TenantAtlas/specs/437-exchange-comparable-promotion-slice-1/checklists/requirements.md

# Requirements Checklist: Spec 437 - Exchange Comparable Promotion Slice 1

**Purpose**: Validate Spec 437 scope, prerequisites, comparable-only safety gates, no-promotion posture, and preparation completeness before implementation.
**Created**: 2026-07-09
**Feature**: [spec.md](../spec.md)

Unchecked runtime proof items below are implementation gates, not preparation failures. They must be checked only after Spec 437 code and tests provide evidence.

## Prerequisites

- [x] Spec 436 PASS/merge-ready or merged state is required before implementation.
- [x] `transportRule` content-backed evidence prerequisite is required.
- [x] `remoteDomain` content-backed evidence prerequisite is required.
- [x] `inboundConnector` content-backed evidence prerequisite is required.
- [x] Spec 436 normalized payloads must be deterministic.
- [x] Spec 436 evidence must remain append-only.

## Scope

- [x] Comparable-only.
- [x] Only `transportRule`.
- [x] Only `remoteDomain`.
- [x] Only `inboundConnector`.
- [x] No renderable.
- [x] No certification.
- [x] No restore.
- [x] No customer claim.
- [x] No UI.
- [x] No jobs/schedules/listeners.
- [x] No migration.

## Comparable Input

- [x] Uses `normalized_payload` only.
- [x] Does not use `raw_payload`.
- [x] Does not use raw stdout/stderr.
- [x] Does not use PowerShell transcript.
- [x] Does not use OperationRun context.
- [x] Does not use logs.
- [x] Does not use report/review-pack output.
- [x] Stable material identity comes from `normalized_payload.source_identity`.
- [x] `payload_hash` is required before comparable output is derived.
- [x] `payload_hash` must be a valid SHA-256 hash before comparable output is derived.
- [x] `evidence_state = content_backed` is required before comparable output is derived.
- [x] `coverage_level = content_backed` is required before comparable output is derived.
- [x] `capture_outcome = captured` is required before comparable output is derived.
- [x] Safe evidence metadata does not override identity or provide material compare fields.

## Comparable Output

- [x] Deterministic.
- [x] Machine-readable.
- [x] Stable identity field included.
- [x] Stable identity exact value is not emitted.
- [x] Scoped HMAC identity anchor is emitted instead of an exact value or unsalted hash.
- [x] Material safe fields included.
- [x] Material safe fields pass target-specific value policies before exact output.
- [x] Volatile fields excluded.
- [x] Provider ordering deterministic.
- [x] Protected values redacted/omitted.
- [x] Unexpected exact protected/sensitive values block comparable output.
- [x] Malformed exact values on otherwise safe fields block comparable output.
- [x] No customer-facing prose.
- [x] No risk verdict.
- [x] No certification label.

## Target Comparable

- [x] `transportRule` comparable safe.
- [x] `remoteDomain` comparable safe.
- [x] `inboundConnector` comparable safe.
- [x] `remoteDomain` domain-only identity blocked.
- [x] `remoteDomain` display-only identity blocked.
- [x] `remoteDomain` unsafe identity variants are blocked case/separator-insensitively.
- [x] `inboundConnector` protected config not exposed.
- [x] `transportRule` sensitive values not exposed.

## Evidence Immutability

- [x] `raw_payload` unchanged.
- [x] `normalized_payload` unchanged.
- [x] `payload_hash` unchanged.
- [x] `operation_run_id` unchanged.
- [x] source metadata unchanged.
- [x] persisted `coverage_level` unchanged.
- [x] `TenantConfigurationResource.latest_*` state unchanged.
- [x] `TenantConfigurationResourceType.default_coverage_level` unchanged.
- [x] prior evidence rows not overwritten.
- [x] evidence remains append-only.

## Empty / Missing / Unsafe

- [x] Empty collection creates no comparable artifact.
- [x] Missing evidence creates no comparable artifact.
- [x] Unsafe identity creates no comparable artifact.
- [x] Blocked target creates no comparable artifact.

## No Promotion Beyond Comparable

- [x] No persisted comparable coverage-level promotion.
- [x] No renderable state.
- [x] No certified state.
- [x] No restore-ready state.
- [x] No customer-ready state.
- [x] No customer-claimable state.
- [x] No report output.
- [x] No Review Pack output.
- [x] No PDF output.

## Product Surface / Trigger

- [x] No routes.
- [x] No Filament pages.
- [x] No Livewire components.
- [x] No views.
- [x] No navigation.
- [x] No asset changes.
- [x] No global search changes.
- [x] No `CoverageV2ReadinessReadModel` render output.
- [x] No job trigger.
- [x] No schedule trigger.
- [x] No listener trigger.
- [x] Browser N/A.

## Architecture

- [x] Uses Coverage v2 architecture.
- [x] Uses Spec 436 normalized payloads.
- [x] Does not use `GenericPayloadNormalizer`.
- [x] Does not use `ExchangeTeamsComparablePayloadNormalizer` for Spec 436 Exchange PowerShell payloads.
- [x] No Exchange-specific compare table.
- [x] No `tenant_id` ownership truth.
- [x] No Exchange mini-platform.
- [x] No legacy shim.
- [x] No fallback reader.
- [x] No migration.
- [x] No new OperationRun type.

## Validation

- [x] Focused unit tests pass.
- [x] Focused feature tests pass.
- [x] Regressions pass.
- [x] Pint passes.
- [x] `git diff --check` passes.
- [x] `git status --short` documented.

## Product Surface Contract

- [x] No-legacy posture is explicit.
- [x] Product Surface Impact is `N/A - no rendered product surface changed`.
- [x] Browser proof is `N/A - no rendered UI surface changed`.
- [x] Human Product Sanity is `N/A - no product surface changed`.
- [x] Product Surface exceptions are `none`.
- [x] Implementation report fields are required.
- [x] Completed historical specs must not be rewritten.

## Review Outcome

- [x] Review outcome class: acceptable-special-case for preparation because scope is backend comparable-only and all product-surface paths are explicitly N/A.
- [x] Workflow outcome: keep.
- [x] Final note location: `specs/437-exchange-comparable-promotion-slice-1/implementation-report.md`.

## Final Candidate Gate

Preparation result: PASS.

Implementation PASS requires all runtime validation items above to be checked with evidence. PASS WITH CONDITIONS is allowed only for bounded follow-ups that do not weaken comparable determinism, redaction, evidence immutability, no-renderable posture, no-customer-output posture, no-product-surface posture, ownership, or no-mini-platform posture.

FAIL if renderable output is added; raw payload/stdout/stderr/transcript/OperationRun context is used as compare input; protected config leaks; evidence payload/provenance is mutated; certification/restore/customer claims appear; UI/routes/jobs/schedules/listeners are added; migration is added without amendment; `tenant_id` ownership truth is introduced; Exchange-specific compare table appears without approval; or tests do not prove comparable safety.