TenantAtlas/specs/437-exchange-comparable-promotion-slice-1/checklists/requirements.md

Requirements Checklist: Spec 437 - Exchange Comparable Promotion Slice 1

Purpose: Validate Spec 437 scope, prerequisites, comparable-only safety gates, no-promotion posture, and preparation completeness before implementation. Created: 2026-07-09 Feature: spec.md

Unchecked runtime proof items below are implementation gates, not preparation failures. They must be checked only after Spec 437 code and tests provide evidence.

Prerequisites

• Spec 436 PASS/merge-ready or merged state is required before implementation.
• transportRule content-backed evidence prerequisite is required.
• remoteDomain content-backed evidence prerequisite is required.
• inboundConnector content-backed evidence prerequisite is required.
• Spec 436 normalized payloads must be deterministic.
• Spec 436 evidence must remain append-only.

Scope

• Comparable-only.
• Only transportRule.
• Only remoteDomain.
• Only inboundConnector.
• No renderable.
• No certification.
• No restore.
• No customer claim.
• No UI.
• No jobs/schedules/listeners.
• No migration.

Comparable Input

• Uses normalized_payload only.
• Does not use raw_payload.
• Does not use raw stdout/stderr.
• Does not use PowerShell transcript.
• Does not use OperationRun context.
• Does not use logs.
• Does not use report/review-pack output.
• Stable material identity comes from normalized_payload.source_identity.
• payload_hash is required before comparable output is derived.
• payload_hash must be a valid SHA-256 hash before comparable output is derived.
• evidence_state = content_backed is required before comparable output is derived.
• coverage_level = content_backed is required before comparable output is derived.
• capture_outcome = captured is required before comparable output is derived.
• Safe evidence metadata does not override identity or provide material compare fields.

Comparable Output

• Deterministic.
• Machine-readable.
• Stable identity field included.
• Stable identity exact value is not emitted.
• Scoped HMAC identity anchor is emitted instead of an exact value or unsalted hash.
• Material safe fields included.
• Material safe fields pass target-specific value policies before exact output.
• Volatile fields excluded.
• Provider ordering deterministic.
• Protected values redacted/omitted.
• Unexpected exact protected/sensitive values block comparable output.
• Malformed exact values on otherwise safe fields block comparable output.
• No customer-facing prose.
• No risk verdict.
• No certification label.

Target Comparable

• transportRule comparable safe.
• remoteDomain comparable safe.
• inboundConnector comparable safe.
• remoteDomain domain-only identity blocked.
• remoteDomain display-only identity blocked.
• remoteDomain unsafe identity variants are blocked case/separator-insensitively.
• inboundConnector protected config not exposed.
• transportRule sensitive values not exposed.

Evidence Immutability

• raw_payload unchanged.
• normalized_payload unchanged.
• payload_hash unchanged.
• operation_run_id unchanged.
• source metadata unchanged.
• persisted coverage_level unchanged.
• TenantConfigurationResource.latest_* state unchanged.
• TenantConfigurationResourceType.default_coverage_level unchanged.
• prior evidence rows not overwritten.
• evidence remains append-only.

Empty / Missing / Unsafe

• Empty collection creates no comparable artifact.
• Missing evidence creates no comparable artifact.
• Unsafe identity creates no comparable artifact.
• Blocked target creates no comparable artifact.

No Promotion Beyond Comparable

• No persisted comparable coverage-level promotion.
• No renderable state.
• No certified state.
• No restore-ready state.
• No customer-ready state.
• No customer-claimable state.
• No report output.
• No Review Pack output.
• No PDF output.

Product Surface / Trigger

• No routes.
• No Filament pages.
• No Livewire components.
• No views.
• No navigation.
• No asset changes.
• No global search changes.
• No CoverageV2ReadinessReadModel render output.
• No job trigger.
• No schedule trigger.
• No listener trigger.
• Browser N/A.

Architecture

• Uses Coverage v2 architecture.
• Uses Spec 436 normalized payloads.
• Does not use GenericPayloadNormalizer.
• Does not use ExchangeTeamsComparablePayloadNormalizer for Spec 436 Exchange PowerShell payloads.
• No Exchange-specific compare table.
• No tenant_id ownership truth.
• No Exchange mini-platform.
• No legacy shim.
• No fallback reader.
• No migration.
• No new OperationRun type.

Validation

• Focused unit tests pass.
• Focused feature tests pass.
• Regressions pass.
• Pint passes.
• git diff --check passes.
• git status --short documented.

Product Surface Contract

• No-legacy posture is explicit.
• Product Surface Impact is N/A - no rendered product surface changed.
• Browser proof is N/A - no rendered UI surface changed.
• Human Product Sanity is N/A - no product surface changed.
• Product Surface exceptions are none.
• Implementation report fields are required.
• Completed historical specs must not be rewritten.

Review Outcome

• Review outcome class: acceptable-special-case for preparation because scope is backend comparable-only and all product-surface paths are explicitly N/A.
• Workflow outcome: keep.
• Final note location: specs/437-exchange-comparable-promotion-slice-1/implementation-report.md.

Final Candidate Gate

Preparation result: PASS.

Implementation PASS requires all runtime validation items above to be checked with evidence. PASS WITH CONDITIONS is allowed only for bounded follow-ups that do not weaken comparable determinism, redaction, evidence immutability, no-renderable posture, no-customer-output posture, no-product-surface posture, ownership, or no-mini-platform posture.

FAIL if renderable output is added; raw payload/stdout/stderr/transcript/OperationRun context is used as compare input; protected config leaks; evidence payload/provenance is mutated; certification/restore/customer claims appear; UI/routes/jobs/schedules/listeners are added; migration is added without amendment; tenant_id ownership truth is introduced; Exchange-specific compare table appears without approval; or tests do not prove comparable safety.