identity fields (Guid, RuleId, DomainName, policyId, sourceId), that the future typed capture handoff preserves that type-specific source_identity, that contract-level volatile fields are excluded from typed unsupported diagnostics/material hashes, and that payload hashes ignore volatile-field diagnostics.

Claim Guard And Redaction

• Certified, restore-ready, full Exchange/Teams/Microsoft 365, and customer-ready claims remain blocked.
• Internal compare/render wording remains bounded by Claim Guard, but this report does not claim source-backed compare/render readiness for the four mandatory types.
• Redaction tests cover provider secrets, tokens, raw provider markers, mail subject/body-like fields, and Teams recording/transcript-like fields in normalized/helper output.

Product Surface / Filament Contract

• No runtime UI files, routes, navigation, Filament resources/pages/widgets, actions, reports, exports, or customer outputs were changed.
• Product Surface decision: N/A - no rendered UI surface changed.
• Product Surface exceptions: none.
• Browser proof: N/A - no rendered UI surface changed.
• Human Product Sanity: N/A - no rendered UI surface changed.
• Livewire v4 compliance: unchanged; Filament v5 remains on Livewire v4.
• Provider registration: unchanged; Laravel provider registration remains in apps/platform/bootstrap/providers.php.
• Global search: unchanged; no resource/global search behavior was added.
• Destructive/high-impact actions: none added.
• Asset strategy: no new assets; no new filament:assets deployment requirement.

Deployment Impact

• Migrations: none.
• Environment variables: none.
• Queues/cron: no new workers or schedules; existing OperationRun-backed capture job reused.
• Storage/volumes: none.
• Assets: none.
• Runtime config: no new Exchange/Teams graph contract entries remain; deploy through the normal container/config-cache path.
• Staging/Production: do not promote Exchange/Teams certification from this branch. Next sequence is Spec 427 verified source contract enablement, Spec 428 content-backed evidence promotion, Spec 429 compare/render promotion, and only later certification. A future verified provider contract must pass staging before evidence promotion or certification proceeds.

Validation

Passed after post-review fix and closure review:

• cd apps/platform && ./vendor/bin/sail artisan test --compact --filter=Spec426
  • terminated with Signal 9 in the container runner.
  • Not a closure blocker because the equivalent direct file runs below passed.
• cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Unit/Support/TenantConfiguration/Spec426ExchangeTeamsSourceContractResolverTest.php tests/Unit/Support/TenantConfiguration/Spec426ExchangeTeamsCanonicalIdentityTest.php
  • 22 passed, 124 assertions.
• cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Unit/Support/TenantConfiguration/Spec426ExchangeTeamsPayloadNormalizationFromSourceTest.php tests/Unit/Support/TenantConfiguration/Spec426ExchangeTeamsEvidenceHashTest.php tests/Unit/Support/TenantConfiguration/Spec426ExchangeTeamsClaimGuardReadinessTest.php tests/Unit/Support/TenantConfiguration/Spec426ExchangeTeamsRedactionTest.php
  • 24 passed, 77 assertions.
• cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/TenantConfiguration/Spec426ExchangeTeamsCoreEvidenceReadinessTest.php tests/Feature/TenantConfiguration/Spec426ExchangeTeamsStableIdentityReadinessTest.php
  • 3 passed, 69 assertions.
• cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/TenantConfiguration/Spec426ExchangeTeamsProviderScopeTest.php tests/Feature/TenantConfiguration/Spec426ExchangeTeamsNoCertificationTest.php tests/Feature/TenantConfiguration/Spec426ExchangeTeamsNoRestoreTest.php tests/Feature/TenantConfiguration/Spec426ExchangeTeamsNoTenantIdTest.php tests/Feature/TenantConfiguration/Spec426ExchangeTeamsNoMiniPlatformTest.php tests/Feature/TenantConfiguration/Spec426ExchangeTeamsClaimGuardFeatureTest.php
  • 7 passed, 55 assertions.
• Direct file Spec 426 total:
  • 56 passed, 325 assertions.
• cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/TenantConfiguration/Spec420M365GenericEvidenceCaptureTest.php tests/Feature/TenantConfiguration/Spec420M365CaptureOperationRunTest.php tests/Unit/Support/TenantConfiguration/Spec420M365CaptureSourceContractResolverTest.php tests/Unit/Support/TenantConfiguration/Spec420M365CaptureEligibilityTest.php tests/Unit/Support/TenantConfiguration/Spec417CoverageIdentityStrategyRegistryTest.php
  • 16 passed, 259 assertions.
• cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Browser/Spec420M365GenericEvidenceOperatorSurfaceSmokeTest.php
  • 1 passed, 44 assertions.
• cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent
  • passed.
• git diff --check
  • passed.

Spec 426 browser validation remains N/A - no rendered UI surface changed; the Spec 420 browser regression fixture changed and passed.