# V1 Domain Workbenches — SOTA Build-Out Master Checklist - Opened: 2026-07-23 - Last scope-and-coverage audit: 2026-07-23 - Last execution-granularity audit: 2026-07-23 - Audit pass: third pass; bidirectional feature coverage plus manual semantic execution decomposition against current code, contracts, domain inventories, deep dives, walkthroughs, and specialist plans - Status: proposed execution ledger; no unchecked item is implied complete This is the implementation ledger for seven related authoring and operations initiatives: Isis, Metis, Yemaya, Veritas, Euterpe, Aja, and Bellona. It expands the original outline into independently verifiable work units and corrects its greenfield assumption. The repository already contains substantial domain libraries, BFF routes, standalone applications, and tests. The goal is to integrate, harden, and complete those systems without duplicating them or violating the product-surface boundaries already ratified elsewhere. The second audit explicitly expanded capability families that the first deep ledger left implicit: Isis production asset/control matrices; Metis credentials, lecture/media, discipline, and correctness systems; Yemaya's complete existing AAA suite; Veritas investigative, channel, regulatory, community, B2B, USSD, commercial-boundary, and multimedia operations; Euterpe's structural DAW, plugin/interchange, AI-audio, spatial, stage, and DJ workflows; Aja live and multimodal capture plus vertical/CG/generative pipelines; and Bellona render, gameplay, virtual-production, XR, mocap, MetaHuman, specialist DCC, remote-agent, package, and event operations. This third pass reviews every parent outcome and manually decomposes compound work into domain-specific, independently provable child tasks wherever that creates a more executable ledger. Section 1.2 makes atomic, bidirectional feature disposition—not the presence of a broad phase—the permanent coverage invariant. Tara remains the quality exemplar: - [`TARA_CONTENT_WORKBENCH_TODOS_2026-07-19.md`](TARA_CONTENT_WORKBENCH_TODOS_2026-07-19.md) - [`V1/TARA_CONTENT_WORKBENCH_DESIGN_2026-07-19.md`](V1/TARA_CONTENT_WORKBENCH_DESIGN_2026-07-19.md) - `apps/oshun/web/src/app/studio/tara-workbench` - `libs/oshun/tara-workbench` - `apps/oshun/bff/src/tara-workbench` Tara is a quality floor, not a UI template to clone blindly. Every initiative must meet its domain's professional workflow, safety model, interoperability standards, latency profile, and evidence burden. --- ## 1. Authoritative scope correction The previous revision said that all seven domains had rich backends but zero interactive authoring UI. That statement is not supportable against the worktree. The 2026-07-23 audit found mature UI code in `apps/isis/web`, `apps/yemaya/studio-web`, `apps/yemaya/studio-desktop`, `apps/euterpe/studio-web`, `apps/bellona/control-room`, `apps/metis/admin`, `apps/metis/web`, and `apps/veritas/web`. The real gap is fragmented coverage, uncertain live wiring, duplicated route trees, incomplete cross-surface workflows, and inconsistent production proof. The canonical boundary in [`docs/oshun/studio-vs-yemaya-studio.md`](docs/oshun/studio-vs-yemaya-studio.md) also forbids rebuilding raw ComfyUI, model, LoRA, GPU, voice-cloning, full 3D, or music-stem controls inside contemplative Oshun Studio. Those tools belong to Yemaya Studio or operator applications. A source-mounted page is not proof that a surface is authorized or reachable. For example, `/studio/isis/nvidia-rtx-processing` has an interactive page module but remains AAA-only under the proxy because `STUDIO_ISIS_ALLOWED_ROUTE_SEGMENTS` is empty. The baseline must therefore test effective middleware behavior as well as count files and routes. | Initiative | Product classification | Canonical host to ratify in P0 | Existing implementation to integrate | Boundary that must not regress | | ---------- | ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | -------------------------------------------------------------------------- | | Isis | V1 governed-generation substrate plus operator factory | `apps/isis/web` for operators; curated cards/gallery in Oshun Studio; AAA controls in Yemaya Studio | `apps/isis/web`, 70+ `libs/isis/*`, V1 Isis adapter/BFF | No raw provider/model/workflow/GPU controls under `/studio/isis/*` | | Metis | V1 customer domain plus institutional authoring | Oshun Studio workbench backed by Metis services; operator review remains `/operator/metis` | `apps/metis/{admin,web}`, `libs/metis/*`, Metis contracts/BFF | Do not conflate learner delivery, institutional admin, and authoring roles | | Yemaya | AAA creative-production suite and V1 rendering substrate | `apps/yemaya/studio-{web,desktop}` | existing Studio apps, study workspace, case pipeline, asset/production systems | Do not present the AAA suite as a new V1 customer domain tab | | Veritas | V1 customer domain plus newsroom/editorial authoring | Oshun Studio newsroom integrated with Veritas CMS/services | `apps/veritas/{web,cms}`, `libs/veritas/*`, canonical V1 contracts | Reader surfaces and protected newsroom surfaces remain separate | | Euterpe | Broader-platform music product, not yet ratified as an Oshun V1 domain | `apps/euterpe/studio-web` | existing DAW, audio engine, mastering, rights, distribution systems | No automatic V1 shell registration without an explicit product decision | | Aja | Cross-domain motion subsystem and operator pipeline | Host decision between an Aja control room and a Studio operator route | Aja services/libs plus existing static Studio route inventory | Metis reaches Aja through the canonical adapter, not private internals | | Bellona | Studio-only V1 engine/build substrate | `apps/bellona/control-room` with a governed Oshun Studio entry/facade | existing control room, bridge hosts, build services, Studio routes | No customer-domain route; no duplicate control room implementation | ### 1.1 Baseline evidence to refresh before implementation These values are discovery evidence only. They are not readiness claims. | Domain | Top-level library directories | Test files under `libs/` | Existing application evidence | | ------- | ----------------------------: | -------------------------------: | ----------------------------------------------------- | | Isis | 77 | 1,206 | `apps/isis/web`: 69 TSX files and Playwright coverage | | Metis | 27 | 365 | `apps/metis/admin` and `apps/metis/web` | | Yemaya | 61 | 1,118 | `studio-web`: 90 TSX; `studio-desktop`: 12 TSX | | Veritas | 65 | 98 | `apps/veritas/web`: 27 TSX; CMS and service apps | | Euterpe | 52 | 336 | `apps/euterpe/studio-web`: 115 TSX and 200+ tests | | Aja | 42 | 65 | service/CLI apps; static Oshun Studio route inventory | | Bellona | 41 | 493 | `apps/bellona/control-room`: 10 TSX and Playwright | - [x] BASE.1 Regenerate the package, route, application, and test inventory from the current branch. Evidence: a committed machine-readable snapshot and the exact command used to produce it. - [x] BASE.1.a Pin the audited commit SHA, workspace roots, ignored paths, and tool versions before scanning. Evidence: inventory manifest records all four inputs. - [x] BASE.1.b Enumerate workspace packages and top-level domain libraries from manifests and project configuration. Evidence: package rows retain manifest path, project name, domain, and target metadata. - [x] BASE.1.c Enumerate deployable applications, services, workers, CLIs, desktop shells, and bridge hosts. Evidence: application rows identify runtime type, entry point, and owning project. - [x] BASE.1.d Enumerate filesystem, framework, proxy, redirect, and middleware-derived routes independently. Evidence: route rows retain route source and effective host. - [x] BASE.1.e Enumerate unit, component, contract, integration, browser, mobile, desktop, accessibility, performance, security, and evaluation test files. Evidence: test rows identify harness and owning target. - [x] BASE.1.f Reconcile generated records with workspace configuration so aliases neither duplicate nor hide a package, application, route, or test. Evidence: reconciliation report has zero unexplained records. - [x] BASE.1.g Commit the normalized snapshot together with its deterministic command and input SHA. Evidence: a clean regeneration produces no diff. - [ ] BASE.2 Classify every existing surface as live, fixture-backed, documentation-only, dead, redirected, or provider-gated. Evidence: every discovered route has exactly one classification. - [x] BASE.2.a Define mutually exclusive classification criteria, including how mixed live/fixture and partially wired surfaces are represented. Evidence: reviewed classification schema and examples. - [ ] BASE.2.b Resolve each route through its real host, middleware, feature flags, and authorization policy rather than inferring reachability from a source file. Evidence: effective-route results for every route row. - [ ] BASE.2.c Trace each reachable surface to its actual data source and record whether fixtures, hard-coded values, or fabricated adapters can enter the result. Evidence: route-to-data-source links. - [ ] BASE.2.d Exercise provider-gated surfaces with provider configuration present and absent. Evidence: both configured and `not_configured` results are captured. - [ ] BASE.2.e Verify redirects at the final destination and distinguish intentional compatibility redirects from abandoned route shells. Evidence: redirect-chain and destination-status records. - [ ] BASE.2.f Assign an owner and remediation or retirement action to every dead, ambiguous, or mixed-classification surface. Evidence: zero ownerless exception rows. - [ ] BASE.2.g Independently review the completed classification against the discovered route inventory. Evidence: signed review with zero unclassified routes. - [ ] BASE.3 Map every top-level library to reuse, refactor, retire, or explicitly out-of-scope. Evidence: no library directory is absent from the signed inventory. - [x] BASE.3.a Record every library's manifest, exported entry points, public symbols, and current domain ownership. Evidence: source-linked library rows. - [x] BASE.3.b Identify all application, service, worker, CLI, test, and library consumers for each library. Evidence: inbound-consumer map. - [x] BASE.3.c Identify each library's runtime and build-time dependencies, including cross-domain and private-internal imports. Evidence: outbound-dependency map. - [ ] BASE.3.d Assign exactly one reuse, refactor, retire, or out-of-scope disposition with rationale and owner. Evidence: zero ambiguous or placeholder dispositions. - [ ] BASE.3.e For refactor rows, name the target boundary, migration order, compatibility period, and removal condition. Evidence: executable migration references. - [ ] BASE.3.f For retire or out-of-scope rows, identify every affected consumer and the replacement, compatibility, or removal path. Evidence: consumer-complete impact records. - [ ] BASE.3.g Reconcile the signed mapping back to the filesystem. Evidence: a path-level check reports neither missing nor extra libraries. - [ ] BASE.4 Record route ownership and canonical host decisions before adding a route. Evidence: approved decision records resolve every row above. - [ ] BASE.4.a Identify the audience, trust boundary, data classification, latency profile, and operator/customer role for every candidate route. Evidence: completed route-context fields. - [ ] BASE.4.b Enumerate all plausible existing hosts and the reuse, duplication, navigation, and deployment consequences of each. Evidence: host-option matrix. - [ ] BASE.4.c Select one canonical host and owning team for every retained route. Evidence: approved route-to-host and route-to-owner mappings. - [ ] BASE.4.d Decide whether each noncanonical route is removed, redirected, proxied, or retained for compatibility. Evidence: migration behavior and end date per noncanonical route. - [ ] BASE.4.e Record cross-host authentication, authorization, deep-link, and data-handoff requirements. Evidence: approved boundary contract. - [ ] BASE.4.f Obtain product, architecture, security, and domain-owner approval where the decision changes an existing product boundary. Evidence: named approval records. - [ ] BASE.5 Reconcile this ledger with `domains.json`, V1 architecture, `DOMAINS.md`, and the Studio/Yemaya boundary. Evidence: the domain registry checker passes and no documentation contradiction remains. - [x] BASE.5.a Extract domain classification, host, audience, ownership, and boundary assertions from each authoritative source. Evidence: source-and-heading-indexed assertion table. - [x] BASE.5.b Compare `domains.json` identifiers and lifecycle fields with the ledger's seven initiatives. Evidence: field-level registry diff. - [ ] BASE.5.c Compare V1 architecture host and dependency rules with every route and integration proposed here. Evidence: architecture-rule diff. - [ ] BASE.5.d Compare `DOMAINS.md` product classifications and ownership with the ledger. Evidence: classification-and-owner diff. - [x] BASE.5.e Compare every Studio and Yemaya exposure with the ratified Studio/Yemaya boundary. Evidence: route-and-control boundary matrix. - [ ] BASE.5.f Resolve each contradiction in its authoritative source rather than documenting competing truths. Evidence: zero unresolved diff rows. - [x] BASE.5.g Run the registry checker and validate every changed internal document link. Evidence: passing command outputs. - [ ] BASE.6 Capture a browser walkthrough of every existing candidate host. Evidence: dated screenshots, network traces, console logs, and a route coverage matrix are linked from the inventory. - [ ] BASE.6.a Define the supported browser, viewport, locale, tenant, role, feature-flag, provider, and data-state matrix for the walkthrough. Evidence: reproducible walkthrough manifest. - [ ] BASE.6.b Provision nonfixture accounts and deterministic live-data records for every authorized role. Evidence: fixture-independent setup record with secret-safe identifiers. - [ ] BASE.6.c Visit every inventory route through normal navigation and by direct deep link. Evidence: navigation and deep-link result per route. - [ ] BASE.6.d Capture the initial, loaded, empty, partial, unauthorized, unavailable, and error states that the route can produce. Evidence: state-indexed screenshots or approved nonapplicability. - [ ] BASE.6.e Archive request/response metadata, redirects, console errors, failed resources, and runtime warnings for each route. Evidence: timestamped trace and console bundle. - [ ] BASE.6.f Record broken navigation, unreachable source-mounted pages, fixture leakage, stale content, and host-boundary violations as owned findings. Evidence: finding IDs linked to route rows. - [ ] BASE.6.g Reconcile captured routes with the candidate-host inventory. Evidence: matrix reports zero unvisited reachable routes. - [ ] BASE.7 Probe each current API from its real UI with fixtures disabled. Evidence: the matrix distinguishes live data, empty data, 503 `not_configured`, and accidental mock data. - [ ] BASE.7.a Enumerate every API request initiated by each current UI and map it to the initiating user action. Evidence: action-to-request map. - [ ] BASE.7.b Disable documented fixture, demo, mock-service, interception, and development-fallback switches. Evidence: captured runtime configuration with all fixture paths off. - [ ] BASE.7.c Exercise an authorized live-data response and verify displayed values against persisted or provider source data. Evidence: source/UI value comparison. - [ ] BASE.7.d Exercise a legitimate empty result and verify the UI does not substitute sample content. Evidence: empty-state trace and screenshot. - [ ] BASE.7.e Remove required provider configuration and verify the API and UI preserve explicit `not_configured` semantics. Evidence: 503 body, trace, and visible state. - [ ] BASE.7.f Exercise authentication, authorization, and tenant-isolation failures for each protected API family. Evidence: negative matrix with no data disclosure. - [ ] BASE.7.g Detect responses originating from hard-coded adapters, request interception, seeded demos, or fallback fixtures. Evidence: zero unexplained mock signatures. - [ ] BASE.7.h Link every API finding to the owning route, service, and remediation task. Evidence: zero ownerless findings. - [ ] BASE.8 Establish the baseline accessibility, performance, reliability, and security results for every host. Evidence: raw reports are archived before feature work begins. - [ ] BASE.8.a Pin the host build, environment, accounts, datasets, browsers, devices, clocks, and network profiles used by all baseline runs. Evidence: baseline environment manifest. - [ ] BASE.8.b Run automated accessibility scans over every reachable route and state in the walkthrough matrix. Evidence: raw route-level results. - [ ] BASE.8.c Run keyboard and screen-reader smoke journeys for each host's critical workflow. Evidence: journey-level findings and recordings. - [ ] BASE.8.d Measure navigation, interaction, rendering, memory, and transfer budgets under the supported device/network profiles. Evidence: raw performance traces and budget comparison. - [ ] BASE.8.e Measure API availability, latency, error rate, queue age, retry, and recovery behavior for exercised dependencies. Evidence: reliability baseline report. - [ ] BASE.8.f Run dependency, secret, configuration, header, transport, authorization, upload, and remote-fetch security checks as applicable. Evidence: raw security reports. - [ ] BASE.8.g Deduplicate findings without discarding route/state provenance, then assign severity and owner. Evidence: triaged baseline register. - [ ] BASE.8.h Archive immutable raw reports before remediation begins. Evidence: checksummed evidence index with capture timestamps. ### 1.2 Atomic feature-completeness rule The audit unit is an atomic capability, not a package, route, page, or broad phase label. A capability is in scope for reconciliation when it is asserted or implemented by any current application route, component, library, public contract, API/worker/CLI command, schema or migration, event, test, feature inventory, domain deep dive, walkthrough, proposal, or release specification. Every discovered capability must have one explicit disposition: 1. exposed in the named workbench for an authorized audience; 2. exposed in a separate operator, AAA, consumer, institutional, or developer surface with a governed workbench handoff where appropriate; 3. runtime-only but observable and controllable through an authorized operational projection; 4. retained for compatibility with no new exposure; 5. retired through a dated migration; or 6. excluded by a named product/safety decision with rationale, owner, compensating control, and review date. Broad tasks such as "map every library" do not by themselves prove feature coverage. The machine-readable inventory must split multi-feature packages and pages into atomic rows and map each row to its contract, owner, audience, host, route or entry point, backing API/job/store, permissions, safety and quality gates, failure states, tests, documentation, and disposition evidence. - [ ] BASE.9 Generate an atomic capability inventory from every source class named above and retain source file plus symbol/route/heading provenance. Evidence: deterministic committed inventory and generator command. - [x] BASE.9.a Define the canonical capability-row schema, identifier rules, and the boundary between one atomic behavior and a compound feature. Evidence: reviewed schema with positive and negative examples. - [x] BASE.9.b Extract capability candidates from application routes and interactive components. Evidence: source path, route, export, and interaction provenance per candidate. - [x] BASE.9.c Extract capability candidates from library public exports and externally consumed internal symbols. Evidence: symbol-level provenance. - [x] BASE.9.d Extract capability candidates from public contracts, API operations, workers, jobs, events, and CLI commands. Evidence: operation-level provenance. - [ ] BASE.9.e Extract capability candidates from schemas, migrations, persisted entities, state machines, and policy definitions. Evidence: entity/transition/rule provenance. - [ ] BASE.9.f Extract capability candidates from tests, feature inventories, deep dives, walkthroughs, proposals, and release specifications. Evidence: test or document heading provenance. - [ ] BASE.9.g Split candidates that combine distinct audiences, mutations, lifecycle transitions, policies, failure modes, or outputs. Evidence: one-behavior-per-row review results. - [x] BASE.9.h Preserve every original source reference when normalizing candidates into canonical rows. Evidence: zero source records without a canonical row. - [x] BASE.9.i Commit the deterministic inventory and exact extraction command. Evidence: rerunning from the pinned SHA produces no diff. - [ ] BASE.10 Reconcile aliases and duplicates without collapsing distinct audience, lifecycle, policy, or data behaviors. Evidence: every source capability maps to exactly one canonical capability ID and all aliases remain searchable. - [ ] BASE.10.a Normalize spelling, casing, route aliases, deprecated names, and equivalent public/internal terminology. Evidence: searchable alias candidates with source provenance. - [ ] BASE.10.b Group only candidates whose actors, inputs, outputs, mutations, policies, lifecycle, and failure semantics are equivalent. Evidence: equivalence criteria recorded for every merge. - [ ] BASE.10.c Keep separate rows when audience, lifecycle, policy, data classification, side effects, or recovery behavior differs. Evidence: reviewed false-merge challenge set. - [ ] BASE.10.d Select a stable canonical identifier and preferred label for every accepted group. Evidence: canonical-ID assignment table. - [ ] BASE.10.e Retain bidirectional links from every alias and duplicate source to its canonical row. Evidence: alias lookup tests. - [ ] BASE.10.f Resolve ambiguous candidate groups with the named domain owner. Evidence: zero unresolved merge decisions. - [ ] BASE.10.g Check that every source candidate maps to exactly one canonical ID and no canonical row is source-empty unless labeled net-new. Evidence: passing cardinality report. - [ ] BASE.11 Assign every canonical capability one of the six dispositions above. Evidence: zero missing, ambiguous, or generic "covered elsewhere" dispositions. - [ ] BASE.11.a Record the authorized audience and canonical surface for every capability proposed for direct workbench exposure. Evidence: audience-and-surface fields. - [ ] BASE.11.b Record the separate surface and governed handoff for every operator, AAA, consumer, institutional, or developer exposure. Evidence: handoff contract or approved no-handoff rationale. - [ ] BASE.11.c Record the observability and control projection for every runtime-only capability. Evidence: operational projection references. - [ ] BASE.11.d Record compatibility owner, supported consumers, and exit condition for every compatibility-only capability. Evidence: compatibility register. - [ ] BASE.11.e Record migration, consumer impact, removal date, and rollback for every retired capability. Evidence: dated retirement plan. - [ ] BASE.11.f Record approver, rationale, compensating control, and review date for every excluded capability. Evidence: approved exclusion record. - [ ] BASE.11.g Reject placeholder dispositions such as "covered elsewhere" until the exact capability and destination are linked. Evidence: lint reports zero generic dispositions. - [ ] BASE.11.h Obtain domain-owner review of all assignments and resolve conflicts between source intent and product scope. Evidence: signed disposition review. - [ ] BASE.12 For every exposed or operationally projected capability, record create/read/update/delete or invoke/cancel/retry semantics, bulk behavior, import/export, search/discovery, history/diff, collaboration/review, accessibility, localization, offline/degraded behavior, observability, recovery, and release/retirement applicability. Evidence: applicability matrix contains an implementation/test link or approved N/A record in every cell. - [ ] BASE.12.a Record create, read, update, delete, and lifecycle-transition applicability per capability. Evidence: mutation/read cells contain implementation and test links or reviewed N/A records. - [ ] BASE.12.b Record invoke, cancel, retry, resume, timeout, and compensation applicability for command and job capabilities. Evidence: command-state cells are complete. - [ ] BASE.12.c Record single-item and bulk eligibility, limits, partial success, and rollback behavior. Evidence: bulk-operation cells are complete. - [ ] BASE.12.d Record import, export, interchange version, validation, round-trip, and unsupported-format behavior. Evidence: interchange cells are complete. - [ ] BASE.12.e Record search, filter, sort, pagination, saved view, catalog, and discovery behavior. Evidence: discovery cells are complete. - [ ] BASE.12.f Record immutable revision, history, diff, restore, fork, and provenance behavior. Evidence: revision cells are complete. - [ ] BASE.12.g Record collaboration, comment, assignment, review, approval, override, and notification behavior. Evidence: governance cells are complete. - [ ] BASE.12.h Record keyboard, screen-reader, nonvisual alternative, responsive, locale, time-zone, and bidirectional-text behavior. Evidence: accessibility/localization cells are complete. - [ ] BASE.12.i Record offline, reconnect, partial, stale, conflict, degraded, unavailable, and recovery behavior. Evidence: resilience-state cells are complete. - [ ] BASE.12.j Record audit, trace, metric, log, cost, freshness, support, and incident-diagnostic behavior. Evidence: operability cells are complete. - [ ] BASE.12.k Record release, migration, rollback, compatibility, deprecation, retirement, retention, and deletion behavior. Evidence: lifecycle-release cells are complete. - [ ] BASE.12.l Validate that every matrix cell has a precise implementation and test reference or an approved child-specific N/A record. Evidence: zero blank, generic, or unapproved cells. - [ ] BASE.13 Diff the atomic capability inventory in CI. Evidence: a new route, exported symbol, contract operation, job, schema entity, CLI command, documented feature, or walkthrough fails the gate until dispositioned. - [x] BASE.13.a Serialize the canonical inventory in deterministic source and identifier order. Evidence: repeated generation is byte-stable. - [x] BASE.13.b Detect additions, removals, and semantic changes in route and interactive-component candidates. Evidence: route/component mutation tests. - [x] BASE.13.c Detect additions, removals, and semantic changes in exported symbols and packages. Evidence: library mutation tests. - [x] BASE.13.d Detect additions, removals, and semantic changes in contracts, API operations, jobs, events, and CLI commands. Evidence: interface mutation tests. - [x] BASE.13.e Detect additions, removals, and semantic changes in schemas, migrations, and persisted entities. Evidence: data-model mutation tests. - [ ] BASE.13.f Detect additions, removals, and semantic changes in documented features and walkthrough findings. Evidence: documentation mutation tests. - [x] BASE.13.g Fail with the exact undispositioned source and remediation command rather than an opaque snapshot mismatch. Evidence: reviewed failure output. - [x] BASE.13.h Prove that an explicitly dispositioned change passes while unrelated formatting changes do not create false capability churn. Evidence: positive and noise-control CI tests. - [ ] BASE.14 Run a bidirectional audit: every inventory row maps to a ledger requirement and every domain ledger requirement maps back to one or more authoritative inventory rows or a clearly labeled net-new requirement. Evidence: zero orphan source capabilities and zero unexplained checklist capabilities. - [ ] BASE.14.a Link every canonical inventory row to its exact parent or child ledger identifier. Evidence: zero inventory rows without ledger links. - [ ] BASE.14.b Link every ledger capability requirement to one or more canonical inventory identifiers. Evidence: zero ledger requirements without inventory or net-new links. - [ ] BASE.14.c Label net-new requirements explicitly and record their product, architecture, and domain authority. Evidence: approved net-new register. - [ ] BASE.14.d Detect many-to-one mappings that conceal distinct audience, policy, lifecycle, or failure behaviors. Evidence: reviewed mapping cardinality exceptions. - [ ] BASE.14.e Detect inventory capabilities linked only to broad phase labels instead of executable requirements. Evidence: zero phase-only links. - [ ] BASE.14.f Resolve orphan source capabilities to exposure, separate surface, runtime projection, compatibility, retirement, or exclusion. Evidence: zero source-side orphans. - [ ] BASE.14.g Resolve unexplained checklist capabilities to authoritative source evidence or approved net-new status. Evidence: zero ledger-side orphans. - [ ] BASE.14.h Publish the final forward and reverse coverage reports. Evidence: checksummed reports generated from the same inventory version. - [ ] BASE.15 Require named domain-owner review of the final atomic inventory, including consumer/runtime-only exclusions. Evidence: signed review records for all seven domains; an engineering agent cannot self-approve product scope. - [ ] BASE.15.a Prepare one domain-specific review packet containing source coverage, canonical capabilities, aliases, dispositions, exclusions, mappings, and unresolved findings. Evidence: seven versioned packets. - [ ] BASE.15.b Obtain Isis owner review and resolve every Isis comment. Evidence: named Isis approval and closed comment log. - [ ] BASE.15.c Obtain Metis owner review and resolve every Metis comment. Evidence: named Metis approval and closed comment log. - [ ] BASE.15.d Obtain Yemaya owner review and resolve every Yemaya comment. Evidence: named Yemaya approval and closed comment log. - [ ] BASE.15.e Obtain Veritas owner review and resolve every Veritas comment. Evidence: named Veritas approval and closed comment log. - [ ] BASE.15.f Obtain Euterpe owner review and resolve every Euterpe comment. Evidence: named Euterpe approval and closed comment log. - [ ] BASE.15.g Obtain Aja owner review and resolve every Aja comment. Evidence: named Aja approval and closed comment log. - [ ] BASE.15.h Obtain Bellona owner review and resolve every Bellona comment. Evidence: named Bellona approval and closed comment log. - [ ] BASE.15.i Re-run both coverage directions after all owner-requested changes. Evidence: final zero-orphan reports at the approved revision. --- ## 2. Execution contract ### 2.1 Checkbox and evidence rules - `[ ]` and `[x]` are the sole task-completion source of truth. - Each checkbox represents one independently reviewable outcome. - A checkbox may flip only when the evidence named by the item exists. - A phase heading is organizational; it is never a completion signal. - An item marked not applicable must remain unchecked until a decision record identifies the approver, rationale, replacement control, and review date. - Existing code is evidence only after it has been inspected and its relevant verification has passed on the current branch. - A unit test does not prove a browser journey; a fixture does not prove live integration; a screenshot does not prove authorization; a narrow build does not prove a release gate. - Human governance approvals remain unchecked until performed by the named human. An agent may prepare an engineering-readiness packet but may not fabricate approval. - A top-level identifier such as `I3.4` remains the accountable outcome. When that outcome contains separately buildable behavior, sequential gates, independently owned work, multiple artifacts, or multiple proof obligations, nested `.a`, `.b`, and later identifiers define its executable child tasks. - Child tasks must be written from the parent's domain semantics. Do not add generic lifecycle boilerplate merely to increase the checkbox count, and do not derive work mechanically from punctuation or keywords. - A parent may flip to `[x]` only after every applicable nested checkbox is complete and linked from the parent's rollup evidence. The parent must remain unchecked while any child is unchecked, failed, stale, or awaiting approval. - A nested task may be marked not applicable only through the same reviewed N/A record required above. A broad N/A decision may cover multiple children only when it names each child identifier and gives a child-specific rationale. - Child identifiers are stable evidence keys and follow execution order where ordering exists. Renaming or resequencing a child requires updating every evidence and dependency reference to it. - An already atomic parent needs no ceremonial children. During implementation, newly discovered semantic work must become a new child or parent when it has independent behavior, ownership, sequencing, failure handling, or approval. - Automation may identify review candidates and validate checklist structure, identifiers, evidence clauses, and parent/child completion consistency. It must not author or regenerate the semantic task text. ### 2.2 Quality and honesty rules - Every scorer, gate, editor, dispatcher, and pipeline stage ships real domain logic with known-value tests or fails loudly behind an explicit `not_configured` or `unavailable` result. - Generated, inferred, scored, or processed values must never be invented in UI adapters. - Provider errors, partial results, stale reads, degraded dependencies, retries, and cancellations must be visible and machine-readable. - Fixtures must carry a persistent `fixture` badge and must be impossible to enable accidentally in production. - All mutations are authenticated, authorized at object and property level, audited, idempotent where retryable, and durable before acknowledgement. - All publish, release, export, and promotion paths are fail-closed. - All high-risk AI operations preserve input, prompt/template version, model identity, parameters, safety results, output hashes, cost, actor, and timestamps. - Destructive operations expose impact previews, require typed confirmation or step-up authorization proportionate to risk, and provide a documented recovery path. ### 2.3 UI and interaction thesis The shared visual thesis is a calm, professional production surface: strong typography, dense but readable information, restrained color, and one dominant working canvas. The content plan is workspace first, context/inspector second, status and evidence always visible, with no marketing hero inside an operator tool. The interaction thesis is: 1. fast workspace-to-inspector transitions that preserve selection and focus; 2. visible, non-ornamental state transitions for jobs, reviews, and publishes; 3. keyboard-first command, comparison, and triage flows with reduced-motion equivalents. - [ ] UX.1 Define a shared utility-first information architecture: global navigation, primary workspace, contextual inspector, and status region. Evidence: approved responsive wireframes for both archetypes. - [ ] UX.1.a Define the global navigation hierarchy, route labels, current location treatment, and cross-workbench exits. Evidence: annotated navigation map. - [ ] UX.1.b Define the primary workspace's canvas, editor, table, graph, timeline, or queue responsibilities for each workbench archetype. Evidence: archetype-by-region responsibility matrix. - [ ] UX.1.c Define contextual inspector opening, pinning, replacement, dismissal, and focus-return behavior. Evidence: annotated inspector interaction flow. - [ ] UX.1.d Define the persistent status region for save, sync, job, review, gate, publish, fixture, degraded, and connectivity state. Evidence: status-content specification. - [ ] UX.1.e Define how selection and working context survive transitions between navigation, workspace, inspector, and status regions. Evidence: state-preservation interaction cases. - [ ] UX.1.f Produce wide and compact wireframes for editor-centric and operations-centric archetypes. Evidence: four approved responsive wireframes. - [ ] UX.2 Define density modes without card mosaics or decorative dashboards. Evidence: the design review confirms cards exist only when the card is the interaction. - [ ] UX.2.a Define comfortable and compact spacing, row-height, control-size, and information-priority tokens. Evidence: density token table. - [ ] UX.2.b Identify the default density for editors, tables, queues, inspectors, timelines, and touch-oriented review. Evidence: surface-density matrix. - [ ] UX.2.c Define which information may collapse, abbreviate, wrap, or move to an inspector at each density. Evidence: content-priority rules. - [ ] UX.2.d Define when a card is itself a selectable, draggable, comparable, or previewable object and prohibit decorative container cards elsewhere. Evidence: reviewed card-use inventory. - [ ] UX.2.e Preserve the user's density preference per workbench and provide an accessible reset. Evidence: preference contract and interaction test. - [ ] UX.2.f Validate both densities at 200% zoom and with long translated labels. Evidence: no-clipping visual test matrix. - [ ] UX.3 Define one accent color and semantic status tokens that remain distinguishable without color. Evidence: token contrast tests pass. - [ ] UX.3.a Select the accent token and specify permitted emphasis, selection, focus, and action uses. Evidence: approved accent-use rules. - [ ] UX.3.b Define independent semantic tokens for informational, success, warning, failure, destructive, stale, fixture, degraded, and pending states. Evidence: token inventory. - [ ] UX.3.c Pair every semantic state with text, iconography, pattern, shape, or position so color is never the sole signal. Evidence: noncolor cue matrix. - [ ] UX.3.d Define foreground, background, border, focus, chart, and disabled token pairs for every supported theme. Evidence: theme token mappings. - [ ] UX.3.e Test text, nontext controls, focus indicators, and adjacent status colors against required contrast ratios. Evidence: automated contrast report with zero violations. - [ ] UX.4 Define at most two type families and a type scale optimized for long-form editing, tables, graphs, code, and metadata. Evidence: rendered specimen passes at 200% zoom. - [ ] UX.4.a Choose the primary interface/editor family and any secondary monospace or specialist family with licensed font sources and fallbacks. Evidence: typography decision record. - [ ] UX.4.b Define display, heading, body, label, metadata, table, code, and numeric styles with size, weight, line height, and tracking. Evidence: typed token scale. - [ ] UX.4.c Define tabular-number, code, long-form prose, dense metadata, and graph-label treatments. Evidence: content-type specimen. - [ ] UX.4.d Validate fallbacks, missing glyphs, diacritics, bidirectional text, vertical-script metadata, and long translations. Evidence: multilingual glyph specimen. - [ ] UX.4.e Validate reflow, clipping, truncation disclosure, and reading order at 200% and 400% text zoom. Evidence: zoom test report. - [ ] UX.5 Define focus, selection, hover, active, disabled, stale, fixture, degraded, conflict, and destructive states. Evidence: Storybook or equivalent state fixtures cover each state. - [ ] UX.5.a Define keyboard focus appearance, focus-visible behavior, focus order, and focus restoration. Evidence: focus-state fixtures and tests. - [ ] UX.5.b Define single, multiple, range, remote-user, and unavailable selection appearance. Evidence: selection-state fixtures. - [ ] UX.5.c Define hover behavior that adds no hover-only information or action. Evidence: pointer/no-pointer comparison fixtures. - [ ] UX.5.d Define pressed, active-route, active-tool, and in-progress action treatment. Evidence: active-state fixtures. - [ ] UX.5.e Define disabled versus read-only semantics, explanations, and keyboard exposure. Evidence: disabled/read-only fixtures and semantic assertions. - [ ] UX.5.f Define stale-data indicators, freshness details, and refresh or recompute actions. Evidence: stale-state fixtures. - [ ] UX.5.g Define persistent fixture labeling and prevent fixture state from visually resembling live production data. Evidence: fixture-state fixtures and production guard test. - [ ] UX.5.h Define degraded and unavailable states with affected capability, retained capability, cause, and recovery action. Evidence: degradation-state fixtures. - [ ] UX.5.i Define local/remote edit conflicts, comparison, resolution, and unresolved-state treatment. Evidence: conflict-state fixtures. - [ ] UX.5.j Define destructive action hierarchy, impact preview, typed or step-up confirmation, completion, and recovery treatment. Evidence: destructive-state fixtures. - [ ] UX.6 Define three responsive arrangements: wide three-region workspace, compact two-region workspace, and single-region mobile/tablet review. Evidence: no horizontal page overflow at supported viewports. - [ ] UX.6.a Define wide-layout minimum dimensions and the allocation, resizing, and collapse rules for navigation, workspace, and inspector. Evidence: wide-layout specification. - [ ] UX.6.b Define compact-layout region pairing, inspector overlay/drawer behavior, and selection persistence. Evidence: compact-layout specification. - [ ] UX.6.c Define single-region review navigation, context breadcrumbs, inspector replacement, and back behavior. Evidence: single-region flow. - [ ] UX.6.d Define content-driven transition thresholds without assuming device labels or orientation. Evidence: breakpoint rationale and tests. - [ ] UX.6.e Define minimum and maximum pane sizes plus keyboard-accessible resizing and reset. Evidence: pane-resize interaction tests. - [ ] UX.6.f Test every arrangement with zoom, translated strings, persistent scrollbars, and software keyboards. Evidence: zero page-level overflow or obscured-action failures. - [ ] UX.7 Define motion durations, easing, interruption, and `prefers-reduced-motion` behavior. Evidence: automated reduced-motion assertions cover all shared transitions. - [ ] UX.7.a Define duration tiers for immediate feedback, region transition, route transition, progress, and explanatory motion. Evidence: duration token table. - [ ] UX.7.b Define easing and direction rules that communicate spatial or lifecycle relationships without decorative movement. Evidence: approved motion examples. - [ ] UX.7.c Define interruption, reversal, cancellation, rapid-repeat, and focus behavior during animation. Evidence: interruption test cases. - [ ] UX.7.d Define reduced-motion replacements that preserve state change and orientation without translation, scale, parallax, or flashing. Evidence: transition-by-transition alternative matrix. - [ ] UX.7.e Enforce flashing, autoplay, and vestibular-safety limits. Evidence: automated motion-safety assertions. - [ ] UX.7.f Test every shared transition with reduced motion enabled before route load and toggled at runtime. Evidence: passing browser automation. - [ ] UX.8 Define keyboard maps for navigation, selection, compare, command palette, save, undo, redo, comment, and escape. Evidence: collision audit covers browser, OS, screen-reader, and editor shortcuts. - [ ] UX.8.a Define landmark, region, tab, panel, and focus-mode navigation commands. Evidence: navigation key map and journey test. - [ ] UX.8.b Define single, range, additive, parent/child, and clear-selection commands. Evidence: selection key map and tests. - [ ] UX.8.c Define compare entry, side switching, synchronized navigation, difference traversal, and compare exit. Evidence: compare key map. - [ ] UX.8.d Define command-palette open, search, group navigation, execution, disabled-command explanation, and dismissal. Evidence: palette key map. - [ ] UX.8.e Define save, save-as-version, undo, redo, and history behavior across text, structured edits, and remote conflicts. Evidence: editing-command key map. - [ ] UX.8.f Define comment creation, anchored navigation, submit, cancel, and resolve shortcuts. Evidence: review-command key map. - [ ] UX.8.g Define layered Escape behavior for composition, menus, dialogs, modes, selections, inspectors, and routes. Evidence: ordered Escape contract. - [ ] UX.8.h Audit every proposed chord against supported browsers, operating systems, assistive technologies, international layouts, and embedded editors. Evidence: collision matrix with resolved conflicts. - [ ] UX.8.i Publish discoverable shortcut help and allow remapping where platform or accessibility conflicts remain. Evidence: help and preference interaction tests. - [ ] UX.9 Define touch and pen alternatives for drag, resize, graph pan, and timeline trim. Evidence: every drag operation has a single-pointer, keyboard, and non-drag alternative. - [ ] UX.9.a Inventory every drag, reorder, resize, pan, scrub, trim, connect, lasso, and freehand interaction by surface. Evidence: complete gesture inventory. - [ ] UX.9.b Define tap/select plus explicit move controls for reordering and drag placement. Evidence: non-drag reorder flows. - [ ] UX.9.c Define numeric, stepper, preset, and reset controls for pane, object, and region resizing. Evidence: non-drag resize flows. - [ ] UX.9.d Define directional, minimap, search, and fit controls for graph, canvas, waveform, and timeline panning. Evidence: non-gesture navigation flows. - [ ] UX.9.e Define timecode/numeric in-out fields and frame/sample stepping for timeline and media trimming. Evidence: non-drag trim flow. - [ ] UX.9.f Define touch/pen hit targets, palm rejection, pressure/tilt applicability, cancellation, and accidental-gesture recovery. Evidence: input-modality specification. - [ ] UX.9.g Test every inventoried gesture with touch, pen, keyboard, switch, and a single pointer without path-based movement. Evidence: complete modality matrix. - [ ] UX.10 Define plain-language utility copy for loading, empty, offline, unauthorized, not configured, failed, partial, stale, and retrying states. Evidence: copy review finds no marketing or false-success language. - [ ] UX.10.a Define loading copy that names the requested object or operation and does not imply success. Evidence: reviewed loading strings. - [ ] UX.10.b Define empty-state copy that distinguishes no records, no matches, no permission-visible records, and first-use setup. Evidence: reviewed empty-state variants. - [ ] UX.10.c Define offline copy that states readable, editable, queued, and unavailable capabilities plus reconnection behavior. Evidence: reviewed offline strings. - [ ] UX.10.d Define unauthorized and forbidden copy without disclosing hidden object existence or sensitive policy detail. Evidence: security-reviewed authorization strings. - [ ] UX.10.e Define not-configured copy that names the missing capability, authorized resolver, and safe next step. Evidence: reviewed configuration strings. - [ ] UX.10.f Define failure copy with affected action, retained data, correlation/support reference, retry eligibility, and recovery action. Evidence: reviewed failure strings. - [ ] UX.10.g Define partial-result copy that quantifies completed, failed, skipped, and still-running work. Evidence: reviewed partial-result strings. - [ ] UX.10.h Define stale-state copy with evidence age, invalidating change, impact, and refresh/recompute action. Evidence: reviewed stale strings. - [ ] UX.10.i Define retrying copy with attempt state, backoff or next-attempt timing, cancellation, and terminal-failure transition. Evidence: reviewed retry strings. - [ ] UX.10.j Test utility copy with screen readers, narrow layouts, long translations, and deliberately induced failures. Evidence: content QA matrix with no false-success language. ### 2.4 Current external standards baseline The versions below are a planning baseline, not a license to hard-code a version forever. Each domain must pin the implemented version, validate against the real conformance tooling, and record its upgrade policy. | Concern | Baseline | | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Web accessibility | [WCAG 2.2](https://www.w3.org/TR/WCAG22/) Level AA, including focus-not-obscured, dragging alternatives, target size, redundant entry, and accessible authentication | | Media provenance | [C2PA Content Credentials](https://spec.c2pa.org/specifications/) with signed manifests, validation, trust, hard/soft bindings, ingredient lineage, and UX guidance | | 3D interchange | [OpenUSD](https://openusd.org/) validation plus `usdchecker`; explicit profile/version per target | | Education interchange | [QTI 3](https://www.1edtech.org/standards/qti/index), [QTI accessibility](https://www.1edtech.org/standards/qti/accessibility), LTI 1.3/LTI Advantage, OneRoster, Caliper, Open Badges | | News exchange | [IPTC NewsML-G2](https://iptc.org/standards/newsml-g2/) current supported release, Media Topics, correction/update metadata, rights, packages, and planning items | | Music delivery | DDEX ERN implemented profile; ITU-R BS.1770 loudness/true peak; [EBU R 128](https://tech.ebu.ch/loudness) where broadcast delivery applies | | API security | [OWASP API Security Top 10 2023](https://owasp.org/API-Security/) plus repository security/privacy controls | | Observability | [OpenTelemetry semantic conventions](https://opentelemetry.io/docs/concepts/semantic-conventions/) for traces, metrics, logs, profiles, and resources | - [ ] STD.1 Record the exact WCAG 2.2 conformance target and supported assistive-technology/browser matrix. Evidence: accessibility test plan. - [ ] STD.1.a Record the required WCAG 2.2 level, included success criteria, allowed exemptions, and exception approval process. Evidence: conformance policy. - [ ] STD.1.b Enumerate supported browsers, engines, operating systems, viewport classes, input modalities, and zoom levels. Evidence: supported platform matrix. - [ ] STD.1.c Enumerate supported screen reader/browser/OS combinations and other required assistive technologies. Evidence: assistive-technology matrix. - [ ] STD.1.d Map automated, manual, and journey-level checks to each applicable success criterion. Evidence: criterion-to-test index. - [ ] STD.1.e Define severity, waiver, remediation deadline, and release-block rules for accessibility failures. Evidence: approved exception policy. - [ ] STD.2 Record the supported C2PA specification and trust-list policy. Evidence: provenance compatibility decision record. - [ ] STD.2.a Pin supported C2PA and Content Credentials specification versions and compatibility behavior for older/newer claims. Evidence: version-support table. - [ ] STD.2.b Define accepted manifest stores, hard and soft bindings, ingredient assertions, actions, and custom assertion policy. Evidence: manifest profile. - [ ] STD.2.c Define signer identity, certificate-chain, timestamp, revocation, trust-list source, update, and offline-cache policy. Evidence: cryptographic trust policy. - [ ] STD.2.d Define valid, invalid, untrusted, unknown, revoked, expired, missing, and partially recoverable UI/API results. Evidence: validation result taxonomy. - [ ] STD.2.e Define signing-key custody, rotation, compromise, revocation, and audit ownership. Evidence: approved key operations record. - [ ] STD.2.f Validate the profile with official or independently compatible fixtures. Evidence: interoperability report. - [ ] STD.3 Record the OpenUSD profile, schema set, resolver policy, and target DCC/engine version matrix. Evidence: interchange compatibility record. - [ ] STD.3.a Pin supported USD file formats, core version, composition features, layer conventions, and stage metadata. Evidence: OpenUSD profile. - [ ] STD.3.b Enumerate required, optional, extended, and forbidden schemas with version constraints. Evidence: schema compatibility table. - [ ] STD.3.c Define asset resolver schemes, search roots, package behavior, credentials, network access, and unresolved-asset failure semantics. Evidence: resolver policy. - [ ] STD.3.d Define units, axes, frame rates, color management, material, texture, animation, skeleton, and variant conventions. Evidence: semantic interchange rules. - [ ] STD.3.e Record import/export capability and known deltas for every target DCC, engine, plugin, and supported version. Evidence: target matrix. - [ ] STD.3.f Pin `usdchecker` and target-host validation commands plus accepted warning policy. Evidence: executable conformance plan. - [ ] STD.3.g Validate canonical round trips and unsupported-feature failures across the matrix. Evidence: checksummed compatibility fixtures and results. - [ ] STD.4 Record QTI, LTI, OneRoster, Caliper, Open Badges, SCORM, and xAPI versions that Metis imports or exports. Evidence: standards matrix. - [ ] STD.4.a Record QTI version, profile, accessibility extensions, interaction support, import/export direction, and lossy mappings. Evidence: QTI support row and fixtures. - [ ] STD.4.b Record LTI Core and Advantage services, message flows, security profile, platform/tool roles, and unsupported claims. Evidence: LTI support row and launch fixtures. - [ ] STD.4.c Record OneRoster version, CSV/REST modes, resource coverage, identifier mapping, and delta-sync behavior. Evidence: OneRoster support row and fixtures. - [ ] STD.4.d Record Caliper version, profiles, event coverage, actor/entity privacy, transport, and retry semantics. Evidence: Caliper support row and fixtures. - [ ] STD.4.e Record Open Badges version, assertion/profile fields, evidence, signing/verification, revocation, and wallet interoperability. Evidence: Open Badges support row and fixtures. - [ ] STD.4.f Record SCORM versions, packaging/runtime coverage, sequencing limits, import/export direction, and compatibility policy. Evidence: SCORM support row and fixtures. - [ ] STD.4.g Record xAPI version, statement profiles, endpoint/authentication, identifier mapping, and delivery/retry behavior. Evidence: xAPI support row and fixtures. - [ ] STD.4.h Define precedence and conflict handling when the same course, roster, activity, result, or credential crosses multiple standards. Evidence: cross-standard mapping decisions. - [ ] STD.4.i Validate declared support using conformance tooling or independently produced provider/consumer fixtures. Evidence: complete standards conformance report. - [ ] STD.5 Record the NewsML-G2 conformance level, catalog, vocabulary, and update/correction policy. Evidence: Veritas exchange profile. - [ ] STD.5.a Pin the supported NewsML-G2 release, conformance level, item types, package structures, and processing model. Evidence: versioned exchange profile. - [ ] STD.5.b Define provider, service, product, subject, genre, role, urgency, and Media Topics catalog/vocabulary mappings. Evidence: catalog mapping. - [ ] STD.5.c Define identifier, version, timestamp, language, location, relationship, and package-reference rules. Evidence: item identity and linkage rules. - [ ] STD.5.d Define rights, usage terms, embargo, source, credit, and confidential/protected metadata mappings. Evidence: rights mapping. - [ ] STD.5.e Define update, correction, replacement, cancellation, retraction, and tombstone semantics. Evidence: lifecycle transition profile. - [ ] STD.5.f Define planning-item ingest/export and assignment/calendar mappings. Evidence: planning interoperability profile. - [ ] STD.5.g Validate producer and consumer behavior with canonical, third-party, invalid, and version-transition fixtures. Evidence: conformance results. - [ ] STD.6 Record the DDEX ERN profile and every distributor-specific delta. Evidence: Euterpe delivery compatibility matrix. - [ ] STD.6.a Pin the ERN version, implementation profile, release types, resource types, deal model, and allowed message flows. Evidence: DDEX profile. - [ ] STD.6.b Define party, contributor, rights-controller, identifier, territory, date, takedown, and update mappings. Evidence: semantic mapping table. - [ ] STD.6.c Define audio, image, lyric, metadata, checksum, naming, directory, and transport package rules. Evidence: delivery-package profile. - [ ] STD.6.d Inventory every distributor's required, optional, forbidden, transformed, and defaulted fields. Evidence: distributor delta rows. - [ ] STD.6.e Define validation, rejection, warning, partial-acceptance, redelivery, acknowledgement, and reconciliation behavior. Evidence: delivery state model. - [ ] STD.6.f Validate canonical and distributor-specific packages against available schemas, validators, and sandbox endpoints. Evidence: destination-level compatibility results. - [ ] STD.7 Record loudness, peak, sample-rate, bit-depth, channel-layout, and codec targets per delivery destination. Evidence: audio delivery profile. - [ ] STD.7.a Inventory streaming, download, broadcast, cinema, immersive, social, preview, archive, and distributor destinations. Evidence: destination register. - [ ] STD.7.b Record integrated, short-term, and momentary loudness targets and measurement gating per destination. Evidence: loudness rows with units and tolerance. - [ ] STD.7.c Record true-peak and sample-peak ceilings plus measurement oversampling policy. Evidence: peak rows with units and tolerance. - [ ] STD.7.d Record sample rate, bit depth, dither, channel layout, bed/object, and downmix requirements. Evidence: PCM/layout rows. - [ ] STD.7.e Record codec, profile, bitrate or quality mode, container, metadata, gapless, and artwork requirements. Evidence: encoded-delivery rows. - [ ] STD.7.f Record normalization, limiting, resampling, encoding, and metadata-transformation rules without overwriting the source master. Evidence: derivative-generation policy. - [ ] STD.7.g Validate boundary, wrong-unit, clipping, silence, short-program, multichannel, and codec round-trip fixtures. Evidence: known-value delivery test report. - [ ] STD.8 Map every workbench API to the OWASP API risk controls. Evidence: threat model and automated negative-test index. - [x] STD.8.a Inventory every public, internal, bridge, webhook, callback, streaming, and administrative API operation. Evidence: operation-level API register. - [ ] STD.8.b Map broken object/property/function authorization controls and tenant boundaries to each operation. Evidence: authorization-control rows. - [ ] STD.8.c Map authentication, token/session lifecycle, sensitive business flow, and automated-abuse controls to each operation. Evidence: identity/abuse-control rows. - [ ] STD.8.d Map resource consumption, pagination, query complexity, payload, upload, storage, compute, queue, and spend controls. Evidence: consumption-control rows. - [ ] STD.8.e Map SSRF, unsafe downstream API consumption, redirect, DNS, egress, timeout, and response-validation controls. Evidence: remote-interaction rows. - [ ] STD.8.f Map inventory management, version retirement, documentation, environment exposure, configuration, and secret controls. Evidence: management-control rows. - [ ] STD.8.g Add operation-specific negative tests for every mapped control, including authenticated cross-tenant and property-level cases. Evidence: passing negative-test index. - [ ] STD.8.h Record residual risk, compensating control, owner, expiry, and retest date for every unautomated or unmet control. Evidence: approved exception register. - [ ] STD.9 Define OpenTelemetry attribute names, cardinality limits, trace propagation, and sensitive-data exclusions. Evidence: observability schema review. - [ ] STD.9.a Define canonical resource attributes for service, deployment, domain, host, tenant-safe scope, worker, and provider identity. Evidence: resource schema. - [ ] STD.9.b Define span names and attributes for HTTP, RPC, database, queue, job, model/provider, render, publish, and bridge operations. Evidence: trace schema. - [ ] STD.9.c Define metric instruments, units, aggregation, histogram boundaries, and allowed dimensions. Evidence: metric schema. - [ ] STD.9.d Define structured log event names, severity, correlation, error, retry, and audit-link fields. Evidence: log schema. - [ ] STD.9.e Set cardinality budgets and prohibit raw IDs, unbounded labels, content, prompts, source text, and stack traces as dimensions. Evidence: attribute allow/deny rules. - [ ] STD.9.f Define propagation through browser, API, worker, queue, provider, desktop, bridge, and callback boundaries. Evidence: propagation map. - [ ] STD.9.g Define PII, learner, source-identity, biometric, credential, rights, prompt, and customer-content redaction or exclusion. Evidence: privacy-reviewed telemetry policy. - [ ] STD.9.h Define sampling, retention, regional storage, access, deletion, and support-safe export behavior. Evidence: telemetry lifecycle policy. - [ ] STD.9.i Validate schema enforcement, propagation continuity, cardinality bounds, and sensitive-data absence. Evidence: automated observability contract tests. - [ ] STD.10 Establish quarterly standards-review ownership. Evidence: named owner, review cadence, compatibility policy, and backlog link. - [ ] STD.10.a Name the primary and backup owner for accessibility and assistive-technology support. Evidence: ownership register entry. - [ ] STD.10.b Name the primary and backup owner for C2PA provenance and trust policy. Evidence: ownership register entry. - [ ] STD.10.c Name the primary and backup owner for OpenUSD and target-host interoperability. Evidence: ownership register entry. - [ ] STD.10.d Name the primary and backup owner for education interchange standards. Evidence: ownership register entry. - [ ] STD.10.e Name the primary and backup owner for NewsML-G2 and newsroom exchange. Evidence: ownership register entry. - [ ] STD.10.f Name the primary and backup owner for DDEX and audio-delivery standards. Evidence: ownership register entry. - [ ] STD.10.g Name the primary and backup owner for OWASP API controls and OpenTelemetry conventions. Evidence: ownership register entries. - [ ] STD.10.h Define the quarterly review agenda, required evidence, change classification, compatibility window, deprecation notice, and emergency review trigger. Evidence: approved review procedure. - [ ] STD.10.i Link discovered changes to owned backlog items and verify closure at the next review. Evidence: standards-review issue template and cadence record. --- ### 2.5 Binding execution notes for the remaining work (added 2026-09-11) These notes come from a review of every open cell against the tree at commit `48f4bc8ddb`. They bind every remaining phase; a per-cell `` comment below repeats only what is specific to that cell. Nothing in this section flips a checkbox. 1. **Name the host before building or testing UI.** Every cell whose verb is build, run, exercise, or verify against a page names the host application, its port, and the route. Metis today: authoring UI is split between `apps/metis/web` (`/create/*` inside the LEARNER app, port 3020, login-only middleware with no role gate) and `apps/metis/admin` (hub, workspaces, psychometrics, credentials, integrations; port 3021), both backed by the Python service `apps/metis/service` (FastAPI, port 8000, env prefix `METIS_`). There is NO `/studio/metis` route in `apps/oshun/web`; the Section 1 table's "Oshun Studio workbench" host is unratified (M0.1.c is open) and `libs/oshun/navigation/src/release-scope.ts` scopes Metis to V1.2. Port 3020 is also `apps/oshun/admin`'s port: never run both. For every other domain the N0.1 host reconciliation cell (V0.1, Y0.1, E0.1, A0.1, B0.1) is a precondition for that domain's UI cells; when the choice is a product decision, draft the ADR as Proposed, build against the existing host as-is, and say so in the cell. Never build a third host. Veritas has no authoring host at all today; the Phase V header note records what exists instead. 2. **"Live backing" means no request interception.** The existing Metis Playwright suites are mocked: 64 of 65 specs in `apps/metis/web/e2e` and 20 of 68 in `apps/metis/admin/e2e` (plus every `e2e/support/*-fixtures.ts`) intercept `**/api/**` with `page.route`, and `admin-fixtures.ts` signs in with a literal `test-admin-token`. A full-journey cell (M10.9–M10.12, M10.21, M10.22, and every later `N9.x` journey) passes only when its spec contains no `page.route`, no fixture token, and its assertions read state back from the service or the database. Reusing those fixtures satisfies a UI-state cell, never a journey cell. 3. **A skipped real-database test is not a pass.** The service's `*_real_database.py` and `*_postgres_integration.py` suites call `pytest.skip` when `METIS_TEST_DATABASE_URL` is unset and shell out to `apps/metis/service/.venv/bin/alembic upgrade head`. That `.venv` does not exist on this Mac (system python is 3.9; the service needs 3.11+). Recipe: `/opt/homebrew/bin/python3.11 -m venv apps/metis/service/.venv`, then `apps/metis/service/.venv/bin/pip install -e 'apps/metis/service[dev]'`, `docker compose -f docker/docker-compose.dev.yml up -d postgres minio redis`, and `METIS_TEST_DATABASE_URL=postgresql+asyncpg://oshun:oshun_dev@127.0.0.1:5432/`. Every evidence block reports skipped counts beside passed counts. 4. **Model-backed evaluation binds the cheap route, per feature.** The service defaults are wrong for tests: `ai_provider="openai"` (that account has no credits) and the floating `deepseek/deepseek-v4-flash`. Every evaluator has its own settings (`METIS__MODEL_PROVIDER`, `_MODEL`, `_BASE_URL`, `_API_KEY` for `SOURCE_CLAIM`, `STANDARDS_ALIGNMENT`, `COURSE_OUTLINE`, `LESSON_ASSIST`, and the rest in `config.py`): set provider `openrouter`, base URL `https://openrouter.ai/api/v1`, model `deepseek/deepseek-v4-flash-0731`, `OPENROUTER_PROVIDER_SORT=price`, and the key from `~/Desktop/workspace/drawer/env-master.env` through a throwaway `/tmp/-env.sh`. Never `openai` or `anthropic`; never a key in the repo. 5. **Corpora and labels may not be invented.** A "licensed/consented representative held-out corpus" (M10.3.a, M10.23, I4.4.b, I9.6, and every later calibration cell) does not exist in this repository and cannot be written by an agent. An agent may build a repo-owned synthetic corpus whose labels derive from ground truth the fixture itself fixes (a known key, a planted contradiction, an executable worked solution), state in the manifest that it is synthetic, unrepresentative and un-adjudicated, and report thresholds as provisional. The parent stays open until a named human supplies or approves the corpus. 6. **External conformance receipts are one gate wherever they appear.** M1.11.g/M10.5.d (QTI: `1edtech-qti3-xsd`, `longsight-qti3-cli`, pinned in `libs/contracts/src/metis/qti-package.ts`), M1.12.g/M10.6 (LTI: the 1EdTech certification suite plus one independent LTI 1.3 platform), M1.13.g/M10.7 (OneRoster, Caliper, Open Badges, SCORM, xAPI validators pinned in `interoperability-profiles.ts`). A receipt is the tool's own output over our artifact, retained under `evidence/v1-workbenches/metis-conformance//` with the tool version and the artifact hash. Our own simulator, contract test, or schema is never a receipt. Install the tool when it is publicly installable and record the exact command and version; when it needs an account, a licence, or a hosted platform, record the attempt and leave the cell open. Docker-heavy tools (a Moodle or Canvas platform) run on the Linux dev server, not this Mac. 7. **Load, performance, and full Playwright sweeps obey the machine rules.** `memory_pressure | tail -2` (Mac) or `free -m` (Linux) before every heavy invocation. 68 admin specs and 65 web specs are sweeps, so `next build && next start`, never `next dev`; `--project=chromium` only (both configs also list firefox and webkit — do not run them); one Next server at a time; kill your PIDs at session end and verify with `lsof`. Load tests (M10.15 and every later `N.15`) run on the Linux dev server with a stop threshold written into the plan; a load run on this Mac is a recorded failed attempt, not evidence. 8. **WCAG 2.2, not the 2.1 helper.** `@oshun/testing/playwright`'s `axeAfterEach` runs `WCAG_21_AA_TAGS`. A cell that says 2.2 uses the kit's `@oshun/workbench-kit/axe-policy` and `wcag22-coverage` (S11.3) or passes tags including `wcag22aa` explicitly, and the evidence says which. 9. **Human approvals stay open, and so do their parents.** Every cell whose verb is obtain, ratify, approve, or sign (M0.5.e, M0.11.b/f, M0.12.g, M0.13.f, M0.14.g, M10.20, S0.12, S11.24.h, DEP.2, and the same cells in every later phase) gets a readiness packet with the approver's name left blank. A generator that reports "0 of N earned" needs no re-run; the missing input is a person. 10. **Re-measure a blocker comment before acting on it.** Several `` notes predate later commits (M0.15.d's first vector changed on 2026-09-06). Read the code the note names, restate the current state with a date, then work. 11. **Structural invariants.** One checkbox per identifier (a rollup note is prose, never a second `- [x] ` line); a parent is `[ ]` while any child is `[ ]`; every cell carries an `Evidence:` clause; child letters are contiguous; an identifier at end of line is still an identifier. `node scripts/v1-workbenches/checklist-structure-lint.mjs` checks these and exits non-zero; run it before every commit that touches this file. 12. **Ground a phase before building it (added 2026-09-18).** Phases Y, V, E, A and B were enumerated, not decomposed: measured that day, more than half of the open cells in Y and E pack six or more slash-separated behaviours into one box, none names a file, package or route, and the evidence clause averages 2.4 words ("task tests."). Such a cell is not yet a task. The first work in a phase, after its N0 decisions, is a grounding pass over that phase only: for each cell, name the existing file, package, contract or route it changes (or say that none exists and where the new one goes), and split every cell whose behaviours have independent failure modes into children (`.a`, `.b`, …) that each carry their own specific `Evidence:` clause — the test file, the journey, the matrix row. Do it when the phase starts, never for a phase that is not next: a split made months ahead is written against code that will have moved. `TODOS/registry.json` lists these phases as deferred for that reason, so the task board does not offer their cells until the phase before them is done. 13. **Work order (added 2026-09-18).** The task board's queue for this file is: section 1 (BASE), section 4 (DEP), the Phase S residue, the Phase M residue, then Phase I starting at I0 — with I0.20, the crosswalk against `ISIS_CHROMA_RUNPOD_MVP_TODOS_2026-09-11.md`, before any I6–I9 cell. Sections 2.3, 2.4 and 3 (UX.*, STD.*, CAP.*) are acceptance criteria that every domain phase must meet; they are checked when DONE.3 can be, not first, and a phase cell that satisfies one should name its id in its evidence. `node tools/todos-board.mjs --next v1-domain-workbenches` prints the next cells in that order. 14. **Who owns and who reviews (decision taken under the owner's delegation, 2026-09-18).** This estate has one accountable person, the repository owner, and its delivery work is done by coding agents, so the words "owner", "independent review" and "signed" in a cell mean this. The accountable owner of every phase is the repository owner. The delivery owner of a cell is the agent session that holds its task on the Eve Task Board. The independent reviewer is a second agent session that did not author the work; its review is "signed" when it is recorded with the session, the date and the commit it read, through `./eve verify` once ETB.4.07 exists and as a dated review note in the cell until then. That is separation of duties for engineering review, and DEP.2.a–f are worked against it. It does not stand in for the named human approvals of rule 9 (legal, privacy, education, accessibility, product sign-off). Those stay open; once the packet exists the cell carries the human blocked tag, which takes it out of the agent queue and puts it on the owner's list in `TODOS/PARKED.md`. Seven such cells were tagged on 2026-09-18 (M0.5.e, M0.11.b, M0.11.f, M0.12.g, M0.13.f, M0.14.g, M10.20). --- ## 3. Cross-cutting SOTA capability contract Every applicable row below must have domain-specific implementation and proof. Rejecting a row requires a P0 decision record and a compensating-control review. ### 3.1 Authoring and operations capability - [ ] CAP.1 Frictionless capture supports keyboard command, paste, upload, import, deep link, and contextual creation where applicable. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.1.a Provide a discoverable keyboard command that opens capture with focus in the first required field. Evidence: per-domain shortcut and focus journey. - [ ] CAP.1.b Accept pasted text, URLs, files, and supported structured clipboard types without silently discarding formatting or provenance. Evidence: per-domain clipboard fixture matrix. - [ ] CAP.1.c Accept supported uploads with type, size, checksum, quarantine, progress, cancellation, and retry behavior. Evidence: per-domain upload journey and negative tests. - [ ] CAP.1.d Import each supported domain interchange format with preview, validation, conflict, partial-failure, and rollback behavior. Evidence: per-domain import conformance tests. - [ ] CAP.1.e Open capture from a safe deep link while preserving authorized target, tenant, and return context. Evidence: per-domain deep-link tests. - [ ] CAP.1.f Create an object contextually from its parent, selection, timeline position, graph node, source, or review item as applicable. Evidence: per-domain contextual-creation journeys. - [ ] CAP.1.g Record a reviewed N/A decision for each capture entry point a domain does not support. Evidence: capability matrix has no implicit omissions. - [ ] CAP.2 Capture preserves source metadata, rights hints, locale, actor, tenant, timestamp, and import checksum. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.2.a Preserve original source identifier, URI/path, filename, media type, size, and supplied descriptive metadata. Evidence: source metadata round-trip tests. - [ ] CAP.2.b Preserve supplied license, copyright, attribution, embargo, consent, and usage-condition hints without treating hints as verified rights. Evidence: rights-hint fixtures and labeling assertions. - [ ] CAP.2.c Preserve declared and detected language, script, region, and direction independently. Evidence: locale round-trip fixtures. - [ ] CAP.2.d Record the authenticated actor and effective delegated actor at the capture boundary. Evidence: actor attribution assertions. - [ ] CAP.2.e Record tenant and authorized workspace/project context without accepting client-selected cross-tenant ownership. Evidence: tenant-spoofing negative tests. - [ ] CAP.2.f Record source-observed, client-supplied, server-received, and persisted timestamps with explicit semantics. Evidence: clock-controlled timestamp tests. - [ ] CAP.2.g Compute the import checksum from received bytes and retain the algorithm and value through later revisions. Evidence: known-byte hash and mutation tests. - [ ] CAP.3 Structured editors use domain-typed blocks rather than an unvalidated generic JSON textarea. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.3.a Inventory the domain object and block types authors must create, inspect, reorder, nest, reference, or remove. Evidence: per-domain editor type register. - [ ] CAP.3.b Define a versioned schema and stable identifier for every editable block type. Evidence: machine-readable block contracts. - [ ] CAP.3.c Provide type-specific authoring controls, labels, help, constraints, and nonvisual semantics. Evidence: component fixtures and accessibility assertions per type. - [ ] CAP.3.d Validate field and cross-block invariants during editing and again at the service boundary. Evidence: shared invalid-fixture tests. - [ ] CAP.3.e Preserve unknown forward-compatible fields without exposing unsafe arbitrary mutation. Evidence: version-skew round-trip tests. - [ ] CAP.3.f Define block-version migration, unsupported-version read-only behavior, and lossless export. Evidence: migration and compatibility fixtures. - [ ] CAP.3.g Remove or confine raw JSON editing to an explicitly authorized developer tool with schema validation and audit. Evidence: route and authorization audit. - [ ] CAP.4 Autosave is durable, observable, recoverable, and explicit about offline or failed writes. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.4.a Define save triggers, debounce, maximum unsaved duration, coalescing, and flush-on-navigation behavior. Evidence: clock-controlled save scheduling tests. - [ ] CAP.4.b Acknowledge saved state only after the authoritative durable write and required outbox/event transaction commit. Evidence: forced commit-failure tests. - [ ] CAP.4.c Display dirty, saving, saved-at, queued-offline, retrying, failed, conflict, and recovered states. Evidence: state-transition component and browser tests. - [ ] CAP.4.d Persist offline edits locally with tenant/user binding, encryption where required, size limits, and expiry. Evidence: offline-store security and quota tests. - [ ] CAP.4.e Reconcile queued offline edits against the current server revision without last-write-wins data loss. Evidence: reconnect conflict tests. - [ ] CAP.4.f Preserve failed payloads and expose retry, copy/export, discard, and support-reference actions. Evidence: failure-recovery journey. - [ ] CAP.4.g Recover unsaved work after refresh, crash, tab suspension, and expired authentication. Evidence: browser lifecycle recovery matrix. - [ ] CAP.4.h Emit bounded save latency, failure, retry, conflict, and recovery telemetry without content. Evidence: telemetry contract tests. - [ ] CAP.5 Undo and redo cover local edits, structured operations, and conflict resolution without rewriting server history. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.5.a Define transaction boundaries for text entry, composition, paste, formatting, and multi-field local edits. Evidence: local undo-grouping tests. - [ ] CAP.5.b Implement inverse operations for add, remove, move, reorder, nest, link, split, merge, resize, and domain-specific structured edits. Evidence: operation-by-operation round-trip tests. - [ ] CAP.5.c Preserve selection, focus, viewport, and inspector context across undo and redo. Evidence: keyboard journey assertions. - [ ] CAP.5.d Define undo behavior after autosave, remote edits, validation, and server normalization. Evidence: save/remote boundary tests. - [ ] CAP.5.e Represent conflict-resolution choices as new reversible local operations rather than mutations of historical revisions. Evidence: conflict-resolution history tests. - [ ] CAP.5.f Clear or branch invalid undo history on restore, permission loss, schema migration, and destructive lifecycle transitions. Evidence: boundary-condition tests. - [ ] CAP.5.g Ensure redo never duplicates server commands or side effects such as publish, dispatch, render, or notification. Evidence: idempotency and side-effect tests. - [ ] CAP.6 Version history supports immutable revisions, semantic diff, authorship, restore-as-new-version, and durable audit linkage. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.6.a Persist immutable revision identity, parent/base revision, schema version, actor, timestamp, reason, and content hash. Evidence: revision persistence assertions. - [ ] CAP.6.b Prevent update or deletion of retained revision content outside an explicit governed retention process. Evidence: authorization and database immutability tests. - [ ] CAP.6.c Produce domain-semantic diffs for fields, blocks, relations, ranges, media/time data, graphs, or artifacts as applicable. Evidence: known-change diff fixtures. - [ ] CAP.6.d Attribute each change to the authenticated or delegated actor without inferring authorship from current ownership. Evidence: multi-actor attribution tests. - [ ] CAP.6.e Restore a historical revision by creating a new head revision that references the restored source. Evidence: restore lineage tests. - [ ] CAP.6.f Link revision creation, restore, migration, merge, and lifecycle events to immutable audit records. Evidence: revision-to-audit integrity tests. - [ ] CAP.6.g Paginate and authorize revision history without leaking deleted, protected, or cross-tenant content. Evidence: history query negative tests. - [ ] CAP.7 Concurrent editing has presence, selection awareness, merge rules, and an explicit conflict surface. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.7.a Define session identity, heartbeat, expiry, reconnect, duplicate tab, and privacy behavior for collaborator presence. Evidence: clock-controlled presence tests. - [ ] CAP.7.b Expose active collaborator identity and location only to authorized participants. Evidence: role and cross-tenant negative tests. - [ ] CAP.7.c Represent remote cursors, selections, object focus, and edit intent without color-only distinction. Evidence: concurrent-selection accessibility tests. - [ ] CAP.7.d Define merge semantics for text, typed blocks, ordered collections, references, metadata, and domain-specific structures. Evidence: deterministic concurrent-operation fixtures. - [ ] CAP.7.e Detect incompatible base revisions, delete/edit races, schema skew, and permission changes. Evidence: conflict-detection tests. - [ ] CAP.7.f Provide compare, choose, combine, duplicate-as-variant, retry, and preserve-for-support actions on the conflict surface. Evidence: conflict-resolution journey. - [ ] CAP.7.g Preserve unsent local work across reconnect and prevent remote updates from being overwritten silently. Evidence: network-partition browser tests. - [ ] CAP.8 Divergence supports best-of-N generation, manual variants, stable comparison, score provenance, and recorded selection rationale. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.8.a Define which domain objects may branch, the permitted variant count, and whether variants share or copy dependencies. Evidence: per-domain divergence contract. - [ ] CAP.8.b Create best-of-N candidates with stable candidate and originating run identifiers. Evidence: deterministic run-to-variant linkage tests. - [ ] CAP.8.c Create, duplicate, rename, archive, and delete manual variants without mutating sibling history. Evidence: manual variant lifecycle tests. - [ ] CAP.8.d Freeze comparison inputs and render semantically aligned differences across supported variant types. Evidence: stable comparison fixtures. - [ ] CAP.8.e Attach raw score, units, evaluator/corpus/model version, threshold policy, confidence, and timestamp to each scored candidate. Evidence: score provenance assertions. - [ ] CAP.8.f Allow selection only among authorized, nonstale, gate-eligible candidates or surface the exact blocking reason. Evidence: selection guard tests. - [ ] CAP.8.g Record selected candidate, considered alternatives, actor, rationale, evidence, and supersession. Evidence: decision-record integration tests. - [ ] CAP.9 Decision records capture considered options, evidence, actor, rationale, consequences, and reversal or supersession. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.9.a Assign stable identity, decision type, scope, owner, status, and effective version. Evidence: decision contract tests. - [ ] CAP.9.b Record every considered option, including retain-current-state, rejection rationale, and links to dependent decisions. Evidence: multi-option fixtures. - [ ] CAP.9.c Link immutable source, evaluation, review, experiment, and risk evidence with captured versions. Evidence: evidence-reference integrity tests. - [ ] CAP.9.d Record proposer, decider, reviewers, delegated authority, and decision timestamp. Evidence: actor/authority assertions. - [ ] CAP.9.e Record rationale, trade-offs, known consequences, affected audiences, and accepted residual risks. Evidence: required-field validation tests. - [ ] CAP.9.f Define proposed, under-review, approved, rejected, effective, superseded, and reversed transitions with authorization. Evidence: state-machine tests. - [ ] CAP.9.g Reverse or supersede through a new linked decision without rewriting the original record. Evidence: immutable lineage tests. - [ ] CAP.10 Maturity or stage transitions use server-enforced guards with exact, actionable refusal reasons. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.10.a Define the versioned state machine, permitted transitions, and terminal states per domain object type. Evidence: machine-readable transition definitions. - [ ] CAP.10.b Define required fields, dependencies, gate results, approvals, rights, consent, and provenance for each transition. Evidence: transition precondition table. - [ ] CAP.10.c Enforce object, transition, property, tenant, and delegated-role authorization at the service boundary. Evidence: transition authorization tests. - [ ] CAP.10.d Evaluate guards against the authoritative current revision in a concurrency-safe transaction. Evidence: stale-client and race tests. - [ ] CAP.10.e Return stable refusal codes plus the exact failed conditions, affected references, and permitted remediation. Evidence: negative contract fixtures. - [ ] CAP.10.f Prevent clients from bypassing guards through direct field writes, bulk operations, imports, jobs, or compatibility APIs. Evidence: alternate-path negative tests. - [ ] CAP.10.g Audit requested, refused, completed, reversed, and overridden transitions with correlated evidence. Evidence: audit assertions. - [ ] CAP.11 Review comments anchor to stable entities, fields, blocks, ranges, bars, frames, nodes, or timecodes as the domain requires. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.11.a Define stable anchor identity and revision semantics for whole entities and fields. Evidence: entity/field anchor contracts. - [ ] CAP.11.b Define stable block and text-range anchors that survive edits, splits, merges, and reordering where resolvable. Evidence: edit-rebasing fixtures. - [ ] CAP.11.c Define measure, beat, bar, sample, frame, and timecode anchors with units and frame-rate/time-base identity. Evidence: temporal anchor fixtures. - [ ] CAP.11.d Define graph node, edge, port, canvas object, scene object, and hierarchy anchors. Evidence: structural anchor fixtures. - [ ] CAP.11.e Detect deleted, replaced, migrated, permission-hidden, and ambiguously rebased anchors. Evidence: orphan-anchor taxonomy tests. - [ ] CAP.11.f Preserve the original excerpt, thumbnail, waveform, or structural context without leaking protected content. Evidence: context-snapshot security tests. - [ ] CAP.11.g Provide accessible navigation from comment to current anchor and from anchored content back to its comment thread. Evidence: keyboard/screen-reader review journey. - [ ] CAP.12 Review supports assignments, due dates, quorum, required roles, abstention, conflict of interest, escalation, and delegated authority. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.12.a Assign individual reviewers and role/group queues with acceptance, reassignment, and workload visibility. Evidence: assignment lifecycle tests. - [ ] CAP.12.b Define due dates with time zone, reminders, overdue state, extension, and service-level policy. Evidence: clock-controlled due-date tests. - [ ] CAP.12.c Define quorum calculation for eligible, completed, recused, abstaining, replaced, and delegated reviewers. Evidence: known-value quorum tests. - [ ] CAP.12.d Require named specialist roles for domain, safety, rights, legal, accessibility, security, or release reviews where applicable. Evidence: missing-role gate tests. - [ ] CAP.12.e Record abstention reason without counting abstention as approval, rejection, or silent absence. Evidence: verdict aggregation tests. - [ ] CAP.12.f Declare, review, enforce, and audit conflicts of interest and recusals. Evidence: conflicted-reviewer negative tests. - [ ] CAP.12.g Escalate overdue, blocked, disputed, unavailable-reviewer, and policy-triggered reviews to the configured authority. Evidence: escalation routing tests. - [ ] CAP.12.h Delegate authority with explicit scope, start, expiry, delegator, delegate, nondelegable actions, and revocation. Evidence: delegation authorization tests. - [ ] CAP.13 Search covers full text, structured fields, status, taxonomy, rights, quality, ownership, dates, and stable IDs. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.13.a Define indexed full-text fields, language analysis, stemming, phrase, typo, and protected-content behavior. Evidence: multilingual known-result tests. - [ ] CAP.13.b Index supported structured fields with typed equality, range, existence, and relationship filters. Evidence: field-query fixtures. - [ ] CAP.13.c Index lifecycle, review, gate, publish, job, stale, and failure statuses with current-state semantics. Evidence: status-filter tests. - [ ] CAP.13.d Index hierarchical taxonomy and aliases without collapsing distinct concepts. Evidence: taxonomy search fixtures. - [ ] CAP.13.e Index rights, consent, embargo, provenance, and usage eligibility without leaking protected detail. Evidence: rights-filter authorization tests. - [ ] CAP.13.f Index raw quality values, verdicts, evaluator versions, and freshness separately. Evidence: quality-query fixtures. - [ ] CAP.13.g Index owner, contributor, assignee, reviewer, team, and delegated actor with tenant-aware identity resolution. Evidence: ownership-query tests. - [ ] CAP.13.h Index created, updated, captured, effective, due, embargo, publish, and event dates with explicit time-zone semantics. Evidence: clock-boundary tests. - [ ] CAP.13.i Resolve exact stable IDs and supported external identifiers without fuzzy ambiguity. Evidence: exact-identifier tests. - [ ] CAP.13.j Apply object/property authorization, tombstone, retention, and tenant filters before counts, facets, snippets, and results. Evidence: search disclosure negative tests. - [ ] CAP.14 Saved views preserve query, columns, sort, grouping, density, and sharing scope. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.14.a Persist the normalized full-text and structured query, including relative-date and current-user semantics. Evidence: query round-trip tests. - [ ] CAP.14.b Persist visible, hidden, ordered, pinned, sized, and type-specific column configuration. Evidence: column-layout round-trip tests. - [ ] CAP.14.c Persist multi-key sort with direction, null ordering, locale, and deterministic tie-breaker. Evidence: stable-sort tests. - [ ] CAP.14.d Persist grouping, expansion, aggregation, and group ordering without storing unauthorized result data. Evidence: grouping tests. - [ ] CAP.14.e Persist density and supported display mode independently from the result query. Evidence: presentation-preference tests. - [ ] CAP.14.f Define private, named-user, team, role, tenant, and public sharing scopes with owner-controlled permissions. Evidence: share-authorization tests. - [ ] CAP.14.g Handle renamed/removed fields, taxonomy changes, authorization loss, and schema version skew. Evidence: saved-view migration tests. - [ ] CAP.14.h Expose clone, rename, make-default, transfer, revoke, and delete operations with audit. Evidence: saved-view lifecycle tests. - [ ] CAP.15 Bulk actions expose eligibility counts, skipped reasons, impact preview, progress, per-item results, cancellation, and safe retry. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.15.a Freeze the candidate set by stable IDs or a versioned query and display total selected versus currently matched. Evidence: concurrent-query selection tests. - [ ] CAP.15.b Evaluate object/property authorization, state, dependency, policy, and capacity eligibility per item before confirmation. Evidence: known-eligibility tests. - [ ] CAP.15.c Display eligible, ineligible, unknown, and already-satisfied counts with item-specific skipped reasons. Evidence: preview assertions. - [ ] CAP.15.d Preview resulting state, dependent impact, notifications, external side effects, cost, irreversibility, and rollback availability. Evidence: action-specific impact fixtures. - [ ] CAP.15.e Require confirmation proportional to impact and bind the approved action parameters to execution. Evidence: confirmation-tamper negative tests. - [ ] CAP.15.f Execute large batches as durable bounded-concurrency jobs with live completed/failed/skipped/pending progress. Evidence: batch job integration tests. - [ ] CAP.15.g Persist one result, reason, side-effect reference, and audit event per item. Evidence: per-item result completeness tests. - [ ] CAP.15.h Cancel unstarted work, report in-flight semantics, and preserve completed results without claiming atomic rollback. Evidence: cancellation tests. - [ ] CAP.15.i Retry only eligible failed items using stable idempotency keys and the original approved parameters. Evidence: partial-retry duplication tests. ### 3.2 Trust, AI, and provenance capability - [ ] CAP.16 Every AI affordance is assistive by default and requires explicit human acceptance before it changes authored truth. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.16.a Inventory every generation, completion, rewrite, extraction, classification, scoring, recommendation, translation, and automation affordance. Evidence: per-domain AI affordance register. - [ ] CAP.16.b Define the authored source, proposed output, diff, confidence or uncertainty, provenance, and limitations visible before acceptance. Evidence: affordance-specific review contract. - [ ] CAP.16.c Store AI results as proposals, variants, or suggestions that do not mutate the authoritative revision on arrival. Evidence: persistence-state tests. - [ ] CAP.16.d Require an authorized human to accept each proposed change or an explicitly bounded group after reviewing its exact diff. Evidence: acceptance authorization and UI tests. - [ ] CAP.16.e Record accepted, partially accepted, edited-before-acceptance, rejected, expired, and superseded outcomes without treating absence as acceptance. Evidence: proposal lifecycle tests. - [ ] CAP.16.f Prevent automated publish, gate override, rights/consent attestation, source verification, grade, or other high-impact truth mutation. Evidence: prohibited-action negative tests. - [ ] CAP.16.g Link accepted content to the exact proposal and human actor while preserving later human edits independently. Evidence: authored lineage assertions. - [ ] CAP.17 AI output is labeled with provider/model/template versions and carries the originating run ID through publication. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.17.a Persist provider, model/deployment identifier, immutable model version or digest, and runtime region with every run. Evidence: run provenance assertions. - [ ] CAP.17.b Persist system/policy prompt, template, tool, retrieval, and evaluator versions or immutable hashes. Evidence: template/tool provenance assertions. - [ ] CAP.17.c Persist request parameters, safety policy, seed when supported, dependency versions, start/end time, actor, tenant, and cost. Evidence: complete run-record tests. - [ ] CAP.17.d Assign one stable originating run ID to each output and derivative proposal. Evidence: run-to-output cardinality tests. - [ ] CAP.17.e Display AI origin and accessible provenance detail in editor, compare, review, history, search, and published-preview surfaces. Evidence: surface-by-surface labeling tests. - [ ] CAP.17.f Preserve the run reference through copy, merge, restore, translation, export, publication, correction, and retirement without misattributing later edits. Evidence: lineage-transition tests. - [ ] CAP.17.g Reject or visibly flag an output whose referenced run record is missing, inaccessible, or integrity-invalid. Evidence: broken-lineage negative tests. - [ ] CAP.18 Prompt injection defenses fence user and retrieved content and test indirect injection through titles, metadata, attachments, and URLs. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.18.a Separate trusted system/policy instructions, developer templates, user requests, retrieved sources, tool results, and prior generated content in the execution contract. Evidence: role-tagged request fixtures. - [ ] CAP.18.b Mark retrieved and user-controlled content as untrusted data and prohibit it from granting tools, changing policy, or redefining output authority. Evidence: instruction-precedence tests. - [ ] CAP.18.c Minimize enabled tools and constrain each tool by typed arguments, allowlisted resources, authorization, tenant, and side-effect policy. Evidence: tool-capability matrix and negative tests. - [ ] CAP.18.d Normalize and inspect filenames, titles, descriptions, EXIF, document metadata, hidden text, captions, comments, and archive entries. Evidence: metadata injection corpus. - [ ] CAP.18.e Fetch URLs through the governed remote-fetch boundary and treat redirects, page text, headers, fragments, and linked attachments as untrusted. Evidence: URL injection and SSRF tests. - [ ] CAP.18.f Parse attachments in isolation with size/depth/type limits and retain source boundaries in the model input. Evidence: malicious attachment fixtures. - [ ] CAP.18.g Detect or constrain exfiltration requests for secrets, protected sources, learner/biometric data, unreleased assets, and cross-tenant context. Evidence: data-exfiltration negative tests. - [ ] CAP.18.h Test direct, indirect, encoded, multilingual, split-content, multimodal, tool-result, and multi-turn injections. Evidence: versioned adversarial evaluation report. - [ ] CAP.18.i Fail closed or require bounded human review when instruction trust cannot be determined. Evidence: ambiguous-trust behavior tests. - [ ] CAP.19 Safety classifiers expose model version, thresholds, confidence, uncertainty, and appeal or override policy. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.19.a Define the exact safety classes, applicability, input units, possible raw outputs, and non-pass states. Evidence: classifier contract. - [ ] CAP.19.b Persist provider, model, immutable version/digest, corpus, preprocessing, and runtime version with each result. Evidence: classifier provenance tests. - [ ] CAP.19.c Separate raw class scores from versioned policy thresholds and composed verdicts. Evidence: recomputation tests under changed policy. - [ ] CAP.19.d Expose value, unit, threshold, confidence/calibration, and uncertainty or insufficient-data status. Evidence: API and accessible UI assertions. - [ ] CAP.19.e Define allow, warn, block, quarantine, human-review, unavailable, unsupported, and evaluator-failure behavior. Evidence: state taxonomy tests. - [ ] CAP.19.f Define who may appeal, the submission evidence, reviewer independence, deadline, status, and notification behavior. Evidence: appeal lifecycle tests. - [ ] CAP.19.g Define override authority, scope, reason, expiry, downstream impact, and non-overridable classes. Evidence: override policy tests. - [ ] CAP.19.h Calibrate thresholds and subgroup behavior on representative, licensed, versioned corpora before release. Evidence: calibration and fairness report. - [ ] CAP.20 High-impact gate overrides require a reason, scoped authority, expiry where appropriate, and immutable audit. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.20.a Enumerate overrideable gates, nonoverrideable gates, allowable verdicts, and maximum risk scope. Evidence: approved override registry. - [ ] CAP.20.b Require a structured reason, supporting evidence, affected object/revision, intended consequence, and acknowledged residual risk. Evidence: request-validation tests. - [ ] CAP.20.c Enforce actor role, tenant, object, gate, target environment, lifecycle stage, and delegated-authority scope. Evidence: authorization matrix and negative tests. - [ ] CAP.20.d Require step-up authentication, separation of duties, quorum, or named specialist approval according to impact. Evidence: high-impact approval tests. - [ ] CAP.20.e Set effective time, expiry or one-use semantics, revocation, renewal, and automatic stale behavior. Evidence: clock-controlled tests. - [ ] CAP.20.f Bind an override to the exact gate result, inputs, evaluator, policy, object revision, and release target. Evidence: changed-input invalidation tests. - [ ] CAP.20.g Record request, evidence, approvals, refusals, activation, use, expiry, revocation, and downstream actions immutably. Evidence: append-only audit assertions. - [ ] CAP.20.h Surface active overrides and their scope in review, compare, publish, release, history, and incident views. Evidence: visibility journey tests. - [ ] CAP.21 Source, rights, canon, consent, or provenance dependencies form a traversable impact graph. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.21.a Define stable node types for source objects, rights records, canon facts, consent grants, provenance claims, authored revisions, generated artifacts, gates, and releases. Evidence: graph schema. - [ ] CAP.21.b Define typed, directional, versioned edges such as derives-from, cites, depends-on, licenses, consents-to, contradicts, supersedes, and published-as. Evidence: edge vocabulary. - [ ] CAP.21.c Create graph edges transactionally when ingest, generation, edit, merge, gate, export, publish, or correction creates a dependency. Evidence: mutation-to-edge integration tests. - [ ] CAP.21.d Preserve exact dependency version or revision instead of resolving only to a mutable latest object. Evidence: historical graph tests. - [ ] CAP.21.e Traverse upstream ingredients and downstream dependents with bounded depth, cycle handling, pagination, and stable ordering. Evidence: graph traversal tests. - [ ] CAP.21.f Apply tenant, object, property, protected-source, and rights/consent authorization to nodes, edges, counts, and paths. Evidence: graph disclosure negative tests. - [ ] CAP.21.g Expose impact paths, affected gates/releases, and uncertainty without overstating missing or inaccessible edges. Evidence: impact-view tests. - [ ] CAP.21.h Reconcile orphaned, dangling, duplicated, and cycle-invalid dependencies. Evidence: graph integrity checker. - [ ] CAP.22 Dependency changes automatically mark affected gates stale and enqueue or require recomputation. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.22.a Define which create, update, delete, revoke, expire, supersede, correction, and policy/version changes invalidate each gate type. Evidence: dependency-to-gate invalidation table. - [ ] CAP.22.b Emit a durable versioned dependency-change event in the same transaction as the authoritative mutation. Evidence: outbox atomicity tests. - [ ] CAP.22.c Traverse direct and transitive affected objects with cycle, depth, fan-out, and authorization-safe handling. Evidence: known-impact graph tests. - [ ] CAP.22.d Atomically mark affected gate results stale with invalidating event, old/new dependency versions, timestamp, and reason. Evidence: stale-record assertions. - [ ] CAP.22.e Enqueue idempotent recomputation where policy permits automatic work and record priority and cost/capacity decisions. Evidence: queue deduplication tests. - [ ] CAP.22.f Require explicit recomputation where consent, cost, policy, provider availability, or human judgment prevents automatic work. Evidence: manual-recompute state tests. - [ ] CAP.22.g Surface pending, running, failed, blocked, cancelled, and completed recomputation without restoring freshness prematurely. Evidence: recomputation lifecycle tests. - [ ] CAP.22.h Recover missed or failed invalidation through periodic reconciliation against dependency versions. Evidence: fault-injection and repair report. - [ ] CAP.23 Publish uses current gate evidence; previously passing stale evidence never silently authorizes release. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.23.a Define the complete required-gate set for object type, revision, audience, channel, territory, environment, and release action. Evidence: publish gate policy. - [ ] CAP.23.b Resolve gate results by exact input object/revision, dependency versions, evaluator, corpus/model, policy/threshold, and target. Evidence: exact-match selection tests. - [ ] CAP.23.c Reject missing, stale, expired, overridden-out-of-scope, unavailable, failed, or unsupported evidence with stable reasons. Evidence: publish refusal fixtures. - [ ] CAP.23.d Recheck dependencies and gate freshness in the authoritative publish transaction or reservation boundary. Evidence: publish/invalidate race tests. - [ ] CAP.23.e Freeze the accepted gate-evidence set and hashes into the release candidate. Evidence: release manifest assertions. - [ ] CAP.23.f Invalidate or abort a reserved candidate when a required input changes before final publication. Evidence: mid-release change tests. - [ ] CAP.23.g Audit the exact evidence consulted, refusals, overrides, actor, target, and final outcome. Evidence: publish audit integrity tests. - [ ] CAP.24 Artifact hashes are computed from stored bytes and verified again at import, promotion, publish, and retrieval boundaries. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.24.a Define approved hash algorithms, canonical identifier format, chunk/multipart behavior, and algorithm migration policy. Evidence: artifact-integrity profile. - [ ] CAP.24.b Compute the authoritative digest while ingesting or after reading the exact durably stored bytes, not client metadata. Evidence: client-hash spoofing tests. - [ ] CAP.24.c Store byte length, media type, storage version, hash algorithm, digest, and immutable blob reference transactionally. Evidence: metadata/blob consistency tests. - [ ] CAP.24.d Recompute and compare hashes at every external import and quarantine mismatches before parsing or use. Evidence: import corruption tests. - [ ] CAP.24.e Recompute and compare hashes when promoting between quarantine, draft, approved, release, or storage tiers. Evidence: promotion corruption tests. - [ ] CAP.24.f Recompute and compare hashes immediately before publish/export package signing or transfer. Evidence: prepublication tamper tests. - [ ] CAP.24.g Verify stored bytes during retrieval according to an explicit read-time, sampled-scrub, or full-scrub policy and fail closed on mismatch. Evidence: retrieval/scrub fault tests. - [ ] CAP.24.h Record corruption findings, affected derivatives/releases, quarantine, recovery source, repair, and revalidation. Evidence: integrity incident workflow test. - [ ] CAP.25 Signed provenance records preserve ingredients, transformations, tools/models, actors, policies, and validation status. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.25.a Assign a signed provenance record to the exact artifact bytes and immutable artifact identifier. Evidence: artifact-manifest binding tests. - [ ] CAP.25.b Enumerate each ingredient with identifier, hash, relationship, origin, rights/consent hints, and accessible or redacted status. Evidence: multi-ingredient fixtures. - [ ] CAP.25.c Record ordered capture, edit, transform, generation, merge, validation, approval, export, and publish actions with parameters. Evidence: action-history fixtures. - [ ] CAP.25.d Record application, library, plugin, tool, provider, model, template, policy, and environment versions used by each action. Evidence: tool/model provenance assertions. - [ ] CAP.25.e Record authenticated actor, delegated role, organization, and automation identity without exposing protected identities. Evidence: actor provenance and redaction tests. - [ ] CAP.25.f Record safety, rights, consent, quality, and release policy versions plus result references without presenting verdicts as facts beyond their scope. Evidence: policy linkage tests. - [ ] CAP.25.g Sign with governed keys, timestamp where required, preserve the certificate chain, and support rotation/revocation. Evidence: cryptographic lifecycle tests. - [ ] CAP.25.h Validate binding, signature, trust, revocation, ingredient availability, assertion support, and policy status independently. Evidence: provenance validation matrix. - [ ] CAP.26 Soft-binding and external-ledger recovery are tested when embedded provenance is stripped by a delivery channel. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.26.a Identify delivery channels and transformations that preserve, modify, or strip each embedded provenance mechanism. Evidence: channel-transformation matrix. - [ ] CAP.26.b Define privacy-reviewed soft bindings appropriate to media type, such as robust fingerprint, watermark, perceptual hash, or lookup hint. Evidence: binding design record. - [ ] CAP.26.c Register external-ledger records by immutable artifact/provenance identity with authorized lookup and retention. Evidence: ledger persistence and access tests. - [ ] CAP.26.d Recover the correct record from an unmodified derivative after embedded metadata removal. Evidence: positive recovery fixtures. - [ ] CAP.26.e Test resize, crop, transcode, recompress, remix, screenshot, re-record, channel normalization, and metadata rewriting as applicable. Evidence: transformation robustness matrix. - [ ] CAP.26.f Measure false positive, false negative, ambiguity, collision, and insufficient-evidence outcomes without claiming certainty. Evidence: known-corpus evaluation. - [ ] CAP.26.g Handle missing, multiple, revoked, private, deleted, and integrity-invalid ledger matches safely. Evidence: recovery negative tests. - [ ] CAP.26.h Display recovered, partially recovered, unresolved, and untrusted status with the method and limitations. Evidence: accessible recovery UX tests. - [ ] CAP.27 Secrets, protected source identities, biometric data, learner records, and unreleased assets never enter prompts or telemetry by default. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.27.a Classify credential material, tokens, keys, connection strings, and secret-bearing configuration at input and logging boundaries. Evidence: secret classification tests. - [ ] CAP.27.b Classify protected source names, contact details, documents, relationship graphs, and identifying metadata. Evidence: protected-source fixtures. - [ ] CAP.27.c Classify raw and derived face, voice, body, motion, health, and other biometric identifiers. Evidence: biometric classification fixtures. - [ ] CAP.27.d Classify learner identity, enrollment, activity, assessment, accommodation, integrity, and credential records. Evidence: learner-record fixtures. - [ ] CAP.27.e Classify unreleased media, scripts, builds, research, models, product plans, and embargoed artifacts. Evidence: unreleased-asset fixtures. - [ ] CAP.27.f Exclude classified values from prompt text, retrieval context, tool arguments, model metadata, traces, metrics, logs, profiles, and support exports by default. Evidence: boundary-by-boundary leakage tests. - [ ] CAP.27.g Permit exceptional processing only through an approved provider, purpose, minimization, region, retention, consent/legal basis, and explicit actor action. Evidence: exception-policy enforcement tests. - [ ] CAP.27.h Redact before emission, detect post-emission leakage, block or quarantine unsafe runs, and trigger incident handling. Evidence: canary-secret and sensitive-data tests. - [ ] CAP.27.i Verify provider no-training/no-retention controls and telemetry exporter filtering rather than relying on UI claims. Evidence: configuration and integration audit. ### 3.3 Production engineering capability - [ ] CAP.28 Contracts are versioned, validated at every trust boundary, and backward compatibility is tested. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.28.a Inventory public, interservice, event, job, persistence, provider, desktop/bridge, import/export, and UI contracts. Evidence: per-domain contract register. - [ ] CAP.28.b Assign canonical ownership, namespace, identifier, semantic version, and source-of-truth representation to each contract. Evidence: ownership/version declarations. - [ ] CAP.28.c Define required, optional, nullable, default, invariant, enum, unknown-field, and extension semantics. Evidence: machine-readable schemas and contract notes. - [ ] CAP.28.d Validate untrusted input before domain use and validate output before crossing each external or asynchronous boundary. Evidence: boundary validation tests. - [ ] CAP.28.e Define version negotiation, unsupported-version failure, deprecation, compatibility window, and consumer migration behavior. Evidence: compatibility policy. - [ ] CAP.28.f Retain canonical valid, invalid, boundary, stale, unauthorized, and old/new-version fixtures. Evidence: versioned fixture corpus. - [ ] CAP.28.g Test current provider against supported consumers and current consumer against supported provider versions. Evidence: bidirectional contract test matrix. - [ ] CAP.28.h Detect schema/source/generated-client drift in CI. Evidence: passing drift gate and deliberate-mutation test. - [ ] CAP.29 Persistence uses explicit queryable columns for operationally important fields instead of opaque payload blobs. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.29.a Inventory fields used for authorization, tenancy, lifecycle, uniqueness, ordering, filtering, sorting, joining, retention, audit, freshness, and operations. Evidence: operational-field register. - [ ] CAP.29.b Map each operational field to a typed column with unit, format, nullability, default, constraint, and owning schema version. Evidence: logical-to-physical mapping. - [ ] CAP.29.c Normalize relationships that require referential integrity or independent lifecycle rather than embedding them in payload blobs. Evidence: relationship design review. - [ ] CAP.29.d Retain flexible payloads only for genuinely nonoperational, versioned extension data with size and schema limits. Evidence: approved payload-field inventory. - [ ] CAP.29.e Add indexes and query plans for supported access patterns without indexing sensitive content indiscriminately. Evidence: production-shape query-plan report. - [ ] CAP.29.f Backfill explicit columns from existing payloads with malformed, missing, conflicting, and version-skew handling. Evidence: rehearsal and reconciliation report. - [ ] CAP.29.g Prevent writes that update a blob without keeping explicit authoritative columns consistent. Evidence: dual-write invariant tests. - [ ] CAP.30 Every mutable table carries tenant, actor, created/updated, revision, tombstone, and concurrency metadata as applicable. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.30.a Record authoritative tenant and owning scope with foreign-key or equivalent isolation constraints. Evidence: cross-tenant write/read negative tests. - [ ] CAP.30.b Record creating actor, last-mutating actor, delegated actor, and automation/service identity as applicable. Evidence: actor attribution tests. - [ ] CAP.30.c Record server-created and server-updated timestamps with consistent precision and clock source. Evidence: timestamp invariant tests. - [ ] CAP.30.d Record monotonic revision or concurrency token and enforce it on conflicting mutations. Evidence: stale-write rejection tests. - [ ] CAP.30.e Define tombstone timestamp, actor, reason, retention, visibility, restoration, and purge linkage. Evidence: soft-delete lifecycle tests. - [ ] CAP.30.f Distinguish tables for immutable events/revisions, global reference data, ephemeral leases, and mutable tenant data with explicit N/A rationale. Evidence: table-by-table applicability review. - [ ] CAP.30.g Enforce metadata through shared persistence boundaries and block bypass by bulk/import/job paths. Evidence: alternate-write-path tests. - [ ] CAP.31 Migrations have forward, rollback-or-compensating, backfill, compatibility-window, and production-size rehearsal evidence. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.31.a Define the forward schema/data change, prerequisites, transactional boundaries, locks, and expected duration. Evidence: reviewed forward plan. - [ ] CAP.31.b Define exact rollback when safe or an explicit compensating migration when rollback would lose accepted writes. Evidence: rollback/compensation plan. - [ ] CAP.31.c Implement resumable, idempotent, observable, and rate-limited backfill with checkpoint and quarantine behavior. Evidence: interruption and resume tests. - [ ] CAP.31.d Define expand/migrate/contract compatibility windows for old and new application, worker, event, and schema versions. Evidence: version coexistence matrix. - [ ] CAP.31.e Validate preconditions and postconditions, row counts, hashes, invariants, nulls, duplicates, orphans, and sampled semantic results. Evidence: reconciliation queries. - [ ] CAP.31.f Rehearse forward, concurrent traffic, backfill, rollback or compensation, and redeploy on production-size representative data. Evidence: timed rehearsal report. - [ ] CAP.31.g Define monitoring, abort thresholds, operator commands, ownership, communication, and evidence capture for production execution. Evidence: migration runbook. - [ ] CAP.32 Retryable commands use idempotency keys and return the original result rather than creating duplicates. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.32.a Inventory retryable create, update, transition, job, publish, provider, webhook, import/export, and bulk commands. Evidence: idempotent-command register. - [ ] CAP.32.b Define idempotency-key scope by tenant, actor/client, operation, target, and compatibility version. Evidence: key-scope contract. - [ ] CAP.32.c Persist key, canonical request hash, state, authoritative result reference, error class, and expiry atomically with command acceptance. Evidence: persistence integration tests. - [ ] CAP.32.d Return the original success or still-running result for an identical request without repeating side effects. Evidence: concurrent duplicate-request tests. - [ ] CAP.32.e Reject reuse of a key with different parameters, target, identity, or contract version. Evidence: key-reuse negative tests. - [ ] CAP.32.f Define behavior for transient failure before acceptance, terminal failure after acceptance, timeout with unknown outcome, and expired records. Evidence: failure-state fixtures. - [ ] CAP.32.g Reconcile uncertain provider or downstream outcomes before retrying an irreversible side effect. Evidence: fault-injection tests. - [ ] CAP.33 Multi-system writes use an outbox, inbox, or documented saga with replay and poison-message handling. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.33.a Inventory mutations that span a database, blob store, queue, search index, provider, ledger, notification, or another domain. Evidence: multi-system mutation register. - [ ] CAP.33.b Choose transactional outbox, idempotent inbox, orchestrated saga, choreographed saga, or explicit reconciliation per mutation. Evidence: pattern decision rows. - [ ] CAP.33.c Persist authoritative mutation and outbound intent atomically where a local transaction exists. Evidence: forced-rollback tests. - [ ] CAP.33.d Deduplicate inbound messages by tenant, producer, event or command identity, and version. Evidence: duplicate-delivery tests. - [ ] CAP.33.e Define step order, preconditions, timeouts, retries, compensation, irreversible steps, and point of no return. Evidence: saga state-machine tests. - [ ] CAP.33.f Preserve ordering or explicitly tolerate reordering, duplication, late delivery, and concurrent consumers. Evidence: delivery-order fault tests. - [ ] CAP.33.g Quarantine poison messages with error class, payload-safe diagnostics, retry history, ownership, and authorized replay. Evidence: dead-letter journey. - [ ] CAP.33.h Reconcile missing, stuck, duplicated, and partially compensated work against authoritative state. Evidence: reconciliation repair tests. - [ ] CAP.34 Long-running work uses durable jobs with heartbeat, lease, cancellation, retry policy, checkpoint, and dead-letter semantics. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.34.a Define job type, versioned parameters, immutable input references, priority, queue, tenant, actor, cost estimate, and idempotency scope. Evidence: job contract. - [ ] CAP.34.b Persist queued, leased, running, waiting, cancelling, cancelled, retrying, failed, dead-lettered, and succeeded transitions. Evidence: job state-machine tests. - [ ] CAP.34.c Acquire exclusive time-bounded leases and renew heartbeats with worker identity and fencing token. Evidence: competing-worker and expired-lease tests. - [ ] CAP.34.d Define cooperative cancellation checkpoints, noncancellable regions, external cancellation, compensation, and terminal result. Evidence: stage-by-stage cancellation tests. - [ ] CAP.34.e Classify retryable, terminal, policy, authorization, invalid, provider, resource, timeout, and unknown errors. Evidence: error-to-retry table and tests. - [ ] CAP.34.f Persist progress and resumable checkpoints without reporting uncommitted work as complete. Evidence: crash/resume fault tests. - [ ] CAP.34.g Apply bounded exponential backoff, jitter, maximum attempts, age deadline, capacity, and spend limits. Evidence: deterministic retry-schedule tests. - [ ] CAP.34.h Dead-letter terminal/exhausted jobs with safe diagnostics, retained inputs, owner, remediation, and authorized replay or abandon. Evidence: dead-letter operations test. - [ ] CAP.34.i Reconcile orphan leases, silent workers, missing results, and side effects with unknown outcomes. Evidence: worker-loss repair test. - [ ] CAP.35 APIs paginate deterministically and define stable sort and cursor semantics under concurrent mutation. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.35.a Define default and maximum page sizes plus server behavior for zero, negative, excessive, or malformed values. Evidence: limit boundary tests. - [ ] CAP.35.b Define an explicit stable default sort and permitted client-selected sorts with deterministic unique tie-breakers. Evidence: equal-key fixtures. - [ ] CAP.35.c Encode sort, filter, direction, position, schema/version, and authorization-safe snapshot context in an opaque integrity-protected cursor. Evidence: cursor contract tests. - [ ] CAP.35.d Reject a cursor reused with incompatible filters, sort, identity, tenant, API version, or expired snapshot. Evidence: cursor misuse negative tests. - [ ] CAP.35.e Define insertion, update, deletion, tombstone, and permission change semantics between page requests. Evidence: concurrent-mutation pagination tests. - [ ] CAP.35.f Return next/previous or continuation metadata consistently without expensive or disclosure-prone total counts by default. Evidence: response contract tests. - [ ] CAP.35.g Verify no duplicate or skipped records within the declared consistency model. Evidence: randomized pagination property tests. - [ ] CAP.36 API rate, concurrency, payload-size, storage, compute, and spend limits are enforced per actor and tenant. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.36.a Define request-rate and burst budgets by actor, tenant, operation, client class, and trust tier. Evidence: rate policy. - [ ] CAP.36.b Define simultaneous request, job, stream, provider, render, bridge-session, and expensive-query limits. Evidence: concurrency policy. - [ ] CAP.36.c Define compressed and decompressed request, response, upload, archive-entry, field, and batch-size limits. Evidence: payload policy. - [ ] CAP.36.d Define object count, metadata, blob, revision, cache, log, and retained-output storage quotas. Evidence: storage policy. - [ ] CAP.36.e Define CPU, memory, GPU, wall-time, query complexity, token, frame/sample, and provider-use budgets. Evidence: compute policy. - [ ] CAP.36.f Define estimated, reserved, actual, daily/monthly, and exceptional spend limits with currency and attribution. Evidence: spend policy. - [ ] CAP.36.g Enforce limits at the earliest authoritative boundary and again before delayed or externally priced work. Evidence: bypass and reservation-race tests. - [ ] CAP.36.h Return stable quota category, current use where safe, reset or retry time, remediation, and correlation metadata. Evidence: limit-response fixtures. - [ ] CAP.36.i Prevent actors from evading tenant budgets and tenants from consuming another tenant's capacity. Evidence: identity/tenant abuse tests. - [ ] CAP.37 Remote fetches defend against SSRF, DNS rebinding, redirect escapes, oversized content, decompression bombs, and malicious media. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.37.a Parse and canonicalize scheme, user info, hostname, port, Unicode/IDNA, IP literals, and path before policy evaluation. Evidence: URL parser adversarial fixtures. - [ ] CAP.37.b Allowlist schemes and ports and block loopback, link-local, private, reserved, multicast, metadata, unix/file, and internal service destinations. Evidence: address-range negative tests. - [ ] CAP.37.c Resolve through a controlled resolver, validate every returned address, pin the connection target, and revalidate on reconnect. Evidence: DNS rebinding tests. - [ ] CAP.37.d Disable redirects by default or validate every redirect hop, target, scheme, port, credential, and maximum count. Evidence: redirect-escape tests. - [ ] CAP.37.e Apply connect, TLS, header, idle, body, total, retry, and bandwidth limits without trusting `Content-Length`. Evidence: slow/large response tests. - [ ] CAP.37.f Bound compressed size, decompressed size, ratio, archive entries, nesting depth, dimensions, frames, duration, and parser resources. Evidence: decompression and media-bomb corpus. - [ ] CAP.37.g Sniff actual content type, quarantine mismatches, and parse untrusted media in isolated constrained workers. Evidence: polyglot and malformed-media tests. - [ ] CAP.37.h Strip outbound credentials and sensitive headers, restrict egress, and prevent response data from becoming privileged instructions. Evidence: credential-leak and injection tests. - [ ] CAP.37.i Log safe policy decisions and correlation metadata without leaking signed URLs, credentials, protected locations, or content. Evidence: telemetry redaction assertions. - [ ] CAP.38 Uploads use quarantine, content sniffing, malware/moderation scans, checksum verification, retention, and orphan cleanup. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.38.a Create a tenant-bound upload intent with allowed types, maximum bytes, part count, expiry, actor, destination purpose, and idempotency key. Evidence: upload-intent contract tests. - [ ] CAP.38.b Write received bytes only to nonpublic quarantine and prevent downstream parsing, preview, indexing, or serving before promotion. Evidence: quarantine isolation tests. - [ ] CAP.38.c Enforce streaming byte/part limits and compute server-observed size and cryptographic checksum. Evidence: truncation/oversize/hash tests. - [ ] CAP.38.d Sniff actual type and structure, compare declared metadata, and reject polyglot, malformed, executable, or unsupported content. Evidence: adversarial type corpus. - [ ] CAP.38.e Run malware, content-safety/moderation, archive, and domain-specific validation with versioned results. Evidence: scanner result matrix. - [ ] CAP.38.f Promote only when every required scan is current and passing, binding the promoted blob to the scanned hash. Evidence: scan/promote race tests. - [ ] CAP.38.g Define quarantine, rejected, infected, appealed, expired, and retained-for-incident access and deletion policy. Evidence: retention lifecycle tests. - [ ] CAP.38.h Reconcile and remove abandoned multipart uploads, orphan quarantine blobs, stale intents, and failed promotions without deleting referenced evidence. Evidence: cleanup reconciliation tests. - [ ] CAP.39 Caches include tenant, authorization, schema, and dependency versions in their keys and expose invalidation reasons. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.39.a Inventory browser, application, HTTP/CDN, query, object, evaluation, render, provider, and search caches. Evidence: cache register. - [ ] CAP.39.b Include tenant and owning scope in keys or prove the cached data is globally public and immutable. Evidence: cross-tenant cache tests. - [ ] CAP.39.c Include actor/role/policy/permission version or cache only data whose representation is authorization-independent. Evidence: permission-change tests. - [ ] CAP.39.d Include contract/schema, object revision, dependency, evaluator, model/corpus, policy/threshold, locale, and target versions as applicable. Evidence: stale-version cache tests. - [ ] CAP.39.e Define TTL, stale-while-revalidate, negative caching, unavailable/failure caching, and stampede control. Evidence: cache-state timing tests. - [ ] CAP.39.f Emit durable invalidation from authoritative mutations and support bounded tag/key eviction. Evidence: mutation-to-invalidation tests. - [ ] CAP.39.g Surface hit/miss, stored/served age, reason, dependency versions, invalidation source, and refresh outcome without sensitive key data. Evidence: cache diagnostic assertions. - [ ] CAP.39.h Reconcile cache divergence and prove permission revocation, deletion, rights/consent change, and emergency purge take effect within policy. Evidence: emergency-invalidation tests. - [ ] CAP.40 Feature flags have owner, purpose, audience, default, expiry, rollback behavior, and removal task. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.40.a Assign a stable flag key, type, owning team/person, creation date, linked decision, and change authority. Evidence: flag registry. - [ ] CAP.40.b State the temporary purpose, hypothesis or migration, affected capability, success criteria, and non-goals. Evidence: reviewed purpose fields. - [ ] CAP.40.c Define eligible environments, tenants, roles, users, cohorts, devices, regions, and dependency conditions. Evidence: targeting contract and isolation tests. - [ ] CAP.40.d Define safe code/config default, missing-service behavior, evaluation-failure behavior, and new-tenant behavior. Evidence: default/failure tests. - [ ] CAP.40.e Set rollout start, review date, expiry, maximum lifetime, and alert before expiry. Evidence: clock-controlled expiry tests. - [ ] CAP.40.f Define rollback trigger, kill-switch authority, propagation budget, cached-evaluation invalidation, and state/data compatibility. Evidence: rollback rehearsal. - [ ] CAP.40.g Audit flag evaluations and changes with bounded cardinality and no sensitive targeting leakage. Evidence: telemetry/audit tests. - [ ] CAP.40.h Create and link the code, schema, data, test, documentation, and registry removal task at flag creation. Evidence: no flag lacks removal criteria. - [ ] CAP.40.i Block expired permanent-unknown flags and contradictory nested flag combinations in CI. Evidence: flag lifecycle lint tests. ### 3.4 Accessibility, localization, and resilient UX capability - [ ] CAP.41 Every route passes automated WCAG 2.2 AA checks in each supported theme, density, viewport, and locale class. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.41.a Derive the reachable route and critical-state matrix from the authoritative route inventory. Evidence: no route/state is omitted or implicitly sampled. - [ ] CAP.41.b Run the configured rules in every supported light, dark, high-contrast, or branded theme. Evidence: theme-indexed scan results. - [ ] CAP.41.c Run each route in comfortable, compact, touch, and other supported density modes. Evidence: density-indexed scan results. - [ ] CAP.41.d Run at minimum supported narrow, medium, wide, zoomed/reflow, and orientation-dependent viewports. Evidence: viewport-indexed results. - [ ] CAP.41.e Run representative Latin, long-string, bidirectional, CJK or other supported locale/script classes. Evidence: locale-indexed results. - [ ] CAP.41.f Scan loaded, empty, validation-error, unavailable, conflict, dialog/drawer, and destructive-confirmation states where present. Evidence: state-indexed results. - [ ] CAP.41.g Triage every violation to a fix, explicit duplicate, tool false positive, or approved temporary waiver with owner and expiry. Evidence: zero unexplained findings. - [ ] CAP.41.h Keep the matrix in browser automation and fail releases on new unwaived AA violations. Evidence: deliberate-regression gate test. - [ ] CAP.42 Keyboard-only users can complete every critical journey. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.42.a Enumerate critical create/edit, review, gate, bulk, recover, publish/release, search, and administrative journeys per workbench. Evidence: approved keyboard journey inventory. - [ ] CAP.42.b Reach every actionable control through logical focus order without pointer, touch, voice, or direct accessibility-tree invocation. Evidence: focus traversal tests. - [ ] CAP.42.c Operate menus, dialogs, tabs, trees, grids, lists, editors, sliders, splitters, canvases, graphs, and timelines with documented keys. Evidence: widget-pattern interaction tests. - [ ] CAP.42.d Provide keyboard equivalents for drag, lasso, pan, zoom, trim, resize, reorder, connect, scrub, and spatial placement. Evidence: nonpointer journey tests. - [ ] CAP.42.e Preserve visible focus, selection, scroll position, working context, and escape route throughout each journey. Evidence: step-level assertions. - [ ] CAP.42.f Avoid traps except intentional modal focus with reachable dismissal and correct focus return. Evidence: trap and restoration tests. - [ ] CAP.42.g Test supported browser/OS/editor/screen-reader shortcut collisions and international keyboard layouts. Evidence: collision matrix. - [ ] CAP.43 Screen-reader announcements cover validation, save, job progress, gate changes, comments, conflict, publish, and destructive results. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.43.a Announce field and form validation at the affected control with error summary, count, and focus/navigation behavior. Evidence: validation announcement tests. - [ ] CAP.43.b Announce dirty, saving, saved, queued, retrying, failed, conflict, and recovered save states without excessive repetition. Evidence: save-state speech log. - [ ] CAP.43.c Announce job queued/running stage, meaningful progress, cancellation, retry, completion, partial result, and failure. Evidence: job speech log. - [ ] CAP.43.d Announce gate pending, running, stale, pass, warn, fail, unavailable, overridden, and recomputation changes. Evidence: gate speech log. - [ ] CAP.43.e Announce new comment, reply, mention, assignment, resolve, reopen, and anchor navigation in review context. Evidence: comment speech log. - [ ] CAP.43.f Announce edit conflict, affected content, comparison entry, resolution result, and preserved local work. Evidence: conflict speech log. - [ ] CAP.43.g Announce publish/release preparation, refusal, approval, dispatch, completion, partial delivery, correction, rollback, and failure. Evidence: release speech log. - [ ] CAP.43.h Announce destructive impact, confirmation requirements, progress, per-item result, recovery, and irreversible completion. Evidence: destructive-action speech log. - [ ] CAP.43.i Validate announcement priority, deduplication, interruption, language, accessible names, and real screen-reader behavior. Evidence: assistive-technology test matrix. - [ ] CAP.44 Graphs, canvases, timelines, waveforms, 3D previews, and charts provide a semantically equivalent navigable data view. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.44.a Inventory every non-DOM visual surface and define the domain facts, relationships, states, and operations it communicates. Evidence: visual-to-semantic content map. - [ ] CAP.44.b Provide a structured table/tree/list/transcript view with the same entities, values, units, ordering, hierarchy, and status. Evidence: semantic-view component tests. - [ ] CAP.44.c Synchronize selection, focus, filters, time/range, zoomed context, and active object bidirectionally between visual and semantic views. Evidence: synchronization tests. - [ ] CAP.44.d Provide nonvisual create, edit, connect, reorder, position, trim, annotate, compare, and delete operations where the visual surface is editable. Evidence: equivalent-operation journeys. - [ ] CAP.44.e Describe color, shape, line, texture, spatial, animation, waveform, and depth encodings in text and expose exact raw values. Evidence: encoding legend and accessible descriptions. - [ ] CAP.44.f Preserve performance through pagination, virtualization, range selection, and on-demand detail without hiding total/position semantics. Evidence: large-dataset accessibility tests. - [ ] CAP.44.g Verify the semantic view supports the complete critical journey with keyboard and screen reader. Evidence: nonvisual end-to-end journey. - [ ] CAP.45 Audio and video have captions, transcripts, visual alerts, and non-audio alternatives where content permits. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.45.a Inventory prerecorded, live, generated, uploaded, embedded, preview, monitoring, tutorial, and communication media. Evidence: media-accessibility register. - [ ] CAP.45.b Provide synchronized captions for dialogue and meaningful sound, with language, speaker, timing, correction, and quality review. Evidence: caption conformance tests. - [ ] CAP.45.c Provide navigable transcripts with speakers, timestamps, chapters/segments, search, download policy, and media synchronization. Evidence: transcript interaction tests. - [ ] CAP.45.d Provide audio description or an equivalent descriptive media alternative for essential visual information. Evidence: content-by-content applicability and proof. - [ ] CAP.45.e Convert alarms, clipping, cues, countdowns, stage signals, connection loss, and other audio-only status to visible and haptic alternatives where supported. Evidence: alert modality tests. - [ ] CAP.45.f Provide text, notation, data, waveform metrics, event lists, or controllable replay for domain information conveyed primarily by sound. Evidence: non-audio workflow tests. - [ ] CAP.45.g Expose caption/transcript availability, processing, failure, partial, language, and stale states without false completeness. Evidence: media-state UI tests. - [ ] CAP.46 Focus is restored predictably after dialogs, drawers, route transitions, virtualization, and deleted items. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.46.a Capture the invoking control and restore focus to it after modal dialog completion or cancellation when it remains available. Evidence: dialog focus tests. - [ ] CAP.46.b Restore focus after nonmodal drawer/inspector dismissal without moving the user's workspace selection. Evidence: drawer focus tests. - [ ] CAP.46.c Place focus at the route's meaningful heading, restored selection, validation target, or requested deep-link anchor after navigation. Evidence: route transition tests. - [ ] CAP.46.d Restore focus to a virtualized item by stable identity and scroll it into view without relying on recycled DOM position. Evidence: virtualization focus tests. - [ ] CAP.46.e After deletion, move focus by documented rule to next item, previous item, parent, collection heading, or recovery action. Evidence: first/middle/last deletion tests. - [ ] CAP.46.f Handle disabled, permission-hidden, filtered, moved, or concurrently deleted restoration targets with a safe announced fallback. Evidence: unavailable-target tests. - [ ] CAP.46.g Prevent asynchronous loading, toasts, status updates, and background rerenders from stealing focus. Evidence: focus stability tests. - [ ] CAP.47 Virtualized content preserves accessible row counts, position, selection, and keyboard navigation. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.47.a Expose total row/item count or an honest unknown/loading state independently from rendered DOM count. Evidence: collection semantic tests. - [ ] CAP.47.b Expose each item's stable position, set size, level, grouping, expansion, and relationship semantics. Evidence: screen-reader tree/grid logs. - [ ] CAP.47.c Preserve single, multiple, range, select-all-filtered, and offscreen selection by stable identity. Evidence: scroll/recycle selection tests. - [ ] CAP.47.d Implement arrow, page, home/end, type-ahead, group, and focus navigation according to the selected widget pattern. Evidence: keyboard navigation tests. - [ ] CAP.47.e Retain focused item and logical scroll anchor through prepend, append, resort, filter, resize, refresh, and concurrent mutation. Evidence: dynamic collection tests. - [ ] CAP.47.f Announce loading, loaded ranges, result-count changes, moved focus, and unavailable items without flooding live regions. Evidence: announcement tests. - [ ] CAP.47.g Test empty, one-row, huge, variable-height, nested, grouped, and permission-changing collections. Evidence: virtualization boundary matrix. - [ ] CAP.48 Drag-and-drop always has non-drag controls and does not require fine motor precision. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.48.a Inventory reorder, move, upload, place, connect, trim, resize, pan, scrub, lasso, and domain-specific drag interactions. Evidence: per-domain drag inventory. - [ ] CAP.48.b Provide select-plus-explicit-action controls for moving between parents, groups, lanes, tracks, stages, or collections. Evidence: non-drag move journeys. - [ ] CAP.48.c Provide move-up/down/start/end and direct-position controls for ordering. Evidence: non-drag reorder tests. - [ ] CAP.48.d Provide numeric, stepper, preset, snapping, and reset controls for position, duration, trim, size, and value changes. Evidence: precision-independent operation tests. - [ ] CAP.48.e Provide source/target selectors and create/remove actions for graph, routing, dependency, or relationship connections. Evidence: non-drag connection tests. - [ ] CAP.48.f Meet target-size/spacing requirements, support cancellation, avoid path-dependent gestures, and tolerate coarse pointers and tremor. Evidence: motor accessibility tests. - [ ] CAP.48.g Keep drag and non-drag paths behaviorally equivalent for validation, authorization, impact preview, audit, undo, and result. Evidence: path-equivalence tests. - [ ] CAP.49 Locale-aware formatting covers dates, times, time zones, numbers, units, currency, pluralization, sorting, and collation. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.49.a Format calendar dates with explicit locale, calendar system, granularity, and unambiguous machine value. Evidence: locale date fixtures. - [ ] CAP.49.b Format time, duration, relative time, time zone, daylight-saving transition, and ambiguous/nonexistent local time correctly. Evidence: clock and zone boundary tests. - [ ] CAP.49.c Format decimal, integer, percentage, scientific, compact, and significant-digit numbers without changing stored values. Evidence: numeric locale fixtures. - [ ] CAP.49.d Format domain units with conversion policy, displayed unit, precision, rounding, and source-unit preservation. Evidence: known-unit tests. - [ ] CAP.49.e Format currency with ISO identity, minor units, exchange-rate source/time when converted, and accounting behavior. Evidence: currency fixtures. - [ ] CAP.49.f Use locale plural categories, select/gender rules where needed, and parameterized messages without string concatenation. Evidence: pluralization tests. - [ ] CAP.49.g Apply locale-aware sort and collation with numeric, case, accent, punctuation, script, and stable tie-break behavior. Evidence: multilingual ordering fixtures. - [ ] CAP.49.h Keep canonical identifiers, hashes, code, paths, standards values, and protocol payloads locale-independent. Evidence: locale-switch invariant tests. - [ ] CAP.50 Bidirectional text, vertical-script metadata, long translations, and font fallback are visual-regression tested where applicable. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.50.a Test full RTL layout mirroring, navigation order, panel placement, icons, directional controls, and embedded LTR technical content. Evidence: RTL route snapshots and interaction tests. - [ ] CAP.50.b Test mixed-direction titles, names, URLs, paths, numbers, timecodes, code, identifiers, and punctuation with isolation controls. Evidence: bidi adversarial fixtures. - [ ] CAP.50.c Test vertical writing-mode metadata and distinguish content direction from interface direction. Evidence: vertical-script fixtures. - [ ] CAP.50.d Expand translatable strings to representative long forms and test wrapping, reflow, control growth, tables, dialogs, toasts, and narrow layouts. Evidence: pseudo-localization snapshots. - [ ] CAP.50.e Test primary and fallback fonts across supported scripts, combining marks, emoji, symbols, notation, and specialist glyphs. Evidence: glyph coverage snapshots. - [ ] CAP.50.f Detect tofu, clipped marks, baseline shifts, broken ligatures, reordered text, overlap, truncation without disclosure, and hidden controls. Evidence: reviewed visual-diff results. - [ ] CAP.50.g Run the matrix in each supported theme, density, viewport, and zoom level. Evidence: cross-dimension visual regression report. - [ ] CAP.51 Localizable content and non-localizable identifiers are separated in contracts and editors. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.51.a Classify each field as invariant identifier, source-authored content, localizable content, locale-neutral metadata, or derived display value. Evidence: field localization schema. - [ ] CAP.51.b Store stable IDs, keys, hashes, enum codes, standard vocabularies, paths, URIs, and protocol values independently from labels. Evidence: contract separation tests. - [ ] CAP.51.c Store localized values by canonical locale with source locale, fallback, translation status, translator, revision, and provenance. Evidence: localized-value contract tests. - [ ] CAP.51.d Prevent locale switching from rewriting identifiers, source-authored truth, references, search keys, or interoperability values. Evidence: locale-switch mutation tests. - [ ] CAP.51.e Present identifier and localizable label controls distinctly with appropriate validation, read-only state, and accessible help. Evidence: editor component tests. - [ ] CAP.51.f Define missing, fallback, stale, machine-suggested, human-reviewed, approved, and obsolete translation behavior. Evidence: translation lifecycle tests. - [ ] CAP.51.g Migrate legacy combined identifier/label fields without breaking external references or silently inventing translations. Evidence: migration reconciliation report. - [ ] CAP.52 Offline, reconnect, tab suspension, expired auth, and mid-operation network loss have deterministic recovery. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.52.a Define which reads, edits, commands, jobs, reviews, approvals, publishes, and destructive actions are available, queued, or prohibited offline. Evidence: per-domain offline capability policy. - [ ] CAP.52.b Detect offline, captive, degraded, high-latency, and server-unavailable states without equating every request failure to offline. Evidence: connectivity classification tests. - [ ] CAP.52.c Persist allowed local work with user/tenant binding, encryption, schema/version, size quota, expiry, and support-safe export. Evidence: offline-store tests. - [ ] CAP.52.d Reauthenticate before replay after expired auth and recheck current tenant, permissions, policy, object revision, and dependencies. Evidence: expired-auth replay tests. - [ ] CAP.52.e Resume or reconcile work after tab suspension, process freeze, browser discard, desktop sleep, and mobile backgrounding. Evidence: lifecycle automation matrix. - [ ] CAP.52.f Handle network loss before acceptance, after acceptance with unknown result, during upload, during job, and during streamed output. Evidence: boundary-specific fault tests. - [ ] CAP.52.g Replay only idempotent queued work in dependency order and surface conflict, rejection, partial completion, and stale intent. Evidence: reconnect replay tests. - [ ] CAP.52.h Preserve recovery evidence and never claim success until the authoritative state is read back. Evidence: false-success negative tests. - [ ] CAP.53 Deep links restore route, selected entity, tab, filter, inspector, and safe share context. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.53.a Define canonical versioned URL/path/query/state encoding for each restorable route context. Evidence: deep-link contract. - [ ] CAP.53.b Restore the authorized entity by stable identifier and handle missing, moved, deleted, retained, cross-tenant, or forbidden targets. Evidence: entity-resolution tests. - [ ] CAP.53.c Restore valid tab/subview and fall back predictably when a tab is removed, unsupported, or unauthorized. Evidence: tab compatibility tests. - [ ] CAP.53.d Restore typed filters, sort, grouping, pagination anchor, and saved-view references without accepting unsafe query expressions. Evidence: query-state round-trip tests. - [ ] CAP.53.e Restore inspector mode, selected subobject/anchor, compare target, and focus without opening hidden protected context. Evidence: inspector restoration tests. - [ ] CAP.53.f Separate shareable state from local-only drafts, secrets, protected identities, signed URLs, transient tokens, and oversized selection data. Evidence: URL leakage tests. - [ ] CAP.53.g Recheck authentication, tenancy, object/property authorization, lifecycle, and link expiry at resolution time. Evidence: deep-link security negative tests. - [ ] CAP.53.h Preserve a safe return location and provide intelligible recovery for stale, malformed, incompatible, or inaccessible links. Evidence: failure journey tests. - [ ] CAP.54 Browser refresh and back/forward navigation do not discard unsaved work or mutate state unexpectedly. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.54.a Classify route state as canonical URL state, server-persisted state, recoverable local draft, ephemeral UI state, or nonrestorable secret state. Evidence: route-state ownership map. - [ ] CAP.54.b Flush, queue, or persist allowed unsaved work before reload and warn only when data loss truly remains possible. Evidence: refresh recovery tests. - [ ] CAP.54.c Restore local drafts only for the same authenticated user, tenant, object, base revision, and compatible schema. Evidence: draft-isolation tests. - [ ] CAP.54.d Make route rendering and history restoration read-only unless the user explicitly repeats a mutation. Evidence: no-mutation navigation assertions. - [ ] CAP.54.e Restore route, selection, filters, inspector, focus, and reasonable scroll position on Back and Forward. Evidence: history navigation tests. - [ ] CAP.54.f Handle POST/redirect, pending upload, running job, open dialog, in-progress composition, and conflict states without duplicate commands. Evidence: lifecycle boundary tests. - [ ] CAP.54.g Detect server changes, deletion, permission loss, expired auth, and stale local base on restoration. Evidence: stale-restoration tests. - [ ] CAP.54.h Test hard refresh, soft reload, crash recovery, tab duplicate, tab restore, and browser session restore. Evidence: browser lifecycle matrix. ### 3.5 Operability and release capability - [ ] CAP.55 Every user mutation emits a correlated audit event and trace. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.55.a Inventory create, edit, delete, restore, transition, review, approval, override, bulk, import, publish, configuration, and administrative mutations. Evidence: mutation-to-audit register. - [ ] CAP.55.b Assign stable mutation, command/idempotency, request, trace, actor/session, and resulting audit event identifiers. Evidence: correlation contract tests. - [ ] CAP.55.c Record authenticated and delegated actor, tenant, target, authorized action, prior/new revision, timestamp, reason, result, and policy decision. Evidence: audit schema assertions. - [ ] CAP.55.d Link to content hashes, diffs, gate/provenance evidence, and side-effect references without duplicating protected content in audit. Evidence: audit redaction and linkage tests. - [ ] CAP.55.e Persist the audit event in the same transaction or guaranteed outbox as the accepted mutation. Evidence: mutation/audit atomicity tests. - [ ] CAP.55.f Propagate trace context across API, database, queue, worker, provider, desktop/bridge, webhook, and notification boundaries. Evidence: end-to-end trace continuity tests. - [ ] CAP.55.g Record refused and failed mutation attempts at a safe detail level without claiming an authoritative state change. Evidence: negative audit tests. - [ ] CAP.55.h Enforce append-only integrity, retention, access, legal hold, export, and tenant isolation for audit events. Evidence: audit lifecycle tests. - [ ] CAP.56 Every job exposes queue delay, execution time, retries, resource use, provider/model, cost, outcome, and failure class. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.56.a Record accepted, eligible, queued, leased, started, stage, completed, and terminal timestamps with one clock/unit contract. Evidence: job timing assertions. - [ ] CAP.56.b Derive queue delay, scheduling delay, active execution, external wait, paused time, retry backoff, and total elapsed time separately. Evidence: known-timeline tests. - [ ] CAP.56.c Record attempt number, retry reason, policy, next-attempt time, worker, lease, checkpoint, and prior attempt linkage. Evidence: retry-history tests. - [ ] CAP.56.d Record bounded CPU, memory, GPU type/time/memory, storage, network, token, frame/sample, and provider usage as applicable. Evidence: resource instrumentation tests. - [ ] CAP.56.e Record provider, model/deployment, immutable version/digest, region, request reference, and provider operation/reference. Evidence: provider job provenance tests. - [ ] CAP.56.f Record estimated, reserved, actual, refunded, and unallocated cost with currency, rate-card version, and attribution. Evidence: cost reconciliation tests. - [ ] CAP.56.g Record succeeded, partial, cancelled, compensated, failed, dead-lettered, abandoned, and unknown outcomes without collapsing them. Evidence: terminal state tests. - [ ] CAP.56.h Classify input, authorization, policy, dependency, provider, timeout, capacity, resource, internal, cancellation, and unknown failure classes. Evidence: error classification tests. - [ ] CAP.56.i Expose support-safe job diagnostics and evidence links without content, secrets, signed URLs, protected identities, or unbounded labels. Evidence: telemetry privacy tests. - [ ] CAP.57 Metrics have bounded cardinality and exclude content, PII, protected-source data, and secrets. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.57.a Inventory each metric name, type, unit, owner, purpose, aggregation, retention, and allowed dimensions. Evidence: metric registry. - [ ] CAP.57.b Set explicit cardinality budgets per instrument and service plus warning and hard-fail behavior. Evidence: budget policy and load tests. - [ ] CAP.57.c Allowlist bounded domain, operation, state, error-class, provider-class, model-family, region, environment, and cohort labels as required. Evidence: attribute schema tests. - [ ] CAP.57.d Prohibit raw user/tenant/object/job/request IDs, URLs, filenames, query text, prompts, content, stack traces, and exception messages as labels. Evidence: forbidden-label lint tests. - [ ] CAP.57.e Redact or exclude direct and quasi-identifying PII, learner records, protected-source identity, biometric values, rights details, credentials, and secrets. Evidence: canary-data leakage tests. - [ ] CAP.57.f Handle unknown/new enum values through bounded fallback categories without silently dropping the event. Evidence: unknown-value tests. - [ ] CAP.57.g Monitor series count, label churn, dropped samples, exporter rejection, cost, and schema violations. Evidence: metric pipeline observability tests. - [ ] CAP.58 SLOs cover availability, latency, durability, queue age, publish correctness, and critical gate freshness. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.58.a Define user-visible service availability SLIs, qualifying requests, exclusions, target, window, and error budget. Evidence: approved availability SLO. - [ ] CAP.58.b Define latency SLIs and percentile targets for critical reads, mutations, searches, saves, jobs, reviews, and publish actions. Evidence: latency SLOs. - [ ] CAP.58.c Define acknowledged-write, revision, blob, event, audit, and restore durability/correctness SLIs. Evidence: durability SLOs. - [ ] CAP.58.d Define queue age, start delay, completion deadline, stuck job, and dead-letter SLOs by priority and job class. Evidence: queue SLOs. - [ ] CAP.58.e Define publish correctness for artifact bytes, metadata, audience/target, rights/consent, gates, provenance, delivery, and read-back. Evidence: publish SLO. - [ ] CAP.58.f Define maximum age and invalidation/recomputation time for safety, rights, consent, canon, quality, and release-critical gate evidence. Evidence: freshness SLOs. - [ ] CAP.58.g Assign owner, measurement source, dashboard, burn alerts, incident trigger, error-budget policy, and review cadence to each SLO. Evidence: operational SLO register. - [ ] CAP.58.h Validate SLIs against controlled success/failure events and prove missing telemetry cannot appear as success. Evidence: synthetic SLI tests. - [ ] CAP.59 Alerts are actionable, deduplicated, routed by ownership, and linked to a tested runbook. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.59.a Define the user/business impact, triggering SLI or invariant, severity, threshold, window, and recovery condition for each alert. Evidence: alert catalog. - [ ] CAP.59.b Include affected domain/service/tenant-safe scope, environment, start time, current value, recent change, dashboard, logs/traces, and correlation data. Evidence: notification template tests. - [ ] CAP.59.c Group duplicate symptoms by incident key and suppress dependent alerts without hiding independent failures. Evidence: deduplication scenario tests. - [ ] CAP.59.d Route primary, backup, specialist, security/privacy/safety, and vendor escalation by service ownership and time. Evidence: routing tests. - [ ] CAP.59.e Define acknowledgement, paging, escalation, silence, maintenance, resolve, reopen, and handoff behavior. Evidence: alert-lifecycle tests. - [ ] CAP.59.f Link a versioned runbook with validation, mitigation, rollback/kill switch, recovery, evidence preservation, and escalation. Evidence: runbook schema review. - [ ] CAP.59.g Exercise alert firing, notification, ownership, runbook steps, recovery detection, and post-incident evidence in a game day. Evidence: timed rehearsal report. - [ ] CAP.59.h Review noisy, unactionable, stale-owner, missing-data, and never-fired alerts on a defined cadence. Evidence: alert hygiene report. - [ ] CAP.60 Backup and restore prove both metadata and blob consistency, including provenance and audit records. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.60.a Inventory authoritative databases, blobs, manifests, search rebuild inputs, queues/outboxes, keys/config references, audit, and external-ledger data. Evidence: backup scope register. - [ ] CAP.60.b Define full/incremental cadence, point-in-time coverage, retention, region, immutability, encryption, key separation, and access. Evidence: backup policy. - [ ] CAP.60.c Capture a transactionally consistent recovery point or explicit ordering markers across metadata, blobs, events, audit, and provenance. Evidence: consistency design. - [ ] CAP.60.d Verify backup completeness, checksums, decryptability, schema version, catalog, and restore prerequisites automatically. Evidence: backup verification report. - [ ] CAP.60.e Restore into an isolated environment using documented credentials and infrastructure without depending on the failed primary. Evidence: independent restore rehearsal. - [ ] CAP.60.f Reconcile rows to blobs, revisions to content, provenance to ingredients, audit to mutations, outbox/inbox positions, tombstones, legal holds, and tenant counts. Evidence: post-restore integrity report. - [ ] CAP.60.g Rehash restored bytes and validate representative read, search, history, review, gate, export, and publish-preparation journeys. Evidence: restored-system verification. - [ ] CAP.60.h Measure achieved recovery point/time and record gaps, owners, remediation, and next rehearsal. Evidence: signed restore report. - [ ] CAP.61 Disaster recovery proves RPO/RTO and safe replay of jobs, outbox events, and pending releases. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.61.a Define disaster scenarios, affected regions/services/data, dependency assumptions, authority, and per-capability RPO/RTO. Evidence: approved DR scope. - [ ] CAP.61.b Provision isolated recovery infrastructure, networking, secrets/keys, providers, storage, queues, observability, and access. Evidence: recovery-environment readiness check. - [ ] CAP.61.c Restore authoritative state to the selected recovery point and measure actual data loss and elapsed time. Evidence: timed recovery log. - [ ] CAP.61.d Fence old writers, leases, schedulers, webhooks, bridges, and provider callbacks before activating recovery writes. Evidence: split-brain prevention tests. - [ ] CAP.61.e Reconcile queued/running/retrying/unknown jobs before replay and preserve idempotency, checkpoints, external outcome, and cost state. Evidence: job replay report. - [ ] CAP.61.f Replay outbox/inbox/events in safe order with duplicate, out-of-order, poison, and consumer-version handling. Evidence: event replay report. - [ ] CAP.61.g Revalidate candidate inputs, gates, rights/consent, provenance, approvals, idempotency, and destinations before resuming pending releases. Evidence: pending-release reconciliation. - [ ] CAP.61.h Verify user journeys, integrations, observability, alerts, backups, and support procedures before failover completion. Evidence: recovery acceptance matrix. - [ ] CAP.61.i Rehearse failback or establish the recovery environment as the new primary with data reconciliation and rollback. Evidence: failback plan and result. - [ ] CAP.62 Cost controls cover estimation, reservation, actual spend, variance, quotas, anomaly detection, and kill switch. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.62.a Define versioned unit prices for provider/model, tokens, GPU/CPU, storage, transfer, render frames/samples, licenses, and other billable resources. Evidence: rate-card registry. - [ ] CAP.62.b Estimate cost from validated inputs before acceptance and expose assumptions, currency, uncertainty, and expiry. Evidence: known-price estimate tests. - [ ] CAP.62.c Atomically reserve actor/project/tenant/provider budget for accepted work and handle concurrent reservations. Evidence: oversubscription race tests. - [ ] CAP.62.d Record actual metered usage and provider charges per attempt, job, derivative, retry, partial result, and cancellation. Evidence: usage attribution tests. - [ ] CAP.62.e Reconcile estimate, reservation, actual, refund/release, and invoice/exported cost with explicit variance reasons. Evidence: cost reconciliation report. - [ ] CAP.62.f Enforce per-operation, actor, project, tenant, day/month, provider, resource, and exceptional approval quotas. Evidence: quota boundary and isolation tests. - [ ] CAP.62.g Detect spend rate, variance, volume, provider, resource, retry, and unallocated-cost anomalies with bounded dimensions. Evidence: anomaly scenario tests. - [ ] CAP.62.h Provide scoped pause/kill controls with named authority, propagation target, in-flight policy, recovery, and audit. Evidence: kill-switch rehearsal. - [ ] CAP.62.i Prevent cost-control failure from becoming unbounded execution or fabricated zero cost. Evidence: unavailable-metering fail-closed tests. - [ ] CAP.63 Release supports canary or tenant cohort rollout, rollback, compatibility monitoring, and data-migration observation. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.63.a Define immutable release candidate, artifacts, contracts, schemas, flags/config, migrations, dependency versions, and evidence. Evidence: release manifest. - [ ] CAP.63.b Define canary or cohort selection by environment, tenant, role, region, platform, data shape, and risk without leaking targeting. Evidence: rollout targeting policy. - [ ] CAP.63.c Define rollout stages, minimum observation, success/error/SLO thresholds, approval points, automatic pause, and abort. Evidence: staged rollout plan. - [ ] CAP.63.d Verify old/new API, event, job, schema, cache, client, desktop/bridge, provider, and artifact compatibility during coexistence. Evidence: compatibility dashboards and synthetic tests. - [ ] CAP.63.e Observe migration progress, lock/latency, backfill, validation, drift, old/new writer behavior, and contract completion. Evidence: migration telemetry. - [ ] CAP.63.f Define code/config/flag rollback, database rollback or compensation, queued-job policy, artifact withdrawal, and irreversible boundary. Evidence: rollback runbook. - [ ] CAP.63.g Rehearse rollback from each stage with realistic traffic and in-flight mutations/jobs. Evidence: stage-level rollback results. - [ ] CAP.63.h Promote only on fresh evidence and record actor, cohort, timestamps, observations, exceptions, and final state. Evidence: release progression audit. - [ ] CAP.63.i Remove temporary compatibility, dual-write/read, and rollout flags after the defined observation window. Evidence: closure checklist. - [ ] CAP.64 A release evidence bundle links requirements, code, tests, scans, migrations, screenshots, performance results, runbooks, and approvals. Evidence: per-domain capability-matrix row linked to implementation and current proof. - [ ] CAP.64.a Pin release identifier, commit SHA, build inputs, dependencies, generated artifacts, configuration, target environment, and artifact hashes. Evidence: immutable release identity record. - [ ] CAP.64.b Link every in-scope requirement and ledger identifier to its implementation, disposition, or approved N/A evidence. Evidence: requirement traceability report. - [ ] CAP.64.c Link source diffs, review records, generated-code drift results, build outputs, and reproducibility or provenance references. Evidence: code/build evidence index. - [ ] CAP.64.d Link raw unit, property, contract, integration, end-to-end, mobile/desktop, evaluation, accessibility, resilience, and release test reports. Evidence: test evidence index. - [ ] CAP.64.e Link dependency, license, secret, static/dynamic security, authorization, privacy, safety, rights, consent, and provenance scans. Evidence: trust scan index. - [ ] CAP.64.f Link migration plans, rehearsals, compatibility windows, reconciliations, rollback/compensation results, and production observation queries. Evidence: migration evidence index. - [ ] CAP.64.g Link dated screenshots, recordings, network traces, console logs, accessibility outputs, and performance/load/cost/SLO results. Evidence: user/runtime evidence index. - [ ] CAP.64.h Link deployment, migration, rollback, incident, DR, support, provider, bridge/host, and kill-switch runbooks with rehearsal state. Evidence: operations evidence index. - [ ] CAP.64.i Link named technical, product, domain, security, privacy, safety, rights/legal, accessibility, operations, and human governance approvals without fabricating missing signoff. Evidence: approval register. - [ ] CAP.64.j Validate every link, hash, version, timestamp, owner, expiry, waiver, scope, and target before signing the bundle. Evidence: release-bundle integrity check. --- ## 4. Dependency and sequencing map 1. Complete BASE, STD, and Phase S architecture decisions before new workbench packages or routes. 2. Migrate Tara to the shared kit without behavioral regression. 3. Integrate existing standalone surfaces before creating replacements. 4. Build domain contracts and known-value gate logic before persistence. 5. Build persistence and service authorization before mutation UI. 6. Build read-only UI against live contracts before enabling mutations. 7. Build publish/release only after trust, provenance, and review gates. 8. Run focused verification throughout; run each expensive gate sequentially under the repository resource-safety policy. 9. Prepare engineering-readiness packets before human launch decisions. - [x] DEP.1 Encode the phase dependency graph in a machine-readable file. Evidence: a cycle detector and unknown-ID validator pass. - [x] DEP.1.a Define the graph schema for phase/task node, dependency edge, edge reason, blocking strength, evidence gate, owner, and source. Evidence: versioned graph schema. - [x] DEP.1.b Encode every sequencing rule numbered above as explicit graph edges rather than prose-only constraints. Evidence: nine rules have machine-readable coverage. - [x] DEP.1.c Encode shared-to-domain, domain-to-domain, host, migration, contract, infrastructure, evidence, and human-approval dependencies. Evidence: dependency-class coverage report. - [x] DEP.1.d Validate every node against an existing ledger identifier and every referenced artifact/environment against its registry. Evidence: zero unknown references. - [x] DEP.1.e Detect direct and transitive cycles and print the complete minimal cycle path. Evidence: cycle unit tests. - [x] DEP.1.f Detect redundant, contradictory, self, orphaned, and unsatisfiable dependencies. Evidence: graph integrity report. - [x] DEP.1.g Generate stable critical-path and parallel-ready projections from the committed graph. Evidence: deterministic projection check. - [ ] DEP.2 Assign an owner and reviewer to every phase. Evidence: no phase has an unowned critical path. - [ ] DEP.2.a Enumerate shared, domain, cross-domain, rollout, and final-gate phases requiring accountable ownership. Evidence: phase ownership rows. - [ ] DEP.2.b Assign one accountable delivery owner with team and escalation path to each phase. Evidence: zero missing owners. - [ ] DEP.2.c Assign an independent reviewer with the required domain, platform, safety, rights, security, accessibility, or operations expertise. Evidence: reviewer qualification rows. - [ ] DEP.2.d Prevent self-review where the phase contains high-impact, regulated, trust, release, or product-scope decisions. Evidence: separation-of-duties validation. - [ ] DEP.2.e Assign backup ownership for critical-path phases and record handoff/escalation timing. Evidence: critical-path coverage report. - [ ] DEP.2.f Validate that every critical-path node inherits or declares both owner and reviewer. Evidence: graph ownership check. - [ ] DEP.3 Record cross-domain contract dependencies and compatibility windows. Evidence: producer/consumer matrix covers every integration. - [ ] DEP.3.a Inventory every synchronous API, asynchronous event, job, provider adapter, schema, blob/bundle, bridge, and embedded UI handoff across domains. Evidence: cross-domain integration register. - [ ] DEP.3.b Record producer, owner, contract identifier/version, transport, data classification, and availability/SLO for each integration. Evidence: producer-side matrix fields. - [ ] DEP.3.c Record every consumer, accepted versions, optional/required use, failure behavior, retry, and fallback. Evidence: consumer-side matrix fields. - [ ] DEP.3.d Define additive, breaking, deprecated, unsupported, and unknown version behavior. Evidence: compatibility policy per integration. - [ ] DEP.3.e Set coexistence start/end, producer-first or consumer-first ordering, feature/config flag, backfill, and removal conditions. Evidence: compatibility-window rows. - [ ] DEP.3.f Link provider and consumer contract, version-skew, replay, and failure tests. Evidence: no integration lacks bidirectional proof. - [ ] DEP.3.g Resolve producer/consumer owner conflicts and orphan consumers before scheduling implementation. Evidence: zero unresolved matrix rows. - [ ] DEP.4 Record required infrastructure, credentials, fixtures, corpora, media, DCC versions, GPU capacity, and test tenants. Evidence: environment readiness checklist. - [ ] DEP.4.a Inventory databases, blob stores, queues, caches, search, telemetry, signing, model/provider, rendering, bridge, and delivery infrastructure by environment. Evidence: infrastructure rows. - [ ] DEP.4.b Inventory service accounts, OAuth clients, certificates, signing keys, provider secrets, DCC/engine licenses, and rotation owners without recording secret values. Evidence: credential-reference rows. - [ ] DEP.4.c Inventory valid, invalid, boundary, adversarial, version-skew, tenant-isolation, and migration fixtures with generation/source provenance. Evidence: fixture rows. - [ ] DEP.4.d Inventory licensed evaluation corpora, expected outputs, subgroup coverage, access policy, retention, and version. Evidence: corpus rows. - [ ] DEP.4.e Inventory source, generated, malformed, rights/consent, multilingual, accessibility, performance, and delivery media assets. Evidence: media fixture rows. - [ ] DEP.4.f Record supported DCC, engine, plugin, codec, browser, device, desktop runtime, and driver versions plus installation source. Evidence: target-version rows. - [ ] DEP.4.g Record GPU/CPU/memory/storage/network capacity, concurrency, reservation, quotas, cost, and fallback. Evidence: capacity rows. - [ ] DEP.4.h Provision isolated tenants, users, roles, cross-tenant collision data, and provider states for every integration and journey. Evidence: test-tenant rows. - [ ] DEP.4.i Validate availability, permission, version, quota, health, and cleanup for every readiness row. Evidence: zero unverified prerequisites. - [ ] DEP.5 Define a critical-path release order with explicit parallel-safe slices. Evidence: the plan respects shared migrations and host ownership. - [ ] DEP.5.a Calculate the transitive critical path from the committed dependency graph with duration/confidence inputs. Evidence: generated critical-path projection. - [ ] DEP.5.b Identify architecture, product-boundary, contract, schema, security, infrastructure, and human-decision gates that block downstream starts. Evidence: blocking-gate list. - [ ] DEP.5.c Define the producer/consumer and expand/backfill/verify/contract order for every shared or cross-domain migration. Evidence: migration-sequencing rows. - [ ] DEP.5.d Define host-owner approval and deployment order for reused, proxied, redirected, embedded, or retired surfaces. Evidence: host-sequencing rows. - [ ] DEP.5.e Mark slices parallel-safe only when they share no incompatible contract, schema, data, host, environment, capacity, or approval mutation. Evidence: independence rationale per slice. - [ ] DEP.5.f Record integration, evidence-refresh, merge, and release synchronization points between parallel slices. Evidence: explicit join gates. - [ ] DEP.5.g Define replan behavior when an estimate, dependency, blocker, standard, provider, or product decision changes. Evidence: versioned schedule update procedure. - [ ] DEP.6 Define stop-the-line conditions for security, provenance, consent, data loss, gate correctness, and cross-tenant leakage. Evidence: release policy links each condition to an owner and rollback. - [ ] DEP.6.a Define credential exposure, exploitable authorization bypass, remote code execution, unsafe fetch/upload, dependency compromise, and critical unpatched vulnerability stops. Evidence: security stop policy. - [ ] DEP.6.b Define invalid/missing signature, artifact hash mismatch, broken ingredient lineage, untrusted required provenance, and signing key compromise stops. Evidence: provenance stop policy. - [ ] DEP.6.c Define missing/revoked/expired/out-of-scope consent, protected identity exposure, and nonconsensual biometric/voice/body use stops. Evidence: consent stop policy. - [ ] DEP.6.d Define acknowledged-write loss, corruption, unrecoverable revision/blob mismatch, failed restore, migration reconciliation gap, and unsafe replay stops. Evidence: data-loss stop policy. - [ ] DEP.6.e Define fabricated, nondeterministic, stale-authorizing, miscalibrated, bypassable, or unavailable fail-open critical gate stops. Evidence: gate-correctness stop policy. - [ ] DEP.6.f Define any cross-tenant read, write, count, search, cache, export, event, telemetry, or provider-context disclosure as a stop. Evidence: tenancy stop policy. - [ ] DEP.6.g Assign incident commander, technical owner, specialist reviewer, communication path, evidence custodian, and restart authority by stop class. Evidence: named responsibility matrix. - [ ] DEP.6.h Define automatic pause/kill action, affected targets, in-flight behavior, rollback/containment, recovery proof, and approval to resume. Evidence: stop-and-resume runbooks. - [ ] DEP.6.i Rehearse at least one trigger per class and prove the release cannot proceed while the stop remains active. Evidence: game-day report. --- ## Phase S — Shared workbench platform Phase S builds `@oshun/workbench-kit` only for genuinely domain-neutral behavior. Domain rules remain in domain packages. Tara's current behavior and tests are the extraction acceptance gate. ### S0 — Extraction audit and decisions - [x] S0.1 Inventory Tara domain-library exports consumed by web, BFF, tests, migrations, and content publishing. Evidence: import graph snapshot. - [x] S0.1.a Enumerate Tara public entry points and exported symbols from package metadata and source. Evidence: export-level inventory. - [x] S0.1.b Map web application imports to exact exports and consuming routes/components. Evidence: web consumer edges. - [x] S0.1.c Map BFF imports to handlers, middleware, stores, and runtime paths. Evidence: BFF consumer edges. - [x] S0.1.d Map unit/integration/browser test, fixture, and builder imports without treating test-only use as production reuse. Evidence: test consumer edges. - [x] S0.1.e Map migration, schema, code-generation, and persistence registration imports. Evidence: data-path consumer edges. - [x] S0.1.f Map content build, validation, bundle, and publishing imports. Evidence: publishing consumer edges. - [x] S0.1.g Flag unused exports, deep imports, circular imports, and exports with only one real consumer. Evidence: reviewed import graph findings. - [x] S0.2 Inventory Tara web components and classify domain-neutral shell behavior separately from meditation-specific behavior. Evidence: component extraction matrix. - [x] S0.2.a Enumerate route, layout, workspace, inspector, editor, review, gate, publish, history, and utility components. Evidence: source-linked component rows. - [x] S0.2.b Record each component's props, state, context, hooks, data requests, mutation paths, styles, tokens, and tests. Evidence: dependency columns are complete. - [x] S0.2.c Identify behavior whose contract and interaction semantics are independently usable by at least one non-Tara archetype. Evidence: domain-neutral rationale per candidate. - [x] S0.2.d Identify meditation vocabulary, stages, content blocks, gates, scores, routes, providers, copy, and policy that must remain Tara-owned. Evidence: Tara-specific rationale per retained component. - [x] S0.2.e Split mixed components at an explicit seam or reject extraction when the seam would leak Tara semantics. Evidence: split/reject decision per mixed row. - [x] S0.2.f Validate proposed neutral components against both an authoring and an operations-console consumer. Evidence: two-archetype usage sketches. - [x] S0.3 Inventory Tara BFF handlers, middleware, stores, and provider seams. Evidence: route-to-capability matrix. - [x] S0.3.a Enumerate all mounted and source-defined Tara BFF routes with method, path, handler, middleware chain, and reachability. Evidence: effective route rows. - [x] S0.3.b Trace each handler to command/query, domain service, store, provider, job, blob, and external side effect. Evidence: handler-dependency rows. - [x] S0.3.c Record actor resolution, object/property/function authorization, tenancy, validation, idempotency, concurrency, rate/size limits, and audit per route. Evidence: boundary-control rows. - [x] S0.3.d Classify stores as durable production, in-memory production, fixture/demo, cache, or adapter and record lifecycle semantics. Evidence: store classification rows. - [x] S0.3.e Classify provider seams as configured, not configured, fallback, fixture, or accidental mock with error/cancellation/cost behavior. Evidence: provider classification rows. - [x] S0.3.f Map each route to the smallest shared or Tara-owned capability and its current tests. Evidence: zero unmapped reachable routes. - [x] S0.4 Inventory `@oshun/studio-authoring` overlap. Evidence: duplication report identifies reuse, consolidation, and intentionally separate logic. - [x] S0.4.a Enumerate public and internally consumed `studio-authoring` contracts, actor/role logic, components, hooks, stores, utilities, and tests. Evidence: source-linked inventory. - [x] S0.4.b Match exact and near-equivalent Tara capabilities by input, output, lifecycle, policy, audience, and failure semantics. Evidence: candidate overlap pairs. - [x] S0.4.c Select direct reuse where ownership and behavior already match. Evidence: reuse rows with consumer migration path. - [x] S0.4.d Select consolidation where two implementations should move to one authoritative package. Evidence: target owner and removal sequence. - [x] S0.4.e Retain separate logic when audience, domain semantics, trust, lifecycle, dependency direction, or release cadence differs. Evidence: reviewed separation rationale. - [x] S0.4.f Check that the final package graph has no duplicate exported contract or dependency cycle. Evidence: boundary and duplication checks. - [ ] S0.5 Inventory shared contract packages and generated persistence registration. Evidence: authoritative owner is named for every shared type. - [x] S0.5.a Enumerate shared schemas, TypeScript/Python/Rust types, protobuf, OpenAPI, events, generated clients, database models, and registry rows. Evidence: contract artifact inventory. - [x] S0.5.b Trace each generated artifact to its source schema and generation command. Evidence: source-to-generated lineage. - [x] S0.5.c Trace each shared type to all producers, consumers, persisted tables, events, and public docs. Evidence: type consumer graph. - [x] S0.5.d Identify duplicate, forked, unregistered, source-less, and generated-but-hand-edited types. Evidence: contract integrity findings. - [ ] S0.5.e Assign one authoritative owner, source, namespace, version policy, compatibility window, and deprecation path per type. Evidence: zero ownerless shared types. - [ ] S0.5.f Validate persistence/model registration from a clean generation and real database metadata. Evidence: generation drift and registration checks. - [ ] S0.6 Record ADR-S1 for package ownership and dependency direction. Evidence: no proposed dependency cycle. - [x] S0.6.a Define the decision questions and current package/consumer graph. Evidence: ADR context and graph snapshot. - [x] S0.6.b Compare retain-current, extend `studio-authoring`, create `workbench-kit`, and other viable ownership options. Evidence: option trade-off table. - [x] S0.6.c Assign ownership for domain-neutral contracts, UI, server boundaries, persistence helpers, testing, and domain plugins. Evidence: responsibility map. - [x] S0.6.d Specify allowed and forbidden dependencies among applications, shared kit, studio-authoring, domain libraries, contracts, BFF, and adapters. Evidence: normative dependency rules. - [x] S0.6.e Validate the chosen direction with a cycle simulation and Nx/tag rule prototype. Evidence: passing boundary proof. - [ ] S0.6.f Obtain architecture and affected package-owner approval. Evidence: ADR approval record. - [x] S0.7 Record ADR-S2 for generic parameters and extension points. Evidence: examples cover content-authoring and operations-console archetypes. - [x] S0.7.a Inventory variability in identity, stage, block, score, gate, artifact, preview, inspector, import, publish, and route semantics. Evidence: variability table. - [x] S0.7.b Define which variability belongs in generic type parameters, discriminated interfaces, plugin capabilities, composition slots, or domain-owned adapters. Evidence: extension mechanism mapping. - [x] S0.7.c Define invariants the shared kit owns and behavior plugins may not override. Evidence: normative core contract. - [x] S0.7.d Define optional capability discovery and honest unsupported/not- configured behavior. Evidence: capability negotiation examples. - [x] S0.7.e Model one Tara-like content-authoring plugin without leaking meditation types into the shared API. Evidence: compiling example. - [x] S0.7.f Model one Aja/Bellona-like operations plugin with jobs, queues, resources, and host targets. Evidence: compiling example. - [x] S0.7.g Reject generic parameters or slots that have only one concrete use or permit unsafe arbitrary escape hatches. Evidence: abstraction challenge review. - [x] S0.8 Record ADR-S3 for event, audit, idempotency, and transaction boundaries. Evidence: failure scenarios are diagrammed. - [x] S0.8.a Inventory shared commands and mutations that produce persistence, event, job, blob, provider, publish, notification, or audit effects. Evidence: mutation-effect matrix. - [x] S0.8.b Define authoritative transaction boundaries and when outbox, inbox, or saga behavior is required. Evidence: boundary decision table. - [x] S0.8.c Define command, idempotency, event, trace, audit, job, and external-operation identity and correlation rules. Evidence: identity contract. - [x] S0.8.d Define event ordering, delivery, duplication, replay, compatibility, and poison handling. Evidence: delivery semantics. - [x] S0.8.e Define audit atomicity, refusal/failure capture, immutability, redaction, retention, and evidence linkage. Evidence: audit semantics. - [x] S0.8.f Diagram failure before commit, after commit/before dispatch, duplicate delivery, worker loss, external success/local timeout, compensation failure, and replay. Evidence: reviewed failure diagrams. - [x] S0.9 Record ADR-S4 for UI composition and theming. Evidence: existing Oshun, Isis, Yemaya, Euterpe, and Bellona design systems are reconciled. - [x] S0.9.a Inventory shells, navigation, layout primitives, tokens, themes, typography, icons, component libraries, overlays, and interaction patterns in all five systems. Evidence: design-system comparison. - [x] S0.9.b Define shared shell/primitive responsibilities versus host/domain-owned composition, vocabulary, information architecture, and specialist visualization. Evidence: ownership boundary. - [x] S0.9.c Define token contracts for color, typography, spacing, density, elevation, motion, focus, semantic states, and data visualization. Evidence: token mapping. - [x] S0.9.d Define host theme injection without global CSS leakage, runtime class collisions, duplicated providers, or inaccessible overrides. Evidence: theming isolation prototype. - [x] S0.9.e Reconcile Oshun calm authoring, Isis operator, Yemaya/Euterpe creative production, and Bellona control-room density without forcing one visual clone. Evidence: archetype compositions. - [x] S0.9.f Validate themes, densities, zoom, reduced motion, and forced colors with shared components. Evidence: cross-host visual/accessibility matrix. - [x] S0.10 Record ADR-S5 for compatibility and incremental migration. Evidence: Tara can migrate without a flag day. - [x] S0.10.a Inventory Tara public imports, routes, state stores, contracts, persisted data, events, generated artifacts, and current consumers. Evidence: migration surface register. - [x] S0.10.b Define additive compatibility seams, adapters, aliases, and version negotiation needed while old and new packages coexist. Evidence: coexistence architecture. - [x] S0.10.c Slice migration by independently verifiable capability rather than package-wide replacement. Evidence: ordered migration slice list. - [x] S0.10.d Define per-slice enablement, dual-read/write avoidance or reconciliation, rollback, evidence, and removal conditions. Evidence: slice transition contract. - [x] S0.10.e Define route/state/deep-link compatibility and preserve current Tara behavior for partially migrated users. Evidence: mixed-version journey plan. - [x] S0.10.f Define the final contract period, legacy consumer migration, and old implementation deletion gate. Evidence: dated retirement plan. - [ ] S0.11 Define a deletion threshold: no shared abstraction ships with only one real consumer unless the reuse is already proven. Evidence: each exported module lists at least two consumers or an approved exception. - [x] S0.11.a Define a real consumer as a production capability with distinct domain ownership or archetype, excluding tests, demos, fixtures, examples, aliases, and reexports. Evidence: consumer definition. - [x] S0.11.b Count consumers per proposed exported module and symbol from the authoritative import/capability graph. Evidence: export-to-consumer report. - [x] S0.11.c Require two implemented consumers before extraction where behavior is not already domain-neutral and stable. Evidence: extraction eligibility check. - [ ] S0.11.d For exceptions, record imminent second consumer, proven prior reuse, cost of delay, abstraction boundary, owner, and expiry. Evidence: approved exception record. - [ ] S0.11.e Delete or return one-consumer abstractions to the owning domain before shared-kit release. Evidence: zero unexplained one-consumer exports. - [x] S0.11.f Recheck consumer counts on every shared export addition/removal in CI. Evidence: deliberate one-consumer regression test. - [ ] S0.12 Ratify the shared capability matrix with domain owners. Evidence: review records list accepted, rejected, and domain-owned rows. - [x] S0.12.a Prepare per-domain rows with capability semantics, proposed shared boundary, extension point, consumer, dependency, and evidence. Evidence: seven review packets. - [ ] S0.12.b Obtain Tara owner review as the extraction source and behavioral regression authority. Evidence: signed Tara comments. - [ ] S0.12.c Obtain Isis, Metis, Yemaya, Veritas, Euterpe, Aja, and Bellona owner decisions for their candidate rows. Evidence: seven named domain review records. - [ ] S0.12.d Record accepted shared capabilities with named consumers and invariants. Evidence: accepted row register. - [ ] S0.12.e Record rejected capabilities with rationale and any retirement or redesign action. Evidence: rejected row register. - [ ] S0.12.f Record domain-owned capabilities with authoritative package and explicitly forbidden shared semantics. Evidence: domain-owned row register. - [ ] S0.12.g Resolve conflicting owner decisions through product/architecture governance rather than averaging incompatible requirements. Evidence: zero unresolved matrix rows. ### S1 — Package, contracts, and extension model - [x] S1.1 Scaffold `libs/oshun/workbench-kit` using repository ESM, Nx, TypeScript, lint, and Vitest conventions. Evidence: targeted lint, typecheck, test, and build pass. - [x] S1.1.a Create the package manifest, project configuration, source/test roots, README, ownership metadata, and initial public entry point. Evidence: scaffold file review. - [x] S1.1.b Configure ESM and TypeScript module resolution, project references, declaration output, source maps, and repository aliases. Evidence: emitted declaration and import inspection. - [x] S1.1.c Configure Nx tags, named inputs, cacheable lint/typecheck/test/build targets, and affected-file inputs. Evidence: project target inspection. - [x] S1.1.d Inherit repository lint/format rules without blanket local disables. Evidence: lint rejects a deliberate invalid fixture. - [x] S1.1.e Configure Vitest environment, setup, coverage boundaries, and test-only entry points. Evidence: sample unit and coverage run. - [x] S1.1.f Configure deterministic build output and validate consumption from an external ESM fixture. Evidence: packed-consumer smoke test. - [x] S1.1.g Run the four targeted targets sequentially on the current branch. Evidence: archived passing command output. - [x] S1.2 Add the package export map without deep-import escape hatches. Evidence: public API test rejects unexported imports. - [x] S1.2.a Enumerate approved root and feature subpath entry points from the ratified shared capability matrix. Evidence: public API list. - [x] S1.2.b Map each entry point to ESM implementation and types without wildcard or source-directory exports. Evidence: manifest review. - [x] S1.2.c Separate browser, React, server, contract, and test-only entry points so incompatible runtimes cannot import one another. Evidence: runtime boundary tests. - [x] S1.2.d Reject internal source paths and undeclared subpaths in workspace and packed-package consumer fixtures. Evidence: negative import tests. - [x] S1.2.e Import every declared subpath from both workspace and built package modes. Evidence: positive public API matrix. - [x] S1.2.f Scan production bundles for test builders, fixtures, server code, and unintended side effects. Evidence: bundle inspection. - [x] S1.3 Add path mapping and dependency tags. Evidence: Nx boundary checks pass. - [x] S1.3.a Add canonical TypeScript path aliases for approved package entry points only. Evidence: resolution tests. - [x] S1.3.b Add package scope, type, domain, and layer tags consistent with the repository taxonomy. Evidence: project metadata review. - [x] S1.3.c Define allowed edges from hosts, BFFs, domain packages, studio-authoring, contracts, shared kit, and adapters. Evidence: dependency constraint table. - [x] S1.3.d Forbid app-internal imports, domain-to-host reverse edges, browser-to-server imports, server-to-React imports, and private deep imports. Evidence: boundary rules. - [x] S1.3.e Add deliberate allowed and forbidden consumer fixtures for each dependency class. Evidence: rule tests reject only forbidden edges. - [x] S1.3.f Resolve all violations in proposed consumers without disabling the constraint. Evidence: clean targeted boundary check. - [x] S1.4 Define `WorkbenchId`, `TenantId`, `ActorRef`, `ArtifactRef`, `RevisionRef`, and `StableAnchor` branded types. Evidence: invalid cross-assignment fails type tests. - [x] S1.4.a Define canonical string format, namespace, parser, serializer, equality, and validation for `WorkbenchId` and `TenantId`. Evidence: valid/invalid/round-trip fixtures. - [x] S1.4.b Define `ActorRef` for human, delegated, service, system, and redacted identities without using display data as identity. Evidence: actor variant tests. - [x] S1.4.c Define `ArtifactRef` with artifact identity, immutable byte version/hash, media/profile, and resolution semantics. Evidence: artifact reference tests. - [x] S1.4.d Define `RevisionRef` with entity/workbench scope, revision ID, schema version, and optional parent/base. Evidence: revision reference tests. - [x] S1.4.e Define `StableAnchor` variants for entity, field, block, range, temporal, graph, canvas, and hierarchy targets with revision semantics. Evidence: anchor variant tests. - [x] S1.4.f Prohibit unchecked string casts and cross-kind ID assignment at compile time and parsing boundaries. Evidence: type-negative and runtime tests. - [x] S1.5 Define versioned envelopes for commands, queries, events, job updates, and capability probes. Evidence: golden wire fixtures. - [x] S1.5.a Define common envelope ID, kind, schema version, timestamp, actor/tenant/workbench scope, correlation, trace, and extension fields. Evidence: common wire schema. - [x] S1.5.b Define command envelope for idempotency, expected revision, deadline, authorization intent, and typed payload. Evidence: command golden fixtures. - [x] S1.5.c Define query envelope for typed filters, pagination, consistency, locale, field projection, and payload. Evidence: query golden fixtures. - [x] S1.5.d Define event envelope for producer, subject, sequence, causation, correlation, delivery compatibility, and typed payload. Evidence: event golden fixtures. - [x] S1.5.e Define job update envelope for job/attempt/stage identity, progress, checkpoint, usage/cost, output/error, and timestamp. Evidence: job-update golden fixtures. - [x] S1.5.f Define capability probe envelope for capability/version, dependency status, state, freshness, limitations, and safe remediation. Evidence: probe golden fixtures. - [x] S1.5.g Test malformed, unknown-kind, older/newer compatible, unsupported-version, unauthorized, and oversized envelopes. Evidence: negative/compatibility fixtures. - [x] S1.6 Define discriminated `configured`, `not_configured`, `degraded`, `unavailable`, and `failed` capability states. Evidence: exhaustive switch tests. - [x] S1.6.a Define common capability identity, checked-at time, freshness, dependency, owner, limitation, remediation, and safe-detail fields. Evidence: common state schema. - [x] S1.6.b Define `configured` only when required configuration, dependencies, permissions, and supported versions are verified. Evidence: configured-state tests. - [x] S1.6.c Define `not_configured` with missing configuration category and authorized resolution path but no secret values. Evidence: not-configured fixtures. - [x] S1.6.d Define `degraded` with affected and retained behavior, cause, limitations, recheck/expiry, and recovery. Evidence: degraded fixtures. - [x] S1.6.e Define `unavailable` with transient/terminal/unknown dependency state, retry/circuit metadata, and no fabricated fallback. Evidence: unavailable fixtures. - [x] S1.6.f Define `failed` for completed probe/evaluation failure with stable error class, correlation, safe detail, and remediation. Evidence: failed fixtures. - [x] S1.6.g Require exhaustive handling and prohibit boolean/truthy collapse in typed and UI consumers. Evidence: compile-time negative and consumer tests. - [x] S1.7 Define a typed workbench capability registry. Evidence: duplicate capability IDs and missing version metadata fail validation. - [x] S1.7.a Define stable capability ID, version, owner, domain, audience, host, runtime, lifecycle, and description. Evidence: registry schema. - [x] S1.7.b Define required/optional dependencies, provided contracts, configuration references, provider/resource needs, and health probes. Evidence: dependency metadata tests. - [x] S1.7.c Define supported commands, queries, jobs, routes, blocks, gates, import/export, and publisher features by typed references. Evidence: capability metadata tests. - [x] S1.7.d Define authorization scope, data classification, trust controls, observability, SLO, cost, and fixture policy. Evidence: operational metadata tests. - [x] S1.7.e Enforce unique IDs/aliases, semantic versions, known owners, known contracts, declared dependencies, and acyclic graph. Evidence: registry negative tests. - [x] S1.7.f Merge/discover shared and domain plugin entries deterministically and reject collisions rather than last-write-wins. Evidence: multi-plugin registry tests. - [x] S1.7.g Generate runtime probe and human/API reference projections from the same registry. Evidence: source-to-output drift test. - [x] S1.8 Define a route descriptor with host, audience, scope, navigation, deep-link, and feature-flag metadata. Evidence: route integrity tests. - [x] S1.8.a Define canonical route ID, path/pattern, method or UI kind, owning capability, contract version, and lifecycle. Evidence: route descriptor schema. - [x] S1.8.b Define canonical host, allowed host aliases, audience, role, tenant/workspace scope, and data classification. Evidence: host/audience validation tests. - [x] S1.8.c Define navigation placement, label/icon keys, order, parent, breadcrumb, discoverability, and external/embedded behavior. Evidence: navigation metadata tests. - [x] S1.8.d Define deep-link entity, subview, filter, inspector, anchor, expiry, and safe-share state. Evidence: deep-link descriptor tests. - [x] S1.8.e Define feature/config flag identity, default, targeting, dependency, expiry, and unavailable behavior. Evidence: flag metadata tests. - [x] S1.8.f Validate unique IDs and effective paths, known host/capability, authorized audience/scope, navigable parents, and no redirect cycles. Evidence: route integrity negative tests. - [x] S1.8.g Generate route inventory and host navigation projections from the descriptor without silently mounting unauthorized source pages. Evidence: generated route snapshot and drift test. - [x] S1.9 Define domain plugin interfaces for stage models, gate evaluators, structured blocks, previews, inspectors, imports, and publishers. Evidence: minimal A and B archetype test plugins compile. - [x] S1.9.a Define plugin identity, supported kit/contract versions, capability declarations, dependencies, configuration, and lifecycle. Evidence: base plugin contract. - [x] S1.9.b Define typed stage model and transition-guard registration with no shared assumption about domain stage names. Evidence: stage plugin fixtures. - [x] S1.9.c Define gate/evaluator input, raw result, policy verdict, provenance, staleness, remediation, and failure interfaces. Evidence: gate plugin fixtures. - [x] S1.9.d Define block schema, validator, editor, semantic renderer, migration, diff, anchor, import/export, and accessibility interfaces. Evidence: block plugin fixtures. - [x] S1.9.e Define preview and inspector contributions with typed selection, authorization, loading/state, nonvisual alternative, and host isolation. Evidence: projection plugin fixtures. - [x] S1.9.f Define importer plan/validate/execute/reconcile and publisher plan/execute/verify/compensate interfaces. Evidence: interchange plugin fixtures. - [x] S1.9.g Compile and runtime-validate one content-authoring and one operations-console plugin with different types and unsupported capabilities. Evidence: A/B archetype tests. - [x] S1.10 Define stable error codes and safe public error envelopes. Evidence: internal causes are logged but secrets and stack traces are absent from client payloads. - [x] S1.10.a Define namespaces and stable codes for validation, authentication, authorization, tenancy, conflict, state, dependency, provider, job, policy, quota, and internal errors. Evidence: error code registry. - [x] S1.10.b Define envelope fields for code, safe message key/parameters, affected field/reference, retryability, remediation, correlation, and optional details. Evidence: public error schema. - [x] S1.10.c Map domain/internal/provider/database/queue/bridge exceptions to public codes without string matching fragile messages. Evidence: mapper unit tests. - [x] S1.10.d Define HTTP/RPC/job/event status and retry semantics per code. Evidence: transport mapping table. - [x] S1.10.e Redact secrets, tokens, signed URLs, stack traces, SQL, protected identities, content, prompts, and cross-tenant object detail. Evidence: canary-data negative tests. - [x] S1.10.f Correlate the safe envelope to access-controlled internal cause, trace, log, and audit context. Evidence: support lookup integration test. - [x] S1.10.g Version and deprecate codes without reusing semantics. Evidence: compatibility and unknown-code consumer tests. - [x] S1.11 Define schema-version negotiation and supported-version discovery. Evidence: backward-compatible and unsupported-version contract tests. - [x] S1.11.a Define how clients request or declare contract versions for HTTP, events, jobs, bundles, desktop/bridge, and generated clients. Evidence: per-transport version carrier rules. - [x] S1.11.b Define server default selection, minimum/maximum and exact supported versions, compatible ranges, and preference ordering. Evidence: negotiation algorithm tests. - [x] S1.11.c Expose authenticated capability/version discovery with owner, lifecycle, deprecation, sunset, and documentation links. Evidence: discovery contract tests. - [x] S1.11.d Return stable unsupported/too-old/too-new/unknown-version errors with supported alternatives and no silent downgrade. Evidence: refusal fixtures. - [x] S1.11.e Test old client/new server, new client/old server, overlapping ranges, no overlap, missing declaration, and disabled capability. Evidence: version-skew matrix. - [x] S1.11.f Bind negotiated version to validation, serialization, cache, idempotency, audit, and telemetry. Evidence: end-to-end version propagation tests. - [x] S1.12 Define deprecation metadata and telemetry. Evidence: deprecated contract/route use is observable without breaking consumers. - [x] S1.12.a Define deprecated-since, replacement, migration guide, warning, owner, supported-through, sunset, removal version, and exception fields. Evidence: deprecation schema. - [x] S1.12.b Attach deprecation metadata to registry capability, contract, field/enum, route, event/job, package export, bundle profile, and plugin versions. Evidence: coverage matrix. - [x] S1.12.c Emit protocol-appropriate warnings without changing successful response meaning or exposing other consumers. Evidence: compatibility tests. - [x] S1.12.d Record bounded usage by deprecated ID/version, consumer class, environment, and tenant-safe cohort. Evidence: telemetry schema tests. - [x] S1.12.e Alert on usage after migration deadline and block removal while supported consumers remain without approved exception. Evidence: lifecycle gate tests. - [x] S1.12.f Remove telemetry and compatibility adapters with the deprecated surface. Evidence: closure checklist. - [x] S1.13 Export test builders separately from production entry points. Evidence: production bundle scan contains no fixture factories. - [x] S1.13.a Inventory builders, factories, fixtures, fake clocks/IDs, in-memory stores, mock providers, and assertion helpers. Evidence: test-utility register. - [x] S1.13.b Define explicit test subpaths by runtime and capability without reexport from production roots. Evidence: export-map review. - [x] S1.13.c Ensure builders produce schema-valid defaults while requiring explicit values for identity, tenant, rights/consent, or other fields whose defaults would hide test intent. Evidence: builder contract tests. - [x] S1.13.d Mark fixture/synthetic values and prevent builders from being selected by production dependency injection. Evidence: production guard tests. - [x] S1.13.e Reject production source imports from test-only subpaths through boundary lint rules. Evidence: deliberate invalid import test. - [x] S1.13.f Scan built exports, bundles, source maps, and transitive modules for test utilities and fixture data. Evidence: clean production scan. Two further defects this cell surfaced, fixed here rather than filed: the export map's module graph read `src/` non-recursively and resolved relative specifiers by stripping `./`, so a nested module was invisible and `../x.js` matched nothing — every check downstream saw a smaller graph than exists. And `assertTestRuntime` read the `process` global directly, which compiles only where `@types/node` is installed; the alias-resolution gate caught it by compiling a consumer program with `types: []`, which is what a `test-contract` subpath claiming to be runtime-agnostic has to survive. - [x] S1.14 Generate API reference from source contracts. Evidence: generation is deterministic and CI detects drift. - [x] S1.14.a Define authoritative contract/registry sources and exclude internal, test-only, unsupported, and secret configuration detail. Evidence: documented generation inputs. - [x] S1.14.b Generate capability, route, command/query, event/job, schema, error, version, lifecycle, and plugin reference pages. Evidence: complete reference index. - [x] S1.14.c Include valid and invalid examples, authorization/scope, idempotency/concurrency, pagination, state/failure, compatibility, deprecation, and evidence links. Evidence: section completeness check. - [x] S1.14.d Sort output and serialize examples deterministically with pinned tool versions. Evidence: repeat generation is byte-identical. - [x] S1.14.e Validate internal links, anchors, schema refs, example parsing, and source provenance. Evidence: documentation validation output. - [x] S1.14.f Add CI check that regenerates in memory or a temp directory and prints actionable drift. Evidence: deliberate source-change failure. ### S2 — Lifecycle, revisions, decisions, and gates - [x] S2.1 Extract the generic stage-machine engine with typed stage unions. Evidence: illegal transitions cannot be expressed without an explicit guard bypass type. - [x] S2.1.a Define typed stage identity, stage metadata, initial/terminal flags, and domain-owned stage union registration. Evidence: stage definition type tests. - [x] S2.1.b Define typed transition identity, source set, target, trigger, actor scope, guard set, side-effect intent, and reversal metadata. Evidence: transition schema tests. - [x] S2.1.c Build a transition graph that rejects unknown stages, duplicate transitions, unreachable stages, unintended cycles, and missing initial state. Evidence: graph validation tests. - [x] S2.1.d Expose allowed-transition queries with exact guard requirements but no mutation. Evidence: query known-value tests. - [x] S2.1.e Execute transitions only through a typed authorized command and expected revision. Evidence: direct-state-write negative tests. - [x] S2.1.f Require an explicit privileged bypass type carrying authority, reason, scope, evidence, and audit linkage. Evidence: compile/runtime bypass tests. - [x] S2.1.g Instantiate two domains with disjoint stage unions to prove no shared hard-coded stages. Evidence: cross-domain compile fixtures. The extraction the cell names is the two graph analyses. `plugins.ts` carried its own reachability loop for the declarative model a plugin contributes, and two implementations of "can you get there from here?" is one that disagrees with the other the first time a source set or a self-loop is involved. Both now call `unreachableFrom`/`cyclesIn` over an untyped `EdgeSet` — the plugin contract is a WEAKER shape than an engine transition (no trigger, no effects, no reversal), so it lifts into that rather than into a full graph, and nothing has to invent the fields the plugin never stated. - [x] S2.2 Make transition guards pure and evidence-driven. Evidence: known-value tests cover pass, fail, stale, missing, and unavailable evidence. - [x] S2.2.a Define immutable guard input containing current object/revision, actor/scope, target transition, versioned evidence refs, policy, and clock snapshot. Evidence: guard input contract. - [x] S2.2.b Prohibit database, network, provider, current-time, random, global configuration, and mutation access inside guard evaluation. Evidence: boundary lint/type tests. - [x] S2.2.c Define pass, fail, stale, missing, unavailable, unsupported, and evaluator-error results with stable reason/remediation fields. Evidence: result union tests. - [x] S2.2.d Compose multiple guards deterministically with explicit blocker/warning and short-circuit policy. Evidence: composition truth-table tests. - [x] S2.2.e Preserve every consulted evidence version and policy version in the result. Evidence: provenance assertions. - [x] S2.2.f Re-evaluate identical input byte-for-byte to the same semantic result. Evidence: determinism/property tests. The purity harness is the part worth reusing elsewhere in this ledger. Every other "must be deterministic" cell in Phase S is currently a convention; this is the shape that makes one enforceable — take the capability away for the duration of the call, restore it in a `finally`, and turn the resulting throw into a typed outcome rather than an exception. - [ ] S2.3 Add optimistic concurrency with expected revision. Evidence: concurrent updates return a typed conflict and never last-write-win silently. - [x] S2.3.a Require expected revision or an explicitly authorized create-if-absent precondition on every mutable command. Evidence: command schema tests. - [x] S2.3.b Compare expected revision and mutate/increment revision atomically in persistence. Evidence: real-database race tests. - [x] S2.3.c Return typed current/expected revision, affected target, safe current metadata, and compare/reload remediation on mismatch. Evidence: conflict envelope fixtures. - [ ] S2.3.d Preserve the rejected client intent for compare, retry, copy, or support recovery without applying it. Evidence: browser/BFF conflict journey. - [x] S2.3.e Apply the same precondition to bulk, import, job, restore, transition, and compatibility mutation paths. Evidence: alternate-path negative tests. - [x] S2.3.f Prevent automatic retry from changing the expected revision or overwriting a remote update. Evidence: retry conflict tests. The reusable shape here is the CALIBRATED HARNESS. S2.3.b is the first cell in Phase S whose property lives outside the code — no type makes a write atomic — and the answer was to ship the race in the kit and run it against a real engine with deliberately broken controls beside it. A conformance harness with no negative control proves that it ran, not that it can fail; every later cell that has to check something a database, a browser or a provider does should carry one the same way. - [x] S2.4 Add immutable revision metadata and parent references. Evidence: history integrity test detects gaps, cycles, and hash mismatch. - [x] S2.4.a Persist stable revision ID, entity/workbench scope, schema version, author/delegate, timestamp, reason, and content hash. Evidence: revision metadata tests. - [x] S2.4.b Persist one parent for linear history and explicit multiple parents/base for merge or divergence semantics. Evidence: lineage fixture tests. - [x] S2.4.c Prevent update/deletion of revision content and metadata outside governed retention/tombstone operations. Evidence: immutability negative tests. - [x] S2.4.d Enforce unique revision sequence/identity and detect missing parent, cross-entity parent, self-parent, and cycle. Evidence: database and graph integrity tests. - [x] S2.4.e Compute/verify content hash from canonical stored content or referenced artifact bytes. Evidence: tamper detection tests. - [x] S2.4.f Reconstruct heads, branches, ancestry, and chronological audit links without mutable denormalized history. Evidence: reconstruction tests. Worth carrying forward: this cell and S2.3.b are the two where the kit stopped being able to prove its own claim alone, and both were answered the same way — put the rule in the layer that can hold it, then run a harness that shows what the OTHER layer catches that this one cannot. A constraint set with no graph check beside it, or a graph check with no constraints beneath it, each reads as complete on its own. - [x] S2.5 Add semantic diff adapters for scalar, list, tree, graph, timeline, and binary-metadata changes. Evidence: golden diff fixtures. - [x] S2.5.a Define common diff operation identity, path/anchor, before/after revision, change type, actor/provenance, and inaccessible/unsupported states. Evidence: shared diff contract. - [x] S2.5.b Implement scalar/object-field comparison with absent/null/default, unit, locale-neutral, enum, and sensitive-value semantics. Evidence: scalar golden fixtures. - [x] S2.5.c Implement ordered/unordered list insert, delete, move, replace, duplicate identity, and item-field changes. Evidence: list golden fixtures. - [x] S2.5.d Implement tree add/remove/move/reparent/reorder/field changes with stable node identity and cycle-invalid state. Evidence: tree fixtures. - [x] S2.5.e Implement graph node/edge/port/property add/remove/reconnect and layout-versus-semantic change separation. Evidence: graph fixtures. - [x] S2.5.f Implement timeline/temporal add/remove/move/trim/split/merge, time-base conversion, track/lane, and parameter changes. Evidence: timeline fixtures. - [x] S2.5.g Implement binary metadata comparison for identity/hash, size, media type, dimensions/duration, codec, channels, embedded metadata, provenance, and availability without pretending to diff opaque bytes. Evidence: binary-metadata fixtures. - [x] S2.5.h Provide stable ordering, accessible summaries, pagination, and redaction across all adapters. Evidence: cross-adapter contract tests. A method note for the rest of the ledger: the two mutants that survived here both survived because a LATER check happened to reject the same fixtures, not because the code was right. That is the class of bug a passing suite cannot show you and a mutant can — a guard that has never been the reason anything failed. Worth running a short mutation pass on any cell whose value is a decision procedure rather than a shape. - [x] S2.6 Add restore-as-new-revision. Evidence: restoring never mutates or deletes history. - [x] S2.6.a Authorize restore against object, source revision, current head, target stage, and protected-field policy. Evidence: restore authorization tests. - [x] S2.6.b Preview semantic differences, dependency/gate staleness, rights or consent impact, and irreversible downstream effects. Evidence: restore preview fixtures. - [x] S2.6.c Require expected current revision and reject changed head before commit. Evidence: restore race test. - [x] S2.6.d Create a new immutable revision whose content derives from and links to the selected historical revision. Evidence: restore lineage assertions. - [x] S2.6.e Preserve intervening revisions and current history; never reassign old heads or delete descendants. Evidence: history integrity tests. - [x] S2.6.f Invalidate dependent gates/projections and emit audit/outbox events transactionally. Evidence: restore integration tests. - [x] S2.7 Add domain-neutral decision records. Evidence: rationale, actor, options, evidence refs, and supersession invariants are tested. - [x] S2.7.a Define decision ID/type/scope, owner, status, effective version, review date, and affected capability/object references. Evidence: decision schema tests. - [x] S2.7.b Define considered option identity, description, status, benefits/costs, dependencies, risks, and rejection reason. Evidence: multi-option fixtures. - [x] S2.7.c Define immutable evidence references with version/hash and access-safe summary. Evidence: evidence integrity tests. - [x] S2.7.d Record proposer, decider, reviewers, delegated authority, timestamp, rationale, consequences, and residual risk. Evidence: actor/required-field tests. - [x] S2.7.e Define propose/review/approve/reject/effective/superseded/reversed transitions and authorization. Evidence: decision state tests. - [x] S2.7.f Supersede or reverse only by creating a new linked record while retaining original content. Evidence: lineage immutability tests. - [x] S2.8 Add score-vector provenance without a default fabricated score. Evidence: absent scores remain absent end-to-end. - [x] S2.8.a Define score dimension ID, raw value, unit, direction, scale, applicability, and optional uncertainty independently from verdict. Evidence: score dimension schema. - [x] S2.8.b Persist evaluator/corpus/model/provider, preprocessing, policy, threshold, input revision/hash, run, and timestamp versions. Evidence: score provenance tests. - [x] S2.8.c Represent absent, not applicable, insufficient data, unsupported, unavailable, failed, stale, and redacted explicitly without numeric sentinels. Evidence: nonvalue state fixtures. - [x] S2.8.d Preserve raw values when policy/threshold changes and recompute derived verdicts separately. Evidence: policy recomputation tests. - [x] S2.8.e Serialize, persist, query, display, compare, export, and publish an absent score without creating zero, neutral, average, or pass. Evidence: end-to-end absence tests. - [x] S2.8.f Reject UI/BFF adapters that fill missing dimensions or average incompatible units. Evidence: adversarial adapter tests. - [x] S2.9 Add gate definitions with severity, owner, applicability, evidence version, expiry, and remediation metadata. Evidence: schema tests. - [x] S2.9.a Define stable gate ID/type/version, domain/object applicability, lifecycle stage, audience/target, and enabled/retired state. Evidence: gate identity tests. - [x] S2.9.b Define blocker/warning/informational severity independently from raw evaluator result. Evidence: severity fixtures. - [x] S2.9.c Assign accountable owner, evaluator/provider owner, remediation owner, reviewer/override authority, and escalation. Evidence: ownership validation. - [x] S2.9.d Define required evidence types, exact version constraints, freshness/expiry, invalidating dependencies, and unavailable behavior. Evidence: evidence policy tests. - [x] S2.9.e Define pass/warn/fail/review/unsupported policy, thresholds, and deterministic composition references. Evidence: policy schema tests. - [x] S2.9.f Define user-facing reason, affected fields/refs, remediation, documentation, recompute, appeal, and waiver metadata. Evidence: remediation metadata tests. - [x] S2.10 Add gate-run results with deterministic aggregate policy. Evidence: blocker, warning, waived, unavailable, and stale combinations have known outcomes. - [x] S2.10.a Persist run ID, gate definition/version, target revision, dependency/evidence versions, evaluator/policy, actor/job, and timestamps. Evidence: result provenance tests. - [x] S2.10.b Persist raw measurements and nonvalue states separately from policy verdict and aggregate release eligibility. Evidence: separation tests. - [x] S2.10.c Define precedence and aggregation for blocker, warning, pass, fail, unavailable, unsupported, stale, missing, waived, and error. Evidence: exhaustive truth table. - [x] S2.10.d Define all-of, any-of, quorum, conditional, target-specific, and domain plugin composition without order dependence. Evidence: aggregation strategy tests. - [x] S2.10.e Preserve every component result and reason; never hide a blocker behind an average or passing sibling. Evidence: component visibility tests. - [x] S2.10.f Recompute identical input deterministically and version aggregate policy changes. Evidence: property and version-change tests. - [x] S2.11 Add authorized, time-bounded gate waivers. Evidence: expiry automatically makes the release ineligible. - [x] S2.11.a Define waiver request for exact gate result, target revision, audience/channel/environment, reason, evidence, and risk. Evidence: waiver schema. - [x] S2.11.b Enforce gate-specific waiverability and actor/role/tenant/object scope plus separation of duties. Evidence: authorization negative tests. - [x] S2.11.c Require start, expiry or one-use, review date, revocation, and renewal as a new decision. Evidence: clock-controlled lifecycle tests. - [x] S2.11.d Bind the waiver to gate/input/evaluator/policy/dependency versions and invalidate it on any out-of-scope change. Evidence: binding invalidation tests. - [x] S2.11.e Include active waiver scope, reason, approver, expiry, and residual risk in review/publish/release surfaces. Evidence: visibility tests. - [x] S2.11.f Make expired, revoked, stale, or out-of-scope waivers nonauthorizing without deleting their audit history. Evidence: release-eligibility tests. - [x] S2.12 Add dependency-triggered staleness propagation. Evidence: a source, model, consent, canon, or asset update marks every dependent gate stale. - [x] S2.12.a Define dependency node/edge and invalidating mutation types for sources, models, consent, canon, assets, policies, evaluators, and target configurations. Evidence: invalidation registry. - [x] S2.12.b Emit versioned dependency-change events transactionally with authoritative mutations. Evidence: outbox atomicity tests. - [x] S2.12.c Traverse direct and transitive dependents with bounded fan-out, cycles, depth, pagination, and version checks. Evidence: graph traversal tests. - [x] S2.12.d Mark affected results stale with old/new dependency version, event, reason, and time before downstream authorization. Evidence: stale-state tests. - [x] S2.12.e Queue idempotent recomputation or require explicit action according to policy/cost/consent/provider constraints. Evidence: recomputation routing tests. - [x] S2.12.f Reconcile missed events and partial propagation against stored dependency versions. Evidence: fault-injection repair tests. - [x] S2.13 Add a human-signoff gate type that automation cannot self-complete. Evidence: system actor attempts are rejected. - [x] S2.13.a Define required human role, named-person or eligible-pool scope, quorum, sequence, independence, and expiry. Evidence: human gate schema. - [x] S2.13.b Require authenticated human presence and step-up authentication where risk policy demands. Evidence: identity/step-up tests. - [x] S2.13.c Reject service, system, agent, model, fixture, unauthenticated, and impersonated actors even when they possess a generic role claim. Evidence: actor-type negative tests. - [x] S2.13.d Record reviewed target/evidence versions, decision, comment, timestamp, authority, conflict/recusal, and signature or equivalent. Evidence: signoff record tests. - [x] S2.13.e Invalidate signoff on expiry or relevant target/evidence/policy change. Evidence: staleness tests. - [x] S2.13.f Require a new human action for renewal, reversal, or materially changed scope. Evidence: no-automation lifecycle tests. - [x] S2.14 Add stage/gate audit projections. Evidence: the projection can be rebuilt from events and matches stored read models. - [x] S2.14.a Define immutable event types for transition request/refusal/ completion/bypass and gate definition/run/stale/waive/recompute/signoff lifecycle. Evidence: audit event schemas. - [x] S2.14.b Include target/revision, prior/new state, actor/delegate, reason, evidence/policy versions, correlation/trace, and safe error refs. Evidence: event completeness tests. - [x] S2.14.c Build per-object timeline, current stage, available/refused transitions, gate status/freshness, waiver, and signoff projections. Evidence: projection reducer tests. - [x] S2.14.d Apply deterministic ordering, idempotency, versioning, out-of-order handling, poison quarantine, and replay. Evidence: event-delivery tests. - [x] S2.14.e Rebuild projections from an empty store and compare to transactional read models and authoritative state. Evidence: full-replay parity test. - [x] S2.14.f Apply tenant/object/property authorization and redaction to audit queries and exports. Evidence: disclosure negative tests. ### S3 — Persistence, tenancy, events, and jobs - [ ] S3.1 Write the shared persistence conventions document. Evidence: it covers explicit columns, `DateTime`, migrations, indexes, generated clients, and real-DB verification. - [x] S3.1.a Define entity/table naming, stable IDs, tenant/workspace scope, actor/revision/tombstone metadata, relationships, and extension fields. Evidence: normative data-model section. - [x] S3.1.b Define which operational fields require explicit typed columns and the limited allowed uses of JSON/blob payloads. Evidence: column-versus-payload decision rules. - [x] S3.1.c Define UTC instant, local date/time, duration, time zone, calendar, precision, server-clock, and serialization rules for `DateTime` values. Evidence: temporal semantics section. - [x] S3.1.d Define constraints, indexes, pagination order, query-plan review, row-level authorization, encryption, and sensitive-field storage. Evidence: integrity/performance section. - [x] S3.1.e Define migration expand/backfill/verify/contract, compatibility, rollback/compensation, production rehearsal, and evidence conventions. Evidence: migration section. - [x] S3.1.f Define generated client/model ownership, commands, checked-in artifacts, drift, version skew, and hand-edit prohibition. Evidence: code-generation section. - [x] S3.1.g Define required real-database unit-of-work, concurrency, constraint, migration, query-plan, isolation, backup/restore, and compatibility verification. Evidence: verification section. - [ ] S3.1.h Review the document against each shared entity and obtain data- platform/security ownership approval. Evidence: applicability and approval record. - [x] S3.2 Define tenant and workspace ownership for every shared entity. Evidence: row-access policy matrix. - [x] S3.2.a Inventory shared authoritative, revision, evidence, job, event, audit, blob, review, taxonomy, calendar, catalog, and projection entities. Evidence: entity register. - [x] S3.2.b Classify each entity as tenant-owned, workspace-owned, cross-workspace tenant-owned, global reference, public immutable, or operational system state. Evidence: ownership classification. - [x] S3.2.c Define creator, owner, contributor, reviewer, delegate, operator, service, and support access per operation and lifecycle state. Evidence: row-access matrix. - [x] S3.2.d Define ownership inheritance and validation for child, join, revision, event, job, blob, cache, and projection rows. Evidence: relationship policy. - [x] S3.2.e Define cross-workspace share, transfer, fork/copy, export/import, support access, and tenant migration behavior. Evidence: boundary transition rules. - [x] S3.2.f Enforce scope in schema/queries and test colliding IDs, counts, search, joins, caches, jobs, events, exports, and audit. Evidence: entity-complete isolation tests. - [x] S3.3 Define soft-delete, retention, legal-hold, and purge semantics. Evidence: lifecycle tests cover all transitions. - [x] S3.3.a Define active, deletion-requested, soft-deleted, retained, legal-held, purge-eligible, purging, purged, restored, and failed states. Evidence: deletion lifecycle machine. - [x] S3.3.b Define deletion authorization, impact preview, confirmation, grace period, tombstone visibility, undo/restore, and notification. Evidence: soft-delete transition tests. - [x] S3.3.c Define retention duration/source, min/max precedence, category, tenant policy, regulatory/contractual override, and review. Evidence: retention policy tests. - [x] S3.3.d Define legal-hold scope, authority, reason, evidence, start/end, protected data, secrecy, release, and audit. Evidence: hold lifecycle tests. - [x] S3.3.e Define dependency order for metadata, blobs, revisions, events, caches, indexes, derivatives, providers, exports, and ledger records. Evidence: purge graph. - [x] S3.3.f Make purge durable, idempotent, resumable, observable, and fail-closed around held/referenced data. Evidence: partial-failure purge tests. - [x] S3.3.g Preserve allowed noncontent audit/tombstone proof without retaining prohibited personal or protected content. Evidence: post-purge privacy review. - [x] S3.4 Define revision and idempotency unique constraints. Evidence: concurrent duplicate writes collapse safely. - [x] S3.4.a Define unique entity revision ID and monotonic sequence/head constraints scoped by tenant/workspace and object. Evidence: schema constraints. - [x] S3.4.b Define parent/base revision referential integrity and prevent self, cross-object, missing, and cyclic lineage. Evidence: constraint and integrity tests. - [x] S3.4.c Define idempotency record uniqueness by tenant, actor/client, operation/version, key, and target where required. Evidence: key scope constraints. - [x] S3.4.d Store canonical request hash and reject same key with different input, target, identity, or contract. Evidence: mismatch tests. - [x] S3.4.e Atomically return existing accepted/running/completed result under concurrent identical requests. Evidence: high-contention real-DB tests. - [x] S3.4.f Define expiry/partition/archive behavior without allowing late duplicates of irreversible commands. Evidence: retention boundary tests. - [x] S3.5 Define searchable indexes for stage, status, owner, dates, taxonomy, gate status, and stable identifiers. Evidence: query plans on realistic volume avoid sequential scans for critical paths. - [x] S3.5.a Enumerate critical filter/sort/pagination queries and production- shape row/cardinality distributions. Evidence: query workload manifest. - [x] S3.5.b Add tenant/scope-prefixed indexes for lifecycle stage and domain status combinations. Evidence: stage/status query plans. - [x] S3.5.c Add owner, actor, assignee, reviewer, team, and delegated-scope indexes required by inbox/search. Evidence: ownership query plans. - [x] S3.5.d Add created/updated/due/effective/expiry/embargo/publish/event time indexes with deterministic ID tie-breakers. Evidence: date query plans. - [x] S3.5.e Add taxonomy membership/path/alias indexes for supported hierarchical and facet queries. Evidence: taxonomy query plans. - [x] S3.5.f Add gate ID/verdict/severity/freshness/evaluator/policy/expiry indexes for eligibility and triage. Evidence: gate query plans. - [x] S3.5.g Add exact internal/external stable identifier uniqueness and lookup indexes without fuzzy collision. Evidence: identifier plans. - [x] S3.5.h Measure write/storage cost, redundant indexes, partial-index predicates, sensitive-data exposure, and plan stability. Evidence: index trade-off report. - [x] S3.5.i Fail performance checks when critical realistic queries regress to unsafe sequential scan or unstable sort. Evidence: query-plan gate. - [x] S3.6 Implement a transaction-bound outbox. Evidence: commit-with-event and rollback-without-event integration tests. - [x] S3.6.a Define outbox row identity, tenant, producer, aggregate/subject, event kind/version, sequence, causation/correlation/trace, payload ref, availability, attempt, and state. Evidence: outbox schema. - [x] S3.6.b Insert authoritative mutation and outbox intent in one database transaction through the shared unit of work. Evidence: atomic commit/ rollback tests. - [x] S3.6.c Claim unpublished rows with bounded batches, ordering/fairness, leases or skip-locking, and concurrent dispatcher safety. Evidence: dispatcher contention tests. - [x] S3.6.d Publish with stable event ID and destination/partition semantics, then mark outcome without losing an externally published event. Evidence: publish/ack crash-window tests. - [x] S3.6.e Apply retry classification, backoff, max age/attempts, circuit, and poison quarantine. Evidence: delivery fault tests. - [x] S3.6.f Expose queue age, attempts, lag, failures, poison, throughput, correlation, and safe replay operations. Evidence: outbox operability tests. - [x] S3.6.g Retain/archive/delete dispatched rows according to replay, audit, privacy, and incident policy. Evidence: outbox retention tests. - [x] S3.7 Implement an idempotent inbox. Evidence: duplicate and out-of-order events produce one correct projection. - [x] S3.7.a Define inbox identity by tenant, consumer/projection, producer, event ID/version, partition/subject, and payload hash. Evidence: inbox schema. - [x] S3.7.b Validate envelope/version/authorization/scope and persist receipt before or with side effects. Evidence: invalid-event tests. - [x] S3.7.c Deduplicate concurrent and repeated delivery and return prior processing outcome without repeating effects. Evidence: duplicate contention tests. - [x] S3.7.d Define per-subject sequence, gap, late, out-of-order, and commutative-event handling. Evidence: ordering fixture matrix. - [x] S3.7.e Apply inbox receipt and projection/domain mutation in one transaction or documented saga. Evidence: crash atomicity tests. - [x] S3.7.f Persist processing version/result/error/attempt and support safe retry after transient failure. Evidence: retry tests. - [x] S3.7.g Rebuild a projection from replayed duplicate/out-of-order history and match authoritative expected state. Evidence: full replay parity. - [x] S3.8 Implement poison-event quarantine and replay. Evidence: operator workflow test preserves cause and audit. - [x] S3.8.a Classify malformed, unsupported, unauthorized, invariant, dependency, deterministic-handler, repeated transient, and unknown poison conditions. Evidence: classification tests. - [x] S3.8.b Quarantine original immutable event reference/hash, safe payload access, consumer/version, attempts, cause chain, trace, and timestamps. Evidence: quarantine schema tests. - [x] S3.8.c Stop hot-loop delivery while isolating only the affected event, subject, partition, or consumer according to ordering semantics. Evidence: blast-radius tests. - [x] S3.8.d Expose authorized inspect, assign, comment, link incident/fix, suppress, transform/migrate, replay, skip, and archive actions. Evidence: operator API/UI journey. - [x] S3.8.e Revalidate event, handler version, dependencies, authorization, sequence, and dry-run impact before replay. Evidence: replay guard tests. - [x] S3.8.f Replay idempotently with new attempt identity while preserving original event identity and complete audit. Evidence: replay integration tests. - [x] S3.8.g Alert and reconcile growing quarantine, blocked partitions, stale owner, and unresolved age. Evidence: poison operations tests. - [x] S3.9 Implement durable jobs with lease, heartbeat, progress, checkpoint, cancellation, retry, and dead-letter state. Evidence: clock-controlled integration tests. - [x] S3.9.a Persist job identity/type/version, tenant/actor, immutable inputs, priority/queue, idempotency, budget, deadline, and initial queued state. Evidence: job creation tests. - [x] S3.9.b Claim with exclusive time-bounded lease, worker ID, attempt, and fencing token. Evidence: competing-worker tests. - [x] S3.9.c Renew heartbeat and lease on a controlled cadence and prevent expired workers from committing. Evidence: lease-loss tests. - [x] S3.9.d Persist stage-specific completed/total progress, message key, output refs, and monotonic timestamp without false completion. Evidence: progress invariant tests. - [x] S3.9.e Persist versioned resumable checkpoints transactionally with authoritative stage effects. Evidence: crash/resume tests. - [x] S3.9.f Implement requested/cancelling/cancelled semantics, cooperative checkpoints, noncancellable regions, external cancel, and compensation. Evidence: stage cancellation tests. - [x] S3.9.g Classify retryability and apply bounded attempts, exponential backoff/jitter, maximum age, capacity, and spend policy. Evidence: deterministic retry tests. - [x] S3.9.h Dead-letter exhausted/terminal jobs with safe diagnostics, owner, retained inputs, remediation, and authorized replay/abandon. Evidence: dead-letter workflow test. - [x] S3.9.i Reconcile orphan leases and external outcomes unknown after worker death. Evidence: fault-injection repair test. - [x] S3.10 Implement job parent/child graphs and aggregate progress. Evidence: partial failure semantics are deterministic. - [x] S3.10.a Define parent/child edge type, ordering, dependency, optional/required, weight/unit, failure policy, and cancellation propagation. Evidence: graph schema. - [x] S3.10.b Validate known jobs, same tenant/workbench, acyclic graph, maximum depth/fan-out, and immutable edges after execution begins. Evidence: graph constraint tests. - [x] S3.10.c Schedule ready children only after required dependencies and capacity/budget gates. Evidence: dependency scheduling tests. - [x] S3.10.d Aggregate heterogeneous progress through explicit weights/units and preserve unknown/indeterminate work honestly. Evidence: known-value aggregate tests. - [x] S3.10.e Define parent queued/running/waiting/partial/failed/cancelled/ succeeded outcome for every required/optional child combination. Evidence: exhaustive state truth table. - [x] S3.10.f Propagate cancellation and retry without duplicating completed children or invalidating reusable output incorrectly. Evidence: cancellation/retry graph tests. - [x] S3.10.g Expose traversable graph, critical path, child results, blockers, costs, and safe diagnostics. Evidence: graph query/UI tests. - [x] S3.11 Implement blob references with size, media type, checksum, encryption, retention, and provenance metadata. Evidence: stored-byte rehash integration test. - [x] S3.11.a Define blob reference ID, tenant/scope, immutable storage locator/version, state, created actor/time, and owning references. Evidence: blob schema. - [x] S3.11.b Record server-observed byte size and sniffed media type separately from untrusted supplied metadata. Evidence: spoofing tests. - [x] S3.11.c Compute approved hash from stored bytes and persist algorithm, digest, and verification time. Evidence: known-byte and tamper tests. - [x] S3.11.d Define encryption mode/key reference/version, region, transport, rotation, and decrypt authorization without storing keys. Evidence: encryption metadata tests. - [x] S3.11.e Define quarantine/active/rejected/retained/held/purge states, retention source/expiry, legal hold, and deletion semantics. Evidence: blob lifecycle tests. - [x] S3.11.f Link provenance manifest/ledger, ingredients, generating run, transformations, source revision, and derived artifacts. Evidence: provenance linkage tests. - [x] S3.11.g Re-read and rehash the exact stored bytes across local/object storage adapters and detect corruption. Evidence: real-storage integration tests. - [x] S3.12 Implement orphan-blob discovery and safe reclamation. Evidence: referenced, legal-held, and pending-upload blobs are never removed. - [x] S3.12.a Enumerate authoritative references from entities, revisions, jobs, outbox/inbox, evidence, provenance, bundles, uploads, releases, audit, and legal holds. Evidence: reference-source register. - [x] S3.12.b Detect metadata-without-bytes, bytes-without-metadata, unreferenced active, abandoned upload/quarantine, failed derivative, and dangling-reference classes. Evidence: orphan classification tests. - [x] S3.12.c Apply age/grace, upload/lease state, retention, hold, quarantine/incident, release, and provider reconciliation gates. Evidence: eligibility policy tests. - [x] S3.12.d Produce a dry-run candidate manifest with size/cost, reason, reference search, confidence, and sampled verification. Evidence: operator preview. - [x] S3.12.e Mark candidates with a reclamation token and recheck references atomically before deletion. Evidence: new-reference race tests. - [x] S3.12.f Delete idempotently in bounded batches, preserve audit/tombstone where permitted, and report partial/unknown outcomes. Evidence: deletion fault tests. - [x] S3.12.g Reconcile deletion and restore/relink false positives before permanently closing findings. Evidence: reclamation report. - [x] S3.13 Implement encrypted sensitive-field storage or vault references. Evidence: database dumps and logs do not expose protected values. - [x] S3.13.a Inventory sensitive fields and classify encryption-at-rest, tokenization, one-way hash, vault reference, or prohibited persistence. Evidence: field protection matrix. - [x] S3.13.b Define key hierarchy, KMS/vault ownership, tenant/context binding, algorithm/version, rotation, revocation, and break-glass access. Evidence: cryptographic design review. - [x] S3.13.c Encrypt before persistence with authenticated associated context and prevent plaintext indexing/querying unless explicitly tokenized. Evidence: tamper and query tests. - [x] S3.13.d Resolve vault references through least-privilege identity, purpose, short-lived access, caching prohibition, and audit. Evidence: vault integration tests. - [x] S3.13.e Redact ORM errors, SQL parameters, logs, traces, metrics, audit summaries, test snapshots, support exports, and backups. Evidence: canary-secret scans. - [x] S3.13.f Migrate plaintext values safely with resumable backfill, verification, compatibility, rollback/compensation, and plaintext removal. Evidence: migration rehearsal. - [x] S3.13.g Test backup/restore, rotation, unavailable KMS/vault, corrupted ciphertext, deleted key, and unauthorized access. Evidence: failure matrix. - [x] S3.14 Implement database health and schema-compatibility probes. Evidence: incompatible schema returns fail-closed readiness. - [x] S3.14.a Separate liveness from readiness and define safe database connection/timeout/pool checks. Evidence: probe contract. - [x] S3.14.b Verify read and, where required, transactional write capability without mutating user data. Evidence: probe integration tests. - [x] S3.14.c Read authoritative migration/schema version and compare it with application minimum, maximum, exact, dirty, in-progress, and incompatible states. Evidence: version matrix tests. - [x] S3.14.d Check required extensions, tables, columns, constraints, indexes, triggers/policies, generated model registry, and permissions. Evidence: compatibility assertions. - [x] S3.14.e Return configured/degraded/unavailable/failed status with safe reason and remediation but no DSN, credentials, SQL, or schema secrets. Evidence: public response redaction tests. - [x] S3.14.f Fail readiness before serving writes/jobs when schema is too old, too new, dirty, partially migrated, or missing required policy. Evidence: startup/readiness tests. - [x] S3.14.g Instrument latency/failure without high-cardinality database detail and alert on sustained incompatibility. Evidence: probe observability tests. - [x] S3.15 Write migration templates for expand/backfill/verify/contract. Evidence: a sample zero-downtime migration rehearsal passes. - [x] S3.15.a Create expand template for additive nullable/default-safe schema, indexes/concurrent build, permissions, generated client update, and compatibility checks. Evidence: expand template. - [x] S3.15.b Create backfill template with immutable input query, batches, checkpoints, idempotency, rate/lock limits, quarantine, progress, and resume. Evidence: backfill template. - [x] S3.15.c Create verify template for counts, nulls, constraints, hashes, duplicates, orphans, semantic samples, performance, and old/new read/write parity. Evidence: verify template. - [x] S3.15.d Create contract template for precondition proof, old writer/ reader absence, removal/constraint tightening, cleanup, and rollback or compensation. Evidence: contract template. - [x] S3.15.e Include owner, approvals, maintenance/lock budget, observability, abort threshold, incident/rollback, evidence paths, and completion criteria in every phase. Evidence: template completeness test. - [x] S3.15.f Implement a sample rename/type-change migration using dual- version coexistence rather than flag-day deployment. Evidence: sample migration artifacts. - [x] S3.15.g Rehearse on production-size representative data with old/new binaries, live writes, interruption, rollback/compensation, and final query plans. Evidence: timed zero-downtime report. - [x] S3.16 Add tenant-isolation integration tests using two tenants and colliding object IDs. Evidence: every read, write, search, export, and event path remains isolated. - [x] S3.16.a Provision two tenants with identical user-facing identifiers, object IDs where storage permits, names, taxonomy, timestamps, and content markers. Evidence: collision fixture setup. - [x] S3.16.b Test direct get/list/filter/paginate/count/facet/join/history/ revision reads across both identities and roles. Evidence: read isolation matrix. - [x] S3.16.c Test create/update/delete/restore/transition/bulk/import/review/ waiver/publish mutations with cross-tenant targets and relationships. Evidence: write isolation matrix. - [x] S3.16.d Test full-text/structured search, suggestions, saved views, caches, indexes, and unauthorized result counts/snippets. Evidence: search/cache isolation matrix. - [x] S3.16.e Test blob upload/download, derivative, signed URL, bundle/export, backup/restore slice, audit export, and data-subject flows. Evidence: artifact/export isolation matrix. - [x] S3.16.f Test command/event/job/outbox/inbox/provider/callback/notification identity and context propagation. Evidence: asynchronous isolation matrix. - [x] S3.16.g Test error, trace, metric, log, support, and health diagnostics for cross-tenant leakage. Evidence: observability isolation matrix. - [x] S3.16.h Run tests against the real supported database with row-level policies/constraints enabled and fail on any disclosure or mutation. Evidence: passing real-DB report. ### S4 — API, authorization, audit, and abuse controls - [x] S4.1 Implement `createWorkbenchRouter` without encoding Tara-specific routes or roles. Evidence: both archetype fixtures mount successfully. - [x] S4.1.a Define router inputs for plugin registry, contracts, actor resolver, authorization, stores, jobs, providers, audit, tracing, limits, and capability probes. Evidence: constructor type tests. - [x] S4.1.b Register only capability-declared routes and versions with deterministic collision refusal. Evidence: route registration tests. - [x] S4.1.c Apply ordered authentication, scope resolution, validation, authorization, idempotency/concurrency, limits, tracing, audit, and safe-error middleware. Evidence: middleware-order tests. - [x] S4.1.d Keep stage names, roles, content types, gates, routes, copy, provider operations, and publish targets in domain plugins. Evidence: shared source scan. - [x] S4.1.e Mount content-authoring and operations-console fixtures with disjoint types and routes. Evidence: archetype integration tests. - [x] S4.1.f Refuse missing/duplicate/incompatible plugins and expose honest capability state. Evidence: startup negative tests. - [x] S4.2 Reuse the canonical Studio actor resolver rather than inventing a second role system. Evidence: role parity tests against `@oshun/studio-authoring`. - [x] S4.2.a Inventory canonical claims, sessions/tokens, human/service/system variants, tenant/workspace membership, roles, delegations, and support access. Evidence: resolver contract map. - [x] S4.2.b Adapt the canonical resolver without copying role strings or reinterpreting claims. Evidence: adapter source review. - [x] S4.2.c Preserve authenticated actor, delegated actor, tenant/workspace, session strength, and correlation. Evidence: actor context tests. - [x] S4.2.d Reject missing, expired, revoked, malformed, wrong-audience, cross-tenant, and unsupported identity state. Evidence: negative tests. - [x] S4.2.e Compare every relevant role, claim, and delegation result between Studio and the shared router. Evidence: parity fixture matrix. - [x] S4.2.f Detect new canonical roles/claims as drift rather than silently treating them as unprivileged or privileged. Evidence: drift test. - [x] S4.3 Define object-level authorization hooks. Evidence: an authorized role cannot access another tenant or unassigned protected object. - [x] S4.3.a Define hook input for actor/delegate, tenant/workspace, action, object type/ID, lifecycle, owner/assignment, classification, policy, and request context. Evidence: hook contract. - [x] S4.3.b Load authoritative minimal object metadata through a tenant-scoped resolver before decision. Evidence: loader isolation tests. - [x] S4.3.c Compose domain policy, ownership, assignment, team/role, protected-object, legal-hold, lifecycle, and support rules. Evidence: policy truth tables. - [x] S4.3.d Return allow, deny, concealed-not-found, step-up, or unavailable with stable safe reason/remediation. Evidence: result fixtures. - [x] S4.3.e Apply hooks to reads, counts, search, history, blobs, exports, jobs/events, mutations, and indirect parent/child access. Evidence: endpoint coverage matrix. - [x] S4.3.f Test colliding cross-tenant IDs, unassigned protected objects, hidden parents, indirect refs, and stale assignments. Evidence: disclosure negative tests. - [x] S4.4 Define property-level authorization hooks. Evidence: mass-assignment tests cannot modify owner, tenant, approval, gate, provenance, or audit fields. - [x] S4.4.a Define readable, createable, updateable, clearable, sortable, filterable, searchable, exportable, and audit-visible permissions per field/path and object state. Evidence: property policy schema. - [x] S4.4.b Normalize patches, nested objects, arrays, JSON Patch, forms, import mappings, and generated proposals before policy. Evidence: mutation-shape tests. - [x] S4.4.c Reject unknown, immutable, server-owned, write-once, conditionally protected, and unauthorized fields before mutation. Evidence: mass-assignment corpus. - [x] S4.4.d Protect owner, tenant, approval, gate, provenance, audit, role, lifecycle, revision, rights, and consent fields explicitly. Evidence: protected-field tests. - [x] S4.4.e Filter reads, errors, diffs, history, search snippets/facets, exports, audit, and provider context at property level. Evidence: field disclosure tests. - [x] S4.4.f Reevaluate after defaults/normalization and test aliases, duplicate keys, Unicode/case variants, magic fields, sparse arrays, and version skew. Evidence: bypass negative tests. - [x] S4.5 Define function-level authorization for capture, edit, review, waive, publish, unpublish, purge, and administration. Evidence: role matrix contract tests. - [x] S4.5.a Define capture/create authority by source type, target parent, object type, quota, classification, rights, and consent. Evidence: capture permission tests. - [x] S4.5.b Define edit authority by revision, lifecycle, field/block class, ownership/assignment, lock, and conflict. Evidence: edit permission tests. - [x] S4.5.c Define comment, suggestion, assignment, verdict, approval, abstention, recusal, escalation, and delegation authority. Evidence: review permission tests. - [x] S4.5.d Define gate run/recompute, appeal, waiver/override, signoff, and policy configuration authority with separation of duties. Evidence: gate permission tests. - [x] S4.5.e Define preview, publish/release, correction, supersession, unpublish, recall, and rollback authority per target. Evidence: release permission tests. - [x] S4.5.f Define purge/restore, secret/key, replay, feature/config, support, kill switch, and other administrative authority. Evidence: high-risk permission tests. - [x] S4.5.g Apply identical decisions to UI discovery, API, job, event, compatibility, and direct service paths. Evidence: alternate-path tests. - [x] S4.6 Add step-up authorization support for high-risk mutations. Evidence: stale or missing step-up tokens are rejected. - [x] S4.6.a Define risk combinations requiring step-up and accepted assurance methods. Evidence: step-up policy. - [x] S4.6.b Create a short-lived one-time challenge bound to actor/session, tenant, exact action, target, parameters/hash, reason, and policy. Evidence: challenge schema tests. - [x] S4.6.c Complete supported WebAuthn/MFA/reauth through the canonical identity service without handling credentials in the workbench. Evidence: identity integration tests. - [x] S4.6.d Verify signature, audience, binding, session, assurance, nonce, issued/expiry time, and unused state at mutation. Evidence: tamper/stale/replay tests. - [x] S4.6.e Consume the challenge atomically with command acceptance and reject concurrent reuse. Evidence: real-DB race test. - [x] S4.6.f Audit request, completion/failure, use, expiry, and actor without exposing authentication secrets. Evidence: audit tests. - [x] S4.7 Add idempotency middleware for retryable commands. Evidence: repeated keys with identical bodies replay; mismatched bodies conflict. - [x] S4.7.a Mark retryable routes with key requirement, scope, request canonicalizer, retention, and unknown-outcome policy. Evidence: route metadata tests. - [x] S4.7.b Validate and scope keys by actor/tenant, route/contract, target, and operation version. Evidence: key validation tests. - [x] S4.7.c Canonicalize authorized parameters and persist request hash, state, and result reference atomically with acceptance. Evidence: integration tests. - [x] S4.7.d Replay prior accepted, running, success, or terminal outcome for identical retries without invoking the handler. Evidence: concurrent duplicate tests. - [x] S4.7.e Return a typed conflict for changed body/query/target/identity/ version and do not reserve keys for prevalidation failures. Evidence: mismatch tests. - [x] S4.7.f Reconcile timeout/connection-loss outcomes before repeating irreversible provider or publish effects. Evidence: fault tests. - [x] S4.8 Add optimistic-concurrency preconditions. Evidence: stale revisions return `409` or `412` with merge context. - [x] S4.8.a Declare expected-revision requirement and accepted field/header per mutable route. Evidence: route contracts. - [x] S4.8.b Validate expected revision against authorized current object and reject missing/malformed conditions. Evidence: input tests. - [x] S4.8.c Pass the precondition to an atomic conditional persistence write. Evidence: real-DB race test. - [x] S4.8.d Return `409`/`412`, safe current/expected revision, conflict reason, compare/reload action, and correlation. Evidence: response fixtures. - [x] S4.8.e Apply to edit, transition, restore, review, waiver, bulk, import, job, and publish paths. Evidence: coverage matrix. - [x] S4.8.f Verify idempotent retry replays an accepted result while a new stale intent conflicts. Evidence: interaction tests. - [x] S4.9 Add deterministic cursor pagination. Evidence: no duplicate or missing records while concurrent inserts occur. - [x] S4.9.a Define default/maximum limit and stable default/allowed sorts with unique tie-breakers per collection. Evidence: pagination registry. - [x] S4.9.b Encode sort, filter, direction, position, version, and safe consistency context in an opaque protected cursor. Evidence: cursor tests. - [x] S4.9.c Bind cursors to actor/tenant scope, route/contract, normalized query, and lifetime. Evidence: misuse tests. - [x] S4.9.d Query through authorization using strict before/after keyset conditions rather than offset. Evidence: query plan and disclosure tests. - [x] S4.9.e Define concurrent insert/update/delete/tombstone/permission-change behavior and any snapshot guarantee. Evidence: scenario tests. - [x] S4.9.f Prove forward/backward traversal has no duplicates or missing items within the declared model across equal sort values. Evidence: property tests. - [x] S4.10 Add payload, upload, query-complexity, rate, concurrency, and spend limits. Evidence: limit tests return actionable retry metadata. - [x] S4.10.a Enforce compressed/decompressed body, field, array, batch, response, and archive limits before expensive parsing. Evidence: payload boundary tests. - [x] S4.10.b Enforce upload bytes, parts, files, dimensions, duration, frames/pages, nesting, and decompression ratio. Evidence: upload limit corpus. - [x] S4.10.c Score and limit filter depth, predicates, joins, expansion, requested fields, sort, page size, graph traversal, and search cost. Evidence: query complexity tests. - [x] S4.10.d Enforce sustained/burst request rate by actor, tenant, route, client class, and trust tier. Evidence: rate-limit tests. - [x] S4.10.e Enforce concurrent requests, streams, uploads, jobs, provider calls, and expensive operations by actor/tenant/resource. Evidence: concurrency tests. - [x] S4.10.f Estimate/reserve and enforce per-operation, actor, tenant, period, provider, and exceptional spend budgets. Evidence: spend tests. - [x] S4.10.g Return stable limit category, safe current/max where permitted, reset/retry time, remediation, and correlation. Evidence: response fixtures. - [x] S4.10.h Prevent identity rotation, multiple clients, retries, or batch subdivision from bypassing tenant/actor limits. Evidence: abuse tests. - [x] S4.11 Add guarded remote-resource fetching. Evidence: SSRF, redirect, private-IP, DNS-rebinding, oversize, timeout, and decompression tests. - [x] S4.11.a Canonicalize scheme, credentials, IDNA/host, port, IP literal, path, and fragment before policy. Evidence: URL parser fixtures. - [x] S4.11.b Allowlist schemes/ports and block loopback, link-local, private, reserved, multicast, metadata, internal service, file, and unix targets. Evidence: address negative tests. - [x] S4.11.c Resolve through controlled DNS, validate every address, pin the connection target, and revalidate on reconnect. Evidence: DNS-rebinding tests. - [x] S4.11.d Disable redirects or validate every hop/target/scheme/port/ credential with a strict maximum. Evidence: redirect escape tests. - [x] S4.11.e Enforce connection/TLS/header/idle/body/total timeout, bandwidth, response, retry, and content limits. Evidence: slow/oversize tests. - [x] S4.11.f Bound compressed/decompressed bytes, archive entries/depth, dimensions, frames, duration, and parser resources. Evidence: bomb fixtures. - [x] S4.11.g Sniff content, quarantine mismatch/malicious media, isolate parsing, and prevent privileged interpretation of fetched text. Evidence: polyglot/injection tests. - [x] S4.11.h Strip outbound credentials and redact signed URLs/protected locations from logs and public errors. Evidence: leakage tests. - [x] S4.12 Add audit capture for every mutation outcome, including refusals and partial failures. Evidence: route inventory has no mutation without an audit assertion. - [x] S4.12.a Derive the mutation route/command/job inventory and assign required audit event types. Evidence: route-to-audit matrix. - [x] S4.12.b Capture actor/delegate, tenant, target, action, authorized parameters/hash, prior/new revision, reason, policy, correlation, and time. Evidence: audit schema assertions. - [x] S4.12.c Persist accepted/completed audit atomically with authoritative mutation or guaranteed outbox intent. Evidence: commit/rollback tests. - [x] S4.12.d Record validation, authentication, authorization, policy, conflict, limit, and dependency refusals without claiming mutation. Evidence: refusal audit tests. - [x] S4.12.e Record started/running/partial/completed/failed/cancelled/ compensated/unknown outcomes and per-item bulk results. Evidence: asynchronous/partial audit tests. - [x] S4.12.f Redact content/secrets/protected data, enforce tenant/property access, and preserve immutable integrity/retention. Evidence: audit security tests. - [x] S4.12.g Fail the inventory check when a mutation lacks an outcome audit assertion. Evidence: deliberate uncovered-route failure. - [x] S4.13 Add request/trace correlation to audit and job IDs. Evidence: one journey can be reconstructed across web, BFF, worker, storage, and publisher. - [x] S4.13.a Generate or validate request and W3C trace context at the browser or trusted ingress without accepting spoofed privileged correlation. Evidence: ingress tests. - [x] S4.13.b Create command/idempotency and audit IDs and link them to request, trace, actor, tenant, target, and revision. Evidence: mutation correlation tests. - [x] S4.13.c Propagate correlation through database transaction/outbox, event, inbox, job parent/child/attempt, blob, provider, and external operation. Evidence: async propagation tests. - [x] S4.13.d Propagate allowed trace/correlation through publisher, callback/webhook, desktop/bridge, and read-back verification. Evidence: boundary integration tests. - [x] S4.13.e Index support-safe IDs for reconstruction without using raw high-cardinality IDs as metric labels. Evidence: observability schema tests. - [x] S4.13.f Reconstruct a complete web-to-publisher journey with retries, partial failure, and compensation from stored evidence. Evidence: correlation acceptance report. - [ ] S4.14 Add explicit capability and dependency-health endpoints. Evidence: client states derive from real probes, not build-time guesses. - [x] S4.14.a Define authenticated capability discovery by workbench/domain, contract/version, audience, host, feature/config state, and lifecycle. Evidence: capability endpoint contract. - [x] S4.14.b Implement real database/schema, blob, queue/worker, cache/search, provider/model, signing/trust, delivery/publisher, and bridge/host probes as applicable. Evidence: probe inventory. - [x] S4.14.c Return configured, not-configured, degraded, unavailable, or failed state with checked time, freshness, affected/retained capability, safe reason, and remediation. Evidence: state fixtures. - [x] S4.14.d Separate liveness/readiness from user-facing dependency state and avoid probing through build-time environment assumptions. Evidence: runtime configuration-change tests. - [x] S4.14.e Authorize and redact probe details so ordinary clients receive no secret, topology, internal host, protected tenant, or exploit detail. Evidence: role response tests. - [x] S4.14.f Add timeout/cache/staleness/circuit behavior and distinguish probe failure from dependency failure. Evidence: fault tests. - [ ] S4.14.g Make UI capability banners and controls consume these endpoints exclusively. Evidence: browser network assertion. - [x] S4.15 Add safe error mapping. Evidence: expected domain errors remain stable while unexpected errors produce an opaque ID and server trace. - [x] S4.15.a Inventory validation, auth, tenancy, conflict, lifecycle, policy/gate, dependency, provider, job, quota, and internal error types. Evidence: error mapping register. - [x] S4.15.b Map expected errors to stable code, status, message key/params, field/ref details, retryability, remediation, and correlation. Evidence: mapping tests. - [x] S4.15.c Preserve discriminated domain semantics across API, job update, event, and UI without relying on message parsing. Evidence: end-to-end error fixtures. - [x] S4.15.d Map unexpected errors to an opaque public ID/message and retain access-controlled cause/stack/trace internally. Evidence: unexpected error tests. - [x] S4.15.e Redact secrets, SQL, stack, internal URLs, signed URLs, content, prompts, protected identities, and cross-tenant references. Evidence: canary leakage tests. - [x] S4.15.f Handle mapper failure, unknown future code, nested aggregate error, and partial bulk result safely. Evidence: resilience tests. - [x] S4.16 Generate OpenAPI or equivalent route contracts. Evidence: request, response, auth, error, and idempotency semantics are complete. - [x] S4.16.a Derive operation ID, method/path, owner/capability, summary, lifecycle, version, and tags from route descriptors. Evidence: operation inventory parity. - [x] S4.16.b Generate path/query/header/body/upload schemas with units, formats, limits, defaults, and examples. Evidence: request schema tests. - [x] S4.16.c Generate success/async/partial/paginated/stream responses and capability/job references. Evidence: response schema tests. - [x] S4.16.d Document authentication, tenant/workspace, object/property/ function authorization, step-up, and data classification. Evidence: security completeness check. - [x] S4.16.e Document validation/auth/conflict/limit/dependency/provider/ internal error envelopes and statuses. Evidence: error coverage check. - [x] S4.16.f Document idempotency key scope/retention/replay/conflict and expected-revision preconditions. Evidence: mutation semantics check. - [x] S4.16.g Validate spec, examples, generated clients, server conformance, deterministic output, and drift. Evidence: contract generation gate. - [x] S4.17 Add consumer-driven contract tests for every host application. Evidence: incompatible BFF changes fail before merge. - [x] S4.17.a Inventory each host application's consumed routes, operations, versions, fields, enum/error/state variants, pagination, and streaming assumptions. Evidence: host consumer manifests. - [x] S4.17.b Capture provider-independent expectations as source-controlled contracts with valid/invalid request and response examples. Evidence: per-host contract suites. - [x] S4.17.c Verify current BFF/provider satisfies each consumer contract without permissive unknown fallbacks hiding required behavior. Evidence: provider verification reports. - [x] S4.17.d Verify consumers tolerate declared additive fields/variants and handle not-configured/degraded/unavailable/error/version states. Evidence: consumer compatibility tests. - [x] S4.17.e Test old/new host and BFF versions across the supported compatibility window. Evidence: version-skew matrix. - [x] S4.17.f Add CI ownership and affected execution so a breaking BFF change fails before merge with the exact impacted host. Evidence: deliberate breaking-change test. - [x] S4.18 Add an API inventory drift gate. Evidence: undocumented and unowned routes fail CI. - [x] S4.18.a Enumerate framework, router factory, domain plugin, proxy, redirect, webhook/callback, streaming, health, and administrative routes. Evidence: deterministic API inventory. - [x] S4.18.b Reconcile mounted operations with route descriptors, generated contracts, capability registry, owner, audience/host, and lifecycle. Evidence: bidirectional mapping report. - [x] S4.18.c Detect new, removed, moved, renamed, method/path/version-changed, undocumented, unowned, duplicate, and unreachable operations. Evidence: drift classifications. - [x] S4.18.d Ignore comments/formatting/generation noise while retaining semantic contract and middleware changes. Evidence: noise-control tests. - [x] S4.18.e Fail CI with exact route source, missing metadata, affected consumers, and remediation command. Evidence: deliberate route addition test. - [x] S4.18.f Require explicit disposition/deprecation/migration for removals and compatibility routes. Evidence: removal mutation tests. ### S5 — Provider, grounding, trust, and policy seams - [x] S5.1 Extract `WorkbenchModelProvider` with explicit operations rather than a generic text-completion escape hatch. Evidence: unregistered operations fail typecheck. - [x] S5.1.a Inventory domain model operations with distinct inputs, outputs, safety, grounding, latency, streaming, tool, cost, and acceptance semantics. Evidence: operation register. - [x] S5.1.b Define stable operation IDs and typed versioned request/result/ error contracts for each operation class. Evidence: provider contract types. - [x] S5.1.c Define provider capability discovery and operation-specific model, region, modality, tool, context, output, and policy support. Evidence: capability fixtures. - [x] S5.1.d Define invoke/stream/cancel/reconcile interfaces that preserve idempotency, correlation, usage/cost, provenance, and unknown outcome. Evidence: lifecycle interface tests. - [x] S5.1.e Register domain adapters explicitly and prevent generic prompt/ text completion or arbitrary tool invocation through the shared API. Evidence: compile-time negative tests. - [x] S5.1.f Implement two providers with different supported operation sets and honest unsupported/not-configured results. Evidence: adapter contract suite. - [x] S5.2 Implement `not_configured` as the production default. Evidence: no provider binding results in an exact 503 and zero fabricated output. - [x] S5.2.a Initialize provider registries empty unless an approved runtime binding passes configuration/credential/capability probes. Evidence: default registry test. - [x] S5.2.b Remove or isolate demo, fake, deterministic, fallback, and heuristic providers behind explicit test/dev-only composition. Evidence: production dependency scan. - [x] S5.2.c Return typed `not_configured` with capability, safe missing category, owner/remediation, and correlation as HTTP 503. Evidence: contract fixture. - [x] S5.2.d Prevent UI/BFF adapters from substituting sample output, empty success, cached unrelated output, or inferred scores. Evidence: end-to-end negative tests. - [x] S5.2.e Keep fixture providers visibly labeled and impossible to enable in production build/runtime configuration. Evidence: production guard tests. - [x] S5.2.f Exercise configured, missing credentials, unsupported operation, disabled provider, unhealthy provider, and probe failure separately. Evidence: capability state matrix. - [x] S5.3 Fence instructions, user content, retrieved sources, tool output, and attachments into distinct trust zones. Evidence: indirect-injection eval. - [x] S5.3.a Define immutable trust-zone types and precedence for system/policy, developer template, user request/content, retrieved source, tool result, attachment, and prior generated output. Evidence: trust contract. - [x] S5.3.b Serialize each zone with unambiguous boundaries, source identity, authority label, data classification, and truncation status. Evidence: request assembly tests. - [x] S5.3.c Prevent untrusted zones from altering system policy, tool availability, authorization, output schema, or evidence standards. Evidence: precedence tests. - [x] S5.3.d Sanitize/normalize title, metadata, hidden text, markup, URLs, filenames, archive members, media metadata, and multimodal text. Evidence: indirect-injection corpus. - [x] S5.3.e Minimize tools and bind typed arguments to actor/tenant/resource/ side-effect policy outside the model. Evidence: tool authorization tests. - [x] S5.3.f Evaluate direct, encoded, multilingual, split, multi-turn, retrieved, tool-result, attachment, URL, and multimodal attacks. Evidence: versioned adversarial report. - [x] S5.4 Require structured-output schema validation. Evidence: malformed, truncated, extra-field, and wrong-version outputs are rejected. - [x] S5.4.a Select exact operation/result schema and version before provider invocation and include provider-supported structured mode where available. Evidence: request contract tests. - [x] S5.4.b Bound raw bytes/tokens/depth/arrays/strings/numbers and detect incomplete/stream-truncated output before parsing. Evidence: limit tests. - [x] S5.4.c Parse strictly and reject malformed syntax, duplicate keys, invalid Unicode/numbers, schema mismatch, unknown forbidden fields, and wrong discriminator/version. Evidence: adversarial fixtures. - [x] S5.4.d Validate cross-field/domain invariants, stable references, units, authorization scope, and prohibited instructions/URLs after schema validation. Evidence: semantic validation tests. - [x] S5.4.e Preserve raw response hash/ref and validation errors; never repair silently into a passing result. Evidence: invalid-output provenance tests. - [x] S5.4.f Define bounded retry-with-correction only for approved error classes and retain every attempt/cost/provenance. Evidence: retry tests. - [x] S5.5 Preserve provider response provenance before normalization. Evidence: raw response hash and normalized projection are linked. - [x] S5.5.a Capture provider operation/request IDs, provider/model/deployment/ version/region, parameters, tool/template/policy versions, actor, and timestamps before normalization. Evidence: run metadata tests. - [x] S5.5.b Store or securely reference exact raw response bytes/event stream and compute hash/length/media type under retention policy. Evidence: raw response integrity tests. - [x] S5.5.c Record transport/status/headers allowlist, finish reason, usage, safety, provider errors, cancellation, and partial/truncation state. Evidence: provider outcome fixtures. - [x] S5.5.d Normalize through a versioned adapter and store adapter version, schema, validation result, warnings, and normalized hash. Evidence: normalization provenance tests. - [x] S5.5.e Link every normalized field/output/score to originating response or mark derived/defaulted/rejected explicitly. Evidence: lineage tests. - [x] S5.5.f Enforce authorization, encryption, redaction, retention, legal hold, and deletion for raw provider content. Evidence: provenance data lifecycle tests. - [x] S5.6 Implement cancellation, timeout, retry classification, and non-retryable safety refusals. Evidence: deterministic fault-injection tests. - [x] S5.6.a Propagate user/job cancellation through queue, worker, provider request/stream, tools, and downstream side effects. Evidence: cancellation boundary tests. - [x] S5.6.b Define connect, first-byte, idle, total, tool, stage, and job deadlines and preserve partial/unknown outcome. Evidence: clock tests. - [x] S5.6.c Classify throttle/capacity, transient network, timeout, unavailable, malformed output, policy refusal, safety refusal, authorization, invalid input, quota, and unknown errors. Evidence: classification table tests. - [x] S5.6.d Retry only approved transient classes with idempotency, bounded attempts/age/backoff/jitter, budget, and cancellation. Evidence: retry schedule tests. - [x] S5.6.e Never automatically retry or prompt-around safety/policy refusal, unauthorized action, invalid consent/rights, or nonretryable validation. Evidence: refusal negative tests. - [x] S5.6.f Reconcile external request status after local timeout/worker loss before repeating costly or irreversible operations. Evidence: unknown-outcome tests. - [x] S5.6.g Persist attempt history, partial outputs, costs, reason, and final state without false success. Evidence: fault-injection report. - [x] S5.7 Implement per-run cost estimate, reservation, actual cost, and budget variance. Evidence: over-budget dispatch is blocked before provider invocation. - [x] S5.7.a Maintain versioned provider/model/operation/tool/input/output/ region unit prices, currency, effective period, and source. Evidence: rate-card fixtures. - [x] S5.7.b Estimate cost from validated request, context, output limits, retries/tools/derivatives, and uncertainty before acceptance. Evidence: known-price tests. - [x] S5.7.c Reserve actor/project/tenant/provider budget atomically with run acceptance and reject concurrent oversubscription. Evidence: budget race tests. - [x] S5.7.d Recheck reservation immediately before each provider/tool dispatch and prevent invocation when insufficient or expired. Evidence: predispatch failure tests. - [x] S5.7.e Capture provider-reported and independently derived actual usage/ cost per attempt/tool and handle missing/disputed billing. Evidence: metering tests. - [x] S5.7.f Release/refund unused reservation and reconcile estimate, reserved, actual, cancelled, failed, retried, and unallocated values. Evidence: reconciliation report. - [x] S5.7.g Record absolute/percentage variance and stable reason and alert on threshold anomaly. Evidence: variance scenario tests. - [x] S5.8 Extract the generic dependency/claim graph without hard-coding Tara's claim kinds. Evidence: Metis evidence, Veritas sources, Yemaya canon, Isis provenance, and Euterpe rights fixtures compile. - [x] S5.8.a Define plugin-owned node/edge type registry atop shared stable identity, version, direction, source, classification, and lifecycle. Evidence: graph extension contract. - [x] S5.8.b Define generic add/remove/version/supersede/resolve and bounded upstream/downstream/path/impact query interfaces. Evidence: operation tests. - [x] S5.8.c Enforce node/edge schema, same-scope rules, duplicate/cycle/ dangling policy, and immutable historical version references. Evidence: graph integrity tests. - [x] S5.8.d Apply tenant/object/property/protected-identity authorization to nodes, edges, counts, paths, and graph errors. Evidence: disclosure negative tests. - [x] S5.8.e Build Metis evidence, Veritas source/claim, Yemaya canon, Isis artifact/provenance, and Euterpe rights fixtures using only plugin types. Evidence: five compiling fixtures. - [x] S5.8.f Verify shared source/export names contain no Tara-specific claim, meditation, stage, authority, or policy semantics. Evidence: API review. - [x] S5.9 Implement authority/severity policies as domain plugins. Evidence: one domain cannot silently use another domain's floors. - [x] S5.9.a Define plugin identity/version/domain, applicable node/edge/gate/ action types, inputs, outputs, and ownership. Evidence: policy plugin contract. - [x] S5.9.b Define authority ranking/independence, source/evidence sufficiency, conflict, protected/anonymous source, and unavailable semantics per domain. Evidence: authority policy fixtures. - [x] S5.9.c Define severity classes, thresholds, escalation, blocker/warning, target/audience, and remediation semantics per domain. Evidence: severity policy fixtures. - [x] S5.9.d Register exact policy by domain/capability/version and reject missing, duplicate, wrong-domain, or unsupported policy. Evidence: registry negative tests. - [x] S5.9.e Persist selected policy/version with each evaluation and prevent caller-supplied weakening below code/domain floors. Evidence: downgrade tests. - [x] S5.9.f Run cross-domain fixtures that deliberately attempt policy substitution and verify refusal. Evidence: isolation tests. - [x] S5.10 Implement recomputation and blast-radius planning. Evidence: preview is read-only; apply creates jobs and audit. - [x] S5.10.a Accept exact changed node/version/event and policy context and resolve affected direct/transitive results, gates, artifacts, reviews, releases, and projections. Evidence: impact query tests. - [x] S5.10.b Bound traversal by tenant, authorization, edge type, depth, fan-out, cycles, and pagination while representing inaccessible/unknown impact. Evidence: traversal safety tests. - [x] S5.10.c Compute deduplicated dependency order, required versus optional work, stale-only versus recompute, provider/resource needs, cost/time, blockers, and releases at risk. Evidence: plan fixtures. - [x] S5.10.d Return an immutable versioned preview with no persistence, provider invocation, queue write, notification, or audit-as-mutation. Evidence: read-only side-effect tests. - [x] S5.10.e Revalidate source/dependency/policy versions, authorization, budget/capacity, and plan hash when applying. Evidence: stale-plan tests. - [x] S5.10.f Create idempotent parent/child durable jobs in dependency order and a correlated audit/notification record. Evidence: apply integration tests. - [x] S5.10.g Expose partial, blocked, failed, cancelled, superseded, and completed recomputation and updated release eligibility. Evidence: lifecycle tests. - [x] S5.11 Add policy version and evaluation timestamp to every trust result. Evidence: policy changes invalidate dependent results. - [x] S5.11.a Inventory all gate, safety, authority, rights, consent, canon, provenance, quality, fairness, and release trust result types. Evidence: result coverage register. - [x] S5.11.b Require stable policy ID and immutable semantic version/hash in each result schema and persistence row. Evidence: schema tests. - [x] S5.11.c Record evaluation start/completion/reference clock, expiry, and source/evidence observation time with explicit semantics. Evidence: temporal tests. - [x] S5.11.d Include evaluator/corpus/model/threshold/input/dependency versions needed to reproduce or explain the result. Evidence: provenance completeness tests. - [x] S5.11.e Emit policy-change events and mark all affected current results stale before downstream authorization. Evidence: invalidation tests. - [x] S5.11.f Reject or migrate legacy results missing policy/time rather than assuming current policy. Evidence: legacy compatibility tests. - [x] S5.12 Add safe human override hooks. Evidence: authorization, rationale, scope, expiry, notification, and audit are enforced. - [x] S5.12.a Register overrideable and nonoverrideable result/gate/policy types and maximum scope. Evidence: override registry. - [x] S5.12.b Require exact result/input/policy versions, requested outcome, structured rationale, evidence, residual risk, and intended consequence. Evidence: request validation tests. - [x] S5.12.c Enforce actor/role/tenant/object/target/stage scope, step-up, separation of duties, quorum, and delegated authority. Evidence: authorization matrix. - [x] S5.12.d Define start, expiry/one-use, review, renewal, revocation, and invalidation on dependency/version change. Evidence: clock and binding tests. - [x] S5.12.e Notify affected owners/reviewers/publishers/security/safety/ rights roles according to severity without leaking protected detail. Evidence: routing tests. - [x] S5.12.f Record request, approvals/refusals, activation/use, effect, expiry/revocation, and downstream actions immutably. Evidence: audit tests. - [x] S5.12.g Surface active override and residual risk wherever the result authorizes review, publish, release, export, or operation. Evidence: end-to-end visibility tests. ### S6 — Bundle assembly, provenance, publish, and verification - [x] S6.1 Define a schema-parameterized bundle builder with no arbitrary file writes. Evidence: output layout is constrained by a domain profile. - [x] S6.1.a Define domain profile ID/version, bundle manifest schema, allowed entry kinds, required/optional paths, multiplicity, media/schema constraints, and target compatibility. Evidence: profile contract. - [x] S6.1.b Accept immutable artifact/reference inputs and logical profile slots rather than caller-selected filesystem destinations. Evidence: builder input schema. - [x] S6.1.c Resolve every logical slot to a normalized profile-owned relative path and reject unmapped or duplicate slots. Evidence: layout tests. - [x] S6.1.d Write only through an isolated temporary assembly root using create-new semantics and bounded resources. Evidence: filesystem confinement tests. - [x] S6.1.e Validate complete layout, manifest, refs, hashes, profile invariants, and unused/missing inputs before archive creation. Evidence: assembly validation tests. - [x] S6.1.f Prove domain profiles can differ without arbitrary callback/file write escape hatches. Evidence: two-profile compile/runtime fixtures. - [x] S6.2 Reject absolute paths, traversal, ambiguous Unicode paths, symlinks, case collisions, duplicate refs, and reserved names. Evidence: adversarial path suite. - [x] S6.2.a Reject POSIX, Windows drive/UNC/device, URL/file-scheme, rooted, and platform-dependent absolute paths. Evidence: absolute path corpus. - [x] S6.2.b Reject dot/dot-dot traversal before and after percent/Unicode/ separator normalization and archive extraction. Evidence: traversal corpus. - [x] S6.2.c Normalize Unicode by one policy and reject confusable, invisible, bidi-control, invalid, or normalization-colliding paths. Evidence: Unicode path corpus. - [x] S6.2.d Reject symlink, hardlink, junction, reparse, device, FIFO/socket, and other nonregular file entries. Evidence: special-file corpus. - [x] S6.2.e Detect case-fold, Unicode-fold, trailing dot/space, separator, and target-filesystem collisions. Evidence: cross-platform collision tests. - [x] S6.2.f Reject duplicate logical/artifact/manifest references and conflicting byte identities. Evidence: duplicate ref tests. - [x] S6.2.g Reject reserved device names, manifest/control paths, forbidden extensions, and overlong path/component/depth. Evidence: reserved/limit tests. - [x] S6.2.h Revalidate normalized paths at final open/write/extract time to prevent race or adapter reinterpretation. Evidence: TOCTOU tests. - [x] S6.3 Validate manifest schemas from their authoritative files. Evidence: tests fail when schema and builder drift. - [x] S6.3.a Register authoritative manifest schema path, ID/version, owner, code-generation command, and supported bundle profiles. Evidence: schema registry. - [x] S6.3.b Compile validators directly from authoritative schema with pinned tool/version and strict unknown/format/reference behavior. Evidence: validator generation. - [x] S6.3.c Validate builder input, assembled manifest, serialized bytes, archived manifest, importer parse, and migrated output. Evidence: boundary coverage tests. - [x] S6.3.d Maintain canonical minimal/full valid and malformed/boundary/ version-skew invalid fixtures. Evidence: schema fixture corpus. - [x] S6.3.e Compare generated types, builder fields/defaults, docs/examples, and validator output with schema. Evidence: cross-artifact drift check. - [x] S6.3.f Deliberately mutate a required field/version/enum in schema and builder to prove CI catches both directions of drift. Evidence: mutation tests. - [x] S6.4 Rehash every referenced artifact from bytes during assembly. Evidence: metadata-only checksum spoof is rejected. - [x] S6.4.a Resolve artifact refs through authorized immutable storage and reject mutable/unknown/nonfinal references. Evidence: resolver tests. - [x] S6.4.b Stream exact stored bytes under size/time/resource limits and compute approved digest and length. Evidence: known-byte tests. - [x] S6.4.c Compare computed digest/length/media type to artifact metadata, manifest expectation, and provenance binding. Evidence: mismatch tests. - [x] S6.4.d Copy/link into assembly only after verification and bind manifest entry to computed values rather than caller metadata. Evidence: spoof-prevention tests. - [x] S6.4.e Detect storage changes between read/hash/copy through immutable version/fencing or hash the exact written bytes. Evidence: race tests. - [x] S6.4.f Quarantine/report corruption and affected derivatives/releases without publishing partial assembly. Evidence: corruption workflow test. - [x] S6.5 Produce deterministic archives. Evidence: identical inputs yield byte-identical output and hash. - [x] S6.5.a Define normalized entry ordering, path encoding, timestamps, owner/group, permissions, extended attributes, line endings, and manifest serialization. Evidence: reproducibility profile. - [x] S6.5.b Pin archive format/version, compression algorithm/level/library, dictionary, and platform-independent flags. Evidence: toolchain lock. - [x] S6.5.c Exclude temporary paths, host metadata, absolute source paths, random IDs, current clock, process order, and nondeterministic maps. Evidence: nondeterminism scan. - [x] S6.5.d Build from the same inputs on supported operating systems/runtimes and compare bytes/hash/entry metadata. Evidence: cross-platform result. - [x] S6.5.e Build under shuffled input order, clocks, locale, time zone, and concurrency and compare byte identity. Evidence: perturbation tests. - [x] S6.6 Generate SBOM-like component and dependency inventory for each release bundle. Evidence: every file and external ref has provenance. - [x] S6.6.a Inventory every archive entry with logical role, path, media type, bytes/hash, source artifact/revision, generated/third-party status, and provenance ref. Evidence: file component rows. - [x] S6.6.b Inventory external URLs/resolvers/providers/models/tools/plugins/ packages/licenses that the bundle references or requires. Evidence: external component rows. - [x] S6.6.c Record dependency edges, version/range/digest, required/optional, runtime/build-only, target/environment, and resolution state. Evidence: dependency graph. - [x] S6.6.d Record license/rights/consent/export/security metadata and unresolved/unknown status without fabricating values. Evidence: compliance fields. - [x] S6.6.e Link components to generation/transformation actions, actors, tools/models/policies, validation, and release candidate. Evidence: provenance linkage. - [x] S6.6.f Reconcile manifest/archive/provenance/importer refs so no file or external ref is absent, duplicated, or orphaned. Evidence: completeness check. - [x] S6.7 Add C2PA signing/validation adapters where the asset format supports them. Evidence: valid, tampered, unknown-trust, expired, and stripped credentials are distinguished. - [x] S6.7.a Register supported asset formats, C2PA spec/profile, embedding/ sidecar mechanism, hard/soft bindings, assertions/actions, and unsupported behavior. Evidence: adapter profile registry. - [x] S6.7.b Assemble ingredient/action/tool/actor/policy assertions from authoritative bundle/provenance records. Evidence: manifest construction fixtures. - [x] S6.7.c Sign with governed key/cert chain/timestamp and bind to exact bytes without exposing key material. Evidence: signing integration tests. - [x] S6.7.d Validate manifest structure, binding, signature, chain, trust list, revocation, timestamp, assertion support, and ingredient availability separately. Evidence: validation matrix. - [x] S6.7.e Represent valid/trusted, cryptographically valid-untrusted, tampered, revoked/expired, unknown/unsupported, missing, stripped, and partially recoverable states. Evidence: result union tests. - [x] S6.7.f Test official/third-party fixtures, post-sign byte mutation, metadata stripping, certificate lifecycle, and offline trust cache. Evidence: interoperability report. - [x] S6.8 Add a provenance-ledger fallback for formats or channels that strip embedded credentials. Evidence: soft-binding recovery test. - [x] S6.8.a Register formats/channels/transforms that strip or alter embedded provenance and select approved binding/recovery method. Evidence: channel profile. - [x] S6.8.b Persist external ledger record keyed by immutable provenance/ artifact identity with hard hash, approved soft bindings, manifest/ref, trust, retention, and access policy. Evidence: ledger schema tests. - [x] S6.8.c Generate media-appropriate fingerprint/watermark/perceptual hash/ lookup hint with privacy and collision review. Evidence: binding tests. - [x] S6.8.d Recover exact/robust matches after representative resize, crop, transcode, recompress, remix, screenshot, rerecord, or normalization. Evidence: transformation matrix. - [x] S6.8.e Measure false positive/negative, ambiguity, insufficient evidence, collision, and adversarial removal. Evidence: known-corpus evaluation. - [x] S6.8.f Handle missing/multiple/private/deleted/revoked/invalid matches and display method, confidence/limitations, and trust safely. Evidence: negative and accessible UX tests. - [x] S6.9 Add publisher adapters with plan, execute, verify, and compensate phases. Evidence: partial external failure is recoverable and audited. - [x] S6.9.a Define adapter identity/version, target capability/config probe, supported bundle/profile/action, authorization, idempotency, and external reference contract. Evidence: publisher interface. - [x] S6.9.b Implement read-only plan resolving destinations, transforms, eligibility, cost, impact, conflicts, irreversible points, and rollback/ compensation. Evidence: plan fixtures. - [x] S6.9.c Revalidate plan hash, release lock, authorization, gates, provenance/rights/consent, target health, and budget at execute. Evidence: stale-plan tests. - [x] S6.9.d Execute idempotently with durable per-step state, retries, external IDs, request/response hashes, partial result, and audit. Evidence: execution fault tests. - [x] S6.9.e Verify by target read-back of bytes/hash, metadata, audience, state, permissions, discoverability, and external acknowledgements. Evidence: verification tests. - [x] S6.9.f Compensate reversible steps in safe order, preserve irreversible effects, and expose manual remediation for failed/partial compensation. Evidence: compensation scenarios. - [x] S6.9.g Reconcile unknown outcomes after timeout/callback loss/worker death before retry. Evidence: external outcome tests. - [x] S6.10 Add immutable release IDs and source revision locks. Evidence: post-approval edits cannot mutate a release candidate. - [x] S6.10.a Create release ID independently from mutable object/project IDs and bind target/profile/environment/locale/territory/audience. Evidence: release identity tests. - [x] S6.10.b Freeze exact source revisions, artifact byte refs/hashes, dependencies, bundle profile, manifests, contracts, policies/gates, approvals, and publisher config. Evidence: release lock manifest. - [x] S6.10.c Create the lock atomically with approval/candidate transition and reject stale expected source revisions. Evidence: lock race tests. - [x] S6.10.d Prevent edits, restores, recomputation, metadata changes, or target changes from mutating the locked candidate. Evidence: post-approval mutation tests. - [x] S6.10.e Require changed input to create a new release candidate/version linked as replacement/supersession. Evidence: new candidate lineage tests. - [x] S6.10.f Audit lock creation, reads, failed mutation attempts, cancellation, expiry, and release outcome. Evidence: lock audit tests. - [x] S6.11 Add publish eligibility recomputation inside the transaction or release lock. Evidence: time-of-check/time-of-use race test. - [x] S6.11.a Resolve required gates/approvals/rights/consent/provenance/ dependencies/target policy for exact release candidate and destination. Evidence: eligibility policy tests. - [x] S6.11.b Re-read current source/dependency/evidence/policy/waiver/signoff versions rather than trusting preview/UI state. Evidence: stale input tests. - [x] S6.11.c Recompute eligibility inside the same transaction as release lock or under an equivalent fenced reservation. Evidence: atomicity integration tests. - [x] S6.11.d Reject missing/stale/expired/invalid/unavailable/out-of-scope/ unauthorized evidence with exact safe reasons. Evidence: refusal matrix. - [x] S6.11.e Freeze consulted evidence/versions/hashes into the release lock. Evidence: lock provenance assertions. - [x] S6.11.f Race a source edit, consent revoke, policy change, gate stale, approval expiry, and target change against publication and prove none silently authorize. Evidence: TOCTOU tests. - [x] S6.12 Add verified-in-target state based on read-back, not a successful write response. Evidence: corrupted or missing target content fails. - [x] S6.12.a Define target-specific read-back endpoint/operation, authorization, eventual-consistency delay, retry budget, and stable external identity. Evidence: verification contract. - [x] S6.12.b Read back target existence/state and exact bytes/hash or strongest supported binding. Evidence: content integrity tests. - [x] S6.12.c Verify metadata, version, audience/permissions, locale/territory, rights/embargo, provenance, relations, and discoverability. Evidence: target field matrix. - [x] S6.12.d Distinguish pending visibility, verified, mismatched, missing, unauthorized-to-verify, target unavailable, and verification failed. Evidence: state union tests. - [x] S6.12.e Prevent publisher 2xx/callback/queued acknowledgment from setting verified state. Evidence: false-success tests. - [x] S6.12.f Trigger compensation/incident/manual reconciliation on corrupted, partial, wrong-target, or unknown read-back and audit every attempt. Evidence: failure journey tests. - [x] S6.13 Add correction, supersession, unpublish, recall, and tombstone semantics. Evidence: downstream state and audit remain coherent. - [x] S6.13.a Define correction as a linked new version preserving original, correction reason/scope, changed facts/artifacts, notice, and target update. Evidence: correction lifecycle tests. - [x] S6.13.b Define supersession as a new release identity replacing prior use while retaining navigable lineage and compatibility. Evidence: supersession tests. - [x] S6.13.c Define unpublish as removal from active/public presentation with target-specific reversibility, cache/search/catalog cleanup, and no history erasure. Evidence: unpublish tests. - [x] S6.13.d Define recall as urgent multi-target withdrawal with severity, authority, notifications, stop-distribution, affected derivative tracking, and incident linkage. Evidence: recall rehearsal. - [x] S6.13.e Define tombstone content, stable identity, reason/category, visibility, rights/privacy-safe detail, replacement link, and retention. Evidence: tombstone tests. - [x] S6.13.f Propagate each action to targets, catalog/search/cache, provenance/ledger, dependencies, analytics, notifications, and future eligibility. Evidence: downstream integration tests. - [x] S6.13.g Preserve immutable audit and distinguish partial/failed/unknown target outcomes with retry/compensation. Evidence: multi-target fault tests. - [x] S6.14 Add bundle importer compatibility and migration hooks. Evidence: supported old versions round-trip; unsupported versions fail with a migration path. - [x] S6.14.a Detect archive/profile/manifest/contract versions and validate path/resource/security limits before parsing content. Evidence: importer preflight tests. - [x] S6.14.b Negotiate exact supported, backward-compatible, migratable, too-old, too-new, unknown, and unsupported versions without silent downgrade. Evidence: version matrix. - [x] S6.14.c Define pure ordered migration hooks with from/to version, preconditions, transformed fields/files/refs, warnings/loss report, and provenance. Evidence: migration interface. - [x] S6.14.d Preserve unknown compatible extension data and reject unknown required semantics. Evidence: forward compatibility tests. - [x] S6.14.e Validate and rehash after each migration, produce new bundle/ manifest identity, and link source/migration lineage. Evidence: migration integrity tests. - [x] S6.14.f Import as plan/preview then idempotent authorized execution with conflict, partial failure, rollback/cleanup, and audit. Evidence: importer journey tests. - [x] S6.14.g Return exact supported target/migration path or upgrade requirement for unsupported input. Evidence: failure response tests. - [x] S6.15 Add golden round-trip tests for every domain bundle profile. Evidence: build, archive, import, verify, and rebuild are deterministic. - [x] S6.15.a Register minimal, full, boundary, localized, provenance-rich, legacy-supported, and invalid fixtures per domain profile. Evidence: profile fixture manifest. - [x] S6.15.b Build logical bundle from authoritative inputs and compare manifest/layout/component inventory/provenance to goldens. Evidence: build golden tests. - [x] S6.15.c Archive twice under perturbed order/clock/locale/platform inputs and compare exact bytes/hash/entry metadata. Evidence: archive reproducibility tests. - [x] S6.15.d Import and migrate where needed, then compare semantic objects, artifact bytes/hashes, refs, rights/consent, gates, and provenance. Evidence: import parity tests. - [x] S6.15.e Verify schema/path/hash/signature/trust/profile/target semantics and expected invalid fixtures. Evidence: verification matrix. - [x] S6.15.f Rebuild from imported state and require byte identity when the profile/version promises it or documented semantic identity otherwise. Evidence: rebuild comparison. - [x] S6.15.g Fail when a registered domain profile lacks current golden coverage. Evidence: registry coverage gate. ### S7 — Shared application shell and working surfaces - [x] S7.1 Build a restrained workbench shell with navigation, primary canvas, inspector, status region, and command palette. Evidence: responsive browser snapshots. - [x] S7.1.a Build landmark-based global/workbench navigation from authorized route descriptors with current location, breadcrumbs, collapse, and keyboard traversal. Evidence: navigation tests. - [x] S7.1.b Build the dominant primary workspace region with domain plugin composition, loading boundary, selection context, and no decorative wrapper cards. Evidence: two-archetype fixtures. - [x] S7.1.c Build contextual inspector placement, pin/replace/close, resizable width, overflow, and focus restoration. Evidence: inspector interaction tests. - [x] S7.1.d Build persistent compact status for save/sync, connectivity, capability/fixture, job, gate, review, publish, and stale state. Evidence: status matrix. - [x] S7.1.e Build command palette discovery, typed capability commands, disabled explanations, search/groups, keyboard behavior, and recent commands without bypassing authorization. Evidence: palette tests. - [x] S7.1.f Compose wide three-region, compact two-region, and single-region review arrangements with preserved selection/focus. Evidence: responsive browser tests. - [x] S7.1.g Apply restrained tokens: two type families max, one accent, semantic status cues, minimal borders/shadows, and cards only where the card is the interaction. Evidence: visual conformance snapshots. - [x] S7.2 Provide route-level loading, empty, unauthorized, not-configured, degraded, offline, and failure states. Evidence: component and Playwright state matrix. - [x] S7.2.a Provide skeleton/progress loading that preserves layout, announces status, supports cancellation where real, and never displays fake final values. Evidence: loading tests. - [x] S7.2.b Distinguish first-use, no records, no matches, filtered-out, retention/deletion, and no permission-visible records. Evidence: empty state fixtures. - [x] S7.2.c Provide unauthenticated, unauthorized, forbidden-concealed, step- up-required, and expired-session behavior without protected disclosure. Evidence: authorization state tests. - [x] S7.2.d Render server `not_configured` capability, missing category, allowed resolver, and safe next step without setup success claims. Evidence: not-configured route tests. - [x] S7.2.e Render affected/retained capability, limitation, cause, freshness, and recovery for degraded state. Evidence: degradation tests. - [x] S7.2.f Render offline versus server/provider unavailable distinctly and state readable/editable/queued/prohibited behavior. Evidence: connectivity tests. - [x] S7.2.g Render validation, dependency, provider, conflict, limit, partial, internal, and unknown failure with preserved work, retry eligibility, remediation, and correlation. Evidence: failure tests. - [x] S7.2.h Test direct load, client navigation, refresh, back/forward, reconnect, locale/theme/density, keyboard, and screen reader for every state. Evidence: Playwright matrix. - [x] S7.3 Build a live capability banner driven by server probes. Evidence: fixture mode cannot masquerade as live. - [x] S7.3.a Consume authenticated runtime capability/dependency endpoints with version, checked-at, freshness, affected/retained behavior, owner, and safe remediation. Evidence: network/contract tests. - [x] S7.3.b Represent configured, not-configured, degraded, unavailable, failed, stale-probe, probe-loading, and probe-error independently. Evidence: banner state fixtures. - [x] S7.3.c Display fixture source/version and persistent unmistakable fixture labeling in banner and working context. Evidence: fixture UI tests. - [x] S7.3.d Prevent build variables, client heuristics, successful route load, cached content, or demo data from asserting live state. Evidence: false-live negative tests. - [x] S7.3.e Provide accessible detail and authorized setup/status link without exposing secrets or internal topology. Evidence: role/redaction tests. - [x] S7.3.f Refresh on dependency/flag/provider change with bounded polling or event update and preserve last-known age honestly. Evidence: transition tests. - [x] S7.4 Build a filter/search grammar with URL serialization. Evidence: copy/paste and back/forward restore the exact view. - [x] S7.4.a Define typed field, operator, value, grouping, negation, range, relative date, taxonomy, rights, quality, ownership, ID, and free-text grammar. Evidence: grammar specification. - [x] S7.4.b Implement tokenizer/parser with positions and stable syntax errors for quotes, escapes, Unicode, nesting, ambiguity, and limits. Evidence: parser corpus. - [x] S7.4.c Validate fields/operators/values against domain capability, contract version, authorization, locale-neutral units, and complexity budget. Evidence: semantic validation tests. - [x] S7.4.d Serialize a canonical normalized query deterministically without changing meaning or localizing identifiers/operators. Evidence: parse/serialize property tests. - [x] S7.4.e Encode safe shareable query, sort, grouping, view, and pagination anchor in URL while excluding protected/local-only state. Evidence: URL leakage tests. - [x] S7.4.f Restore exact valid view on paste/direct link/refresh/back/forward and provide migration/fallback for older or invalid grammar versions. Evidence: navigation tests. - [x] S7.4.g Provide keyboard editor, suggestions, accessible token/error semantics, plain form alternative, and no search-on-every-keystroke abuse. Evidence: accessibility/performance tests. - [x] S7.5 Build accessible data tables with column control, density, pinning, resizing, sort, selection, and virtualization. Evidence: keyboard and screen-reader tests. - [x] S7.5.a Define semantic table/grid pattern by interaction need, accessible name/description, captions, headers, relationships, row identity, and loading/empty/error state. Evidence: base table tests. - [x] S7.5.b Implement visible/hidden/ordered column control with required- column rules, reset, persistence, and authorization-aware fields. Evidence: column control tests. - [x] S7.5.c Implement comfortable/compact/touch density without clipping, inaccessible targets, or page overflow. Evidence: density/zoom tests. - [x] S7.5.d Implement keyboard and numeric resizing, min/max/reset, persisted width, overflow disclosure, and screen-reader feedback. Evidence: resize tests. - [x] S7.5.e Implement left/right pinning, pinned boundaries, keyboard navigation, reorder interaction, and narrow-view fallback. Evidence: pinning tests. - [x] S7.5.f Implement single/multi stable sort with direction/null/locale/ tie-break semantics and server parity. Evidence: sort tests. - [x] S7.5.g Implement single/range/additive/select-all-filtered/offscreen selection with eligible/hidden/permission-changing behavior. Evidence: selection tests. - [x] S7.5.h Implement virtualization with total/position semantics, stable focus/selection/scroll anchor, dynamic rows, and semantic nonvirtual fallback for print/export. Evidence: large dataset a11y tests. - [x] S7.6 Build kanban or stage-board primitives only where stage movement is the core interaction. Evidence: non-drag move controls and transition refusal UI. - [x] S7.6.a Require a domain applicability decision proving stage movement, not monitoring or decorative status, is the primary object interaction. Evidence: board registration rationale. - [x] S7.6.b Render typed stages, allowed/terminal state, counts, WIP/capacity, ordered items, freshness, and authorization from server contracts. Evidence: stage board fixtures. - [x] S7.6.c Implement drag preview/drop only for server-declared candidate transitions and preserve source until accepted. Evidence: drag tests. - [x] S7.6.d Provide select-plus-move command, target list, keyboard shortcuts, and accessible move dialog as fully equivalent non-drag paths. Evidence: keyboard/screen-reader tests. - [x] S7.6.e Preview guard/evidence/approval/impact/cost requirements and require confirmation proportionate to transition risk. Evidence: transition preview tests. - [x] S7.6.f Handle accepted, conflict, refused-with-reasons, stale evidence, unauthorized, partial bulk, offline, and failed transitions without optimistic false state. Evidence: result matrix. - [x] S7.6.g Preserve focus/selection after move and expose semantic table/list parity for every board fact and operation. Evidence: nonvisual journey. - [x] S7.7 Build a stable inspector router. Evidence: selection persists across refresh and invalid/deleted selections recover safely. - [x] S7.7.a Register inspector routes by typed object/subobject/anchor, capability, authorized data loader, component, and compatibility version. Evidence: inspector registry tests. - [x] S7.7.b Encode only safe workbench/object/subview/anchor/compare state in route and keep drafts/secrets/transient credentials local. Evidence: URL state tests. - [x] S7.7.c Load by stable identity with tenant/object/property authorization and handle loading/partial/stale/conflict/degraded state. Evidence: loader tests. - [x] S7.7.d Preserve inspector selection, tab, scroll, and focus on refresh, back/forward, workspace navigation, and compatible revision update. Evidence: navigation tests. - [x] S7.7.e Recover from invalid, malformed, unsupported, moved, deleted, filtered, archived, tombstoned, permission-hidden, and cross-tenant selection. Evidence: recovery matrix. - [x] S7.7.f Restore focus to invoker/selected object/fallback after close or invalidation and announce the change. Evidence: focus tests. - [x] S7.7.g Prevent inspector routes from mutating state on resolution and avoid hidden N+1/unbounded fetch behavior. Evidence: network and no-mutation assertions. - [x] S7.8 Build structured field and block-editor primitives with validation, dirty state, autosave, undo/redo, and revision metadata. Evidence: conflict journey. - [x] S7.8.a Register versioned typed field/block schema, stable identity, editor renderer, semantic renderer, validation, diff, migration, anchor, and serialization. Evidence: block registry tests. - [x] S7.8.b Build type-appropriate controls with labels/help, units/formats, required/nullable/default, read-only/unauthorized, and accessible semantics. Evidence: field fixture matrix. - [x] S7.8.c Implement add/remove/move/reorder/nest/split/merge/reference operations through domain commands rather than arbitrary JSON mutation. Evidence: structured operation tests. - [x] S7.8.d Run local field/cross-block validation for feedback and authoritative service validation on save; preserve stable reason/ remediation. Evidence: shared invalid fixtures. - [x] S7.8.e Track dirty state against base revision across local changes, server normalization, remote edits, save, failure, and restore. Evidence: dirty-state tests. - [x] S7.8.f Implement durable autosave/offline queue/failure recovery with explicit state and no saved indicator before commit. Evidence: autosave fault tests. - [x] S7.8.g Implement operation-aware undo/redo with focus/selection preservation and no server history rewrite or side-effect replay. Evidence: undo boundary tests. - [x] S7.8.h Display current/base revision, author/time/reason/save state and detect expected-revision conflict with compare/preserve/resolve actions. Evidence: conflict end-to-end journey. - [x] S7.9 Build tree and hierarchy editing with cycle prevention, keyboard reorder, and impact preview. Evidence: tree property tests and a11y. - [x] S7.9.a Define stable node ID/type, parent, sibling order, depth, properties, allowed parent/child relations, roots, and limits. Evidence: tree contract tests. - [x] S7.9.b Implement authorized add, rename/edit, duplicate, move/reparent, reorder, archive/delete, restore, and reference operations with expected revision. Evidence: command tests. - [x] S7.9.c Prevent self-parent, descendant-parent, cycle through concurrent updates, duplicate/order corruption, invalid root, and depth/fan-out overflow. Evidence: property and real-DB race tests. - [x] S7.9.d Provide tree keyboard pattern plus explicit move before/after/ into/out, numeric position, and target picker equivalent to drag. Evidence: keyboard/screen-reader tests. - [x] S7.9.e Preview affected descendants, inherited policy/taxonomy, references, permissions, gates, schedules, URLs, and destructive or cost effects. Evidence: impact fixtures. - [x] S7.9.f Handle lazy/virtualized nodes, loading/unknown child counts, remote edits, moved/deleted target, conflict, partial failure, and rollback. Evidence: state matrix. - [x] S7.9.g Provide semantic list/breadcrumb/search and preserve focus, expansion, selection, and scroll through operations. Evidence: accessible journey. - [x] S7.10 Build graph viewing with semantic list/table parity. Evidence: graph-only information is zero. - [x] S7.10.a Register typed node/edge/port/property/direction/version, group/hierarchy, status, source, and authorization projection. Evidence: graph view contract. - [x] S7.10.b Render bounded pan/zoom/fit/minimap/search/filter/highlight/path/ impact layout without making spatial position the sole meaning. Evidence: visual interaction tests. - [x] S7.10.c Expose nodes as navigable table/tree with identical labels, types, properties, status, groups, inbound/outbound counts, and details. Evidence: node parity tests. - [x] S7.10.d Expose edges as navigable table/list with source, target, type, direction, version, status, and properties. Evidence: edge parity tests. - [x] S7.10.e Synchronize selection, focus, filters, path/neighbor expansion, inspector, and deep link bidirectionally. Evidence: synchronization tests. - [x] S7.10.f Provide keyboard/nonpointer traversal and explicit relationship operations where editable. Evidence: nonvisual journey. - [x] S7.10.g Handle huge/partial/cyclic/disconnected/permission-redacted/ stale graphs with honest counts and no layout denial of service. Evidence: resilience/performance tests. - [x] S7.10.h Compare every displayed visual encoding/fact/action to the semantic view and report zero graph-only information. Evidence: parity audit. - [x] S7.11 Build timeline editing with keyboard/timecode controls and semantic track list parity. Evidence: trim, move, split, and zoom journeys. - [x] S7.11.a Define time base, frame/sample/beat units, frame rate/sample rate/ tempo map, rounding, origin, duration, tracks/lanes, clips/events, and stable IDs. Evidence: timeline contract. - [x] S7.11.b Implement keyboard transport, seek, step, selection, range, zoom/fit, marker, track, clip/event traversal, and shortcut collision handling. Evidence: key map tests. - [x] S7.11.c Provide exact start/end/in/out/duration/offset/speed/value fields with unit conversion, validation, snapping, and accessible labels. Evidence: timecode control tests. - [x] S7.11.d Implement move, trim, split, merge, duplicate, ripple/overwrite, reorder, enable/mute/lock, and domain plugin operations with undo. Evidence: operation known-value tests. - [x] S7.11.e Provide track/event table/list with every identity, time/value, status, relationship, and operation available nonvisually. Evidence: semantic parity tests. - [x] S7.11.f Synchronize playhead/range/selection/zoom/filter/inspector between visual and semantic views. Evidence: synchronization tests. - [x] S7.11.g Handle variable frame rate/tempo, drop frame, long duration, overlaps, boundaries, locked/unauthorized items, remote edits, and conflicts. Evidence: boundary fixture matrix. - [x] S7.11.h Run trim, move, split, zoom, undo, autosave, conflict, and nonpointer journeys under supported viewports. Evidence: Playwright tests. - [x] S7.12 Build comparison surfaces for text, metadata, images, video, audio, 3D, graphs, and gate results through typed adapters. Evidence: each adapter has a golden comparison fixture. - [x] S7.12.a Define common compare contract for left/right/base identity and revision, adapter/version, aligned change list, selection, filters, unknown/unsupported/redacted state, and accessible summary. Evidence: compare interface. - [x] S7.12.b Implement text adapter for block/line/word/character and semantic structured changes with whitespace/locale policy. Evidence: text goldens. - [x] S7.12.c Implement typed metadata adapter for field presence/value/unit/ enum/list/relationship changes with redaction. Evidence: metadata goldens. - [x] S7.12.d Implement image adapter for bytes/hash/dimensions/color/profile/ metadata plus aligned overlay/swipe/pixel/perceptual differences and nonvisual metrics. Evidence: image goldens. - [x] S7.12.e Implement video adapter for stream/codec/duration/frame rate/ tracks/metadata and time-aligned visual/audio/event differences. Evidence: video goldens. - [x] S7.12.f Implement audio adapter for bytes/format/duration/channels/ loudness/peak/waveform/spectrum/events and synchronized audition with text/data alternative. Evidence: audio goldens. - [x] S7.12.g Implement 3D adapter for stage/scene graph, geometry, topology, transforms, materials/textures, skeleton/animation, variants/refs, and OpenUSD validation. Evidence: 3D goldens. - [x] S7.12.h Implement graph adapter for node/edge/property/group/path and layout-versus-semantic changes. Evidence: graph goldens. - [x] S7.12.i Implement gate adapter for raw values/units, evaluator/corpus/ model, policy/threshold, verdict, freshness, evidence, waiver, and remediation. Evidence: gate goldens. - [x] S7.12.j Provide stable difference navigation, side switching, synchronized context, comments/decision linkage, keyboard/screen-reader parity, and large-diff pagination across adapters. Evidence: common compare journeys. - [x] S7.13 Build the decision-record drawer. Evidence: selected and rejected variants remain linked to the decision. - [x] S7.13.a Display decision identity/type/scope/status/owner/effective version/review date and affected objects/capabilities. Evidence: header fixtures. - [x] S7.13.b List every option/variant with stable ID, summary, provenance, score/evidence, status, and compare action. Evidence: option fixtures. - [x] S7.13.c Mark selected, rejected, retained-current, unavailable, and deferred options without hiding any considered option. Evidence: outcome state tests. - [x] S7.13.d Display rationale, trade-offs, consequences, risks, actors/ authority, reviews, timestamps, and immutable evidence refs. Evidence: detail tests. - [x] S7.13.e Navigate to compare/evidence/source and back with preserved selection/focus and authorization/redaction. Evidence: drawer journey. - [x] S7.13.f Support propose/review/approve/reject/supersede/reverse only when authorized, with exact validation and audit. Evidence: mutation tests. - [x] S7.13.g Render missing/inaccessible/stale evidence and supersession lineage honestly. Evidence: degraded state fixtures. - [x] S7.14 Build the gate panel with freshness, evidence, policy version, owner, remediation, waiver, and rerun state. Evidence: state matrix. - [x] S7.14.a Display gate ID/name/severity/applicability, current target revision, owner/escalation, and required/optional status. Evidence: definition fixtures. - [x] S7.14.b Display raw values/units/uncertainty, evaluator/corpus/model, policy/threshold version, verdict, reason, and completion time. Evidence: result fixtures. - [x] S7.14.c Display fresh/stale/expired/missing/pending/running/unavailable/ unsupported/failed state with invalidating dependency and age. Evidence: freshness matrix. - [x] S7.14.d List evidence refs with type/version/hash/access state and safe navigation. Evidence: evidence tests. - [x] S7.14.e Display remediation steps, affected fields/objects, documentation, appeal/review, and recompute prerequisites. Evidence: remediation tests. - [x] S7.14.f Display waiver/override scope/reason/approver/evidence/start/ expiry/residual risk and out-of-scope/stale status. Evidence: waiver matrix. - [x] S7.14.g Authorize and run/recompute/cancel/retry/appeal/waive actions through durable jobs with cost/impact confirmation. Evidence: action journeys. - [x] S7.14.h Provide keyboard/screen-reader navigation, noncolor status, compact grouping, and no pass-only aggregation hiding blockers. Evidence: accessibility tests. - [x] S7.15 Build the provenance/lineage inspector. Evidence: ingredients, transformations, hashes, signatures, validation, and gaps are visible. - [x] S7.15.a Display exact artifact/revision identity, byte hash/algorithm/ size/type, release refs, and manifest/ledger binding. Evidence: artifact fixtures. - [x] S7.15.b Traverse ingredients and derivatives with relation, version/hash, source/origin, rights/consent hint, availability, and redaction. Evidence: lineage graph tests. - [x] S7.15.c Display ordered capture/edit/generate/transform/merge/validate/ approve/export/publish actions and parameters. Evidence: action history fixtures. - [x] S7.15.d Display tool/app/plugin/provider/model/template/policy/environment versions and authenticated/delegated actors safely. Evidence: provenance detail tests. - [x] S7.15.e Display signature/binding/chain/trust/revocation/timestamp/ assertion/ingredient validation independently. Evidence: validation state matrix. - [x] S7.15.f Display missing/stripped/unavailable/unsupported/untrusted/ invalid/ambiguous gaps with recovery method and limitations. Evidence: gap fixtures. - [x] S7.15.g Provide semantic table/tree parity, bounded graph traversal, protected-source redaction, keyboard navigation, and evidence export authorization. Evidence: accessible/security tests. - [x] S7.16 Build job and queue views with progress, dependency graph, logs, cost, retry, cancel, and failure detail. Evidence: live fault-injection journey. - [x] S7.16.a Build permission-aware queue list with job type/version, target, priority, state/stage, queued age, progress, owner, resource/provider, cost, deadline, and stable pagination/filtering. Evidence: queue tests. - [x] S7.16.b Build job detail with immutable inputs, attempts, lease/worker, timing, checkpoints, outputs, provenance, audit/correlation, and safe support refs. Evidence: detail fixtures. - [x] S7.16.c Visualize parent/child/dependency/critical-path graph with semantic table parity and required/optional/blocking state. Evidence: graph parity tests. - [x] S7.16.d Display completed/total/indeterminate progress by stage and aggregate without invented percentages or false completion. Evidence: progress fixtures. - [x] S7.16.e Display privacy-safe structured logs/events with levels, timestamps, attempt/stage, filters, bounded streaming, download policy, and no content/secrets. Evidence: log security tests. - [x] S7.16.f Display estimated/reserved/actual/refunded/variance cost and resource usage with units/rate version. Evidence: cost fixtures. - [x] S7.16.g Authorize cancel/retry/resume/replay/abandon with impact, idempotency, confirmation, eligible scope, and result. Evidence: control journey tests. - [x] S7.16.h Display failure class/reason/retained outputs/retryability/ remediation/dead-letter/unknown outcome without stack leakage. Evidence: fault-injection browser journey. - [x] S7.17 Build audit history with safe redaction and export. Evidence: authorization tests distinguish ordinary users and auditors. - [x] S7.17.a Build immutable chronological/correlated event query by target, actor, action, outcome, revision, policy, job/release, and time with stable pagination. Evidence: query tests. - [x] S7.17.b Display actor/delegate, tenant-safe context, action, prior/new revision, reason, decision/policy, result, evidence refs, and correlation without copying protected content. Evidence: event fixtures. - [x] S7.17.c Group request/command/audit/event/job/provider/publish chains and preserve raw event drilldown for authorized roles. Evidence: correlation view tests. - [x] S7.17.d Apply object/property, protected-source, learner/biometric, rights, tenant, support, legal-hold, and role redaction at query/result. Evidence: ordinary-user/auditor negative tests. - [x] S7.17.e Distinguish redacted, inaccessible, retained, purged, integrity- invalid, late, and missing-linked-event states. Evidence: state fixtures. - [x] S7.17.f Export a versioned checksummed snapshot with query scope, generated-by/time, schema, redaction policy, page completeness, and access controls. Evidence: export tests. - [x] S7.17.g Verify audit chain/signature/hash integrity and surface failures without hiding remaining history. Evidence: tamper tests. - [x] S7.18 Build bulk-action preview and result surfaces. Evidence: mixed eligibility, partial failure, cancel, and retry journeys. - [x] S7.18.a Freeze selected IDs or versioned query and show selected, currently matched, hidden/inaccessible, and changed-since-selection counts. Evidence: concurrent selection tests. - [x] S7.18.b Display eligible/ineligible/unknown/already-satisfied items with object-specific authorization/state/dependency/policy/capacity reasons. Evidence: eligibility fixtures. - [x] S7.18.c Preview resulting state, dependencies, gates, notifications, external effects, cost, irreversibility, rollback, and confirmation requirement. Evidence: impact fixtures. - [x] S7.18.d Execute through durable job and display pending/running/ completed/failed/skipped/cancelled per-item and aggregate progress. Evidence: live execution journey. - [x] S7.18.e Allow cancellation of unstarted work, explain in-flight behavior, and preserve completed results. Evidence: cancellation journey. - [x] S7.18.f Allow retry only for eligible failed items with original approved parameters/idempotency and refreshed preconditions. Evidence: retry duplication tests. - [x] S7.18.g Export result/evidence and provide keyboard/screen-reader traversal of mixed status without color-only meaning. Evidence: accessibility tests. - [x] S7.19 Build notification center and preference entry points. Evidence: unread counts reconcile with server state. - [x] S7.19.a Build permission-aware paginated notification list with event type, urgency, domain/workbench, actor-safe summary, target, time, read/archived state, and action. Evidence: list tests. - [x] S7.19.b Group/deduplicate event storms while preserving distinct assignments, decisions, blockers, failures, mentions, and security/safety alerts. Evidence: grouping fixtures. - [x] S7.19.c Implement mark read/unread, mark group/all, archive/unarchive, delete/retention, and target navigation with optimistic rollback. Evidence: lifecycle tests. - [x] S7.19.d Reconcile unread counts across tabs/devices/reconnect/duplicate delivery and never infer read state only from opening the center. Evidence: real-time count tests. - [x] S7.19.e Expose preference entry by event/category, urgency, domain/ project, role, channel, locale/time zone, quiet hours/digest, and nonmutable mandatory notices. Evidence: preference tests. - [x] S7.19.f Show notification capability/degraded/delivery failure state and protect source/content/learner/biometric/private target detail. Evidence: state/security tests. - [x] S7.19.g Meet keyboard, screen-reader, focus, live announcement, narrow layout, and long-locale requirements. Evidence: accessibility journey. - [x] S7.20 Build contextual help that describes real capability and failure semantics. Evidence: help links are versioned with the surfaced feature. - [x] S7.20.a Register help by capability/route/operation/field/block/gate/ error/state/contract version and locale. Evidence: help registry. - [x] S7.20.b Write utility guidance for purpose, prerequisites, authorized audience, inputs/outputs, lifecycle, limitations, cost, safety/rights, failure/recovery, and support. Evidence: content completeness review. - [x] S7.20.c Link help at labels, states, disabled reasons, errors, remediation, inspectors, command palette, and documentation entry points without clutter. Evidence: placement review. - [x] S7.20.d Resolve the exact feature/version and show stale/missing/ incompatible/unauthorized help honestly. Evidence: version matching tests. - [x] S7.20.e Generate links from the same registry/contracts as capability and errors and detect drift/broken anchors. Evidence: drift tests. - [x] S7.20.f Validate concise product-language copy, keyboard/focus behavior, screen reader, locale, narrow layout, and no secret/protected details. Evidence: content accessibility tests. - [x] S7.21 Add design tokens and primitives to Storybook or the repository equivalent. Evidence: automated interaction, a11y, theme, and visual regression suites. - [x] S7.21.a Publish typed tokens for typography, spacing, sizing, layout, density, color/accent/semantic state, border/radius, elevation, motion, z-index, and data visualization. Evidence: token docs. - [x] S7.21.b Publish base controls, forms, status, navigation, overlay, workspace/inspector, table/list/tree, feedback, and accessibility primitives without app-specific vocabulary. Evidence: primitive index. - [x] S7.21.c Add default, hover, active, focus, selected, disabled, read-only, loading, empty, error, stale, fixture, degraded, conflict, and destructive stories. Evidence: state coverage. - [x] S7.21.d Add comfortable/compact/touch, theme/forced-colors, narrow/wide, zoom, reduced-motion, RTL/bidi, long-string, and font-fallback stories. Evidence: cross-context coverage. - [x] S7.21.e Add play-function interaction/keyboard/focus/announcement/ pointer-alternative tests. Evidence: passing interaction suite. - [x] S7.21.f Run automated WCAG checks and real semantic assertions for complex widgets. Evidence: passing accessibility suite. - [x] S7.21.g Pin visual baselines for intended compositions and fail on accidental token/layout/state changes across themes/viewports. Evidence: visual regression report. - [x] S7.21.h Prevent stories/fixtures/test providers from production exports and bundles. Evidence: bundle scan. - [ ] S7.22 Enforce no unnecessary card nesting, no app heroes, no decorative gradient chrome, and no competing accent colors. Evidence: design conformance review. - [x] S7.22.a Inventory every container/card/panel and require that cards represent a selectable, draggable, comparable, previewable, or otherwise meaningful object interaction. Evidence: card-use review. - [x] S7.22.b Flatten nested cards/panels into workspace regions, sections, columns, dividers, lists, or semantic groups where borders/elevation add no meaning. Evidence: before/after composition review. - [x] S7.22.c Remove marketing hero, campaign headline, stat strip, logo cloud, and aspirational banner patterns from operator/authoring routes. Evidence: route screenshot audit. - [x] S7.22.d Remove decorative gradients, glows, glass effects, ornamental icons, thick repeated borders, and shadows that do not convey state/ hierarchy. Evidence: chrome audit. - [x] S7.22.e Enforce one primary accent and separate accessible semantic statuses with noncolor cues. Evidence: token/contrast audit. - [x] S7.22.f Verify each route opens on the actual working surface with one dominant workspace, readable dense information, concise utility copy, and contextual inspector/status. Evidence: hierarchy review. - [ ] S7.22.g Review all supported themes/densities/viewports and record approved exceptions with product/design/accessibility rationale. Evidence: signed design conformance report. ### S8 — Collaboration, review, notifications, and activity - [x] S8.1 Extract approval workflows with role, quorum, sequence, separation-of-duties, and conflict-of-interest rules. Evidence: known-value policy tests. - [x] S8.1.a Define workflow/version, target/revision, approval stages, verdicts, actors/eligible pools, deadlines, and terminal outcomes. Evidence: approval workflow schema. - [x] S8.1.b Define role requirements and eligibility by tenant, object, lifecycle, assignment, specialist qualification, and delegated scope. Evidence: role policy tests. - [x] S8.1.c Define quorum math for eligible, completed, approving, rejecting, abstaining, recused, replaced, unavailable, and delegated reviewers. Evidence: quorum truth tables. - [x] S8.1.d Define sequential, parallel, conditional, repeat-on-change, escalation, and veto stages. Evidence: sequence tests. - [x] S8.1.e Enforce proposer/reviewer/approver/publisher and other separation-of-duties constraints. Evidence: self-approval negative tests. - [x] S8.1.f Define conflict disclosure, recusal, reassignment, confidential detail, override authority, and audit. Evidence: COI lifecycle tests. - [x] S8.1.g Preserve exact evidence/policy/target versions and invalidate stale approvals. Evidence: dependency change tests. - [x] S8.2 Extract anchored comment threads with stable target adapters. Evidence: anchors survive unrelated revisions or are explicitly orphaned. - [x] S8.2.a Define thread/comment identity, target adapter/type, stable anchor, base revision, author/delegate, visibility, state, timestamps, and parent/reply. Evidence: comment schema. - [x] S8.2.b Register entity/field/block/range/temporal/graph/canvas/hierarchy anchor resolve/rebase/context adapters. Evidence: adapter contract tests. - [x] S8.2.c Preserve original excerpt/thumbnail/structural context and exact revision without leaking protected content. Evidence: context security tests. - [x] S8.2.d Rebase anchors across unrelated edits, moves, split/merge, timing conversion, and schema migration where unambiguous. Evidence: rebasing fixtures. - [x] S8.2.e Mark deleted/replaced/ambiguous/permission-hidden/unsupported anchors orphaned with reason and original context rather than moving silently. Evidence: orphan tests. - [x] S8.2.f Implement create/reply/edit-window/resolve/reopen/archive/link/ navigate with authorization, expected revision, notifications, and audit. Evidence: lifecycle tests. - [x] S8.2.g Provide keyboard/screen-reader bidirectional navigation between anchor and thread. Evidence: accessible review journey. - [x] S8.3 Add suggestions distinct from comments and direct edits. Evidence: accept/reject creates attributed revisions. - [x] S8.3.a Define suggestion identity, typed operation/patch, target/base revision/anchor, proposer, rationale, evidence, state, and expiry. Evidence: suggestion schema. - [x] S8.3.b Render proposed change and semantic diff without applying it to authored truth or dirty state. Evidence: proposal isolation tests. - [x] S8.3.c Authorize creation independently from direct edit and approval rights. Evidence: permission matrix. - [x] S8.3.d Revalidate target revision, anchor, schema, authorization, validation, and dependencies at acceptance. Evidence: stale suggestion tests. - [x] S8.3.e Accept whole or supported atomic parts by creating an attributed new revision linked to proposer and accepting actor. Evidence: acceptance lineage tests. - [x] S8.3.f Reject/withdraw/expire/supersede with reason while retaining immutable proposal/audit and no content mutation. Evidence: rejection tests. - [x] S8.3.g Keep comment discussion and suggestion state linked but semantically distinct. Evidence: thread/suggestion tests. - [x] S8.4 Add mentions with tenant-scoped identity resolution. Evidence: unauthorized identities cannot be discovered. - [x] S8.4.a Define mention token/reference independent from display name and support human/team/role/on-call aliases as policy permits. Evidence: mention schema. - [x] S8.4.b Search only identities visible to actor in current tenant/ workspace/object and authorized mention scope. Evidence: identity search negative tests. - [x] S8.4.c Prevent enumeration through query timing, result counts, avatars, errors, autocomplete, copied markup, or guessed stable IDs. Evidence: discovery abuse tests. - [x] S8.4.d Resolve at submission, validate current eligibility, and preserve redacted historical reference if identity later changes/leaves. Evidence: lifecycle tests. - [x] S8.4.e Create idempotent notification/activity refs with source context, urgency, privacy/redaction, locale, and preference policy. Evidence: mention delivery tests. - [x] S8.4.f Handle self, duplicate, nested quote, edit-add/remove, deleted content, suspended user, and inaccessible target. Evidence: edge-case tests. - [x] S8.5 Add assignments, due dates, escalation, reassignment, and workload views. Evidence: state-machine tests. - [x] S8.5.a Define assignment identity/type, target/revision, assignee/ eligible pool, assigner, role, priority, state, reason, and timestamps. Evidence: assignment schema. - [x] S8.5.b Define offered/accepted/active/blocked/completed/declined/ cancelled/overdue/escalated/reassigned transitions and authorization. Evidence: state machine tests. - [x] S8.5.c Define due instant, originating time zone, reminder schedule, extension, SLA class, pause behavior, and DST handling. Evidence: clock-controlled tests. - [x] S8.5.d Escalate overdue/declined/blocked/unavailable/policy-triggered work to configured actor/role/on-call with deduplication. Evidence: escalation tests. - [x] S8.5.e Reassign with reason, preserved history/comments/work, old/new notifications, authority, and due/SLA policy. Evidence: reassignment tests. - [x] S8.5.f Build authorization-aware workload counts/queues by assignee, role, priority, state, due/SLA, domain, capacity, and locale/time zone. Evidence: workload query tests. - [x] S8.5.g Reconcile assignment state with review/gate/target changes and avoid ghost/duplicate work. Evidence: dependency tests. - [x] S8.6 Add presence and active-selection awareness with privacy controls. Evidence: reconnect and stale-presence cleanup tests. - [x] S8.6.a Define ephemeral presence session ID, actor-safe identity, workbench/object, permitted sublocation/selection, device/tab, state, heartbeat, and expiry. Evidence: presence schema. - [x] S8.6.b Authorize publish/subscribe by tenant/object/property/protected context and minimize precision/content exposed. Evidence: privacy tests. - [x] S8.6.c Handle multiple tabs/devices, reconnect/session replacement, network partition, browser sleep, logout, permission loss, and object deletion. Evidence: lifecycle tests. - [x] S8.6.d Expire stale presence by server clock/lease and reconcile missed disconnects without durable online claims. Evidence: cleanup tests. - [x] S8.6.e Render collaborator presence/selection with accessible identity and noncolor cues without obscuring authoring content. Evidence: UI accessibility tests. - [x] S8.6.f Keep presence out of immutable authored state/audit by default while emitting bounded operational telemetry. Evidence: persistence/ telemetry tests. - [x] S8.7 Add notification routing by event, role, urgency, locale, channel, quiet hours, and frequency caps. Evidence: known-value routing suite. - [x] S8.7.a Register notification event types with source, recipients/ audience rules, default urgency, required/optional delivery, sensitivity, template, dedupe key, and expiry. Evidence: event registry. - [x] S8.7.b Resolve explicit user, assignee, mention, owner, reviewer, role/ team, escalation, and delegated recipients at event time with tenancy/ authorization. Evidence: recipient tests. - [x] S8.7.c Compose event/category, urgency, domain/project, role, user, mandatory notice, and channel preferences with explicit precedence. Evidence: preference truth tables. - [x] S8.7.d Render localized templates using recipient locale/time zone, accessible/plain alternatives, safe redaction, and target link. Evidence: locale/security fixtures. - [x] S8.7.e Route in-app, email, push, SMS, webhook, or other registered channel through capability/consent/verification and fallback policy. Evidence: channel tests. - [x] S8.7.f Apply quiet hours/time zone/DST, urgency bypass, digest eligibility, frequency caps, and mandatory safety/security exceptions. Evidence: clock/routing tests. - [x] S8.7.g Persist planned/sent/delivered/failed/bounced/suppressed/deduped/ expired/acknowledged state and safe retry. Evidence: delivery lifecycle. - [x] S8.8 Add digest coalescing and deduplication. Evidence: event storms do not produce notification storms. - [x] S8.8.a Define dedupe identity by recipient, event family, target/scope, state transition, urgency, channel, and time window. Evidence: key contract. - [x] S8.8.b Distinguish exact duplicate, update/supersession, aggregateable related events, and events that must remain separate. Evidence: classification tests. - [x] S8.8.c Define digest windows/schedules by user locale/time zone, preference, urgency, quiet hours, channel, and maximum delay. Evidence: scheduling tests. - [x] S8.8.d Aggregate counts, actors, targets, status, earliest/latest, failures/blockers, and accessible links without leaking hidden items. Evidence: digest content tests. - [x] S8.8.e Atomically claim/send digest items with idempotency and handle concurrent events, retry, partial channel failure, and late arrivals. Evidence: race/fault tests. - [x] S8.8.f Enforce per-recipient/type/channel caps and escalate/drop/summarize according to policy rather than silently discard critical events. Evidence: storm load tests. - [x] S8.9 Add immutable activity-feed events with safe summaries. Evidence: rebuild from audit produces the same ordering. - [x] S8.9.a Define activity event ID/version/type, target/revision, actor-safe reference, outcome, time, causation/correlation, source audit/event, and visibility. Evidence: activity schema. - [x] S8.9.b Generate events from immutable audit/domain events rather than UI guesses and prevent update/delete outside retention/redaction policy. Evidence: source linkage tests. - [x] S8.9.c Generate structured localized safe summaries with no raw content/secrets/protected identity/learner/biometric/unreleased asset. Evidence: canary-data tests. - [x] S8.9.d Apply tenant/object/property/audience authorization to events, counts, actors, targets, linked refs, and export. Evidence: disclosure tests. - [x] S8.9.e Order deterministically by authoritative time/sequence and stable tie-breaker; handle late/out-of-order/replayed events. Evidence: ordering tests. - [x] S8.9.f Rebuild from empty feed using audit/event history and compare event IDs/order/content/visibility to stored projection. Evidence: replay parity test. - [x] S8.10 Add review inbox and saved queues. Evidence: server-side filters, assignment, SLA, and pagination are tested. - [x] S8.10.a Define inbox item projection for review/assignment/gate/signoff/ escalation target, revision, role, priority, state, due/SLA, freshness, blockers, and safe summary. Evidence: projection schema. - [x] S8.10.b Resolve eligible items from current assignment/role/delegation/ quorum/stage/authorization and remove stale or completed work. Evidence: eligibility tests. - [x] S8.10.c Implement server-side full-text/structured filters for domain, workbench, type, state, stage, assignee/role, priority, due/SLA, freshness, gate, and target. Evidence: query tests. - [x] S8.10.d Implement deterministic sort/cursor pagination and live count/ status reconciliation under concurrent assignment or decision changes. Evidence: pagination tests. - [x] S8.10.e Persist private/team saved queues with query, columns, grouping, sort, density, sharing, schema migration, and authorization. Evidence: saved queue tests. - [x] S8.10.f Support accept/start/block/complete/decline/reassign/escalate/ bulk actions with expected revision, impact, audit, and partial result. Evidence: inbox action tests. - [x] S8.10.g Provide keyboard/screen-reader/virtualization/deep-link and narrow review experience. Evidence: accessible journey. - [x] S8.11 Add reviewer handoff and temporary delegation. Evidence: expired delegations stop authorizing actions. - [x] S8.11.a Define handoff for selected assignment/review target with source/ destination reviewer, reason, context, unresolved work, due/SLA, and effective time. Evidence: handoff schema. - [x] S8.11.b Validate destination eligibility, role/qualification, tenant/ object access, workload/capacity, COI, and availability. Evidence: eligibility negative tests. - [x] S8.11.c Transfer ownership atomically, preserve prior reviewer history, comments/evidence, due/SLA policy, notifications, and audit. Evidence: handoff integration tests. - [x] S8.11.d Define delegation scope by action/role/domain/workbench/object/ target, delegator/delegate, start/expiry, reason, and nondelegable actions. Evidence: delegation schema. - [x] S8.11.e Require delegator authority and delegate eligibility, prohibit privilege amplification/transitive redelegation unless explicit, and enforce separation/COI. Evidence: authorization tests. - [x] S8.11.f Activate/revoke/expire delegation by server time and re-evaluate pending work/approvals without retroactively altering completed actions. Evidence: clock-controlled tests. - [x] S8.11.g Display effective delegated actor on actions/audit and notify affected parties. Evidence: attribution tests. - [x] S8.12 Add redaction rules for protected sources, learner records, biometric data, and unreleased assets. Evidence: notification and activity snapshots contain no protected payloads. - [x] S8.12.a Define protected-source identity/contact/document/relationship/ location fields and allowed pseudonym/role summaries per audience. Evidence: source redaction policy. - [x] S8.12.b Define learner identity/enrollment/activity/assessment/ accommodation/integrity/credential fields and educational-role access. Evidence: learner redaction policy. - [x] S8.12.c Define face/voice/body/motion/health/embedding/template/derived biometric fields and consent/purpose/role access. Evidence: biometric redaction policy. - [x] S8.12.d Define unreleased content/title/media/script/build/research/ model/product/embargo metadata and audience/embargo access. Evidence: unreleased asset policy. - [x] S8.12.e Apply structured allowlist/redaction before template rendering, summary generation, channel routing, activity projection, search/index, export, logs, and support tools. Evidence: boundary coverage tests. - [x] S8.12.f Prevent inference through counts, actor names/avatars, target titles/URLs, snippets, grouping, timing, errors, and deep links. Evidence: side-channel tests. - [x] S8.12.g Use canary values across notifications/activity/digests/emails/ push/webhooks/exports/snapshots and fail on any payload leak. Evidence: automated leakage suite. ### S9 — Taxonomy, localization, calendar, catalog, and discovery - [x] S9.1 Extract tighten-only registry merge with code floors and provenance. Evidence: every attempted loosening fails. - [x] S9.1.a Define registry entry identity/version, owner, value schema, scope, status, source, authority, effective period, and provenance. Evidence: registry contract. - [x] S9.1.b Define immutable code floors for required entries, minimum severity/constraint, prohibited values, trust/safety requirements, and schema/version bounds. Evidence: floor schema. - [x] S9.1.c Define source precedence for code, signed policy, tenant, project, domain, environment, and runtime overrides without last-write-wins. Evidence: precedence truth table. - [x] S9.1.d Implement field-aware merge that permits additions and equal/ stricter values while rejecting deletion, weakening, wider audience, lower threshold/severity, longer expiry, or unknown comparison. Evidence: tighten-only property tests. - [x] S9.1.e Preserve contributing source/version/hash/actor/decision/time and rejected override reason for every effective field. Evidence: field provenance tests. - [x] S9.1.f Reject conflicts, ambiguous partial order, incompatible schema, cycles/aliases, unsigned required inputs, and stale sources. Evidence: negative fixture matrix. - [x] S9.1.g Generate deterministic effective registry and diff/explanation. Evidence: repeat generation and loosening mutation tests. - [x] S9.2 Add registry draft, review, publish, deprecate, alias, and migration lifecycle. Evidence: published artifacts remain resolvable. - [x] S9.2.a Define immutable registry version identity and draft/review/ approved/published/deprecated/retired state machine. Evidence: lifecycle tests. - [x] S9.2.b Create/edit drafts against an explicit base with validation, semantic diff, conflict, ownership, reason, and provenance. Evidence: draft tests. - [x] S9.2.c Define review assignments, required roles/quorum, comments, decisions, tighten-only/floor checks, and stale-review invalidation. Evidence: review tests. - [x] S9.2.d Publish atomically with immutable artifact/hash, effective time, compatibility, notifications, cache/index invalidation, and audit. Evidence: publish tests. - [x] S9.2.e Deprecate with replacement, migration guide, warning, supported- through/sunset, owner, and usage telemetry. Evidence: deprecation tests. - [x] S9.2.f Add alias with stable source/target, scope, noncollision, noncycle, display/search behavior, and deprecation status. Evidence: alias tests. - [x] S9.2.g Define migration mappings for removed/merged/split/moved/renamed entries with loss/conflict report and resumable backfill. Evidence: migration tests. - [x] S9.2.h Resolve exact historical published versions and aliases after later updates/deprecation/retirement. Evidence: historical resolution tests. - [x] S9.3 Add taxonomy impact preview. Evidence: affected queries, artifacts, filters, exports, and URLs are enumerated before change. - [x] S9.3.a Accept a versioned proposed add/rename/move/merge/split/alias/ deprecate/retire change against exact published base. Evidence: preview input contract. - [x] S9.3.b Enumerate affected stored entity assignments, inherited classifications, translations, rules, gates, permissions, and dependent registry entries. Evidence: data impact rows. - [x] S9.3.c Enumerate affected search queries/index docs/facets/suggestions, saved views/queues, filters, reports, and dashboards. Evidence: discovery impact rows. - [x] S9.3.d Enumerate affected bundle/export/import/interchange values, consumer contracts, external IDs, catalog/collection rules, and published artifacts. Evidence: integration impact rows. - [x] S9.3.e Enumerate canonical/deep URLs, navigation, redirects, bookmarks, caches, and share links. Evidence: route impact rows. - [x] S9.3.f Calculate counts, samples, ambiguous mappings, required decisions, migrations/backfills/reindex, cost/time, owners, and rollback. Evidence: impact plan. - [x] S9.3.g Keep preview read-only and revalidate base/proposal/authorization when applying through a separate audited job. Evidence: no-side-effect and stale-preview tests. - [x] S9.4 Add localized label and description support without localizing stable IDs. Evidence: locale fallback tests. - [x] S9.4.a Keep stable registry/taxonomy ID, code, alias target, parent/path, version, and interchange value locale-independent. Evidence: contract tests. - [x] S9.4.b Store localized label/short/long description/help/keywords with canonical locale, source locale, status, author/translator, revision, provenance, and updated time. Evidence: localized value schema. - [x] S9.4.c Define exact locale, language, configured fallback chain, source/default, and missing behavior without silently persisting a fallback as translation. Evidence: fallback tests. - [x] S9.4.d Distinguish absent, draft, machine-suggested, human-reviewed, approved, stale, rejected, obsolete, and inaccessible values. Evidence: state fixtures. - [x] S9.4.e Validate script/direction, length/markup/placeholders/links, terminology, uniqueness where required, and unsupported locale. Evidence: validation tests. - [x] S9.4.f Search/sort/display by requested locale while retaining stable ID for API/filter/URL/export and exposing fallback/source state. Evidence: end-to-end locale tests. - [x] S9.5 Add editorial calendar entities for tentative and committed slots. Evidence: committed capacity cannot be double-booked. - [x] S9.5.a Define calendar/resource/slot IDs, owner/scope, title-safe ref, start/end/time zone, status, priority, target/type, capacity demand, dependency, revision, and audit. Evidence: slot schema. - [x] S9.5.b Define proposed/held/tentative/committed/in-progress/completed/ cancelled/expired/conflicted transitions and authorization. Evidence: slot state tests. - [x] S9.5.c Define tentative hold duration/expiry, renewal, overbooking visibility, ranking, confirmation deadline, and no guaranteed-capacity claim. Evidence: hold clock tests. - [x] S9.5.d Define committed reservation transaction, capacity unit/ availability, exclusivity/share rules, expected revision, and idempotency. Evidence: reservation contract. - [x] S9.5.e Enforce exclusion/capacity constraints under concurrent commit, resize, move, cancel, resource change, and recurrence materialization. Evidence: real-DB double-booking tests. - [x] S9.5.f Reconcile resource/target/project dependencies, conflicts, notifications, publication/release state, and calendar projections. Evidence: integration tests. - [x] S9.5.g Apply tenant/object/property authorization and protect embargoed/ confidential titles in free-busy views. Evidence: disclosure tests. - [x] S9.6 Add recurrence, time-zone, daylight-saving, embargo, blackout, and dependency semantics. Evidence: calendar edge-case suite. - [x] S9.6.a Define supported recurrence rule/version, start, count/until, intervals, weekdays/month rules, inclusions/exclusions, exception edits, and series/occurrence identity. Evidence: recurrence contract. - [x] S9.6.b Store source local date/time and IANA zone plus resolved instant/ offset and tzdata version without relying on server locale. Evidence: temporal schema tests. - [x] S9.6.c Define nonexistent/ambiguous DST time choice, repeated/skipped occurrence, zone rule change, leap/day boundary, and all-day behavior. Evidence: DST edge fixtures. - [x] S9.6.d Define embargo start/end/zone, allowed prepublication actors, early release, extension/lift, clock source, target/channel/territory, and fail-closed state. Evidence: embargo tests. - [x] S9.6.e Define resource/tenant/global blackout type, interval/recurrence, capacity effect, priority, override authority, and conflict. Evidence: blackout tests. - [x] S9.6.f Define finish/start, release/gate, asset/source, resource, approval, and cross-domain dependencies with lag/lead and unavailable state. Evidence: dependency scheduling tests. - [x] S9.6.g Materialize/query bounded windows deterministically and detect conflicts without infinite expansion or stale tzdata. Evidence: performance/property tests. - [x] S9.7 Add drag and non-drag scheduling with server conflict checks. Evidence: concurrent reservation test. - [x] S9.7.a Load resource/calendar capacity, tentative/committed slots, dependencies, blackouts, embargo, permissions, version, and current time from server. Evidence: scheduling view tests. - [x] S9.7.b Implement pointer/touch drag/resize preview with snapping, time zone/DST, target resource, duration, dependency, and impact; do not commit optimistically. Evidence: drag tests. - [x] S9.7.c Provide keyboard move/resize/target controls and explicit edit dialog with exact date/time/zone/duration/resource as non-drag parity. Evidence: accessible alternatives. - [x] S9.7.d Send expected calendar/resource/slot revisions and idempotency key to an atomic server capacity/conflict check and reservation. Evidence: command contract. - [x] S9.7.e Return conflicting slots/resources/dependencies/blackouts/ embargo/capacity with protected safe detail and alternatives where permitted. Evidence: conflict fixtures. - [x] S9.7.f Handle concurrent accept/reject, stale display, tentative expiry, permission change, partial bulk, offline, retry, and unknown outcome. Evidence: race/fault tests. - [x] S9.7.g Restore focus/selection and announce accepted/refused/conflict result with undo/compensating behavior where supported. Evidence: accessible journey. - [x] S9.8 Add capacity resources and reservation units as domain plugins. Evidence: GPU, reviewer, DCC host, editorial, and distribution examples. - [x] S9.8.a Define plugin-owned resource type/ID/version, tenant/scope, capabilities/constraints, calendar/availability, capacity units, location/zone, cost, health, and lifecycle. Evidence: resource contract. - [x] S9.8.b Define reservation request units, amount/rate, interval, exclusivity/share, setup/teardown, priority, preemption, quota, cost, and result. Evidence: reservation contract. - [x] S9.8.c Define availability/capacity calculation, tentative hold, commitment, release, resize, move, expiry, failure, and reconciliation interfaces. Evidence: plugin lifecycle tests. - [x] S9.8.d Implement GPU example with model/VRAM/compute/region/driver, fractional/exclusive capacity, quota, health, and cost. Evidence: GPU fixtures. - [x] S9.8.e Implement reviewer example with qualification/role/working hours/ load/COI, count/effort units, delegation, and privacy. Evidence: reviewer fixtures. - [x] S9.8.f Implement DCC host example with application/version/plugin/ license/GPU/session/exclusive slot, liveness, and maintenance. Evidence: DCC fixtures. - [x] S9.8.g Implement editorial and distribution examples with slot/ throughput/channel/territory/embargo/deadline/blackout semantics. Evidence: domain fixtures. - [x] S9.8.h Prove plugins share reservation engine without shared code assuming one unit or silently converting incompatible capacities. Evidence: cross-resource isolation tests. - [x] S9.9 Add collection, relation, feature, rank, eligibility, and audience curation primitives. Evidence: deterministic curation bundle. - [x] S9.9.a Define versioned collection identity/type/owner/scope/title refs/ lifecycle and ordered or rule-driven membership. Evidence: collection schema. - [x] S9.9.b Define typed directional relation identity, source/target, role/strength/order, validity period, provenance, and constraints. Evidence: relation schema. - [x] S9.9.c Define feature placement/slot, target, creative/metadata ref, start/end, priority, exclusivity, fallback, and target/channel context. Evidence: feature schema. - [x] S9.9.d Define raw rank signals/units/source/version/time separately from rank policy/weights/tie-break/diversity and final position. Evidence: deterministic ranking tests. - [x] S9.9.e Define eligibility rules for lifecycle/gates/freshness/rights/ consent/embargo/audience/locale/territory/channel/capacity and exact refusal reasons. Evidence: eligibility truth tables. - [x] S9.9.f Define audience segments by stable governed refs, allowed attributes/purpose/consent, version, minimum cohort/privacy, and noninference rules. Evidence: audience security tests. - [x] S9.9.g Compose/validate curation with no duplicates/cycles/invalid refs, deterministic ordering, preview/diff, review, and expected revision. Evidence: composition tests. - [x] S9.9.h Build a versioned bundle whose identical inputs produce identical members/ranks/eligibility/reasons/hash. Evidence: reproducibility test. - [x] S9.10 Prohibit direct production-catalog writes. Evidence: all changes pass through reviewed versioned bundles. - [x] S9.10.a Inventory database/admin/API/job/import/script/provider paths capable of changing production catalog, search, feature, rank, collection, or audience state. Evidence: write-path register. - [x] S9.10.b Define draft proposal/bundle, semantic diff/impact, validation/ gates, required reviews/approvals, schedule/embargo, publish, verify, and rollback lifecycle. Evidence: catalog workflow contract. - [x] S9.10.c Restrict production catalog credentials and write functions to the publisher identity and deny humans/hosts/domain services direct access. Evidence: authorization tests. - [x] S9.10.d Bind publisher execution to immutable approved bundle/hash, target/environment, expected production version, idempotency, and step-up. Evidence: command tests. - [x] S9.10.e Prevent alternate database, search index, cache, compatibility, migration, admin, or provider API writes from bypassing the workflow. Evidence: bypass tests. - [x] S9.10.f Read back and verify production catalog, preserve immutable release/audit, and reconcile partial/unknown/rollback outcomes. Evidence: end-to-end publish tests. - [x] S9.10.g Add CI/runtime detection for unregistered catalog mutation code/ credentials. Evidence: deliberate bypass failure. - [x] S9.11 Add search indexing events with replay and dead-letter handling. Evidence: full rebuild matches incremental index. - [x] S9.11.a Define versioned index event types for upsert/delete/tombstone/ permission/taxonomy/localization/rights/gate/catalog/visibility changes. Evidence: event schemas. - [x] S9.11.b Emit authoritative event with tenant/object/revision/sequence, changed field classes, causation/correlation, and projection version via outbox. Evidence: atomicity tests. - [x] S9.11.c Consume idempotently with per-object/version ordering, late/ duplicate/out-of-order/gap/deletion handling, and property redaction. Evidence: delivery tests. - [x] S9.11.d Build documents through versioned projection adapter and perform atomic replace/delete without partial searchable state. Evidence: indexing integration tests. - [x] S9.11.e Retry transient failures and dead-letter malformed/unsupported/ deterministic failures with owner, safe cause, source event, and replay. Evidence: dead-letter tests. - [x] S9.11.f Implement checkpointed full rebuild from authoritative data/ events into new index version with validation and atomic alias/cutover. Evidence: rebuild rehearsal. - [x] S9.11.g Compare incremental and rebuild docs/counts/hashes/queries/ permissions and repair divergence. Evidence: parity report. - [x] S9.12 Add permission-aware search projection. Evidence: hidden titles and counts do not leak. - [x] S9.12.a Define searchable/displayable/facetable/sortable/suggestible/ exportable fields per property authorization, audience, lifecycle, classification, and tenant scope. Evidence: projection policy. - [x] S9.12.b Project tenant/workspace/object ACL or authorization filter version plus protected-source/learner/biometric/unreleased redaction without raw credentials/roles. Evidence: index document tests. - [x] S9.12.c Apply authorization before query, total/count, facet, group, suggestion/autocomplete, highlight/snippet, ranking, and pagination. Evidence: disclosure negative tests. - [x] S9.12.d Revalidate current object/property authorization at result use to cover stale index and emergency revocation. Evidence: stale ACL tests. - [x] S9.12.e Update/delete index immediately on permission/ownership/ classification/embargo/rights/consent/lifecycle change. Evidence: invalidation latency tests. - [x] S9.12.f Prevent hidden existence inference through timing, score, spelling suggestion, related item, empty-versus-forbidden errors, cached result, and cursor. Evidence: side-channel tests. - [x] S9.12.g Test two tenants with colliding IDs/titles/content/taxonomy and ordinary/assigned/reviewer/auditor/support roles. Evidence: isolation matrix. - [x] S9.13 Add localization jobs, translation memory refs, glossary refs, review, and parity gates. Evidence: locale bundle round-trip. - [x] S9.13.a Define localization job source revision/locale, target locale/ script/region, field/unit list, provider/method, references, policy, budget, and lifecycle. Evidence: job schema. - [x] S9.13.b Segment structured content without localizing IDs/code/URLs/ placeholders/standards and preserve stable source anchors/order/context. Evidence: segmentation tests. - [x] S9.13.c Reference authorized versioned translation memory matches with source/target locale, segment/hash, score, rights/confidentiality, and provenance. Evidence: TM tests. - [x] S9.13.d Reference versioned glossary terms, morphology/context, required/ forbidden translations, case, locale scope, and precedence. Evidence: glossary tests. - [x] S9.13.e Store generated/human translation as proposal with provider/ model/template/run/cost or translator identity and no auto-approval. Evidence: proposal lifecycle tests. - [x] S9.13.f Implement linguistic/domain/legal/safety/accessibility review, suggestions, comments, required roles/quorum, and approval per locale. Evidence: review workflow tests. - [x] S9.13.g Gate completeness, placeholder/markup/reference parity, terminology, numbers/units/dates, links, rights, layout/overflow, accessibility, and source freshness. Evidence: parity gate tests. - [x] S9.13.h Build/export/import locale bundle with source/target revisions, stable IDs, statuses, refs, provenance, hashes, and loss report; require round-trip identity. Evidence: bundle tests. - [x] S9.14 Add cross-locale dependency invalidation. Evidence: source changes mark translated dependents stale. - [x] S9.14.a Record dependency from each translated field/segment/bundle/ review/gate/release to exact source field/anchor/revision/hash and translation inputs. Evidence: dependency schema. - [x] S9.14.b Classify source changes as content, structure, identifier, placeholder/markup, link, media, rights/consent, glossary/TM, policy, metadata, or nonsemantic. Evidence: change classifier tests. - [x] S9.14.c Determine affected locales/segments/references/layout/parity gates/catalog/search/releases transitively without invalidating unrelated translations. Evidence: blast-radius tests. - [x] S9.14.d Mark dependencies stale transactionally with source old/new revision, change reason/type, time, and event. Evidence: staleness tests. - [x] S9.14.e Queue idempotent retranslation/review/parity/reindex/rebundle or require human action according to policy and cost. Evidence: workflow routing tests. - [x] S9.14.f Block publication/use where stale translated content violates target policy and surface exact affected locales/segments. Evidence: eligibility tests. - [x] S9.14.g Reconcile missed invalidation by comparing stored dependency versions to authoritative sources. Evidence: repair tests. - [x] S9.15 Add accessible calendar, catalog, and taxonomy UI primitives. Evidence: keyboard-only full journeys. - [x] S9.15.a Build calendar agenda/list/grid views with semantic date/time/ zone/resource/slot/status/capacity/conflict data and synchronized selection. Evidence: calendar parity tests. - [x] S9.15.b Provide keyboard create/navigate/select/move/resize/recurrence/ exception/resource/commit/cancel and exact form alternatives to drag. Evidence: keyboard calendar journey. - [x] S9.15.c Build catalog table/list/collection/feature/rank/eligibility/ audience views with preview/diff/review/publish state. Evidence: catalog semantic tests. - [x] S9.15.d Provide keyboard curation, ordering, targeting, eligibility inspection, preview, review, and bundle publication journey. Evidence: keyboard catalog journey. - [x] S9.15.e Build taxonomy tree/list/search/detail/impact/diff/lifecycle/ translation views with nonvisual hierarchy and counts. Evidence: taxonomy semantic tests. - [x] S9.15.f Provide keyboard add/rename/move/merge/split/alias/deprecate/ migrate/review/publish journey with cycle and impact feedback. Evidence: keyboard taxonomy journey. - [x] S9.15.g Implement focus restoration, announcements, noncolor status, zoom/reflow, RTL/time-zone/locale, virtualization, conflict/offline/ degraded states across all three. Evidence: cross-primitive a11y matrix. - [x] S9.16 Add exportable calendar and catalog audit snapshots. Evidence: stable schema and authorization tests. - [x] S9.16.a Define versioned snapshot envelope with type/scope/query/time window/target, source versions, generated actor/time, schema, redaction policy, counts, pagination completeness, and hash. Evidence: envelope schema. - [x] S9.16.b Export calendar resources/capacity, slots/recurrence/exceptions, states, dependencies, blackouts/embargo, conflicts, actors, changes, and audit refs. Evidence: calendar snapshot fixtures. - [x] S9.16.c Export catalog/collection/relation/feature/rank/eligibility/ audience, bundle/release, target verification, correction/withdrawal, actors, changes, and audit refs. Evidence: catalog snapshot fixtures. - [x] S9.16.d Apply tenant/object/property/protected/embargo/audience role and purpose authorization at query and serialization. Evidence: ordinary/ auditor cross-tenant negative tests. - [x] S9.16.e Redact or pseudonymize content/identity according to snapshot purpose while preserving stable internal refs only for authorized exports. Evidence: canary data tests. - [x] S9.16.f Generate deterministically with stable order/format/time semantics and sign/checksum immutable output. Evidence: reproducibility tests. - [x] S9.16.g Verify import/read tooling, schema compatibility, complete page capture, retention/legal hold, and audit of export/download. Evidence: snapshot lifecycle tests. ### S10 — Observability, reliability, privacy, and cost - [x] S10.1 Define shared OpenTelemetry resource and span attributes. Evidence: schema lint rejects unbounded content attributes. - [x] S10.1.a Define resource attributes for service/library, version, domain/ workbench, host/runtime, environment, region, deployment, worker/ provider class, and tenant-safe scope. Evidence: resource schema. - [x] S10.1.b Define span naming and attributes for UI navigation/action, HTTP/ RPC, command/query, database, outbox/inbox/event, job, provider/model, blob/bundle, review/gate, publish/verify, and bridge. Evidence: span schema. - [x] S10.1.c Define status/error/retry/cancel/timeout/partial/unknown outcome, correlation, version, target, usage, and cost attributes with units. Evidence: semantic convention tests. - [x] S10.1.d Allowlist bounded values and explicitly prohibit raw IDs, content, prompts, URLs/paths, filenames, stack/error messages, PII, protected identity, biometric/learner data, and secrets. Evidence: attribute policy. - [x] S10.1.e Set cardinality and length budgets, unknown/other behavior, and schema version/deprecation ownership. Evidence: lint configuration. - [x] S10.1.f Add compile/runtime lint and canary-data tests that reject unregistered or unbounded attributes. Evidence: deliberate violation test. - [x] S10.2 Instrument browser-to-worker trace propagation. Evidence: one synthetic journey has an unbroken trace. - [x] S10.2.a Create/continue W3C trace context at trusted browser/desktop ingress and validate sampling/baggage propagation without accepting spoofed internal identity. Evidence: ingress tests. - [x] S10.2.b Propagate through web navigation/action, BFF request, actor/auth/ authorization, domain service, database/blob/cache/search, and response. Evidence: synchronous trace tests. - [x] S10.2.c Persist trace/correlation in outbox/event/inbox/job parent-child/ attempt and restore context in worker. Evidence: asynchronous tests. - [x] S10.2.d Propagate allowed context to provider/model/tool, publisher, callback/webhook, DCC/engine/bridge, and read-back verification. Evidence: external boundary tests. - [x] S10.2.e Link audit, job, provider, artifact, bundle, release, and external refs as span attributes/events without high-cardinality metrics. Evidence: trace evidence tests. - [x] S10.2.f Preserve parent/link semantics across retry, fan-out/fan-in, queue delay, batch, cancellation, unknown outcome, and compensation. Evidence: topology tests. - [x] S10.2.g Run a synthetic browser-to-worker-to-publisher journey and assert no broken segment, wrong tenant context, or sensitive baggage. Evidence: captured trace. - [x] S10.3 Instrument stage, gate, review, job, publish, and curation metrics. Evidence: metric names and units pass semantic review. - [x] S10.3.a Define stage transition requests/refusals/completions/duration/ current distribution with bounded domain/stage/action/outcome labels. Evidence: stage metrics. - [x] S10.3.b Define gate runs/duration/verdict/freshness age/invalidation/ recomputation/waiver/unavailable metrics with evaluator/policy families. Evidence: gate metrics. - [x] S10.3.c Define review assignments/queue age/SLA/verdict/quorum/escalation/ delegation/COI/approval duration metrics without identity labels. Evidence: review metrics. - [x] S10.3.d Define job queue/execution/attempt/retry/cancel/dead-letter/ resource/usage/cost/outcome metrics by bounded job/provider/resource class. Evidence: job metrics. - [x] S10.3.e Define publish plan/eligibility/refusal/execute/read-back/ mismatch/compensation/target latency and outcome metrics. Evidence: publish metrics. - [x] S10.3.f Define curation proposal/review/bundle/publish, eligible/ ineligible, collection/feature size/rank drift, catalog verify/correction metrics. Evidence: curation metrics. - [x] S10.3.g Verify instrument type, unit, boundaries, aggregation, cardinality, privacy, owner, dashboard, and alert use. Evidence: semantic review. - [x] S10.4 Define SLOs and error-budget policies for interactive and asynchronous paths. Evidence: owners approve measurable objectives. - [x] S10.4.a Inventory critical interactive read/search/navigation/save/ mutation/review/gate/publish-control journeys and user-visible success. Evidence: interactive SLI register. - [x] S10.4.b Inventory critical queued job/gate/provider/render/import/export/ publish/notification/index/localization workflows and terminal success. Evidence: async SLI register. - [x] S10.4.c Define availability/correctness, latency/deadline/queue-age, durability/freshness, and partial/degraded success semantics with qualifying events and exclusions. Evidence: SLI specifications. - [x] S10.4.d Set target/window/error budget by domain/risk/priority and dependency contribution without hiding missing telemetry. Evidence: SLO table. - [x] S10.4.e Define multiwindow burn alerts, ownership/escalation, freeze/ rollback/capacity actions, and release/feature-work error-budget policy. Evidence: policy. - [x] S10.4.f Validate SLIs against synthetic success/failure/degraded/missing data and historical or load evidence. Evidence: SLI tests. - [x] S10.4.g Obtain named service/domain/product/operations owner approval and quarterly review. Evidence: approval records. - [x] S10.5 Add dependency health, saturation, queue age, and circuit-breaker dashboards. Evidence: fault injection changes the expected panels. - [x] S10.5.a Register databases, blobs, queues/workers, caches/search, providers/models/tools, signing/trust, publishers/channels, bridges/ hosts, identity, and telemetry dependencies with owner/SLO. Evidence: dependency register. - [x] S10.5.b Display configured/not-configured/healthy/degraded/unavailable/ failed/stale-probe, latency/error rate, last success/failure, and affected capability. Evidence: health panels. - [x] S10.5.c Display CPU/memory/GPU/storage/connection/thread/license/token/ quota/provider capacity versus limits and trend. Evidence: saturation panels. - [x] S10.5.d Display queue depth/age by priority/type/tenant-safe cohort, throughput, lease loss, retries, dead letters, worker availability, and oldest work. Evidence: queue panels. - [x] S10.5.e Display circuit closed/open/half-open, reason, threshold, failures, opened/until, probes, affected calls, fallback/degradation, and authorized controls. Evidence: circuit panels. - [x] S10.5.f Link SLO/burn, traces/logs/jobs/incidents/runbooks/owners and apply bounded labels/access/redaction. Evidence: dashboard review. - [x] S10.5.g Inject timeout/throttle/saturation/queue stall/circuit/dead-letter faults and assert exact panel/alert/recovery changes. Evidence: dashboard fault tests. - [x] S10.6 Add privacy-safe structured logging. Evidence: automated log scan catches content, tokens, secrets, PII, and protected identifiers. - [x] S10.6.a Define versioned event names and allowlisted typed fields for lifecycle/state/error-class/correlation/trace/operation/version/ duration/usage/cost and bounded context. Evidence: logging schema. - [x] S10.6.b Define severity and required/optional sampling for validation, auth, dependency, retry, job, provider, publish, audit linkage, degradation, and incident events. Evidence: event catalog. - [x] S10.6.c Exclude raw authored/source content, prompts/responses, file/URL/ query/path, tokens/credentials, stack/SQL, PII, protected identity, learner/biometric, and unreleased asset detail by default. Evidence: field prohibition policy. - [x] S10.6.d Redact/tokenize/pseudonymize only approved fields before log emission and treat redaction failure as drop/quarantine, not raw fallback. Evidence: redaction tests. - [x] S10.6.e Configure transport encryption, regional storage, access, retention/deletion/legal hold, export, sampling/rate limits, and unavailable exporter behavior. Evidence: log lifecycle tests. - [x] S10.6.f Scan source/config/generated logs and runtime output with canary content/secrets/PII/protected IDs; minimize retained failures. Evidence: automated leakage report. NOTE (S10.6, for S10.7): `evaluateDeletion` over the shipped sink register answers `partial` -- only Elasticsearch can delete by query, `http` is append-only-immutable and the rest expire by partition. S10.7 asks for retention, legal hold and integrity over AUDIT records and will need that answer, along with `evaluateLegalHold`'s `hold-cannot-override-partition-expiry`, which is the case where a hold is recorded and the data goes anyway. - [x] S10.7 Add audit retention, export, legal hold, and integrity verification. Evidence: tamper test and retention test. - [x] S10.7.a Classify audit event types/data fields by retention source, minimum/maximum, tenant/regulatory/contractual policy, and purge rules. Evidence: audit retention matrix. - [x] S10.7.b Implement immutable append-only storage/partitioning with hash/signature chain or equivalent integrity, trusted timestamp, backup, and restricted writer. Evidence: integrity design tests. - [x] S10.7.c Apply retention/expiry/archive/purge while preserving required tombstone/integrity linkage and deleting prohibited content. Evidence: clock-controlled retention tests. - [x] S10.7.d Implement legal hold by scope/reason/authority/start/release, prevent held purge, restrict visibility, and audit every action. Evidence: hold tests. - [x] S10.7.e Export authorized query/time/tenant/object/event scope in stable schema with redaction policy, completeness, hashes/signature, chain verification, and export audit. Evidence: export tests. - [x] S10.7.f Continuously/sample-verify sequence/hash/signature/timestamp/ storage/backup consistency and surface missing/reordered/changed events. Evidence: verification job. - [x] S10.7.g Tamper, delete, reorder, duplicate, corrupt, expire, hold, export, and restore audit fixtures. Evidence: adversarial lifecycle report. NOTE (S10.7, for S10.8): `AUDIT_RECORD_CLASSES` includes `billing-event`, and `classRetention` resolves its bounds but nothing yet meters it. S10.8 asks for cost attribution with sampled invoice reconciliation, and a cost record is an audit record with a number on it: its retention row, its `attestsAbout` edge and the `attestation-expires-before-its-subject` rule all apply, and a reconciliation that outlives the records it reconciled is the same defect this cell named. - [x] S10.8 Add provider, storage, compute, egress, and human-review cost attribution. Evidence: sampled invoice reconciliation. - [x] S10.8.a Maintain versioned rate cards and units for provider/model/tool, database/blob/cache/search/queue/log, CPU/GPU/memory, transfer/egress, DCC/license, and reviewer role/time. Evidence: rate registry. - [x] S10.8.b Capture metered quantity, unit, source, time window, region/ tier, attempt, job/run/artifact/release, actor/project/tenant/provider attribution, and confidence. Evidence: usage schema. - [x] S10.8.c Calculate estimated/reserved/actual/refunded/unallocated cost with currency/rate version and no fabricated zero on missing data. Evidence: calculation tests. - [x] S10.8.d Allocate shared storage/compute/egress/observability/license/ reviewer cost through approved reproducible rules and retain raw/derived distinction. Evidence: allocation tests. - [x] S10.8.e Reconcile provider invoices, cloud billing exports, storage/ egress meters, license records, and review time samples to internal usage. Evidence: sampled reconciliation. - [x] S10.8.f Record variance/missing/late/duplicate/disputed/refund/credit and correction without rewriting prior periods. Evidence: variance tests. - [x] S10.8.g Expose permission-aware cost by domain/workbench/project/tenant/ capability/provider/resource/release with privacy and bounded labels. Evidence: cost projection tests. NOTE (S10.8, for S10.9): `reviewCostSystem` predicts ten defect classes and this harness has scenarios for six. The four unexercised — `unversioned-rate`, `unmetered-class-as-zero`, `prior-period-rewrite`, `residual-disclosure` — are real and named rather than quietly dropped. S10.9 asks for spend and unallocated-cost anomaly alerts, and an alert computed over a total that cannot say which of its parts were priced inherits every one of them: a burn-rate forecast over a partial denominator under-predicts exhaustion by exactly the share nobody metered, and `costComplete` is the field that says so. - [x] S10.9 Add quota and anomaly alerts before hard exhaustion. Evidence: threshold and recovery tests. - [x] S10.9.a Register rate/concurrency/storage/compute/GPU/token/provider/ license/queue/spend/reviewer capacity quotas by scope, window, owner, and hard limit. Evidence: quota registry. - [x] S10.9.b Define warning/critical forecast thresholds by absolute use, percentage, remaining time, burn rate, queue growth, and provider/reset delay. Evidence: threshold policy. - [x] S10.9.c Detect volume/rate/variance/retry/failure/resource/provider/cost/ unallocated and behavioral anomalies with versioned model/rule and uncertainty. Evidence: anomaly fixtures. - [x] S10.9.d Alert before exhaustion with affected capability/scope, current/ forecast/limit/reset, owner, dashboard/runbook, mitigation, and safe context. Evidence: alert payload tests. - [x] S10.9.e Deduplicate correlated quota/anomaly/dependency symptoms and route/escalate by ownership and severity. Evidence: event storm tests. - [x] S10.9.f Test recovery/reset/quota increase/demand reduction/provider recovery and clear only after sustained safe state. Evidence: clock-controlled recovery tests. - [x] S10.9.g Verify hard limits still fail closed if warning/alert pipeline is unavailable. Evidence: alert outage test. NOTE (S10.9, for S10.10): the enforcement split this section ships -- `hardLimitReached` computed before the pipeline is read, soft slack withdrawn when it cannot deliver -- is one dependency's degradation plan written out by hand. S10.10 asks for that plan for EVERY dependency, and the field it will need is the one `QUOTA_WINDOW_KINDS` already forced: `concurrent` and `non-renewing` have no reset instant, so "degraded until it recovers" has no recovery time to quote and a mode matrix that assumes one will invent it. - [x] S10.10 Add graceful degradation plans for each dependency. Evidence: dependency outage matrix names what remains read-only or unavailable. - [x] S10.10.a Inventory each dependency and capability/operation/read/write/ job/gate/publish/release path that uses it. Evidence: dependency- capability matrix. - [x] S10.10.b Define trigger/classification for not-configured, slow, partial, stale, rate-limited, unavailable, corrupt, incompatible, and recovery state. Evidence: trigger tests. - [x] S10.10.c Decide per capability what remains live read, cached/stale read, local/offline edit, queued operation, read-only, limited, manually handled, or unavailable. Evidence: mode matrix. - [x] S10.10.d Define data/gate freshness, authorization, trust, rights/ consent, cost, capacity, and safety constraints that prohibit fallback or fail-open. Evidence: invariants. - [x] S10.10.e Implement circuit/timeout/retry/cache/queue/provider alternative and explicit user/API state without fabricated output. Evidence: implementation tests. - [x] S10.10.f Define recovery probe, reconciliation/replay/recompute/ revalidation, stale state clearing, user notification, and SLO. Evidence: recovery tests. - [x] S10.10.g Fault each dependency and verify exact retained/unavailable behavior across UI/API/job/audit/telemetry/runbook. Evidence: outage report. NOTE (S10.10, for S10.11): `productMode` calls `dep:primary-store` unavailable `read-only` because seven read paths still answer -- from `dep:read-cache`, whose contents were written by the store that is now down. S10.11 asks for a cross-store recovery point, and the same question arrives one layer lower: a backup of the datastore and a backup of the cache, the blob store and the search index are four snapshots taken at four instants, and `DEPENDENCY_SUBSTRATE` already says which of them is derived from which. A restore that reconciles rows against blobs without asking which side was authoritative at the recovery point is the same defect as a fallback that reports a substitute's number in the field that means the policy. - [x] S10.11 Add backup consistency checks across relational, blob, search, and provenance stores. Evidence: restore drill. - [x] S10.11.a Define a cross-store recovery point using database transaction/ log, blob inventory/version, search projection/checkpoint, provenance/ ledger manifest, event/outbox, and key/config markers. Evidence: consistency contract. - [x] S10.11.b Verify backup catalogs, objects, checksums, encryption/ decryptability, schema/version, retention, immutability, and required external refs before restore. Evidence: backup preflight tests. - [x] S10.11.c Restore relational metadata/revisions/events/audit, blob bytes, provenance manifests/ledger, and rebuild or restore search into isolation. Evidence: restore commands/log. - [x] S10.11.d Reconcile rows↔blobs, revisions↔hashes, provenance↔ingredients, search docs↔authoritative projections, tombstones/holds, and tenant counts. Evidence: integrity queries. - [x] S10.11.e Rehash stored bytes and validate read/search/history/audit/ lineage/gate/bundle/publish-preparation journeys. Evidence: restored system tests. - [x] S10.11.f Measure achieved point/time, missing/inconsistent/orphan/ protected findings, remediation, and next drill. Evidence: signed drill report. NOTE (S10.11, for S10.12): this cell measures a drill that an operator chose to run, on a host they prepared, at an instant they picked. S10.12 asks for game-day scenarios with a measured DETECTION time, and `DrillTiming` already refuses to compute a recovery time without one -- the field is there and the estate has no producer for it. The scenario register S10.12.a wants is the same shape as S10.10's mode matrix one layer up: a scenario that no capability path traverses is a rehearsal for an incident nobody can have. - [ ] S10.12 Add disaster-recovery runbooks and game-day scenarios. Evidence: measured RPO/RTO and follow-up issues. - [x] S10.12.a Define disaster scenarios for regional/service/data/key/queue/ provider/search/blob/database/bridge compromise or outage and per- capability RPO/RTO. Evidence: DR scenario register. - [x] S10.12.b Document detection/declaration authority, communications, dependency assumptions, recovery infrastructure/secrets, restore order, fencing, validation, failover, and rollback/failback. Evidence: versioned runbooks. ` marker, IN the document rather than beside it, so the statement the checker grades and the statement the operator follows are one object. `runbook-scan.mjs` parses it, grades it with the shipped contract, and refuses an undeclared finding, a DECLARED finding that stopped firing, a scenario with no runbook, two runbooks for one scenario, a silent section, and a dependency id the prose never mentions. Eight negative controls mutate the REAL statements and the scan exits 2 rather than reporting if any goes undetected -- including a guard that refuses a control whose fault is already present unmutated, since that control proves nothing. THE REGISTER WAS WRONG, AND THE RUNBOOKS ARE HOW IT SHOWED. `gd:regional-loss` listed four targets. `docker/docker-compose.yml` declares postgres, redis, minio, elasticsearch, kafka, prometheus, grafana, loki, tempo, jaeger and every API in ONE file with no placement constraint, which is one host. The omission was not a smaller claim, it was a WRONG one in the direction that flatters the estate: without `dep:identity` the model said a total box loss leaves SIGN-IN WORKING, and without `dep:notification-channel` it said the messages announcing the outage travel over a sender that is inside it -- so `communication-over-the-failed-dependency` and `authority-reachable-only-over-the-failed-dependency` could not fire on the one scenario they exist for. Four targets added, each citing what puts it on the box. The repair immediately produced three findings the fixture had been hiding: an observer blinded by the fault it watches (the panel reports over `dep:telemetry-pipeline`, which is now inside the blast radius -- which is exactly why every core dependency in the S10.5 register carries an `outOfBandCheck` naming a prober outside the collector failure domain), and two recovery-time breaches, because a box loss now interrupts "sign in", whose promise is fifteen minutes. MEASURED, AND EACH IS A RUNBOOK SECTION SOMEBODY WOULD OTHERWISE HAVE WRITTEN WRONG: 1. THE PAGE THAT WOULD ANNOUNCE A BOX LOSS IS EVALUATED ON THE BOX. `docs/operations/alert-routing.md` routes `Prometheus up == 0 for any production target` to PagerDuty `oshun-platform` at SEV-1, and Prometheus is a service in the same compose file. The highest-severity route in the estate is the one `gd:regional-loss` removes first. Its `CloudWatch RDS` rows describe an AWS deployment; V1's PostgreSQL runs in docker. 2. THE C2PA VERIFIER READS THE PUBLIC KEY OUT OF THE MANIFEST IT IS VERIFYING. `verifyAudioC2paManifest` (`apps/oshun/bff/src/generation/audio-c2pa-signer.ts`) calls `createPublicKey(manifest.publicKeyPem)`. Nothing compares `signerKeyId` or `publicKeyPem` against an allowlist and `dep:trust-store` has no implementation, so ROTATION DOES NOT REVOKE: manifests signed under a disclosed key keep verifying, and the disclosed key mints new ones that verify. S10.7's vein, in the key scenario. 3. THERE IS A STANDBY-PROMOTION SCRIPT AND NOTHING TO PROMOTE. `infra/yemaya/postgres-ha/failover.sh` runs `pg_ctl promote`; the V1 compose declares one PostgreSQL service and no standby, replica or pooler, and nothing outside `infra/yemaya/postgres-ha/` references that directory. `check_standby` refuses, correctly. Two of its steps would mislead if it did run: `update_pgbouncer()` logs "PgBouncer update requires manual configuration or automation" and RETURNS 0, so `do_failover` proceeds as though the pooler were repointed; and `promote_standby` calls `read -p` on lag > 60s, so it blocks on stdin under automation. Its split-brain control is a human typing `yes`. 4. THE V1 JOB QUEUE IS NOT A BROKER. `jobs-route.ts` holds jobs in an in-process map and persists the whole set through `createSnapshotSink` into the `admin_store_snapshot` table -- so the durable record is in `dep:primary-store`, and a queue loss is a reload rather than a replay. 5. `docs/operations/on-call.md` EXISTS, and an earlier draft of these runbooks said it did not. It describes a weekly primary/secondary rotation and an escalation ladder, names NO person, and holds no rotation config while instructing the reader to "open a PR against the rotation config in this doc". None of the register's four `rota:` identifiers appears in it or in `alert-routing.md`. The claim in every runbook is therefore the narrow, checkable one -- the name is registered, the route from it to whoever carries the pager is not -- and the test asserts THAT, not the absence of on-call documentation. THE ABSENCE REGISTER is the unusual half. Eight claims each runbook makes about what this repository does NOT have (no reindex entry point, the search index in no backup, no queue drain or replay script, no Postgres standby, the pgbouncer no-op, the self-attesting verifier, the fail-closed signer, the unused PITR config) are predicates in `v1-dr-runbook.test.mjs`, and each FAILS the day its absence stops being true. A document describing a gap the estate has closed misleads in the direction of caution, which is still misleading. TRAPS IN MY OWN WORK, both found by testing rather than by reading. The prose-vs-statement cross-check compared the statement against the whole document -- which CONTAINS the statement -- so every dependency id trivially "appeared in the prose" and the check could never fail; fixed to compare against the text before the marker, whereupon it immediately caught that `v1-disaster-recovery.md` §6 named three stores in prose and ten in its restore order. And `RUNBOOKS[].prose` was a field nothing read until that fix, which is the S10.12.a trap repeated: a declared input nothing reads is a check that never runs. Also corrected: a claim that `providerEffects` is the reconciler's first collection (it is the second of seven), and a sentence asserting "zero matches for replica" in the compose file, which matches `KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR` -- an answer about the wrong subject in the right shape, in a paragraph warning about exactly that. AND THE LARGEST TRAP WAS IN THE CLAIM I INHERITED AND REPEATED. Three runbooks said "there is no fencing anywhere in this estate", which is S10.12.a's finding 12 restated. It is a claim about the WHOLE REPOSITORY supported by a grep over THREE DIRECTORIES for FOUR WORDS (`split-brain|fence|fencing|STONITH` across `docs/`, `infra/`, `scripts/`), and the estate's one real fencing token is in neither the directories nor the vocabulary: `live_media_pipeline_job_attempts` `.lease_token` (`libs/shared/live-media/src/sql-media-pipeline-job-store.ts`) carries `AND lease_token = $4 AND status = 'leased'` in the `UPDATE WHERE` of every heartbeat, lease expiry and completion, so a worker holding a superseded lease updates ZERO ROWS. That is textbook lease fencing and it works. What is absent is the STORE-LEVEL equivalent -- nothing rejects the writes of a host that returns after its replacement was promoted -- which is what `FencingStep` asks for. All four fencing sections now scope the absence and NAME the token, because "the estate has never done this" and "the estate has not done this here" are different sentences and only the second is true; the second also tells the reader which pattern to copy. Finding 12 in the module header is narrowed in place, and the token's continued existence is a predicate in the absence register, so the narrowed claim is refutable in both directions. Same shape as the Yemaya vein: A CLAIM ABOUT THE WHOLE REPOSITORY HAS TO BE CHECKED AGAINST THE WHOLE REPOSITORY. --> NOTE (S10.12.b, on the authority sections): every runbook names its authority from the S10.5 dependency register (`workbench-platform on-call`, `delivery pipeline on-call`, `production operations duty officer`) rather than declaring it UNASSIGNED as S10.12.a's runbook did. That is a change of position and it was deliberate: the register already carries an owner with a role, a name and a `rota:` contact for every dependency, so writing UNASSIGNED was under-reporting a fact the estate had. What it does NOT have is a resolution from those identifiers to a person, and that is stated in every runbook and machine-checked. Naming the registered rota is reading the register; inventing a person would have been the defect S10.12.a warned about. - [x] S10.12.c Document reconciliation/replay for jobs, leases, outbox/inbox/ events, provider outcomes, pending uploads, gates, and releases. Evidence: state-specific procedures. ` marker), `scripts/operations/v1-replay-inventory.mjs` (the missing PRODUCER, run against the live database), `libs/oshun/workbench-kit/tools/replay-scan.mjs` (nx target `replay-scan`, `pnpm run verify:operations:v1-replay`, 10 negative controls), a 23-test `scripts/operations/v1-replay-procedure.test.mjs` wired into `verify:operations:v1-disaster-recovery` (66 tests pass), and a repair to `replayFaults` with 4 new spec tests (129 pass). THE VEIN: A STATE CLASS IS NOT A TABLE NAME. Every claim that this estate lacks a state class was a search over `CREATE TABLE` names, and V1's durable state lives in ONE key-value table -- `admin_store_snapshot`, measured at 415 rows under 52 store keys -- where a second job store, thirty-eight crypto invoices carrying on-chain transaction ids and the editorial release streams all sit invisible to that search. The rule: for every state class, enumerate the STORE KEYS as well as the tables, and name the query that produces the inventory. AND THE SECOND HALF, WHICH IS WHY THE CELL NEEDED A PRODUCER RATHER THAN ONLY A DOCUMENT: `scripts/operations/v1-restore-reconcile.mjs` is named as `nextRequiredControl` by `box-loss-restore-drill.sh` and by every S10.12.b runbook, and NOTHING IN THIS REPOSITORY PRODUCES ITS INPUT. A grep for `oshun.v1-restore-reconciliation-input.v1` returns the validator, its own unit test, and the kit scan that builds a synthetic one. The operator following the runbook reaches the required control and the step has no first action. IT HAS NO PRODUCER FOR A REASON THAT DECIDES WHAT TO BUILD: its seven collections match on `externalRef` or `idempotencyKey`, and the V1 schema's 146 tables contain NO COLUMN of either name (`external_refs`, plural and JSONB, is a different thing on two tables); four of the seven have no table at all; and `artifact_detection_report`, the nearest name match for `artifacts`, is about visual artifacts in generated media. The input describes an estate this is not, and writing a producer for it would mean inventing the columns to fill it. So the producer that shipped reads the NINE state classes instead, and the document says plainly that it is not a drop-in for the reconciler. MEASURED AGAINST THE RUNNING DATABASE on 2026-08-14 (docker `oshun-dev-postgres`, `oshun_dev`), all reproduced by running the code: 1. jobs: 63 records over two store keys, 24 IN FLIGHT -- `generation-jobs` 8 (7 failed, 1 queued) and `metis-ingest-jobs` 55 (32 completed, 23 `awaiting_source_content`). Only the first has a boot recovery. 2. provider-outcomes: 38 crypto invoices -- 20 expired, 10 PENDING, 8 confirmed and all 8 carrying a `txId`. This is the one subject in the estate whose external side genuinely outlives a restore of ours and can be queried independently, and nothing reconciles against it. 3. leases: the estate's one real fence (`lease_token`, S10.12.b's finding) is correct, and NOTHING RUNS IT. `recoverExpiredLeases` is reachable only through `MediaPipelineWorker` -> `createLiveMediaPipelineRuntime` -> `apps/aphrodite/streaming`, which appears in no compose file, no infrastructure manifest and no workflow; `docker/docker-compose.yml` declares no such service; and the relation exists in no database on the box, because the compose declares an `aphrodite` database the running server does not have. The table is created by `libs/aphrodite/database`, not by V1's schema -- which the scan caught in my own statement. 4. releases were recorded as absent by the S10.12.a groundwork on the strength of "no `CREATE TABLE` matching `release` anywhere". That is true of the table names and FALSE ABOUT THE ESTATE: `v1_metis_publication_package` carries `release_id` and `release_history` as COLUMNS, and `admin-editorial-release-streams` is a store key. The same error as S10.12.b's fencing claim, one level down. Corrected in place, and both halves are now predicates. 5. jobs' boot recovery reconciles the JOB and not the two Redis ledgers the job wrote before dispatch: `activeQuotaGate.admit()` and `activeBudgetGate.reserve()` both run pre-dispatch and nothing releases either, so a job held for review after a restore keeps its quota slot and its estimated spend. THE CONTRACT REPAIR. `externallyVisible` was read on exactly ONE branch of `replayFaults` -- the `kind: 'none'` branch -- and ignored on the other four, so an effect the outside world saw and a purely internal one were graded identically the moment a procedure declared any reconciliation at all: a replay that verifies itself by counting our own rows passed every check. Added `externalAuthority` and `externally-visible-effect-verified-only-from-our-own-records`. Two of the nine subjects now DECLARE that fault rather than silence it (jobs has no provider-side receipt; releases have no readback from `dep:external-publish-target`), and the declaration fails in both directions. TRAPS IN MY OWN WORK, all found by the adversarial pass rather than by reading. (a) `inFlight: measured.reduce((sum, m) => sum + (m.inFlight ?? 0), 0)` -- THE `?? 0` VEIN, IN THE PRODUCER SHIPPED BY THE CELL THAT QUOTES IT: a subject whose stores carry no state field reported `inFlight: 0`, which says none was in flight where the truth is that the store cannot answer. Now null, with `inFlightMeasuredBy` naming which stores counted. (b) The producer answered "is this class absent" out of ITS OWN REGISTER; it now queries the live schema and reports `declared-absent-and-contradicted`. (c) `compareInventories` accepted a restored side with MORE records than the source as `reconciled` -- duplication is the failure every idempotency key here exists to prevent, and it was the one outcome the comparison could not report. (d) In the scan, the dependency-id prose check sat AFTER the absent branch's `continue`, so for three of the nine subjects it could not fire; moved, with its own control. (e) Two bindings for one subject silently kept the last. (f) I wrote that `admin_store_snapshot.version` is "the one per-store marker the estate has, and S10.11 recorded it had none" -- an overreach: S10.11's subject was which committed transactions are inside a dump, which a per-document counter cannot answer. Narrowed in place to what it does do (order two readings of one store key). AND THE VEIN CAUGHT THE DOCUMENT THAT STATES IT. §§3-4 shipped in the first commit saying "there is no outbox in V1" and "there is no consumer-side deduplication table", on the strength of no `CREATE TABLE` matching `outbox` or `inbox` -- the exact error §0 of the same document warns about, made two sections later. **V1 HAS BOTH AND THEY ARE COMPLETE.** `apps/oshun/bff/src/metis/academic-integrity-appeal-store.ts` (store key `metis-academic-records`) keeps `operations`, an append-only log carrying a `revision`, and derives `notificationIntents` from it by REPLAY, so a verdict transition and the notification intent it produces are one durable operation -- transactional publication, without a table named for it. `deliveredNotificationIds` is the acknowledgement set and `listPendingNotifications()` is literally the intents minus it, which is the inbox pattern. `reconcilePendingAcademicIntegrityNotifications()` is called from `server.ts` at boot, deliberately after both durable stores hydrate, and returns `{ attempted, pending }` with `pending` RECOMPUTED after the drain rather than assumed. The idempotency key is the stable `messageId`, and the module says so: "a crash after message commit but before outbox acknowledgement is retried as a harmless duplicate on restart". What it lacks against `study.domain_event_ack` is `attempts` and `dead_letter`, so a poison intent is retried at every boot forever with nothing counting the failures. Corrected in the document, the register, the statement and the tests, and the correction is left visible in §0 rather than rewritten away -- it is the strongest argument for the rule that this cell produced. Only `pending-uploads` remains declared absent, re-checked with a second vocabulary (`multipart`, `presigned`, `uploadId`) rather than the first. THE SAME SELF-REFERENCE BIT THREE TIMES IN ONE PREDICATE. "Nothing produces the reconciler's input" is a claim about the repository, and the claim's own artifacts kept entering its result set: first the TODOS note quoting the schema string, then the new producer's header comments, then the test's own search pattern. Narrowed to the ASSIGNMENT form and scoped away from markdown and from itself, because naming a thing is not producing it. AND A CHECK IN S10.12.b'S OWN TEST WAS WRONG, exposed by this document being written: `no other runbook still claims to cover the V1 recovery path` asserted an exclusion BY NAME while its comment stated a REACHABILITY requirement. Under the name rule the only way to satisfy it was to leave the reconciliation handoff undocumented, which is the condition that whole file exists to end. Repaired to assert what it meant -- a document naming the recovery path must be LINKED from a scenario runbook -- which is the stronger check, and `v1-disaster-recovery.md` §10 now links here. --> - [x] S10.12.d Prepare synthetic/production-like data, fault controls, observers, timers, safety boundaries, abort, evidence capture, and success criteria. Evidence: game-day plan. ` marker), `scripts/operations/v1-fault-control.mjs` (the missing INJECTOR: six controls, each applied/confirmed/reversed on this box, with a durable reversal ledger and a `--self-test` that stands up its own containers), `libs/oshun/workbench-kit/tools/plan-scan.mjs` (nx target `plan-scan`, `pnpm run verify:operations:v1-game-day-plan`, 13 negative + 4 positive controls), a 14-test `scripts/operations/v1-game-day-plan.test.mjs` wired into `verify:operations:v1-disaster-recovery` (86 tests pass), and contract repairs in `game-day.ts` with 15 new spec tests (144 pass). THE VEIN: A FAULT CONTROL IS A CLAIM THAT SOMETHING BROKE, AND EVERY FIELD IN THE CONTRACT IS A SENTENCE ABOUT THE COMMAND RATHER THAN A READING FROM THE ESTATE. The rule: for every fault control, name the observation that distinguishes the injected estate from a healthy one, and confirm the injection by TAKING it. S10.12.a's rule was about the scenario's pass; this is the same rule one level down, about the injection itself. MEASURED ON 2026-08-14 against throwaway containers on this box, all reproduced by `--self-test`: 1. `docker exec kill -9 1` EXITS 0 AND KILLS NOTHING. The kernel discards SIGKILL sent to a PID namespace's init from inside it, so the process the drill meant to crash keeps serving. `kill -TERM 1` DOES work, because postgres installs a handler. The strongest signal is the one that does nothing and it is the one an operator reaches for. 2. THE OBVIOUS CONTROLS DO NOT PRODUCE THE SAME FAULT, and there are THREE client-visible shapes, not one: `docker stop` -> `could not translate host name` in 539ms; `docker network disconnect` -> the same in 359ms; `docker pause` -> `timeout expired` in 5407ms; `iptables -j DROP` -> the same in 5370ms; `iptables -j REJECT --reject-with tcp-reset` -> `Connection refused` in 316ms. A host that is really gone KEEPS ITS NAME, so `docker stop` rehearses a graceful deregistration and measures a recovery time with every caller's connect timeout removed from it. `name-unresolvable` matches no scenario in the register; the control is registered anyway, so a plan naming it is REFUSED rather than left undescribed. 3. ZEROING ONE 8KiB HEAP PAGE TOOK 185 OF 2000 ROWS OUT OF `select count(*)` WITH NO ERROR, `max(id)` still 2000 and the connection healthy. It is silent because `data_checksums` is `off` -- which is how the RUNNING estate is configured -- so no drill on this estate can be graded by "did the store stay up". 4. A TRAP IS A PROMISE A PROCESS MAKES ABOUT ITS OWN DEATH. S10.12.a's own repair added EXIT/INT/TERM traps to the two mutating drills; a drill that paused a container and was then SIGKILLed left it `paused` with nothing to unpause it. SIGKILL, OOM and reboot are exactly the deaths a trap cannot honour, and `reversesOnAbort: true` is satisfied by a trap. The driver writes the reversal record BEFORE injecting, so `--reverse-all` drains it from an unrelated process. 5. THE ESTATE DEPLOYS NO TELEMETRY PIPELINE AT ALL. `infra/hetzner/docker-compose.yml` -- the compose the deploy workflow and every `v1-dr-*` runbook name -- has ZERO mentions of Prometheus, Grafana, Loki, Tempo, Jaeger, OTLP or Sentry. The S10.12.a register put `dep:telemetry-pipeline` in the regional blast radius citing `docker/docker-compose.yml`, which is the DEVELOPMENT compose (44 mentions) and describes a different estate. The conclusion survives and the reason is worse: AN OBSERVER INSIDE THE BLAST RADIUS AND AN OBSERVER THAT WAS NEVER DEPLOYED PRODUCE THE SAME SILENCE, and only the first has a name in the contract. 6. All 14 docker healthchecks on the estate run against `localhost` INSIDE the container they check, so a paused container cannot run its own healthcheck and a box loss takes every one. Following the contract's refusal of a blinded observer is what produced the two observers the plans actually use. THE CONTRACT REPAIRS, each forced by a reading rather than argued. `FaultControl` gained `presentsAs` (checked against a `PRESENTATIONS_BY_IMPAIRMENT` table, so an `unavailable` scenario cannot be rehearsed with a control that deregisters a name), `confirmedBy` and `movesTheRecoveryPoint`; `Observer` gained `detects`; `GameDayPlan` gained `unrehearsableBecause`. THE RECOVERY-POINT REQUIREMENT IS NOW CONDITIONAL AND THE RECOVERY-TIME ONE IS NOT: as shipped, `no-criterion-compares-the-recovery-point` fired on every plan without an RPO criterion, but most controls cannot cause data loss at all (a postgres crash replays its log -- measured), so it was demanding a criterion that passes whatever the estate does, which is the `aspect-passed-with-no-evidence` shape the same module refuses two sections down. AND `observer-blinded-by-the-injected-fault` TREATED EVERY IMPAIRMENT AS IF IT WERE `unavailable`: a `corrupt` store ANSWERS, so the check refused the only observer a corruption drill can have. Blindness now follows `silencesObservers(impairment)`. THE THIRD OPTION. Five of the ten scenarios cannot be injected on this estate -- no signing service is deployed, the model provider needs the undeployed ISIS admin API, the search index has no process of its own (it IS the relational store), and the bridge host is somebody else's workstation. Without `unrehearsableBecause` the author must either invent a control (the defect this cell warns about) or omit the plan, and an omitted plan is `scenario-with-no-plan`, which reads as an oversight rather than a measured impossibility. The declaration fails in BOTH directions: `planFaults` refuses one that also ships a control, and the scan re-checks each against the deployed compose, with four positive controls proving those patterns CAN match -- because a declaration guarded by a regex that cannot fire is an absence nothing re-checks. TRAPS IN MY OWN WORK, found by the adversarial pass. (a) THE SELF-REFERENCE, exactly as S10.12.c recorded it one section up: "does the document state this target has no process" was `markdown.includes(target)`, and the statement block IS part of the markdown, so every target the statement named satisfied the question the statement raised. The check could not fail for any input; it now reads the prose BEFORE the marker, with a negative control using `dep:trust-store`. (b) MY OWN PROBE WAS BLIND TO THE FAULT THAT HIDES BEST: `presentationOf` settled `healthy` on the socket's `connect` event, and a container frozen with `docker pause` reported HEALTHY -- the kernel completes the handshake from the listen backlog whether or not any process will ever read from it. Found by the driver's own self-test reporting `injected: false` on a demonstrably paused container. It now requires an ANSWER, and counts a close-without-bytes as one, because only a live process hangs up. (c) The destructive confirmation asked whether the census was ZERO, which is right only for a control that destroys everything -- against the corruption control it would have reported the estate healthy for the one fault a liveness check already misses. It is a before/after comparison now. (d) `--self-test` exited 0 when docker was absent and `--reverse-all` exited 0 with a destructive fault still applied: S10.12.a's finding 2 rebuilt twice inside the driver written to end it. Now 3 and non-zero. --> FINDINGS FOR S10.12.g, from this cell: F-1 no telemetry pipeline is deployed (high); F-2 all 14 healthchecks are inside their own container (high); F-3 the S10.12.a register cites the development compose for the estate's blast radius (medium); F-4 `data_checksums` is off, so page corruption is silent (high); F-5 a trap-based reversal does not survive SIGKILL (medium); F-6 five of ten scenarios are unrehearsable here (low). - [x] S10.12.e Execute rotating scenarios end-to-end without undocumented access/dependency and measure actual detection, decision, recovery point, recovery time, and correctness. Evidence: timed report. - [x] S10.12.f Test split-brain prevention, degraded operation, queued work, user communication, monitoring/alerts, backup of recovered primary, and failback. Evidence: acceptance matrix. - [x] S10.12.g Assign severity/owner/deadline to every finding, link backlog, retest critical fixes, and update runbook. Evidence: closed follow-up register. NOTE (S10.12.a, on b-g): b through g are LEFT UNCHECKED DELIBERATELY, and the contract each of them needs is already shipped in `libs/oshun/workbench-kit/src/game-day.ts` -- what is missing is the artifact, not the definition. `Runbook` + `runbookFaults` name the eleven sections S10.12.b lists and enforce them (authority is a named person or rota, communications must not travel over the failed dependency, the recovery must not assume it, secrets must be recoverable out of band, the restore order must not contradict the reference graph, a promotion needs a fencing token applied BEFORE it, and there must be a failback); `ReplayProcedure` + `replayFaults` name S10.12.c's nine subjects and refuse a replay window bounded by a wall clock instead of by the recovery point; `GameDayPlan` + `planFaults` name S10.12.d's fault controls, observers, timers, abort, evidence and success criteria; `AspectResult` + `acceptanceFaults` name S10.12.f's seven aspects; `FollowUp` + `followUpFaults` name S10.12.g's fields and refuse a critical finding closed without a retest. Each remains unchecked for its own reason. (b) asks for VERSIONED RUNBOOKS. CORRECTION, measured after the S10.12.a note was first written: the estate has 27 runbooks under `docs/runbooks/`, several of them substantive and dated (`database-backups.md`, `object-storage-backups.md`, `provider-failover.md`, `shell-outage.md`, each with an `Owner:` and a `Last reviewed:` line). The gap is narrower and sharper than "there are none": **NOT ONE RUNBOOK IN THE REPO MENTIONS THE V1 RECOVERY PATH.** A grep across `docs/runbooks/`, `docs/reference/runbooks/` and `V3/runbooks/` for `box-loss-restore-drill`, `v1-restore-reconcile`, `offbox-backup` or `restic` returns NOTHING. `database-backups.md` -- the runbook an operator reaches for -- documents `scripts/db-backup.sh`, an RDS/S3/cron cadence and a `db-restore.sh` whole-database restore, and never mentions that a V1 restore is not finished when it finishes: `box-loss-restore-drill.sh` ends by writing `status: "restore-pass-reconciliation-required"`, `safeToResumeAutonomy: false` and `nextRequiredControl: "scripts/operations/v1-restore-reconcile.mjs"`, and no runbook carried that step. Its `Owner:` is `platform team`, which the module refuses as a team noun. PARTIALLY CLOSED IN THE SAME PASS: `docs/runbooks/v1-disaster-recovery.md` now exists -- all eleven sections, every step citing a script that is really there, machine-checked by `scripts/operations/v1-dr-runbook.test.mjs` (10 tests, in `verify:operations:v1-disaster-recovery`). The checks are the ones a reader cannot perform: every cited repository path exists, every `§N` cross-reference resolves, no authority line names a collective, the restore order is stated in the REFERENCE direction (blob before relational -- the reverse of S10.11's capture order), the reconciler is named along with the proof fields that demand it, and the two sections that cannot be written from the repository are DECLARED (`Owner: UNASSIGNED`, `## 8. Fencing — ABSENT`) rather than omitted, because an absent section and a satisfied one look identical in a document. It also states the gaps rather than papering over them: `keyRecoveryVerified` is unproven, and Redis/MinIO/file-state/configuration are asserted from steps an EMPTY store also passes. S10.12.b STAYS UNCHECKED, and the criterion for marking it is now precise: ONE of the ten registered scenarios has a runbook. `runbookCoverageFaults(WORKBENCH_GAME_DAY_SCENARIOS, [...])` reports the other nine, and each needs the same treatment -- written from scripts that exist, or declared absent where they do not. (c) the replay procedures: the outbox, lease and provider-outcome reconciliations were not read in this cell and must not be invented. **(c) IS NOW DONE** -- they were read, against the running database as well as the source, and the answer to two of the three was that the store is not where a table-name search looks: the outbox is genuinely absent, the lease fence is real and its reclaim loop is deployed nowhere, and the provider outcomes are thirty-eight crypto invoices under a snapshot store key. See the S10.12.c note above. (d) a game-day plan needs the fault controls that actually exist on this estate, which is a Hetzner box plus docker compose, and naming a control that has not been tried is a plan for a rehearsal nobody can run. (e) executing rotating scenarios end-to-end needs a live ISIS API and a real host: NOT LOCALLY ACTIONABLE, and the harness now refuses to call an un-injected run a pass rather than pretending otherwise. (f) an acceptance matrix is filled by an executed drill; a matrix written without one is exactly the `aspect-passed-with-no-evidence` the module refuses. **(f) IS NOW DONE** -- the drill exists, and the matrix it filled fails three of the seven aspects with a measurement behind each. See the S10.12.f note above. (g) a follow-up register needs owners and backlog references, and inventing a name to satisfy a field is the same defect as inventing a result. The thirteen findings this cell measured ARE the raw material for (g); they are enumerated in the S10.12.a note above and in the module header, with the four that were repaired marked as such. - [x] S10.13 Add data-subject export and deletion orchestration hooks. Evidence: protected retention exceptions and deletion receipts are tested. - [x] S10.13.a Define verified request identity/authority, subject identifiers, tenant/scope, jurisdiction/purpose, request type, deadline, state, communication, and audit. Evidence: request contract. - [x] S10.13.b Register domain/store/provider/processor data locations, identity mapping, export format, deletion/anonymization action, retention/hold exceptions, owner, and verification. Evidence: data map. - [x] S10.13.c Plan authorized search/export/delete with impact, dependencies, derived/backup/log/audit/provenance/search/cache/provider data, exclusions, and approvals. Evidence: orchestration plan tests. - [x] S10.13.d Export access-controlled, portable, understandable, checksummed/encrypted data with source/category/purpose/time and no other subject/tenant data. Evidence: export isolation tests. - [x] S10.13.e Delete/anonymize/withdraw in dependency-safe idempotent jobs, preserve only lawful held/minimal audit data, and prevent rehydration from cache/index/event/backup replay. Evidence: deletion tests. - [x] S10.13.f Record protected retention exception with authority/legal basis, scope, fields, reason-safe communication, expiry/review, access, and later deletion. Evidence: exception tests. - [x] S10.13.g Reconcile each processor/store outcome and issue a signed receipt of completed/pending/refused/retained items without leaking hidden data. Evidence: receipt fixtures. - [x] S10.13.h Test cancellation, duplicate request, identity mismatch, provider unavailable, partial failure, hold release, backup restore, and deadline escalation. Evidence: lifecycle matrix. - [x] S10.14 Add runtime feature-flag inventory and expiry alerts. Evidence: stale flags fail the release-readiness check. - [x] S10.14.a Discover declared flags from registry/code/config/provider and runtime-evaluated flags from telemetry without treating dynamic values as source truth. Evidence: flag inventory. - [x] S10.14.b Reconcile key/type/owner/purpose/capability/audience/default/ environments/targeting/start/review/expiry/rollback/removal task and code/config references. Evidence: completeness report. - [x] S10.14.c Detect undeclared, duplicate/conflicting, unused, always-on/off, unknown state, expired, missing owner/purpose/removal, unsafe default, and contradictory nested flags. Evidence: integrity tests. - [x] S10.14.d Alert owner/backups before review/expiry and escalate expired flags with affected routes/capabilities/cohorts and removal runbook. Evidence: clock/routing tests. - [x] S10.14.e Fail release readiness on expired or critical incomplete flags and prevent waived expiry from becoming indefinite. Evidence: deliberate stale flag test. - [x] S10.14.f Track code/data/schema/contract/test/docs/telemetry cleanup and close/remove registry entry after verified cohort observation. Evidence: removal lifecycle tests. ### S11 — Shared verification and release harness - [x] S11.1 Parameterize the Tara route-integrity test. Evidence: missing, duplicate, forbidden, and unowned routes fail. - [x] S11.1.a Define test inputs for app/source roots, framework/proxy/ middleware routes, route descriptors, host, audience, owner, capability, lifecycle, allowed/forbidden patterns, redirects, and feature flags. Evidence: harness contract. - [x] S11.1.b Extract route discovery and normalization without Tara path/ role/capability constants. Evidence: Tara and synthetic domain snapshots. - [x] S11.1.c Detect source-described versus effectively mounted missing routes. Evidence: deliberate missing-route test. - [x] S11.1.d Detect duplicate effective method/path/host, alias collision, case/normalization collision, and redirect cycle. Evidence: duplicate fixture tests. - [x] S11.1.e Detect host/audience/boundary forbidden routes including source- mounted but middleware-blocked or inadvertently enabled surfaces. Evidence: forbidden fixture tests. - [x] S11.1.f Detect missing/unknown owner, capability, contract/version, audience, lifecycle, and deprecation/migration metadata. Evidence: ownership fixture tests. - [x] S11.1.g Produce source/actionable failure diff and run Tara plus two archetype fixtures. Evidence: parameterized suite. - [ ] S11.2 Parameterize a live-data/full-journey Playwright scaffold. Evidence: fixtures are opt-in and visibly labeled. - [x] S11.2.a Define workbench fixture for host/base URL, actor/tenant/roles, capability probes, data reset/seed/read-back, critical routes/journeys, state selectors, and evidence output. Evidence: scaffold interface. - [x] S11.2.b Provision unique nonfixture tenant/account/data through real service boundaries and verify source values before UI use. Evidence: setup/teardown tests. - [x] S11.2.c Keep fixture providers/data/intercepts opt-in per test with persistent visible badge and metadata. Evidence: fixture mode tests. - [x] S11.2.d Fail when interception, hard-coded fallback, demo seed, empty success, or build-time guess masquerades as live. Evidence: anti-mock negative tests. - [x] S11.2.e Provide reusable authenticated navigation, direct-link, network/ console capture, save/read-back, job wait, gate/review/publish, failure, and cleanup helpers. Evidence: example journeys. - [x] S11.2.f Capture screenshots, traces, console, requests, test data refs, correlation IDs, state, and exact command per step/failure. Evidence: evidence bundle. - [ ] S11.2.g Run content-authoring and operations-console exemplar journeys with fixtures disabled. Evidence: two passing live suites. - [ ] S11.3 Upgrade the axe harness and rule policy to WCAG 2.2 AA. Evidence: tests cover the new 2.2 criteria applicable to workbenches. - [x] S11.3.a Pin axe/browser versions, WCAG 2.0/2.1/2.2 A/AA tags, rules, experimental/manual flags, impact policy, and allowed exclusions. Evidence: harness configuration review. - [x] S11.3.b Map WCAG 2.2 focus-not-obscured, dragging movements, target size, consistent help, redundant entry, and accessible authentication to automated/manual/journey checks. Evidence: criterion coverage map. - [x] S11.3.c Scan route/state/theme/density/viewport/locale matrix after stable load and each relevant overlay/conflict/error/destructive state. Evidence: scan runner tests. - [x] S11.3.d Fail on new unwaived AA violations and require rule/selector/ state/screenshot/DOM snippet/source owner in findings. Evidence: deliberate regression. - [x] S11.3.e Define waiver schema with false-positive proof or temporary exception, scope, owner, approver, expiry, remediation, and retest. Evidence: expiry tests. - [x] S11.3.f Add custom semantic assertions where axe cannot prove names/ states/relationships, announcements, complex widget patterns, or visual obstruction. Evidence: custom test index. - [ ] S11.4 Add keyboard-only journey helpers. Evidence: no pointer calls in the critical keyboard suite. - [x] S11.4.a Provide focus-current/order/visible/not-obscured/within-region/ restored assertions and focus history evidence. Evidence: helper tests. - [x] S11.4.b Provide Tab/Shift-Tab, arrows, Home/End/Page, Enter/Space, Escape, type-ahead, application shortcuts, and composition-safe helpers. Evidence: key helper tests. - [x] S11.4.c Provide semantic selection/range/additive, reorder/move/resize/ trim/pan/zoom/connect, compare, command palette, review, and confirmation helpers without pointer APIs. Evidence: complex interaction examples. - [x] S11.4.d Detect pointer/touch/mouse calls, coordinate clicks, force-click, direct DOM evaluation, inaccessible test IDs, and accessibility-tree bypass in keyboard suites. Evidence: static/runtime guard. - [ ] S11.4.e Run critical create/edit/save/conflict/review/gate/bulk/publish/ recover journeys from fresh page through only keyboard input. Evidence: journey suite. - [x] S11.4.f Exercise supported browser/OS/editor/assistive shortcut collisions and alternate/remapped path. Evidence: collision tests. - [ ] S11.5 Add screen-reader announcement assertions. Evidence: async status and error messages are covered. - [x] S11.5.a Instrument accessible name/description/error/message, live region role/politeness/atomic/relevant, focus, DOM order, language, and visibility without replacing real AT smoke tests. Evidence: assertion library. - [x] S11.5.b Assert validation summary/control error, focus movement, correction, and resolved error announcements. Evidence: validation fixtures. - [x] S11.5.c Assert save/offline/retry/conflict/recovery and job/gate/review/ comment/publish/destructive progress/result announcements. Evidence: async state matrix. - [x] S11.5.d Assert debouncing/deduplication, priority/interruption, no stale queued message, and no announcement flood under rapid events. Evidence: event storm tests. - [x] S11.5.e Assert dynamic counts, selection, virtualized position, sort/filter changes, dialog/drawer, route transition, and focus restoration context. Evidence: navigation fixtures. - [ ] S11.5.f Run representative NVDA/JAWS/VoiceOver or supported real screen- reader speech-log journeys and reconcile differences from DOM-level assertions. Evidence: AT matrix. - [ ] S11.6 Add responsive and theme visual-regression baselines. Evidence: approved baseline matrix. - [x] S11.6.a Define supported narrow/medium/wide, zoom/reflow, orientation, DPR, persistent scrollbar, software keyboard, and panel arrangement viewport cases. Evidence: viewport manifest. - [x] S11.6.b Define light/dark/high-contrast/forced-colors/branded themes, comfortable/compact/touch densities, reduced motion, and color scheme. Evidence: context manifest. - [x] S11.6.c Define representative Latin/long pseudo/RTL/mixed-bidi/CJK/ fallback-font content and deterministic data/clock/assets. Evidence: locale fixture manifest. - [x] S11.6.d Capture shell/workspace/inspector/status plus loading/empty/ error/degraded/conflict/destructive/complex visualization states. Evidence: state baseline index. - [x] S11.6.e Mask only proven nondeterministic data and retain layout/content areas so regressions cannot be hidden. Evidence: mask review. - [x] S11.6.f Review at intended pixel/structural thresholds for overflow, clipping, overlap, focus, contrast, semantic state, card/chrome drift, and font/icon change. Evidence: signed baseline matrix. - [x] S11.6.g Require named review/update reason and linked implementation for baseline changes. Evidence: visual approval gate. - [ ] S11.7 Add deterministic clock, UUID, provider, queue, and storage test adapters. Evidence: no production adapter imports test fixtures. - [x] S11.7.a Define production interfaces and explicit test-only entry points for clock/time zone/timer, stable/random ID, provider, queue/worker, and blob/object storage. Evidence: adapter contracts. - [x] S11.7.b Implement controllable wall/monotonic clock, timers, DST/time zone, advance/run-pending, and timeout/backoff semantics. Evidence: clock adapter tests. - [x] S11.7.c Implement seeded/scripted UUID/ID sequences, collision/exhaustion/ invalid generation, and no production predictability. Evidence: ID adapter tests. - [x] S11.7.d Implement provider scripts for chunks/results/usage/cost/safety/ errors/delays/cancel/unknown outcome with exact request capture. Evidence: provider adapter tests. - [x] S11.7.e Implement queue scripts for delivery/order/duplicate/lease/ heartbeat/retry/cancel/dead-letter/worker loss and observable state. Evidence: queue adapter tests. - [x] S11.7.f Implement storage scripts for bytes/version/hash/range/latency/ partial/corruption/eventual consistency/permission/failure. Evidence: storage adapter tests. - [x] S11.7.g Enforce dependency rules and production bundle scan so no app/ production adapter imports test builders/fixtures. Evidence: deliberate invalid import and bundle tests. - [x] S11.8 Add real-database isolation and migration harnesses. Evidence: multi-tenant round-trip tests. - [x] S11.8.a Provision supported database version/extensions in isolated schema/database/container with production constraints/policies/triggers and deterministic cleanup. Evidence: harness setup tests. - [x] S11.8.b Apply migrations from empty, prior supported versions, and production-like snapshots; verify generated clients/schema metadata. Evidence: migration paths. - [x] S11.8.c Provide transactional/nontransactional seed builders for two tenants with colliding IDs/data and role/ownership/protected cases. Evidence: fixture setup. - [x] S11.8.d Run read/write/search/history/blob ref/event/job/export/audit tenant isolation through real repositories/services. Evidence: multi-tenant tests. - [x] S11.8.e Run unique/foreign/check/concurrency/idempotency/outbox/inbox/ lease/retention/legal-hold constraints under contention. Evidence: constraint tests. - [x] S11.8.f Rehearse expand/backfill/verify/contract with old/new binaries, live writes, interruption/resume, rollback/compensation, and production- size data. Evidence: migration report. - [x] S11.8.g Capture slow queries/locks/plans and fail on unsafe sequential scans or incompatible schema readiness. Evidence: database verification output. - [x] S11.9 Add contract fuzzing for envelopes, manifests, and remote payloads. Evidence: minimized failure corpus is retained. - [x] S11.9.a Generate schema-valid, boundary-valid, and invalid command/query/ event/job/probe envelopes across kind/version/field/size/order/encoding. Evidence: envelope property suite. - [x] S11.9.b Fuzz duplicate/unknown/missing fields, discriminators, enums, IDs, numbers, dates, Unicode, nesting, arrays, aliases, and older/newer/unsupported versions. Evidence: negative envelope corpus. - [x] S11.9.c Generate profile-valid and invalid bundle manifests with path/ ref/hash/size/media/schema/dependency/provenance/version/lifecycle relationships. Evidence: manifest property suite. - [x] S11.9.d Fuzz raw remote JSON/XML/form/multipart/archive/media/stream/ provider/tool/webhook payloads for malformed/truncated/oversized/ ambiguous/polyglot/version-skew input. Evidence: remote payload suite. - [x] S11.9.e Assert bounded time/memory/depth/output/logging, no crash/hang/ traversal/SSRF/leak, stable typed rejection, and no partial side effect. Evidence: invariants. - [x] S11.9.f Seed runs deterministically, shrink failures, retain smallest reproducer with seed/schema/version/expected result, and promote to regression fixture. Evidence: minimized corpus workflow. - [x] S11.9.g Run fast mutation corpus in PR and broader scheduled fuzzing with resource limits and owner routing. Evidence: CI schedule. - [x] S11.10 Add malicious upload and remote-fetch fixtures. Evidence: archive, media, path, metadata, and SSRF cases. - [x] S11.10.a Add archive fixtures for traversal/absolute/symlink/hardlink/ device/duplicate/case/Unicode/reserved paths, excessive entries/depth, nested archives, and decompression bombs. Evidence: archive corpus. - [x] S11.10.b Add image/audio/video/document/3D fixtures for wrong declared/ actual type, polyglot, malformed headers/chunks, huge dimensions/ duration/frames, parser bugs, embedded active content, and corrupted metadata. Evidence: media corpus. - [x] S11.10.c Add filenames/paths/IDs for Unicode normalization/confusables/ bidi/invisible/control, encoded traversal, drive/UNC/device, trailing dots/spaces, separators, and extreme length. Evidence: path corpus. - [x] S11.10.d Add EXIF/XMP/ID3/container/document/archive/3D/filename/title/ caption/comment metadata containing injection, secrets, protected data, URLs, scripts, and oversized nested values. Evidence: metadata corpus. - [x] S11.10.e Add URLs/redirect/DNS fixtures for loopback/private/link-local/ reserved/metadata/internal, userinfo, IDNA, IP encodings, rebinding, redirect escape, alternate ports/schemes, and credential leakage. Evidence: SSRF corpus. - [x] S11.10.f Add slow headers/body, chunked lie, no length, endless stream, timeout/retry, TLS/host mismatch, oversized compressed response, and malicious content-type fixtures. Evidence: transport corpus. - [x] S11.10.g Assert quarantine/no parse before scans, resource bounds, stable refusal, redacted diagnostics, cleanup, and zero outbound/ persistent side effects. Evidence: fixture expectation matrix. - [x] S11.11 Add provider fault-injection fixtures for timeout, throttle, malformed output, partial output, safety refusal, and cost overrun. Evidence: exact UI and API results. - [x] S11.11.a Inject connect/first-byte/idle/total/tool/stage timeout before acceptance, during stream, after provider success, and with unknown outcome. Evidence: timeout fixtures. - [x] S11.11.b Inject throttle/capacity with retry-after, quota reset, transient/terminal variants, repeated exhaustion, and circuit transition. Evidence: throttle fixtures. - [x] S11.11.c Inject malformed syntax, wrong schema/version/type/unit/ref, duplicate/extra fields, unsafe URLs/tool calls, and semantic invariant failure. Evidence: malformed fixtures. - [x] S11.11.d Inject partial stream/output/usage/safety metadata, truncated finish, connection loss, cancellation, and inconsistent provider status. Evidence: partial fixtures. - [x] S11.11.e Inject provider and local safety/policy refusal classes with nonretryable behavior, appeal/review, and no prompt-around fallback. Evidence: refusal fixtures. - [x] S11.11.f Inject estimate-underrun, reservation expiry, per-attempt overrun, missing metering, currency/rate mismatch, budget exhaustion, and kill switch. Evidence: cost fixtures. - [x] S11.11.g Assert exact typed API status/code/state/provenance/correlation/ retry metadata and exact UI utility state/actions/no fabricated result. Evidence: API/UI snapshot matrix. - [x] S11.12 Add queue fault-injection for lease loss, duplicate delivery, out-of-order events, retry exhaustion, and cancellation race. Evidence: no duplicated side effects. - [x] S11.12.a Inject lease expiry before/during/after checkpoint or external effect, failed heartbeat, fencing violation, worker pause/death, and new worker takeover. Evidence: lease fixtures. - [x] S11.12.b Deliver same command/event/job concurrently, after ack loss, after success, after retry, and with altered payload under same ID. Evidence: duplicate fixtures. - [x] S11.12.c Deliver sequence gaps, late predecessor, reordered independent/ dependent events, stale version, replayed tombstone, and partition reorder. Evidence: ordering fixtures. - [x] S11.12.d Exhaust retry by transient repeats, permanent reclassification, max attempts/age/cost, poison payload, dead-letter/replay, and circuit open. Evidence: retry fixtures. - [x] S11.12.e Race cancellation before lease, during stage/checkpoint/ external effect, after success/before commit, with retry/parent-child, and with compensation. Evidence: cancellation fixtures. - [x] S11.12.f Assert idempotent authoritative and external side effects, monotonic state/progress, correct result/audit/cost, preserved checkpoint, and no false success. Evidence: invariant suite. - [x] S11.12.g Reconcile unknown outcomes and prove authorized replay does not duplicate effect. Evidence: recovery journey. - [x] S11.13 Add golden bundle build/import/verify runners. Evidence: each domain profile registers a golden. - [x] S11.13.a Define runner plugin for domain profile/version, fixture set, build inputs, expected layout/manifest/archive hash, import/migration, verification, and semantic/byte identity promise. Evidence: runner API. - [x] S11.13.b Register minimal/full/boundary/localized/provenance-rich/ compatibility/invalid goldens per profile with licensed source and immutable hashes. Evidence: golden manifest. - [x] S11.13.c Build under controlled/perturbed order/clock/locale/platform and compare layout/manifest/components/provenance/archive bytes. Evidence: build runner. - [x] S11.13.d Import/preflight/migrate/validate/persist/cleanup and compare semantic entities/artifacts/refs/lineage/loss report. Evidence: import runner. - [x] S11.13.e Verify paths/schema/hash/signature/trust/dependency/profile/ target compatibility and expected invalid/refusal outcomes. Evidence: verify runner. - [x] S11.13.f Rebuild from imported state and compare byte or documented semantic identity. Evidence: round-trip runner. - [x] S11.13.g Fail registry/CI when a profile/version lacks current golden or a golden update lacks reviewed source/semantic rationale. Evidence: coverage gate. - [x] S11.14 Add provenance tamper and trust-chain fixtures. Evidence: valid, invalid, unknown, expired, and stripped states. - [x] S11.14.a Add valid embedded/sidecar/ledger fixtures with complete and partial ingredients, supported assertions, trusted chain, timestamp, and hard/soft bindings. Evidence: valid corpus. - [x] S11.14.b Tamper artifact bytes, manifest/assertion/ingredient/action/ actor/tool/policy fields, signature, certificate chain, timestamp, ledger record, and binding. Evidence: tamper corpus. - [x] S11.14.c Add structurally/schema/signature/binding/chain/revocation/ timestamp/assertion/ingredient invalid variants with separable causes. Evidence: invalid corpus. - [x] S11.14.d Add unknown signer/root/trust list/assertion/algorithm/format/ version/ledger and offline or stale trust-list variants. Evidence: unknown corpus. - [x] S11.14.e Add expired/not-yet-valid/revoked certificate, timestamp, trust-list, assertion/policy, consent/rights, and manifest retention variants. Evidence: lifecycle corpus. - [x] S11.14.f Strip embedded metadata through realistic channel/transcode/ resize/crop/recompress/rerecord and test sidecar/soft-binding/ledger recovery, ambiguity, and failure. Evidence: stripped corpus. - [x] S11.14.g Assert crypto validity, trust, binding, assertion, ingredients, policy, and recovery states independently in API/UI/gates. Evidence: state matrix. - [x] S11.15 Add performance budgets for route load, interaction latency, save, search, compare, and virtualized scrolling. Evidence: CI trend report. - [x] S11.15.a Define route navigation/load/usable timing, JS/CSS/image/font/ data transfer, requests, main-thread/CPU/memory, and layout shift budgets by device/network. Evidence: route budgets. - [x] S11.15.b Define input/selection/command/panel/table/tree/graph/timeline/ media interaction latency and dropped-frame/long-task budgets. Evidence: interaction budgets. - [x] S11.15.c Define local feedback, autosave dispatch, durable ack, offline queue, retry, and conflict timing budgets. Evidence: save budgets. - [x] S11.15.d Define search typeahead/debounce/query/server/first result/full result/facet/pagination and expensive query rejection budgets. Evidence: search budgets. - [x] S11.15.e Define compare load/alignment/diff/render/navigate/filter for text/metadata/media/3D/graph/gate and large input bounds. Evidence: compare budgets. - [x] S11.15.f Define virtualized initial/scroll/page/jump/filter/resort/ selection/focus/memory/DOM count and accessibility semantic budgets. Evidence: scrolling budgets. - [x] S11.15.g Run controlled repetitions, record median/p75/p95/worst/ variance, compare baseline/trend, fail significant regression, and attach traces. Evidence: CI trend report. - [x] S11.16 Add high-volume API and job load profiles. Evidence: limits and backpressure activate before resource exhaustion. - [x] S11.16.a Define realistic/surge/abuse API mixes for reads/search/count/ upload/mutation/bulk/stream/health and tenant/actor/key distributions. Evidence: API profiles. - [x] S11.16.b Define job mixes for short/long/GPU/provider/render/evaluator/ import/export/publish/parent-child/retry/cancel and priority/tenant distributions. Evidence: job profiles. - [x] S11.16.c Define data/artifact sizes, hot/cold keys, pagination/search complexity, provider/dependency latency/error, and production-like capacity/cost constraints. Evidence: load manifest. - [x] S11.16.d Ramp sustained, burst, spike, soak, recovery, noisy-neighbor, single-tenant abuse, dependency slowdown, worker loss, and regional capacity scenarios sequentially. Evidence: run results. - [x] S11.16.e Measure latency/throughput/error, queue age/depth, saturation, DB/cache/search/blob/provider, retries/dead letters, fairness, cost, SLO, and data correctness. Evidence: dashboards/reports. - [x] S11.16.f Assert rate/concurrency/payload/query/storage/compute/spend/ queue limits, load shedding, circuit, reservation, and backpressure activate before unsafe memory/CPU/storage/provider exhaustion. Evidence: threshold assertions. - [x] S11.16.g Assert no cross-tenant starvation/leak, duplicate/lost effect, priority inversion, false success, or unrecovered state after load. Evidence: post-run integrity report. - [x] S11.17 Add accessibility parity tests for canvas/table, graph/list, timeline/list, waveform/transcript, and 3D/metadata views. Evidence: semantic-equivalence assertions. - [x] S11.17.a Define a shared parity contract for entity IDs, values/units, relationships/order/hierarchy/time, status, selection/focus/filter/ range, operations, errors, and protected/inaccessible state. Evidence: parity schema. - [x] S11.17.b Assert canvas objects/spatial facts/selection/edit operations are present and synchronized in a navigable table/form alternative. Evidence: canvas/table fixtures. - [x] S11.17.c Assert graph nodes/edges/properties/groups/paths/impact and relationship operations are present in list/table/tree alternatives. Evidence: graph/list fixtures. - [x] S11.17.d Assert timeline tracks/events/start/end/duration/value/status/ overlap and trim/move/split/zoom/seek operations are present in semantic lists/forms. Evidence: timeline/list fixtures. - [x] S11.17.e Assert waveform/audio duration/channels/time/range/markers/ loudness/events/alerts and navigation are present in transcript/data/ event views. Evidence: waveform/transcript fixtures. - [x] S11.17.f Assert 3D hierarchy/objects/transforms/geometry/materials/ animation/variants/refs/validation and selection/navigation are present in metadata/tree/table views. Evidence: 3D/metadata fixtures. - [x] S11.17.g Mutate each visual-only fact/action and require parity test failure; test keyboard/screen-reader full journeys on alternatives. Evidence: semantic mutation report. - [x] S11.18.b Detect fake/mock/demo/stub/in-memory/fallback provider binding, deterministic canned outputs, catch-and-success, and unconfigured-to- success paths. Evidence: provider rules/fixtures. - [x] S11.18.c Detect numeric/boolean pass/default score, random/hash/length/ keyword heuristics presented as domain evaluation, UI-computed truth, and missing-to-zero/green. Evidence: score rules/fixtures. - [x] S11.18.d Detect fixture/sample/demo seed/interception/test builder in production dependency graph or unlabeled runtime output. Evidence: fixture rules/fixtures. - [x] S11.18.e Detect fabricated success/verified/published/saved/healthy/ configured/complete state from request dispatch, HTTP 2xx, empty value, build env, optimistic UI, or swallowed error. Evidence: success rules. - [x] S11.18.f Classify blocker/review/allowed test-only/known false-positive with source, dataflow/context, owner, disposition, expiry, and linked proof; no broad ignore patterns. Evidence: triage schema. - [x] S11.18.g Run static patterns plus AST/import/bundle checks and targeted runtime/adversarial tests, then independently review zero-blocker report. Evidence: signed scan report. S11.18 parent rollup — closed by a–g (note only; the checkbox is the `S11.18` line above, §2.5.11). - [x] S11.19 Add dependency-license, secret, SAST, and supply-chain scans to the release evidence index. Evidence: critical findings block release. - [x] S11.19.a Scan direct/transitive runtime/build/dev/container/native/ model/plugin/DCC/tool dependencies for vulnerabilities, reachability, maintenance, source, hash, and advisories. Evidence: dependency report. - [x] S11.19.b Generate license/notice/SBOM and detect prohibited/unknown/ missing/incompatible/transitive/model/data/font/media license or attribution. Evidence: license report. - [x] S11.19.c Scan source/history/config/build artifacts/images/bundles/log/ test snapshots for credentials/tokens/keys/certs/signed URLs/secret patterns and verified canaries. Evidence: secret report. - [x] S11.19.d Run language/framework SAST for injection, auth, tenant, SSRF/ upload/path, crypto, deserialization, traversal, unsafe subprocess, privacy, and unsafe API use with reachability. Evidence: SAST report. - [x] S11.19.e Verify lockfile/integrity/signatures/provenance, pinned actions/ tools/images, build isolation, generated artifacts, package confusion, typosquat, install scripts, and signing chain. Evidence: supply-chain report. - [x] S11.19.f Normalize findings with scan/tool/db version, artifact/commit, severity/exploitability/scope, owner, fix/exception/expiry, retest, and raw evidence link. Evidence: evidence index rows. - [x] S11.19.g Block critical policy findings, expired exceptions, missing/ stale/incomplete scans, or artifact mismatch and prove with deliberate fixture. Evidence: release gate test. S11.19 parent rollup — closed by a–g (note only; the checkbox is the `S11.19` line above, §2.5.11). - [x] S11.20 Add a release-readiness generator. Evidence: it refuses to produce a green packet when required evidence is missing or stale. - [x] S11.20.a Define versioned readiness manifest for release/commit/artifact/ environment/target, scope/requirements, dependency graph, required evidence types, owners/approvals, freshness, waivers, and stop policy. Evidence: readiness schema. - [x] S11.20.b Resolve requirement/ledger IDs to code, tests/scans, migration, screenshots/traces, performance/SLO, runbooks, approvals, and immutable evidence hashes. Evidence: traceability resolver tests. - [x] S11.20.c Validate artifact/commit/version/target/scope match, file/link existence, hash/signature, schema, command/result, complete pages/ matrices, owner, timestamp, expiry, and source provenance. Evidence: validator tests. - [x] S11.20.d Recompute freshness from code/contract/schema/dependency/ policy/model/corpus/fixture/environment/standard changes rather than trusting a green label. Evidence: staleness mutation tests. - [x] S11.20.e Evaluate required pass/known limitation/waiver/N/A/human approval states and stop-the-line conditions without allowing one result to substitute for another evidence class. Evidence: truth tables. - [x] S11.20.f Emit green only with zero missing/stale/failed/blocking/ unapproved items; otherwise emit exact blockers and remediation while preserving unchecked human gates. Evidence: negative fixtures. - [x] S11.20.g Generate deterministic signed/checksummed packet and machine/ human summaries from the same evidence, and detect generator drift. Evidence: reproducibility test. - [ ] S11.21 Migrate Tara to the shared kit incrementally. Evidence: each slice preserves public API and behavior. - [x] S11.21.a Freeze Tara public package exports, contracts, routes, BFF/UI behavior, persistence/events/jobs, fixtures policy, performance, and accessibility baselines. Evidence: pre-migration manifest. - [x] S11.21.b Order independently reversible slices for branded IDs/ envelopes, capability/route registry, lifecycle/revisions/gates, persistence/jobs, API/security, provider/trust, bundle/publish, shell/UI, collaboration/taxonomy, and observability/testing. Evidence: migration plan. - [x] S11.21.c Add shared implementation behind existing Tara public adapters without changing consumer imports/contracts. Evidence: compatibility tests per slice. - [x] S11.21.d Migrate one call path/state/data flow at a time with expected revision/idempotency/events/audit and no dual-write divergence. Evidence: slice integration tests. - [x] S11.21.e Run targeted unit/contract/integration/browser/performance/ accessibility/stub scans and compare behavior after every slice. Evidence: per-slice report. - [x] S11.21.f Define per-slice enablement/rollback, data compatibility/ reconciliation, old/new mixed deployment, and removal criteria. Evidence: rollback tests. - [x] S11.21.g Migrate external consumers and delete legacy implementation/ adapters/flags only after import/usage graph and full suite prove no dependency. Evidence: deletion gate. - [ ] S11.22 Run Tara's complete relevant unit, integration, contract, build, accessibility, and Playwright suite after migration. Evidence: reports are linked and green. - [x] S11.22.a Pin migrated commit, dependencies, environment, database/ storage/queue/provider modes, fixtures, accounts/tenants, browser, clock, and exact commands. Evidence: verification manifest. - [x] S11.22.b Run all affected Tara/shared unit/property/known-value/ component tests with coverage mapping. Evidence: unit report. - [x] S11.22.c Run real database/storage/queue/provider/publisher/host integration, migration, tenant, fault, replay, and restore tests. Evidence: integration report. - [x] S11.22.d Run provider/consumer/schema/generated/API/event/job/bundle/ compatibility/drift contract suites. Evidence: contract report. - [x] S11.22.e Run lint/typecheck/package/bundle/production build and dependency boundary/test-fixture/stub/secret scans sequentially. Evidence: build/static reports. - [x] S11.22.f Run automated/manual/keyboard/screen-reader/semantic parity/ visual/zoom/locale accessibility matrix. Evidence: accessibility report. - [x] S11.22.g Run all critical live-data and fault-state Playwright journeys with fixture mode explicit. Evidence: browser report/traces/screenshots. - [x] S11.22.h Triage every failure, rerun affected/full gates, and link final current green reports with no stale result. Evidence: zero open failures. - [ ] S11.23 Compare Tara pre/post performance and accessibility baselines. Evidence: regressions are fixed or explicitly approved. - [x] S11.23.a Verify pre/post builds use equivalent environment/data/accounts/ browser/device/network/clock/providers/routes/states and record unavoidable differences. Evidence: comparison manifest. - [x] S11.23.b Compare route load/transfer/request/main-thread/memory/layout, interaction/save/search/compare/virtualization, API/job/queue/provider, and cost/resource metrics statistically. Evidence: performance diff. - [x] S11.23.c Compare automated WCAG findings, keyboard journeys, screen- reader announcements, focus, semantic alternatives, zoom/reflow, themes/densities, RTL/locales, and visual baselines. Evidence: accessibility diff. - [x] S11.23.d Distinguish regression/improvement/noise/tool/environment/ intentional semantic change with raw evidence and significance/budget. Evidence: triaged delta register. - [x] S11.23.e Fix each unapproved regression and rerun focused then complete affected comparison. Evidence: closed fix results. - [x] S11.23.f For an allowed regression, record affected users/SLO/criterion, rationale, alternatives, compensating control, owner, named product/ accessibility/performance approval, expiry, and follow-up. Evidence: approved exception. - [x] S11.23.g Publish final comparison with zero unexplained or expired regressions. Evidence: signed baseline report. - [ ] S11.24 Complete an adversarial code review of the extracted kit. Evidence: findings are resolved and public API is frozen for domain P1. - [x] S11.24.a Freeze review commit/scope and map every public export, extension point, consumer, dependency direction, generated artifact, runtime boundary, and test evidence. Evidence: review manifest. - [x] S11.24.b Review abstraction quality for Tara leakage, one-consumer extraction, generic escape hatches, unsafe defaults, hidden coupling, runtime/type mismatch, and extension invariants. Evidence: API findings. - [x] S11.24.c Review identity/tenancy/object/property/function authorization, step-up, idempotency/concurrency, audit, errors, limits, fetch/upload, and secret/protected data paths adversarially. Evidence: security findings. - [x] S11.24.d Review persistence/migrations/events/jobs/cache/blob/provenance/ publish for atomicity, races, replay, partial/unknown outcome, retention, and recovery. Evidence: correctness findings. - [x] S11.24.e Review provider/trust/gates/scores/fixtures/states for injection, fabricated truth/success, stale authorization, policy/version, cost, override, and human approval boundaries. Evidence: trust findings. - [x] S11.24.f Review UI/API accessibility/localization/resilience/privacy/ performance/operability and test harness ability to detect regressions. Evidence: quality findings. - [ ] S11.24.g Classify blocker/major/minor/question, owner/fix/decision, retest, and resolve all blocker/major and every public API uncertainty. Evidence: closed finding ledger. - [ ] S11.24.h Freeze public API/compatibility/version/support window only after clean build/contracts/Tara full suite and named architecture/ package/security/domain approval. Evidence: P1 API signoff. --- ## Phase I — Isis governed-generation workbenches Isis is not one new `/studio/isis-workbench` page. It has three governed audiences: operator factory controls in `apps/isis/web`, AAA-creator controls in Yemaya Studio, and curated generation cards plus the output gallery in Oshun Studio. This phase closes the workflow across those hosts while preserving the generation-tier resolver as the single boundary authority. ### I0 — Product boundary, reuse, and threat model - [ ] I0.1 Reconcile every Isis route with `STUDIO_ISIS_ALLOWED_ROUTE_SEGMENTS` and the generation-tier resolver. Evidence: route-boundary test covers every discovered route. - [x] I0.1.a Enumerate Isis routes from `apps/isis/web`, Oshun Studio, Yemaya Studio, BFF/proxy, redirects, route inventories, and deep links with source/mount/host. Evidence: route register. - [x] I0.1.b Resolve each Oshun Studio segment against `STUDIO_ISIS_ALLOWED_ROUTE_SEGMENTS`, including the current empty/ deny-all behavior. Evidence: segment decision rows. - [x] I0.1.c Resolve every route/action through the canonical generation-tier resolver for actor, tenant, audience, asset/workflow class, and host. Evidence: tier decision rows. - [x] I0.1.d Classify source-mounted but unreachable, feature/provider-gated, redirected, proxied, embedded, compatibility, and live routes by effective middleware behavior. Evidence: effective route matrix. - [ ] I0.1.e Assign canonical owner/host/audience/capability, allowed controls, data classification, and keep/refactor/redirect/retire disposition. Evidence: completed route rows. - [x] I0.1.f Add generated route cases that prove each discovered route is allowed only for its exact tier/host and concealed/refused elsewhere. Evidence: complete route-boundary test. - [x] I0.1.g Fail inventory drift when a new Isis route or allowed segment lacks a tier/host disposition. Evidence: deliberate route addition test. - [ ] I0.2 Ratify operator, AAA-creator, curated-creator, and contemplative capabilities separately. Evidence: signed audience-capability matrix. - [ ] I0.2.a Define operator actors, operational purpose, canonical host, raw workflow/model/provider/resource visibility, mutation/override/emergency authority, and exclusions. Evidence: operator matrix rows. - [ ] I0.2.b Define AAA-creator actors, Yemaya project/asset context, advanced workflow/model/training/3D/voice/music controls, release handoff, and forbidden fleet/admin authority. Evidence: AAA rows. - [ ] I0.2.c Define curated-creator actors, approved task/asset cards, high- level controls, gallery/editorial handoff, and forbidden raw details. Evidence: curated rows. - [ ] I0.2.d Define contemplative actors, permitted narrow assistive generation, consent/safety constraints, output use, and prohibited AAA/ operator capabilities. Evidence: contemplative rows. - [ ] I0.2.e Decide exposure/observe/control/review/approve/publish/recall/ support applicability per canonical capability and audience. Evidence: zero blank matrix cells. - [ ] I0.2.f Resolve shared capabilities whose behavior/data detail differs by audience without relying on UI hiding. Evidence: contract and authorization variants. - [ ] I0.2.g Obtain named Isis, Yemaya, Oshun Studio, product, safety/rights, security/privacy, and architecture approval. Evidence: signed matrix. - [ ] I0.3 Map `apps/isis/web` pages to keep, refactor, merge, or retire. Evidence: every page and route has one disposition. - [x] I0.3.a Enumerate every page/layout/component route, navigation entry, deep link, API/provider/store/job dependency, role, state, and test. Evidence: source-linked page inventory. - [x] I0.3.b Walk each reachable page with fixtures off and classify live, partial, fixture, not-configured, dead, duplicate, and unreachable behavior. Evidence: page walkthrough matrix. - [ ] I0.3.c Assign keep where audience/host/capability and live implementation are correct; record missing hardening/proof separately. Evidence: keep rows. - [ ] I0.3.d Assign refactor with target shared/domain boundary, contract/data/ authorization changes, migration slice, compatibility, and rollback. Evidence: refactor rows. - [ ] I0.3.e Assign merge with canonical destination, source-only behavior to preserve, deep-link/state migration, consumer impact, and deletion gate. Evidence: merge rows. - [ ] I0.3.f Assign retire with replacement/redirect/export/retention/notice/ owner/date and verify no unique capability is lost. Evidence: retirement rows. - [ ] I0.3.g Reconcile source routes/navigation to dispositions and obtain operator owner approval. Evidence: zero undispositioned pages/routes. - [ ] I0.4 Map existing Oshun Studio generation cards and gallery routes. Evidence: no planned route duplicates an existing approved surface. - [x] I0.4.a Enumerate generation cards, entry actions, contexts, high-level controls, tier resolver calls, BFF/API operations, output destinations, and tests. Evidence: card inventory. - [x] I0.4.b Enumerate gallery/list/detail/compare/replay/promotion/history/ provenance/routes and deep-link state. Evidence: gallery route inventory. - [x] I0.4.c Classify each surface by authorized audience, asset/workflow class, live/fixture/provider state, backing contract/service/store, and current gaps. Evidence: surface matrix. - [ ] I0.4.d Match every proposed curated capability/route against existing card/gallery behavior and exact reusable component/contract. Evidence: proposal-to-existing map. - [ ] I0.4.e Select extend/refactor/merge/redirect/retire instead of a new route whenever an approved surface owns the same audience/workflow. Evidence: zero unexplained duplicate proposals. - [ ] I0.4.f Record missing approved card/gallery capability as an extension task with canonical route and no raw operator/AAA control leakage. Evidence: gap rows. - [ ] I0.4.g Validate route/navigation/deep-link inventory after decisions. Evidence: uniqueness and boundary tests. - [ ] I0.5 Map Yemaya Studio generation, workflow, model, training, 3D, voice, and music controls. Evidence: deep-link and ownership matrix. - [x] I0.5.a Inventory high-level and raw generation brief/run/variant/output controls and their Isis contract/provider/job paths. Evidence: generation rows. - [ ] I0.5.b Inventory workflow graph/template/node/parameter/version/import/ validation/execution controls. Evidence: workflow rows. - [x] I0.5.c Inventory model/checkpoint/adapter/LoRA/version/intake/evaluation/ selection controls. Evidence: model rows. - [x] I0.5.d Inventory dataset/training/fine-tune/checkpoint/evaluation/ promotion/resource/cost controls. Evidence: training rows. - [x] I0.5.e Inventory scene/mesh/rig/material/texture/splat/animation/DCC/ engine generation and post-process controls. Evidence: 3D rows. - [x] I0.5.f Inventory voice/TTS/cloning/dubbing/conversation/foley/audio and music/stem/composition/mastering generation controls. Evidence: audio/ music rows. - [ ] I0.5.g Assign each control to Yemaya, Isis operator, domain plugin, or excluded surface with owner, audience, capability, contract, route, and permitted detail. Evidence: ownership matrix. - [ ] I0.5.h Define signed deep-link/handoff context for project/asset/shot/ timeline/run/output/return path and test tenant/expiry/permission. Evidence: deep-link matrix. - [ ] I0.6 Map all `libs/isis/*` packages to operator, creator, worker, shared service, or out-of-scope. Evidence: all discovered packages classified. - [x] I0.6.a Enumerate every Isis library/export/consumer/dependency/test/ runtime/contract/entity/job/provider and atomic capability. Evidence: package capability inventory. - [ ] I0.6.b Classify operator-owned packages that expose fleet, provider, workflow/model registry, policy, emergency, economics, parity, or administration. Evidence: operator rows. - [ ] I0.6.c Classify creator-facing packages for brief/workflow/variant/ preview/compare/review/gallery or authorized project handoff. Evidence: creator rows. - [ ] I0.6.d Classify worker/runtime packages for generation, training, processing, validation, lineage, storage, queue, and provider adapters with operational projection. Evidence: worker rows. - [ ] I0.6.e Classify truly domain-neutral contract/service helpers as shared only with two real consumers and correct dependency direction. Evidence: shared rows. - [ ] I0.6.f Classify compatibility/dead/experimental/vendor/test-only/ superseded/non-V1 packages with retain/retire/exclude rationale, consumers, owner, and date. Evidence: out-of-scope rows. - [ ] I0.6.g Resolve mixed packages at symbol/capability level rather than one broad package label. Evidence: split mapping. - [ ] I0.6.h Reconcile every filesystem package to exactly one or more capability rows with no unclassified library. Evidence: path check and domain-owner signoff. - [ ] I0.7 Decide whether any new Isis workbench domain library is needed. Evidence: ADR prefers existing `@oshun/generation-control-isis`/domain packages unless a concrete gap is demonstrated. - [ ] I0.7.a Define the exact missing capability/ownership/dependency/API/ runtime/test problem that cannot live in an existing Isis package. Evidence: source-linked gap statement. - [x] I0.7.b Evaluate extending `@oshun/generation-control-isis`, another existing domain package, the shared workbench kit, an application-local adapter, and no-new-code options. Evidence: option matrix. - [x] I0.7.c Compare public API, dependency direction, consumer count, domain-specific semantics, runtime boundary, version/release cadence, migration, and deletion cost. Evidence: trade-off table. - [x] I0.7.d Prototype the smallest interface in the preferred existing boundary and record why it succeeds or fails. Evidence: compile/dependency proof. - [ ] I0.7.e If a new library is justified, define owner, scope/non-goals, exports, dependencies, two consumers, contracts, migration, and deletion threshold. Evidence: proposed package design. - [ ] I0.7.f Record the chosen decision, rejected options, consequences, compatibility, review date, and named architecture/Isis approval. Evidence: ratified ADR. - [ ] I0.8 Define the asset-kind taxonomy for image, portrait, texture, video, audio, foley, voice, mesh, rig, gaussian splat, and composite scenes. Evidence: registry maps each kind to contract, preview, gates, and publisher. - [ ] I0.8.a Define taxonomy entry identity/version, parent/family, aliases, media/profile, lifecycle, owning package, audience/host, and extension policy. Evidence: asset-kind registry schema. - [ ] I0.8.b Define generic image kind controls/outputs, metadata, visual preview/semantic alternative, quality/safety/rights/provenance gates, and publishers. Evidence: image registry row and fixtures. - [ ] I0.8.c Define portrait kind identity/reference/consent controls, face preview/alternatives, impersonation/biometric/safety/quality gates, and publishers. Evidence: portrait row and fixtures. - [ ] I0.8.d Define texture kind tiling/channels/color/PBR target controls, material preview/metadata, seam/technical/rights/provenance gates, and publishers. Evidence: texture row and fixtures. - [ ] I0.8.e Define video kind duration/frame/rate/size/codec/motion/audio/ caption controls, synchronized preview/alternatives, temporal/safety/ rights/quality gates, and publishers. Evidence: video row and fixtures. - [ ] I0.8.f Define general audio kind duration/sample/channel/format/content controls, waveform/audition/transcript alternative, loudness/safety/ rights/quality gates, and publishers. Evidence: audio row and fixtures. - [ ] I0.8.g Define foley kind event/action/material/scene/time/variation/ synchronization controls, audiovisual preview, originality/rights/ technical gates, and publishers. Evidence: foley row and fixtures. - [ ] I0.8.h Define voice kind speaker/language/style/text/timing/delivery and consent constraints, audio/transcript preview, cloning/impersonation/ safety/rights/quality gates, and publishers. Evidence: voice row. - [ ] I0.8.i Define mesh kind units/axes/topology/geometry/material/UV/LOD/ collision/format controls, 3D/metadata preview, OpenUSD/geometry/rights/ provenance gates, and publishers. Evidence: mesh row and fixtures. - [ ] I0.8.j Define rig kind skeleton/joint/naming/orientation/constraints/ skin/controls/target controls, hierarchy/pose preview, deformation/ compatibility/rights gates, and publishers. Evidence: rig row. - [ ] I0.8.k Define Gaussian-splat kind coordinate/scale/SH/point-count/ cameras/compression/format controls, spatial preview/metadata, quality/privacy/rights/interchange gates, and publishers. Evidence: splat row. - [ ] I0.8.l Define composite-scene kind hierarchy/reference/variant/camera/ light/material/animation/audio/dependency controls, scene/semantic preview, cross-asset/rights/provenance/target gates, and publishers. Evidence: scene row. - [ ] I0.8.m Validate unique IDs/aliases, inheritance, audience exposure, contract/preview/gate/publisher completeness, unsupported behavior, and no ambiguous kind resolution. Evidence: registry validation tests. - [ ] I0.9 Define the workflow-class taxonomy and audience allowlist. Evidence: raw graph, model hash, LoRA, scheduler, and provider details cannot leak to curated payloads. - [x] I0.9.a Inventory current workflow templates/graphs/nodes/providers/ models and classify generation, edit/transform, upscale/enhance, animate/video, audio/voice/music, 3D, training, analysis, and composite classes. Evidence: workflow class register. - [ ] I0.9.b Define class ID/version, supported asset kinds/operations, required inputs/outputs, parameter schema, capabilities, cost/resource class, lifecycle, and owner. Evidence: class schema. - [ ] I0.9.c Assign operator, AAA, curated, and contemplative allow/deny/ request/inspect/edit/execute/replay exposure per class. Evidence: audience allowlist. - [ ] I0.9.d Define operator payload with authorized raw graph/node/model/ adapter/LoRA/scheduler/provider/resource/debug detail. Evidence: operator contract tests. - [ ] I0.9.e Define AAA payload with approved advanced workflow/model/training detail but no fleet credentials, private provider internals, or operator emergency authority. Evidence: AAA contract tests. - [ ] I0.9.f Define curated/contemplative payload as task-specific high-level intent/constraints/reference/quality/budget/delivery choices and stable public labels. Evidence: curated contract tests. - [ ] I0.9.g Redact raw graph, node IDs/parameters, model/checkpoint hashes, LoRA/adapter identity, scheduler/sampler internals, provider/endpoint, secrets, pricing, and fleet topology from lower tiers. Evidence: property/bundle leak tests. - [ ] I0.9.h Resolve workflow/tier at authoritative BFF/service boundary and reject direct IDs or parameter injection outside allowlist. Evidence: bypass negative tests. - [ ] I0.9.i Define unsupported/not-configured/degraded/version-skew and class migration behavior per audience. Evidence: capability state matrix. - [ ] I0.10 Threat-model brief injection, workflow injection, malicious graphs, model supply chain, unsafe media, face/voice impersonation, child safety, biometric data, training rights, and cost abuse. Evidence: mitigations map to test IDs. - [ ] I0.10.a Threat-model brief/prompt/reference/negative-prompt/metadata injection across audience tiers and downstream provider/tools. Evidence: brief attack tree and tests. - [ ] I0.10.b Threat-model workflow/template/node/parameter/import/version injection and unauthorized class/tier escalation. Evidence: workflow attack tree and tests. - [ ] I0.10.c Threat-model malicious graph cycles, resource bombs, unsafe nodes/scripts/custom code, filesystem/network access, deserialization, dependency escape, and hidden outputs. Evidence: graph tests. - [ ] I0.10.d Threat-model model/checkpoint/adapter/LoRA/plugin/container/ dependency origin, license, signature/hash, malicious serialization/ code, poisoning, backdoor, update, and compromise. Evidence: supply-chain tests. - [ ] I0.10.e Threat-model uploaded/fetched/generated image/video/audio/3D/ archive malformed, active, oversized, steganographic, illegal, or parser exploit content. Evidence: media threat tests. - [ ] I0.10.f Threat-model face and voice cloning/reenactment/dubbing/ impersonation, identity theft, fraud, consent scope, public figure, disclosure, and revocation. Evidence: impersonation tests. - [ ] I0.10.g Threat-model child sexual abuse/exploitation, age ambiguity, grooming/sexualization, identity/biometric processing, reporting, quarantine, and mandatory escalation. Evidence: child-safety controls. - [ ] I0.10.h Threat-model face/voice/body/motion embeddings/templates, inference, cross-context linking, retention, access, provider transfer, breach, and deletion. Evidence: biometric tests. - [ ] I0.10.i Threat-model dataset/reference/output/model training rights, license/consent, attribution, opt-out/revocation, laundering, derivative use, and territorial limits. Evidence: rights tests. - [ ] I0.10.j Threat-model token/GPU/storage/provider/egress/retry/batch/ training/render cost exhaustion, quota bypass, cryptomining/denial, invoice fraud, and kill-switch failure. Evidence: cost abuse tests. - [ ] I0.10.k Map asset/threat/actor/entry/control/detection/response/recovery/ residual risk/owner to exact automated/manual test and stop-the-line policy. Evidence: zero unmapped high-risk scenarios. - [ ] I0.11 Define data classification and retention for prompts, references, biometric embeddings, model artifacts, outputs, logs, and provenance. Evidence: privacy/security approval. - [ ] I0.11.a Classify prompts/briefs/templates/negative prompts/system policy/ tool arguments by content, tenant, source identity, secrecy, and purpose. Evidence: prompt data rows. - [ ] I0.11.b Classify uploaded/fetched/link/reference media, metadata, protected identities, rights/consent, source, and derived analysis. Evidence: reference data rows. - [ ] I0.11.c Classify face/voice/body/motion embeddings/templates/features/ similarity scores and prohibit or constrain persistence by purpose/ consent. Evidence: biometric rows. - [ ] I0.11.d Classify model/checkpoint/adapter/LoRA/training dataset/ optimizer/artifact/config/evaluation/license/security metadata. Evidence: model artifact rows. - [ ] I0.11.e Classify generated/intermediate/partial/quarantined/rejected/ approved/published/recalled outputs, derivatives, hashes, and metadata. Evidence: output rows. - [ ] I0.11.f Classify provider/worker/API/security/audit/debug logs/traces/ metrics/profiles/support exports and prohibit sensitive payloads by default. Evidence: telemetry rows. - [ ] I0.11.g Classify provenance manifests/ledger/ingredient/action/actor/ signature/trust and protected/redacted identity fields. Evidence: provenance rows. - [ ] I0.11.h For each class define collection/minimization, legal basis/ consent, purpose, encryption, region/provider, access, sharing, training use, retention, hold, deletion, backup, incident, and subject rights. Evidence: complete lifecycle matrix. - [ ] I0.11.i Obtain named privacy/security/safety/rights/domain approval and test enforcement against stores/providers/logs/exports/deletion. Evidence: approvals and data lifecycle tests. - [ ] I0.12 Define the operator emergency controls for provider disable, workflow revoke, model quarantine, output recall, and spend kill switch. Evidence: authority and blast-radius decisions. - [ ] I0.12.a Define provider disable scope by provider/endpoint/operation/ model/class/region/tenant/global, trigger, in-flight/queued behavior, fallback prohibition/allowance, recovery, and authority. Evidence: provider control decision. - [ ] I0.12.b Define workflow revoke scope by template/version/class/audience/ host, future dispatch, active jobs, outputs/releases, cache, replacement, and restoration. Evidence: workflow control decision. - [ ] I0.12.c Define model quarantine scope by model/version/checkpoint/adapter/ LoRA, intake/evaluation/dispatch/training/outputs/derivatives, evidence, investigation, revoke/restore. Evidence: quarantine decision. - [ ] I0.12.d Define output recall scope by artifact/run/ingredient/model/ workflow/release/target, dependent derivatives, gallery/catalog/cache, notifications/tombstone, provider/target withdrawal, and verification. Evidence: recall decision. - [ ] I0.12.e Define spend kill scope by actor/project/tenant/provider/model/ operation/resource/global, reservation/new dispatch/in-flight/retry/ queued behavior, essential exceptions, and recovery. Evidence: spend control decision. - [ ] I0.12.f Define request/approve/activate/revoke/expire/recover workflow with least privilege, step-up, separation/quorum, emergency break-glass, immutable audit, communication, and evidence. Evidence: common control contract. - [ ] I0.12.g Preview direct/transitive blast radius and make all actions idempotent, rapid, fail-closed, observable, and reconcilable. Evidence: blast-radius and fault tests. - [ ] I0.12.h Rehearse each control and combined incidents, measure propagation and recovery, and link stop-the-line/runbooks. Evidence: game-day report. - [ ] I0.13 Author and ratify `V1/ISIS_GENERATION_WORKBENCHES_DESIGN_2026-07-23.md` with current-state, audience, host, data, API, job, UI, trust, migration, rollout, and decision records. Evidence: approved doc and resolved review comments. - [ ] I0.13.a Document code-derived current applications/routes/components/ contracts/packages/entities/jobs/providers/tests, live/fixture/dead status, and reusable/gap disposition. Evidence: current-state section. - [ ] I0.13.b Document operator/AAA/curated/contemplative actors, roles, capabilities, forbidden detail/actions, approvals, and boundary matrix. Evidence: audience section. - [ ] I0.13.c Document canonical hosts/routes/navigation/deep links/embeds/ handoffs/proxies/redirects and migration from noncanonical surfaces. Evidence: host section. - [ ] I0.13.d Document asset/workflow/model/brief/plan/run/output/lineage/gate/ rights/consent/provenance/release data contracts, stores, retention, and migrations. Evidence: data section. - [ ] I0.13.e Document APIs/events/jobs/providers/bundles/publishers, authentication/authorization, idempotency/concurrency, limits, errors, health, and compatibility. Evidence: service sections. - [ ] I0.13.f Document queue/worker/resource/cost/cancel/retry/checkpoint/ fault/recovery/emergency operations. Evidence: job/operations section. - [ ] I0.13.g Document restrained operator/AAA/curated/gallery workspace hierarchy, responsive behavior, states, accessibility/nonvisual media/ graph/3D alternatives, localization, and utility copy. Evidence: UI section. - [ ] I0.13.h Document threat model, data classification, safety/child/ impersonation, rights/consent, provenance/trust, gates/overrides, incident/recall, and evidence. Evidence: trust section. - [ ] I0.13.i Document incremental reuse/refactor/data/route/consumer migration, compatibility, rollback, deprecation/deletion, environment/standards, verification, rollout/cohort, SLO, support, and DR. Evidence: migration/ rollout sections. - [ ] I0.13.j Record every product/architecture/security/privacy/safety/rights/ host/ownership/standard decision with options/evidence/rationale/ consequences/approver/review. Evidence: decision appendix. - [ ] I0.13.k Run source link/schema/route/inventory/requirement consistency checks, obtain named reviews, resolve every comment, and ratify exact document revision. Evidence: approval record and closed comment ledger. - [ ] I0.14 Reconcile the complete `ISIS_TODOS_2.md` asset-family matrix: character concept, turnaround, expression, costume, prop-interaction, NPC-crowd and creature packs; environment concept, matte-painting, tileset, architecture, interior, prop, weapon, vehicle, PBR material, decal, terrain, foliage, sky, VFX, UI/HUD, storyboard, animatic, cinematic, marketing, social, audio-SFX, voice-line, and music-cue outputs. Evidence: every matrix row has an audience, authorized host, workflow/template, controls, output bundle, preview, quality profile, and release disposition. - [ ] I0.14.a Reconcile character-concept outputs independently, including single/multi-view intent, identity/style references, anatomy/silhouette, design variation, audience/host, workflow, controls, bundle, preview, quality/rights/provenance gates, and release. Evidence: completed character-concept row. - [ ] I0.14.b Reconcile character-turnaround outputs independently, including canonical views, camera/pose/scale consistency, identity/wardrobe locks, sheet layout, downstream modeling, and release proof. Evidence: completed turnaround row. - [ ] I0.14.c Reconcile expression-sheet outputs independently, including expression taxonomy/intensity, identity/anatomy consistency, layout, rig/reference handoff, and safety/quality proof. Evidence: completed expression row. - [ ] I0.14.d Reconcile costume outputs independently, including garment/ material/accessory variants, identity/body/era/style locks, rights/ cultural review, turnaround/fit preview, and downstream handoff. Evidence: completed costume row. - [ ] I0.14.e Reconcile prop-interaction outputs independently, including character/prop identity, grasp/contact/occlusion/physics, action poses, scale, rig/animation handoff, and quality gates. Evidence: completed prop-interaction row. - [ ] I0.14.f Reconcile NPC-crowd pack outputs independently, including population taxonomy, identity diversity, variation rules, LOD/atlas/ instancing, bias/safety, engine bundle, and performance gates. Evidence: completed NPC-crowd row. - [ ] I0.14.g Reconcile creature-pack outputs independently, including species/ anatomy/size variants, turnaround/expression/motion/rig needs, safety, downstream formats, and quality. Evidence: completed creature-pack row. - [ ] I0.14.h Reconcile environment-concept outputs independently, including biome/location/era/mood, composition/scale/perspective, camera/lighting/ palette locks, production breakdown, and world-building handoff. Evidence: completed environment-concept row. - [ ] I0.14.i Reconcile matte-painting outputs independently, including plate/ camera/perspective/lighting/color/depth, alpha/layer/overscan, projection, EXR delivery, and compositing/rights/quality proof. Evidence: completed matte-painting row. - [ ] I0.14.j Reconcile tileset outputs independently, including grid/tile/ adjacency/rules, seamless variants, collision/metadata, atlas/engine packaging, preview map, and validation. Evidence: completed tileset row. - [ ] I0.14.k Reconcile architecture outputs independently, including style/ period/function, dimensions/units/modularity, interior/exterior, material/ code considerations, LOD/collision, DCC/engine handoff, and gates. Evidence: completed architecture row. - [ ] I0.14.l Reconcile interior outputs independently, including room program/ layout/scale, furniture/props/materials/lighting, camera/navigation, modular breakdown, DCC/engine bundle, and quality. Evidence: completed interior row. - [ ] I0.14.m Reconcile standalone prop outputs independently, including function/scale/material/wear/variants, turnaround, mesh/texture/LOD/ collision targets, rights, and engine/DCC release. Evidence: completed prop row. - [ ] I0.14.n Reconcile weapon outputs independently, including fictional/ historical context, safety policy, dimensions/mechanism/material/ variants, hands/animation, mesh/LOD/collision, rights, and audience restrictions. Evidence: completed weapon row. - [ ] I0.14.o Reconcile vehicle outputs independently, including class/scale/ design/variants, exterior/interior, wheel/part/rig/animation, materials/decals, LOD/collision, and simulation/engine handoff. Evidence: completed vehicle row. - [ ] I0.14.p Reconcile PBR-material outputs independently, including workflow/ shader model, base color/normal/roughness/metallic/AO/height/emissive/ opacity channels, tiling/scale/color space, preview, and target export. Evidence: completed PBR-material row. - [ ] I0.14.q Reconcile decal outputs independently, including purpose/ dimensions/alpha/channel packing/projection/atlas/variants, trademark/ rights, surface preview, DCC/engine format, and validation. Evidence: completed decal row. - [ ] I0.14.r Reconcile terrain outputs independently, including extent/units/ heightfield/erosion/biomes/masks/material layers/LOD/collision/streaming, GIS/source rights, preview, and engine package. Evidence: completed terrain row. - [ ] I0.14.s Reconcile foliage outputs independently, including species/ growth/season/variation, cards/geometry/material/wind/LOD/collision/ density, ecological/source rights, and engine bundle. Evidence: completed foliage row. - [ ] I0.14.t Reconcile sky outputs independently, including time/weather/ location/HDRI/cloud/sun/stars/color/exposure, environment-map format, lighting preview, rights, and engine/DCC handoff. Evidence: completed sky row. - [ ] I0.14.u Reconcile VFX outputs independently, including effect taxonomy/ duration/space/timing, sprites/flipbooks/particles/volumes/materials/ simulation, loop/LOD/performance, preview, and engine package. Evidence: completed VFX row. - [ ] I0.14.v Reconcile UI/HUD outputs independently, including platform/ resolution/state/components/icons/text/localization/accessibility/ interaction, style consistency, atlas/vector/source delivery, and rights. Evidence: completed UI/HUD row. - [ ] I0.14.w Reconcile storyboard outputs independently, including script/ shot/scene/panel IDs, composition/action/dialogue/camera/timing/notes, continuity, revision, accessibility, and editorial package. Evidence: completed storyboard row. - [ ] I0.14.x Reconcile animatic outputs independently, including ordered panels/shots, timing/camera/transitions/dialogue/music/SFX/temp media/ captions, EDL/timecode, review, and editorial export. Evidence: completed animatic row. - [ ] I0.14.y Reconcile cinematic outputs independently, including sequence/ shots/cameras/animation/lighting/VFX/audio/titles/captions/color/ delivery, render jobs, editorial/DCC/engine package, and release gates. Evidence: completed cinematic row. - [ ] I0.14.z Reconcile marketing outputs independently, including campaign/ channel/audience/territory/format/copy/brand/rights/disclosure/ accessibility/approval/variant tracking and delivery. Evidence: completed marketing row. - [ ] I0.14.aa Reconcile social outputs independently, including platform/ placement/dimensions/duration/safe area/caption/audio/copy/hashtags/ accessibility/moderation/rights/schedule and derivatives. Evidence: completed social row. - [ ] I0.14.ab Reconcile audio-SFX outputs independently, including event/ category/material/action/perspective/variation/duration/sample/channel/ loop/loudness/metadata/rights and engine package. Evidence: completed audio-SFX row. - [ ] I0.14.ac Reconcile voice-line outputs independently, including character/ speaker/actor consent/language/text/pronunciation/emotion/timing/takes/ processing/loudness/caption/localization and engine package. Evidence: completed voice-line row. - [ ] I0.14.ad Reconcile music-cue outputs independently, including brief/ scene/mood/style/key/tempo/meter/duration/structure/stems/loop/hit points/ mix/master/rights and engine/editorial package. Evidence: completed music-cue row. - [ ] I0.14.ae Validate that every asset-family row independently names its audience, authorized host, workflow/template, typed controls, output contract/bundle, preview/semantic alternative, quality profile, safety/ rights/provenance gates, downstream handoff, and release/exclusion. Evidence: zero incomplete matrix rows. - [ ] I0.15 Reconcile every consistency and conditioning mode: seed and latent reuse; identity, style, wardrobe, prop, scene, lighting, palette, lens, camera, pose, depth, temporal, and motion locks; ControlNet pose/depth/ canny/line-art/segmentation/normal; IP-Adapter style/face; InstantID; open-pose sequences; camera paths; motion vectors; masks; reference ensembles; and multi-control blends. Evidence: per-mode audience exposure, typed contract, diagnostics, gate, and unsupported-state matrix. - [ ] I0.15.a Reconcile seed reuse with provider/workflow/version scope, deterministic limits, exposure by audience, replay provenance, diagnostics, and unsupported behavior. Evidence: seed row. - [ ] I0.15.b Reconcile latent reuse with latent format/model/workflow/version/ storage/privacy scope, compatibility, audience restriction, diagnostics, and reproducibility. Evidence: latent row. - [ ] I0.15.c Reconcile identity lock with consent/biometric/reference/ embedding/strength/scope/version, drift measures, impersonation gates, and audience policy. Evidence: identity-lock row. - [ ] I0.15.d Reconcile style lock with reference/licensing/artist-style policy, adapter/embedding/strength/scope, consistency diagnostics, and audience exposure. Evidence: style-lock row. - [ ] I0.15.e Reconcile wardrobe lock with garment/accessory/material/color/ era references, character/shot scope, occlusion/fit diagnostics, and variant behavior. Evidence: wardrobe-lock row. - [ ] I0.15.f Reconcile prop lock with prop identity/scale/material/state/ placement/interaction references, shot scope, diagnostics, and failure behavior. Evidence: prop-lock row. - [ ] I0.15.g Reconcile scene lock with environment/layout/object/spatial/ weather/time references, shot/sequence scope, diagnostics, and change control. Evidence: scene-lock row. - [ ] I0.15.h Reconcile lighting lock with source/rig/HDRI/time/exposure/color/ shadow references, shot/sequence scope, diagnostics, and target color profile. Evidence: lighting-lock row. - [ ] I0.15.i Reconcile palette lock with color list/space/roles/tolerance/ source, local/global scope, accessibility/brand constraints, and drift metrics. Evidence: palette-lock row. - [ ] I0.15.j Reconcile lens lock with focal length/sensor/FOV/distortion/ aperture/focus and camera/model/shot scope, unit validation, and diagnostics. Evidence: lens-lock row. - [ ] I0.15.k Reconcile camera lock with pose/path/orientation/intrinsics/ framing/stabilization/coordinate system and shot/sequence scope. Evidence: camera-lock row. - [ ] I0.15.l Reconcile pose lock with skeleton/keypoints/confidence/visibility/ proportions/contact, actor/character/shot scope, diagnostics, and accessibility alternative. Evidence: pose-lock row. - [ ] I0.15.m Reconcile depth lock with depth type/units/range/confidence/ occlusion/resolution/camera alignment, normalization, diagnostics, and unsupported state. Evidence: depth-lock row. - [ ] I0.15.n Reconcile temporal lock with frame/shot identity, cadence/time base, consistency window, memory/reference state, flicker/drift metrics, and reset behavior. Evidence: temporal-lock row. - [ ] I0.15.o Reconcile motion lock with optical flow/trajectory/velocity/ acceleration/camera-vs-object/masks/time base, diagnostics, and failure state. Evidence: motion-lock row. - [ ] I0.15.p Reconcile ControlNet pose conditioning with preprocessor/model/ version, keypoint schema, strength/range, resolution, diagnostics, license, and audience. Evidence: ControlNet-pose row. - [ ] I0.15.q Reconcile ControlNet depth conditioning with estimator/model/ version, units/normalization/alignment, strength/range, diagnostics, and audience. Evidence: ControlNet-depth row. - [ ] I0.15.r Reconcile ControlNet canny conditioning with threshold/aperture/ resolution/inversion/strength/schedule, diagnostics, and typed preview. Evidence: ControlNet-canny row. - [ ] I0.15.s Reconcile ControlNet line-art conditioning with preprocessor/ style/model/version/resolution/strength/schedule, preview, and diagnostics. Evidence: ControlNet-line-art row. - [ ] I0.15.t Reconcile ControlNet segmentation conditioning with vocabulary/ class map/palette/model/version/unknown class/strength, semantic preview, and diagnostics. Evidence: ControlNet-segmentation row. - [ ] I0.15.u Reconcile ControlNet normal conditioning with coordinate system/ range/encoding/camera alignment/model/version/strength, 3D preview, and diagnostics. Evidence: ControlNet-normal row. - [ ] I0.15.v Reconcile IP-Adapter style conditioning with reference rights/ preprocessing/embedding/model/version/weight/schedule/masking, style policy, and diagnostics. Evidence: IP-Adapter-style row. - [ ] I0.15.w Reconcile IP-Adapter face conditioning with identity consent/ face detection/embedding/model/version/weight/masking, impersonation/ biometric gates, and diagnostics. Evidence: IP-Adapter-face row. - [ ] I0.15.x Reconcile InstantID with identity image/landmarks/embedding/ adapter/control versions/strength, consent/impersonation/biometric policy, and identity drift metrics. Evidence: InstantID row. - [ ] I0.15.y Reconcile open-pose sequences with keypoint/skeleton schema, frame rate/time base/interpolation/confidence/person tracking, sequence preview, and temporal diagnostics. Evidence: open-pose row. - [ ] I0.15.z Reconcile camera paths with coordinate system/keyframes/ interpolation/lens/time base/collision/constraints, 3D and timeline preview, and downstream export. Evidence: camera-path row. - [ ] I0.15.aa Reconcile motion vectors with encoding/coordinate space/units/ scale/direction/time base/resolution/occlusion, visualization, and validation. Evidence: motion-vector row. - [ ] I0.15.ab Reconcile masks with source/semantic role/format/alpha/ resolution/alignment/feather/invert/animation/lifecycle, visual preview, and privacy/safety constraints. Evidence: mask row. - [ ] I0.15.ac Reconcile reference ensembles with ordered refs/roles/weights/ conflicts/rights/consent/compatibility, per-reference influence/ exclusion diagnostics, and lineage. Evidence: ensemble row. - [ ] I0.15.ad Reconcile multi-control blends with typed control set/weights/ schedules/masks/precedence/conflict/capacity, component/aggregate diagnostics, and unsupported combinations. Evidence: multi-control row. - [ ] I0.15.ae Validate every mode independently for audience/host exposure, typed inputs/units/version, provider/workflow compatibility, preview/ diagnostics, raw values/gates, provenance/rights/consent, and explicit unsupported/not-configured/degraded behavior. Evidence: zero incomplete mode rows. - [ ] I0.16 Reconcile specialized 3D capabilities in `libs/isis/*`: scene from image, part-level and semantic/text mesh editing, AI texturing, PBR relighting, mesh transformers, quad meshing, model fine-tuning, video-to-mesh, score distillation, advanced/diffusion-edited Gaussian splats, gigascale scenes, asset browsing/marketplace, and universal rigging. Evidence: each capability is explicitly exposed, operationally projected, retained, retired, or excluded. - [ ] I0.16.a Reconcile scene-from-image generation independently: source/ camera/depth/segmentation/scale assumptions, scene graph/geometry/ material outputs, uncertainty, preview, provenance/rights, validation, target formats, audience/host, and disposition. Evidence: scene-from- image capability row. - [ ] I0.16.b Reconcile part-level mesh editing independently: stable part/ topology/selection identity, local operation/mask/constraint, boundary/ UV/skin/material preservation, preview/diff/undo, validation, and disposition. Evidence: part-edit row. - [ ] I0.16.c Reconcile semantic/text mesh editing independently: typed edit intent/target/strength/constraints, ambiguous target clarification, geometry/topology/material/rig impact, variants, provenance, quality, and disposition. Evidence: semantic mesh-edit row. - [ ] I0.16.d Reconcile AI texturing independently: mesh/UV/material inputs, prompt/reference/rights, texture set/channels/resolution/UDIM/color/ tiling, seam consistency, preview, PBR gates, and disposition. Evidence: AI-texturing row. - [ ] I0.16.e Reconcile PBR relighting independently: geometry/material/ normals/environment/light rig/camera/color inputs, relit maps/renders, energy/material consistency, preview, and disposition. Evidence: PBR-relighting row. - [ ] I0.16.f Reconcile mesh-transformer capabilities independently: supported model/task/version/input/output/topology/scale limits, resource/cost, quality/compatibility/rights/provenance, preview, and disposition. Evidence: mesh-transformer row. - [ ] I0.16.g Reconcile quad meshing independently: source mesh/point/splat, target density/flow/symmetry/boundaries/features, UV/material/rig preservation, topology metrics, preview, downstream DCC, and disposition. Evidence: quad-meshing row. - [ ] I0.16.h Reconcile 3D model fine-tuning independently: dataset/license/ consent/provenance, architecture/base/version, training parameters/ resource/cost, checkpoints/evaluation, promotion/quarantine, and disposition. Evidence: model fine-tuning row. - [ ] I0.16.i Reconcile video-to-mesh independently: video/camera/calibration/ time/mask inputs, reconstruction scope, geometry/texture/animation/ confidence outputs, identity/biometric/rights, quality, and disposition. Evidence: video-to-mesh row. - [ ] I0.16.j Reconcile score-distillation capabilities independently: representation/camera/render/diffusion/model/version/objective/optimizer/ seeds/resource inputs, intermediate/final artifacts, reproducibility, safety/rights, evaluation, and disposition. Evidence: score-distillation row. - [ ] I0.16.k Reconcile advanced and diffusion-edited Gaussian splats independently: source/camera/splat/model/edit/mask inputs, coordinate/ SH/compression outputs, temporal/spatial/artifact/privacy gates, preview/interchange, and disposition. Evidence: advanced-splat row. - [ ] I0.16.l Reconcile gigascale scene capabilities independently: tiling/ streaming/LOD/spatial index/resolver/coordinate/precision/distributed build, resource/cost, preview, integrity/performance, export, and disposition. Evidence: gigascale scene row. - [ ] I0.16.m Reconcile asset browsing/marketplace independently: catalog/ search/filter/preview/license/price/entitlement/provenance/import/ dependency/update/revocation/attribution, provider trust, audience, and disposition. Evidence: asset-marketplace row. - [ ] I0.16.n Reconcile universal rigging independently: source mesh/ skeleton/archetype/landmarks, auto joints/weights/controls/retarget/ constraints, target rigs/formats, deformation metrics, preview, and disposition. Evidence: universal-rigging row. - [ ] I0.16.o Validate every 3D capability row names owner/package/consumer, audience/host, typed contract, provider/job/resource, persistence/ lineage, UI/API/operational projection, rights/safety/privacy, quality/ compatibility/interchange, tests, and one approved disposition. Evidence: zero incomplete 3D rows. - [ ] I0.17 Reconcile specialized image/video/audio capabilities: portrait and face synthesis, relighting, fast generation, AnimateDiff Lightning, Florence-2 analysis, live preview, camera/motion control, AV narrative, video editing/object removal, NVIDIA RTX/RIFE/Topaz enhancement, visual dubbing, foley, TTS, text-to-audio, voice cloning, music, and conversational audio. Evidence: each capability has a host, consent/right policy, typed controls, preview, lineage, gates, and release path or explicit exclusion. - [ ] I0.17.a Reconcile portrait synthesis independently: subject/context/ style/pose/wardrobe/background references, consent/biometric/public- figure policy, identity/anatomy/quality, disclosure/provenance, host, and release/disposition. Evidence: portrait row. - [ ] I0.17.b Reconcile face synthesis independently: identity/attribute/ expression/age/pose/lighting controls, detection/embedding, consent/ impersonation/child safety, artifact/identity metrics, watermark/ provenance, audience, and disposition. Evidence: face row. - [ ] I0.17.c Reconcile image relighting independently: image/depth/normal/ mask/environment/light/camera/color inputs, shadow/specular/material/ identity preservation, diagnostics, preview, and disposition. Evidence: relighting row. - [ ] I0.17.d Reconcile fast-generation paths independently: model/distillation/ quantization/step/scheduler/provider/version, quality/latency/cost trade- offs, unsupported controls, tier exposure, provenance, and disposition. Evidence: fast-generation row. - [ ] I0.17.e Reconcile AnimateDiff Lightning independently: base model/ motion module/version/workflow/frame/rate/duration/seed/conditioning, temporal quality/flicker, license/provenance, preview, and disposition. Evidence: AnimateDiff row. - [ ] I0.17.f Reconcile Florence-2 analysis independently: supported caption/ detection/grounding/OCR/segmentation tasks, model/version, input/output schema/confidence, privacy/safety, evaluator limits, host, and disposition. Evidence: Florence-2 row. - [ ] I0.17.g Reconcile live preview independently: progressive/intermediate/ low-res/stream protocol, cancellation/backpressure/cost, unsafe/unscanned content containment, ephemeral retention, accessible alternative, and audience. Evidence: live-preview row. - [ ] I0.17.h Reconcile camera/motion control independently: camera path/lens/ pose/depth/flow/vector/reference/time controls, model/workflow compatibility, diagnostics/preview, and disposition. Evidence: camera-motion row. - [ ] I0.17.i Reconcile audiovisual narrative generation independently: script/scene/shot/character/dialogue/camera/image/video/voice/music/SFX/ captions/timecode dependencies, continuity, rights/safety, bundles, and disposition. Evidence: AV-narrative row. - [ ] I0.17.j Reconcile video editing independently: trim/split/reorder/ extend/inpaint/replace/style/color/frame-rate/upscale/audio/caption operations, source preservation, timeline/preview, provenance, quality, and disposition. Evidence: video-editing row. - [ ] I0.17.k Reconcile video object removal independently: object/mask/track/ occlusion/background/motion inputs, temporal fill consistency, protected evidence/manipulation policy, preview/diff, and disposition. Evidence: object-removal row. - [ ] I0.17.l Reconcile NVIDIA RTX processing independently: supported SDK/ model/operation/GPU/driver/version, inputs/outputs, latency/quality/ resource/cost, host licensing, diagnostics, and disposition. Evidence: RTX row. - [ ] I0.17.m Reconcile RIFE interpolation independently: implementation/ model/version/input/output frame rates/time base/scene cuts/artifacts/ audio sync, quality/latency, preview, and disposition. Evidence: RIFE row. - [ ] I0.17.n Reconcile Topaz enhancement independently: product/model/version/ license/host/provider, upscale/denoise/sharpen/frame operations, parameters/outputs, quality/artifact/cost, provenance, and disposition. Evidence: Topaz row. - [ ] I0.17.o Reconcile visual dubbing independently: source video/audio/ transcript/translation/voice/face/timing, speaker identity/consent, lip-sync/translation/audio metrics, captions/disclosure/provenance, and disposition. Evidence: visual-dubbing row. - [ ] I0.17.p Reconcile foley generation independently: scene/action/material/ event/time/perspective/variation prompts, audiovisual sync, source/ training rights, audio technical/quality gates, package, and disposition. Evidence: foley row. - [ ] I0.17.q Reconcile TTS independently: text/SSML/language/voice/style/ pronunciation/timing/output controls, voice license/consent/disclosure, safety/quality/accessibility, and disposition. Evidence: TTS row. - [ ] I0.17.r Reconcile text-to-audio independently: prompt/category/duration/ scene/timing/variation/loop/sample/channel controls, safety/rights/ originality, technical quality, provenance, and disposition. Evidence: text-to-audio row. - [ ] I0.17.s Reconcile voice cloning independently: enrollment samples/ identity verification/consent/purpose/locale/quality, embedding/model/ retention/revocation, impersonation/disclosure/watermark, access, and disposition. Evidence: voice-cloning row. - [ ] I0.17.t Reconcile music generation independently: brief/genre/style/ artist-policy/key/tempo/meter/structure/instrument/duration/stems/lyrics/ seed controls, originality/rights/quality, provenance, and disposition. Evidence: music row. - [ ] I0.17.u Reconcile conversational audio independently: participants/ voices/roles/script/turns/interruptions/emotion/timing/room/SFX/music/ captions, voice consent/safety, streaming/cancel, and disposition. Evidence: conversational-audio row. - [ ] I0.17.v Validate every media capability for owner/package, audience/host, typed controls/contracts, provider/workflow/job, live preview/semantic alternative, lineage/provenance, consent/rights/safety/privacy, raw quality diagnostics/gates, bundles/publish/recall, tests, and approved release or exclusion. Evidence: zero incomplete media rows. - [ ] I0.18 Reconcile the existing operator-only parity monitors, feature flags, audit log, RunPod topology, model/workflow parity, API parity, entitlement, anomaly, chargeback, marketplace, monetization, resource recommendation, and collection surfaces. Evidence: route-by-route keep, merge, retire, and live-data disposition. - [ ] I0.18.a Reconcile generation-type parity monitors: authoritative type/ capability sources, expected versus implemented provider/workflow/UI/ contract coverage, divergence/freshness, owner, and disposition. Evidence: generation-type route row. - [ ] I0.18.b Reconcile workflow parity monitors: registry/graph/template/ version/node/provider/host expected versus deployed coverage, mismatch/ drift/unsupported state, and disposition. Evidence: workflow parity row. - [ ] I0.18.c Reconcile model/model-version parity monitors: registry/artifact/ provider/endpoint/evaluation/promotion/host expected versus actual versions/states and disposition. Evidence: model parity row. - [ ] I0.18.d Reconcile provider API/SDK/UI parity monitors: operations/ request-response/error/capability/version/control exposure and exact missing producer/consumer surface. Evidence: API parity row. - [ ] I0.18.e Reconcile feature-flag surfaces: registry/runtime evaluation/ owner/purpose/audience/default/expiry/rollout/rollback/removal and authorized operator control. Evidence: feature-flag row. - [ ] I0.18.f Reconcile audit-log surfaces: mutation/event/job/provider/ release/emergency coverage, correlation/redaction/integrity/retention/ export/access and live source. Evidence: audit row. - [ ] I0.18.g Reconcile RunPod topology surfaces: accounts/projects/regions/ network volumes/templates/endpoints/pods/workers/GPUs/models/queues/ health/capacity/cost/credentials with safe live probes. Evidence: topology row. - [ ] I0.18.h Reconcile entitlement surfaces: actor/tenant/project/plan/license/ asset/workflow/model/provider/quota/territory/time rights, decision provenance, enforcement, and appeal. Evidence: entitlement row. - [ ] I0.18.i Reconcile anomaly surfaces: signal/model/rule/version/baseline/ confidence/threshold/category, affected provider/job/cost/quality/ security, triage/alert/ack/resolution, and false-positive handling. Evidence: anomaly row. - [ ] I0.18.j Reconcile chargeback surfaces: usage/rate-card/allocation/ estimate/reservation/actual/variance/invoice/project/tenant/provider/ resource attribution, correction, export, and access. Evidence: chargeback row. - [ ] I0.18.k Reconcile marketplace surfaces: provider/vendor/asset/model/ workflow/license/price/entitlement/trust/security/rights/provenance/ compatibility/install/update/revoke and disposition. Evidence: marketplace row. - [ ] I0.18.l Reconcile monetization surfaces: offer/plan/price/currency/tax/ entitlement/quota/metering/billing/refund/revenue share/territory/ disclosure and product-boundary approval. Evidence: monetization row. - [ ] I0.18.m Reconcile resource-recommendation surfaces: workload/model/ quality/latency/budget/capacity inputs, candidates, raw estimates/ confidence/reasons, policy/floors, reservation, actual comparison, and no auto-dispatch. Evidence: recommendation row. - [ ] I0.18.n Reconcile collection surfaces: collection/member/relation/order/ taxonomy/eligibility/audience/owner/lifecycle/search/bulk/export/ publisher and operator-only versus creator exposure. Evidence: collection row. - [ ] I0.18.o For each route assign canonical host/owner/audience, live API/ store/provider, fixture/degraded states, keep/refactor/merge/retire/ redirect decision, migration, tests, and evidence. Evidence: zero undispositioned operator routes. - [ ] I0.19 Reconcile every output/interchange format and package, including PNG, JPEG, WebP, TIFF, EXR, MP4, MOV, WAV, FLAC, OBJ, FBX, glTF/GLB, USD, Alembic, Gaussian-splat/SPZ, manifests, EDL/shot packages, DCC bundles, and engine bundles. Evidence: each supported format maps contract, metadata, preview, deterministic naming, integrity, provenance, quality, downstream ingest, loss profile, and authorized host; unsupported formats are explicit. - [ ] I0.19.a Reconcile PNG support: color type/depth/profile/alpha/metadata/ animation applicability, limits, preview, deterministic encoding/name, hash/provenance, rights/quality, ingest, and loss profile. Evidence: PNG row. - [ ] I0.19.b Reconcile JPEG support: profile/quality/subsampling/color/EXIF/ orientation/metadata limits, preview, deterministic encoding/name, hash/provenance, rights/quality, ingest, and lossy behavior. Evidence: JPEG row. - [ ] I0.19.c Reconcile WebP support: lossless/lossy/quality/alpha/animation/ color/metadata limits, preview, deterministic encoding/name, integrity/ provenance, ingest, and loss profile. Evidence: WebP row. - [ ] I0.19.d Reconcile TIFF support: classic/BigTIFF, pages/layers, bit depth/ sample format/compression/color/alpha/metadata limits, preview, naming, integrity/provenance, ingest, and loss. Evidence: TIFF row. - [ ] I0.19.e Reconcile EXR support: version/compression/channels/layers/ half-float/full-float/color/metadata/tile-scanline/deep applicability, preview/tonemap, naming, integrity/provenance, ingest, and loss. Evidence: EXR row. - [ ] I0.19.f Reconcile MP4 support: container/codec/profile/level/bitrate/ resolution/frame rate/color/HDR/audio/subtitles/timecode/metadata, preview, deterministic transcode/name, integrity/provenance, ingest, and loss. Evidence: MP4 row. - [ ] I0.19.g Reconcile MOV support: QuickTime container/codecs/profiles/ ProRes/alpha/timecode/tracks/color/HDR/audio/subtitles/metadata, preview, deterministic transcode/name, integrity/provenance, ingest, and loss. Evidence: MOV row. - [ ] I0.19.h Reconcile WAV support: RIFF/RF64, PCM/float, sample rate/depth/ channels/layout/BWF/timecode/metadata, audition/waveform, deterministic encoding/name, integrity/provenance, ingest, and lossless behavior. Evidence: WAV row. - [ ] I0.19.i Reconcile FLAC support: version/level/sample rate/depth/channels/ compression/metadata/cues/pictures, audition/waveform, deterministic encoding/name, integrity/provenance, ingest, and lossless behavior. Evidence: FLAC row. - [ ] I0.19.j Reconcile OBJ support: vertices/normals/UVs/faces/groups/ materials/MTL/textures/units/axes/naming/encoding/limits, preview, integrity/provenance, ingest/round-trip, and known loss. Evidence: OBJ row. - [ ] I0.19.k Reconcile FBX support: supported versions/binary-text, units/ axes/hierarchy/geometry/materials/textures/skeleton/skin/animation/ cameras/lights/custom props, preview, deterministic constraints, integrity/provenance, ingest, and loss. Evidence: FBX row. - [ ] I0.19.l Reconcile glTF/GLB support: version/extensions/buffers/images/ geometry/materials/PBR/skins/animation/cameras/lights/units/axes/ compression, preview, validation, naming, integrity/provenance, ingest, and loss. Evidence: glTF/GLB row. - [ ] I0.19.m Reconcile USD support: profile/version/file formats/layers/ composition/variants/payloads/refs/resolver/schemas/units/axes/materials/ skeleton/animation, preview, `usdchecker`, deterministic packaging, integrity/provenance, target ingest, and loss. Evidence: USD row. - [ ] I0.19.n Reconcile Alembic support: version/archive type/units/axes/ hierarchy/geometry/topology/UV/normals/attributes/cameras/animation/time sampling/compression, preview, integrity/provenance, ingest, and known loss. Evidence: Alembic row. - [ ] I0.19.o Reconcile Gaussian-splat/SPZ support: version/coordinate/ positions/scales/rotations/opacity/SH/cameras/compression/count/limits/ privacy, spatial preview, validation, naming, integrity/provenance, target ingest, and loss. Evidence: splat/SPZ row. - [ ] I0.19.p Reconcile manifest support: schema/version/profile/IDs/refs/ hashes/media/metadata/dependencies/rights/consent/gates/provenance/ signatures/compatibility, deterministic serialization/name, validation, import, and losslessness. Evidence: manifest row. - [ ] I0.19.q Reconcile EDL/shot packages: EDL/XML/AAF/OTIO or supported profile, sequence/shot/clip IDs, source refs, timecode/rate, handles/ transitions/tracks/audio/metadata/assets/manifests, validation, round-trip, and known loss. Evidence: editorial-package row. - [ ] I0.19.r Reconcile DCC bundles: target app/version/plugins, project/ scene/assets/refs/resolver/cache/textures/fonts/scripts policy, manifest/lock/SBOM/provenance, deterministic layout, sandbox validation, import/round-trip, and loss. Evidence: DCC-bundle row. - [ ] I0.19.s Reconcile engine bundles: target engine/version/platform/ renderer/plugins, assets/import settings/metadata/LODs/collision/ materials/rig/animation/audio/code policy, manifest/dependencies/ provenance, deterministic layout, validation, ingest, and loss. Evidence: engine-bundle row. - [ ] I0.19.t For every format/profile assign supported import/export/ preview/publish direction, asset kinds/audiences/hosts, authoritative contract/schema/validator, limits/security, naming/integrity/provenance/ quality, dependency packaging, round-trip/loss policy, version/ deprecation, and explicit unsupported behavior. Evidence: zero incomplete format rows. - [ ] I0.20 Crosswalk Phase I against `ISIS_CHROMA_RUNPOD_MVP_TODOS_2026-09-11.md` before any I6–I9 cell is started. Added 2026-09-18 by the board specification audit: that tracker has built, since 2026-09-11 and with no reference to this ledger, the RunPod endpoints, spend governor, model library and cache, Civitai intake and licence register, job/output pages in `apps/isis/web`, and a 3D workspace plan (T.15) — the same ground as I6.6, I7.1, I7.3, I7.5, I7.13, I7.18 and I7.19 here. Evidence: a committed crosswalk table under `evidence/v1-workbenches/isis/` with one row per I6–I9 parent, in the merged / superseded / independent / split vocabulary of Isis ADR-0008. - [ ] I0.20.a List every checked item of the Isis tracker's C, V, A, L, E, H and T sections that ships code in `apps/isis/web`, `apps/isis/generation-api` or `libs/isis/*`, with the path it shipped. Evidence: shipped-surface rows keyed by tracker id. - [ ] I0.20.b For each I6–I9 parent, record whether an Isis-tracker item already delivers it in whole (superseded), in part (split, naming the remainder), under a different design (merged, naming which design wins and why), or not at all (independent). Evidence: zero unmapped I6–I9 parents. - [ ] I0.20.c Re-run the I0.3 page map over the `apps/isis/web` pages added after the BASE.1 inventory SHA, so keep/refactor/merge/retire covers them. Evidence: I0.3 rows cite the refreshed inventory SHA. - [ ] I0.20.d Record the reverse direction in the Isis tracker: every open T, E and F item that adds a page or an API to those paths names the I-cell it satisfies or states that none applies. Evidence: the Isis tracker's open dashboard items (T.15, T.22.06, E.01.02, E.02.04, F.20.03) carry the reference. ### I1 — Canonical generation-control model - [ ] I1.1 Verify the canonical workflow-template state machine against current contracts. Evidence: code-derived state diagram and known-value tests. - [x] I1.1.a Inventory workflow/template status enums, transition commands, guards, APIs, persistence, events/jobs, operator UI, and tests from current code/contracts. Evidence: source mapping. - [x] I1.1.b Generate the implemented state/transition/guard/actor/side-effect diagram from authoritative definitions. Evidence: code-derived diagram. - [x] I1.1.c Reconcile draft/review/approved/active/deprecated/revoked/ archived and any current states with the intended lifecycle. Evidence: state disposition table. - [x] I1.1.d Verify create/edit/submit/review/approve/activate/deprecate/revoke/ archive/restore/version transitions and exact authorization/guards. Evidence: transition matrix. - [ ] I1.1.e Test invalid source/target, missing evidence, stale revision, incompatible dependency, revoked model/node, in-use template, and unauthorized/system actor. Evidence: known-value negative tests. - [ ] I1.1.f Verify immutable version/history/audit/event/active-run/release effects and no direct status write bypass. Evidence: integration tests. - [x] I1.1.g Resolve contract/code/UI drift and fail on future state/transition additions without tests/diagram update. Evidence: drift gate. - [ ] I1.2 Verify the canonical model and model-version state machines. Evidence: invalid promotion, deprecation, and archive paths fail. - [x] I1.2.a Inventory model and model-version states/transitions/guards/ contracts/stores/events/jobs/UI/tests independently. Evidence: source mapping. - [x] I1.2.b Define model identity/ownership/license/risk/supported task/ lifecycle separately from immutable version/checkpoint/artifact/ evaluation/provider compatibility. Evidence: boundary review. - [ ] I1.2.c Verify model draft/review/approved/active/deprecated/revoked/ archived lifecycle and model-level default/current version semantics. Evidence: model state tests. - [ ] I1.2.d Verify version intake/quarantine/scan/evaluate/approve/promote/ active/deprecate/revoke/archive transitions and actor/guard requirements. Evidence: model-version state tests. - [ ] I1.2.e Prevent promotion without hash/signature/source/license/security/ safety/quality/compatibility evidence or with stale/missing results. Evidence: promotion negative tests. - [ ] I1.2.f Prevent deprecation/archive/revoke that strands active workflows/ endpoints/runs/releases without replacement/impact/recall/migration. Evidence: dependency guard tests. - [ ] I1.2.g Verify immutable version artifacts/lineage/audit/events and no direct status or current-version bypass. Evidence: real integration tests. - [ ] I1.3 Verify provider-endpoint lifecycle and health semantics. Evidence: state/health combinations have deterministic dispatch eligibility. - [x] I1.3.a Inventory endpoint configuration/lifecycle/health/circuit/ maintenance/capability/capacity states, probes, routing, APIs/stores/UI, and tests. Evidence: source mapping. - [x] I1.3.b Define configured/unconfigured/validating/ready/draining/ maintenance/disabled/retired lifecycle and authorized transitions. Evidence: lifecycle state machine. - [x] I1.3.c Define probe unknown/healthy/degraded/unhealthy/unavailable/ incompatible/stale states with checked time, latency/error/capacity/ supported operation/model detail. Evidence: health contract. - [x] I1.3.d Define circuit closed/open/half-open and throttle/quota/capacity/ regional/license/dependency state separately from health. Evidence: dispatch input schema. - [x] I1.3.e Produce a deterministic eligibility/routing/refusal reason table for every lifecycle×health×circuit×maintenance×capability×capacity combination. Evidence: truth table tests. - [ ] I1.3.f Recheck endpoint state/health/capacity/model compatibility/ entitlement/budget at dispatch reservation and handle races. Evidence: dispatch integration tests. - [ ] I1.3.g Verify drain/disable/maintenance/failover/recovery behavior for queued/in-flight/retry work and unknown external outcomes. Evidence: fault tests. - [x] I1.4 Define a generation brief with intent, audience, asset kind, locale, references, rights assertions, safety context, quality targets, budget, and delivery target. Evidence: schema invariants. - [x] I1.4.a Define stable brief ID/version, tenant/project/parent context, author/delegate, lifecycle, base revision, title/summary, and created/updated metadata. Evidence: brief identity schema. - [x] I1.4.b Define structured creative/production intent, goal/non-goals, subject/content/action/context/style/tone, required/excluded elements, and domain extension blocks. Evidence: intent fixtures. - [x] I1.4.c Define audience/tier/end user/age/region/channel/purpose/ sensitivity and verify it against actor/host entitlement. Evidence: audience tests. - [x] I1.4.d Define asset-kind/profile/operation/count/variant/group/ composite relationship and kind-specific typed control selection. Evidence: asset-kind invariant tests. - [x] I1.4.e Define content/UI/source/target locale/language/script/direction/ cultural context and localizable versus stable identifiers. Evidence: locale tests. - [x] I1.4.f Define ordered reference roles/weights/scopes/hashes/versions/ rights/consent/provenance/availability and conditioning bindings. Evidence: reference fixtures. - [x] I1.4.g Define rights/license/ownership/attribution/territory/term/ derivative/training/publication assertions as claims requiring evidence, not client truth. Evidence: rights validation tests. - [x] I1.4.h Define safety context for people/identity/age/biometric/voice/ sensitive content/policy/risk/reviewer/consent and required restrictions. Evidence: safety fixtures. - [x] I1.4.i Define asset/delivery-specific raw quality targets/units/ thresholds/tolerance/priorities/evaluator/profile versions and unavailable behavior. Evidence: quality target tests. - [x] I1.4.j Define currency/rate-card/estimate ceiling/tenant-project budget/ latency/resource/carbon or other approved constraints without fabricated cost. Evidence: budget tests. - [x] I1.4.k Define delivery target/host/channel/territory/environment/format/ profile/dimensions/time/audio/3D package/naming/deadline/embargo/ publisher and compatibility. Evidence: delivery target tests. - [x] I1.4.l Enforce cross-field authorization/compatibility/safety/rights/ budget/quality/delivery invariants and retain valid/invalid/full fixtures. Evidence: schema invariant suite. - [x] I1.5 Define a resolved generation plan distinct from the user brief. Evidence: plan records workflow/model/provider choices and every reason. - [x] I1.5.a Define immutable plan ID/version, originating exact brief revision, resolver/policy/catalog versions, actor/job/time, status, expiry, and plan hash. Evidence: plan identity schema. - [x] I1.5.b Record normalized intent and every default/derived/unsupported/ constrained field separately from user-authored brief values. Evidence: brief-to-plan mapping tests. - [x] I1.5.c Record chosen workflow/template/version/graph/class/node/ parameter profile and compatible alternatives/rejections with reasons. Evidence: workflow decision fixtures. - [x] I1.5.d Record chosen model/version/checkpoint/adapter/LoRA/scheduler/ preprocessor/evaluator and alternatives/rejections with compatibility/ policy reasons. Evidence: model decision fixtures. - [x] I1.5.e Record chosen provider/endpoint/region/resource/queue/failover/ priority/capacity reservation and alternatives/rejections with health/ entitlement/latency/cost reasons. Evidence: provider decision fixtures. - [x] I1.5.f Record transformed/resolved inputs/references/conditioning, output kinds/counts/formats/bundles, post-processing, gates/review/ provenance/watermark/publisher steps. Evidence: execution graph. - [x] I1.5.g Record per-stage estimate/reservation, resource/time/cost ranges, uncertainty, budget checks, and stop conditions. Evidence: plan budget tests. - [x] I1.5.h Validate plan against current actor/tier/host, contracts/versions, compatibility, config/health, rights/consent/safety, capacity/budget, and delivery before approval/dispatch. Evidence: invalid plan tests. - [x] I1.5.i Keep plans immutable and create linked replan versions when any brief/dependency/policy/provider/capacity/target input changes. Evidence: replan lineage tests. - [x] I1.6 Define immutable generation execution records. Evidence: seed, parameters, inputs, policy, provider response, costs, outputs, and timings are retained. - [x] I1.6.a Define execution/run/attempt/stage IDs, exact plan/brief revisions, actor/tenant/project/host/tier, job/correlation/trace, lifecycle, and timestamps. Evidence: execution identity schema. - [x] I1.6.b Record resolved workflow/graph/template/node/model/checkpoint/ adapter/LoRA/scheduler/provider/endpoint/resource/environment/container/ dependency versions. Evidence: runtime provenance tests. - [x] I1.6.c Record seed/subseeds/latent refs and exact typed stage parameters/ defaults/derived values with units and immutable hashes. Evidence: parameter tests. - [x] I1.6.d Record ordered immutable input/reference/conditioning/mask/ source artifact refs, hashes, roles, transformations, rights/consent, and availability. Evidence: input tests. - [x] I1.6.e Record safety/rights/consent/quality/release policy, threshold, gate/evidence/waiver versions, decisions, and dispatch eligibility. Evidence: policy provenance tests. - [x] I1.6.f Securely retain or reference raw provider request/response/ stream/tool events with IDs/hashes/status/finish/safety/usage/error/ cancellation and normalized adapter version. Evidence: provider record tests. - [x] I1.6.g Record estimate/reservation/actual/refund/variance cost and token/ GPU/CPU/memory/storage/egress/provider/resource usage per stage/attempt. Evidence: cost tests. - [x] I1.6.h Record intermediate/partial/quarantined/rejected/final output refs/hashes/metadata/state/provenance and no-output reason. Evidence: output tests. - [x] I1.6.i Record queued/leased/started/first output/stage/checkpoint/ completed/cancelled/failed/retry/total timing with clock/unit semantics. Evidence: timing tests. - [x] I1.6.j Enforce append-only/immutable attempts with access/retention/ deletion/legal hold and new linked record for corrections/replay. Evidence: immutability/lifecycle tests. - [ ] I1.7 Define output and ingredient lineage. Evidence: composites retain ordered relationships to every source and generated ingredient. - [x] I1.7.a Define lineage node types for source/reference/input, intermediate, generated output, edited derivative, composite, bundle, provenance manifest, and release with exact revision/hash. Evidence: node schema. - [x] I1.7.b Define typed directional ordered edges for uses/conditions/ derives/transforms/composites/mixes/layers/supersedes/publishes with role/weight/mask/time/range/part metadata. Evidence: edge schema. - [ ] I1.7.c Create edges transactionally for ingest, planning, execution stages, post-process, manual edit, variant merge, bundle, promotion, and publication. Evidence: mutation integration tests. - [x] I1.7.d Preserve each duplicate use and ordering/layer/track/shot/part relationship where semantically meaningful without collapsing equal hashes. Evidence: composite fixtures. - [x] I1.7.e Link edge to run/stage/action/tool/model/policy/actor/time and rights/consent/license/attribution/provenance evidence. Evidence: provenance tests. - [x] I1.7.f Traverse exact upstream/downstream paths and compute impact/ recall with cycle/fan-out/depth/pagination and redaction. Evidence: graph tests. - [x] I1.7.g Validate no missing/dangling/cross-tenant/cross-brief-invalid/ hash-mismatched ingredient and represent inaccessible/deleted/unknown honestly. Evidence: integrity tests. - [ ] I1.8 Define variant groups and comparison membership. Evidence: variants cannot cross tenant, brief, or incompatible asset kinds. - [x] I1.8.a Define group ID/version, tenant/project, exact brief revision, purpose/strategy, asset kind/profile, base/source, owner, lifecycle, and limits. Evidence: group schema. - [x] I1.8.b Define member ID/order/label/source manual-or-run/plan/run/output/ revision/hash, state, provenance, created actor/time, and archive. Evidence: member schema. - [x] I1.8.c Validate same tenant/project/authorized scope and exact brief or explicitly compatible fork lineage. Evidence: tenancy/brief negative tests. - [x] I1.8.d Validate asset-kind/profile/semantic/time-base/dimension/channel/ 3D coordinate compatibility or require typed cross-kind adapter. Evidence: compatibility tests. - [x] I1.8.e Support add/remove/reorder/rename/archive/restore/freeze/duplicate/ merge-derived member with expected revision and immutable history. Evidence: lifecycle tests. - [x] I1.8.f Freeze comparison input revisions/hashes/adapters/score/gate versions and represent unavailable/stale/redacted member. Evidence: stable compare tests. - [ ] I1.8.g Link selection/rejection/decision/rationale/evidence and preserve all considered members. Evidence: decision integration tests. - [ ] I1.9 Define quality profiles per asset kind and delivery target. Evidence: thresholds are versioned configuration with code-owned floors. - [x] I1.9.a Define profile ID/version/owner, asset kind/operation, delivery target/profile/environment/audience, applicability, lifecycle, and effective period. Evidence: quality profile schema. - [x] I1.9.b Register raw technical/semantic/aesthetic/temporal/audio/3D/ accessibility/safety/rights/provenance measures with units/direction/ evaluator and nonvalue states. Evidence: measure registry. - [x] I1.9.c Define target-specific thresholds/tolerance/severity/composition/ required evidence/freshness/remediation and human-review bands. Evidence: policy fixtures. - [x] I1.9.d Define immutable code-owned minimum/maximum/fail-closed floors for safety/integrity/compatibility and only allow configuration to tighten. Evidence: loosening negative tests. - [x] I1.9.e Merge global/asset-kind/target/territory/channel/tenant/project policies with field provenance and no ambiguous precedence. Evidence: merge truth tables. - [x] I1.9.f Version changes, invalidate old results where required, retain raw values, and define compatibility/deprecation/migration. Evidence: policy-change tests. - [ ] I1.9.g Calibrate/validate profiles on representative known-value/ boundary/adversarial corpora and obtain domain/target approvals. Evidence: calibration report. - [ ] I1.10 Define release-gate policy composition. Evidence: safety, provenance, watermark, quality, policy, rights, output shape, and review requirements have deterministic precedence. - [x] I1.10.a Define safety gates for content/person/identity/child/biometric/ impersonation/provider policy with nonoverrideable classes and fail- closed unavailable behavior. Evidence: safety gate policy. - [x] I1.10.b Define provenance gates for artifact hash, ingredient/action/ tool/actor completeness, manifest binding/signature/trust/revocation/ recovery and target requirement. Evidence: provenance policy. - [x] I1.10.c Define watermark/disclosure gates for method/profile/presence/ robustness/detectability/accessibility/target/channel and stripped-state fallback. Evidence: watermark policy. - [x] I1.10.d Define asset/target quality gates from raw measures/evaluator/ profile/threshold/freshness and no missing-to-pass. Evidence: quality policy. - [x] I1.10.e Define platform/product/brand/editorial/marketplace/provider/ territory/channel policy gates with exact version and owner. Evidence: policy gate rows. - [x] I1.10.f Define rights/consent/license/attribution/training/derivative/ identity/territory/term/revocation gates with evidence and expiry. Evidence: rights policy. - [x] I1.10.g Define output-shape/format/schema/hash/size/media/technical/ bundle/dependency/target-compatibility gates. Evidence: shape policy. - [x] I1.10.h Define human review/signoff roles/quorum/sequence/COI/step-up/ expiry/staleness and automation prohibition. Evidence: review policy. - [x] I1.10.i Define deterministic precedence/aggregation for blocker/warning/ unavailable/stale/waived/overridden/unsupported/partial across required/ optional and target-specific gates. Evidence: exhaustive truth tables. - [ ] I1.10.j Bind eligibility to exact output/dependency/evaluator/policy/ evidence/waiver/signoff/target versions and audit all reasons. Evidence: composition integration tests. - [x] I1.11 Define model, adapter, LoRA, checkpoint, node, and workflow compatibility constraints. Evidence: incompatible combinations fail planning before dispatch. - [x] I1.11.a Define model family/architecture/task/modality/input-output/ tokenizer/encoder-decoder/precision/quantization/context/license/ provider/runtime compatibility. Evidence: model constraints. - [x] I1.11.b Define adapter type/base architecture/model/version/target modules/dimensions/weights/format/precision/license and stacking/ conflict compatibility. Evidence: adapter constraints. - [x] I1.11.c Define LoRA base model/version/architecture/target modules/rank/ alpha/weight format/trigger/tags/precision/license/style/identity policy and multi-LoRA compatibility. Evidence: LoRA constraints. - [x] I1.11.d Define checkpoint architecture/base/version/format/hash/source/ config/tokenizer/VAE/text encoder/scheduler/precision/license/security compatibility. Evidence: checkpoint constraints. - [x] I1.11.e Define node implementation/type/version/input-output socket/ schema/data type/shape/unit/asset kind/runtime/provider/resource/ determinism/security compatibility. Evidence: node constraints. - [x] I1.11.f Define workflow graph/template/version required/optional nodes/ models/adapters/LoRAs/checkpoints/providers/resources/asset kinds/ audiences/outputs and target constraints. Evidence: workflow constraints. - [x] I1.11.g Implement versioned constraint registry and planner solver that returns exact conflicts/alternatives/unsupported rather than dispatch or implicit conversion. Evidence: planning negative tests. - [x] I1.11.h Test pairwise and multi-component combinations, version skew, missing metadata, unknown extensions, provider capability drift, and post-plan change. Evidence: compatibility fixture matrix. - [ ] I1.12 Define deterministic replay eligibility. Evidence: required artifacts, versions, seeds, and environment dependencies are explicit. - [x] I1.12.a Define replay class: byte-deterministic, semantically reproducible-with-tolerance, provider-best-effort, or nonreplayable with reason. Evidence: replay taxonomy. - [x] I1.12.b Require immutable brief/plan/workflow/graph/node/model/ checkpoint/adapter/LoRA/tool/template/policy/evaluator/corpus/provider versions or hashes. Evidence: version completeness tests. - [x] I1.12.c Require all source/reference/conditioning/mask/latent/ intermediate/artifact bytes and ingredient lineage with hash/access/ retention. Evidence: artifact completeness tests. - [x] I1.12.d Require exact seed/subseed/random generator/algorithm/parameters/ precision/hardware/runtime/container/driver/environment/dependency/ locale/time inputs where applicable. Evidence: environment manifest. - [x] I1.12.e Require provider operation/idempotency/replay support or classify provider nondeterminism/version unavailability honestly. Evidence: provider replay tests. - [x] I1.12.f Validate current authorization/rights/consent/policy/budget/ safety and distinguish technical reproducibility from permitted replay. Evidence: eligibility tests. - [x] I1.12.g Produce missing/inaccessible/expired/revoked/incompatible/ nondeterministic dependencies and expected tolerance/cost before replay. Evidence: replay preview. - [ ] I1.12.h Execute as a new linked run with same inputs/seed where eligible and compare bytes/raw metrics/semantic tolerances/provenance/cost. Evidence: replay known-value tests. - [ ] I1.13 Define artifact promotion across development, test, staging, and production. Evidence: no environment can consume an inadmissible state. - [x] I1.13.a Define environment-specific artifact states, stores/regions/ encryption/credentials, allowed producers/consumers, and immutable identity/hash. Evidence: environment policy. - [x] I1.13.b Define development intake/iteration artifacts and explicit prohibition from test/staging/production consumption without promotion. Evidence: dev isolation tests. - [x] I1.13.c Define test promotion prerequisites for source/hash/schema/ malware/security/license/rights/consent/provenance and reproducible fixture/evaluation. Evidence: test gate. - [x] I1.13.d Define staging promotion prerequisites for approved model/ workflow, representative quality/safety/compatibility/cost/load, target bundle, and release candidate. Evidence: staging gate. - [x] I1.13.e Define production promotion prerequisites for fresh gates, human/signoff, provenance/signature, rights/consent, artifact lock, rollback/recall, and target readiness. Evidence: production gate. - [ ] I1.13.f Copy/replicate exact verified bytes using target-managed credentials, rehash/read-back, record source/destination identity and promotion lineage, and prohibit in-place status relabeling. Evidence: promotion integration tests. - [x] I1.13.g Define reject/quarantine/rollback/demote/revoke/recall/expire and dependent workflow/run/release/cache behavior per environment. Evidence: lifecycle tests. - [x] I1.13.h Test environment credential, URL/ref, API/provider, storage, cache/search, job, and direct-ID bypass plus concurrent source mutation. Evidence: inadmissible consumption negative tests. - [ ] I1.14 Define provenance aggregation for multi-step workflows. Evidence: nested executions produce one verifiable release lineage. - [x] I1.14.a Define workflow/parent-run/child-run/stage/action/artifact/ ingredient/transform relationships and stable ordering/branch/fan-in/ retry identity. Evidence: aggregation graph schema. - [x] I1.14.b Ingest each child/stage raw provider/tool/model/template/policy/ actor/input/output provenance and validate hashes/references before aggregation. Evidence: stage provenance tests. - [x] I1.14.c Preserve shared/reused/duplicate/optional/failed/retried/ compensated/manual edited ingredients and exact selected outputs without flattening lineage. Evidence: complex workflow fixtures. - [x] I1.14.d Compose ordered action/ingredient/tool/actor/policy assertions with field-level source and identify conflicts/missing/unsupported/ redacted data. Evidence: aggregation tests. - [x] I1.14.e Bind aggregate manifest/ledger record to final artifact/bundle bytes and include child manifest/hash refs rather than unbounded content. Evidence: binding tests. - [x] I1.14.f Sign/validate aggregate independently while preserving invalid/ untrusted/revoked child status and preventing a trusted parent from hiding child failure. Evidence: trust composition tests. - [x] I1.14.g Traverse release→final→stages→ingredients and ingredient→all derivatives/release with authorization/redaction/cycle/scale handling. Evidence: lineage query tests. - [ ] I1.14.h Verify rebuild/round-trip/tamper/stripped recovery and exact release eligibility based on complete current lineage. Evidence: end-to-end provenance report. - [x] I1.15 Add canonical contract fixtures for every asset kind. Evidence: fixtures parse through public contracts with no `any` or payload gaps. - [x] I1.15.a Add minimal/full/invalid/boundary/version-skew image brief/plan/ run/output/lineage/gate/release fixtures. Evidence: public contract parse/round-trip tests. - [x] I1.15.b Add portrait fixtures covering identity/reference/consent/ biometric/impersonation and missing/revoked evidence states. Evidence: portrait contract tests. - [x] I1.15.c Add texture fixtures covering PBR channels/UDIM/tiling/color/ material target and unsupported channel/profile. Evidence: texture tests. - [x] I1.15.d Add video fixtures covering frame/time/audio/caption/motion/ codec/delivery and partial/truncated/variable-rate states. Evidence: video tests. - [x] I1.15.e Add audio fixtures covering sample/channel/duration/loudness/ transcript/codec/delivery and nonvalue/error states. Evidence: audio tests. - [x] I1.15.f Add foley fixtures covering event/time/variation/perspective/ sync/loop/package and rights/quality states. Evidence: foley tests. - [x] I1.15.g Add voice fixtures covering speaker/consent/language/SSML/ pronunciation/timing/disclosure/caption and revoke states. Evidence: voice tests. - [x] I1.15.h Add mesh fixtures covering units/axes/geometry/topology/UV/ materials/LOD/collision/formats and invalid/unsupported cases. Evidence: mesh tests. - [x] I1.15.i Add rig fixtures covering hierarchy/joints/skin/controls/ constraints/retarget/target formats and deformation failure. Evidence: rig tests. - [x] I1.15.j Add Gaussian-splat fixtures covering coordinates/cameras/ positions/scales/rotations/opacity/SH/compression/point count/privacy and version failures. Evidence: splat tests. - [x] I1.15.k Add composite-scene fixtures covering hierarchy/refs/variants/ cameras/lights/materials/animation/audio/dependencies/bundles and partial component states. Evidence: scene tests. - [x] I1.15.l Assert every fixture uses branded typed fields, exact units/ discriminators/versions/refs, no `any`/unknown payload bag, public parse/ serialize/round-trip, and expected invalid refusal. Evidence: asset-kind fixture coverage gate. ### I2 — Brief, prompt, workflow, and variant authoring - [x] I2.1 Implement deterministic brief-to-prompt-spec compilation. Evidence: known briefs compile to exact structured specs. - [x] I2.1.a Define versioned `PromptSpec` schema with separated system/policy, positive intent, exclusions, references/conditioning, spatial/temporal/ audio controls, output/delivery constraints, locale, and extensions. Evidence: schema fixtures. - [x] I2.1.b Validate and canonicalize exact brief revision, asset/workflow/ audience profile, locale, units, ordered refs, typed controls, and policy/code floors before compile. Evidence: compiler input tests. - [x] I2.1.c Resolve only versioned approved templates/vocabularies/mappings and record every source field/default/derived/omitted/unsupported decision. Evidence: mapping trace. - [x] I2.1.d Serialize normalized spec in stable field/list/number/string/ Unicode order independent of host locale/time/random/process ordering. Evidence: determinism tests. - [x] I2.1.e Keep untrusted user/reference content fenced as data and prohibit compiled spec from granting workflows/models/tools/provider detail outside audience. Evidence: injection/tier tests. - [x] I2.1.f Return structured validation/unsupported/policy errors without falling back to generic prompt concatenation. Evidence: negative tests. - [x] I2.1.g Compile canonical minimal/full/multilingual/multireference/ multimodal briefs to exact golden specs and recompile byte-identically. Evidence: golden compiler suite. - [x] I2.2 Keep positive intent, exclusions, reference controls, spatial controls, temporal controls, audio controls, and delivery constraints as typed fields. Evidence: no required control is hidden in free-form text. - [x] I2.2.a Define typed positive intent for subject/content/action/context/ style/tone/composition/required elements and domain blocks with stable vocabularies/extensions. Evidence: intent field tests. - [x] I2.2.b Define typed exclusions for content/objects/styles/attributes/ safety/brand/rights/technical constraints with scope/severity/source. Evidence: exclusion tests. - [x] I2.2.c Define typed ordered reference roles, weights, strengths, regions/masks, influence schedule, preprocessing, versions/hashes, rights/consent, and conflict behavior. Evidence: reference control tests. - [x] I2.2.d Define typed canvas/coordinate/units/aspect/resolution/crop/ layout/position/depth/pose/camera/lens/light/scene spatial controls. Evidence: spatial tests. - [x] I2.2.e Define typed frame/sample/beat/timecode units, duration/rate/ sequence/shot/timing/motion/transition/loop/sync temporal controls. Evidence: temporal tests. - [x] I2.2.f Define typed sample/channel/codec/loudness/peak/dialogue/voice/ pronunciation/music/SFX/foley/stem/mix/sync audio controls. Evidence: audio tests. - [x] I2.2.g Define typed target/host/channel/environment/territory/locale/ format/profile/dimensions/quality/naming/package/deadline/embargo/ publisher constraints. Evidence: delivery tests. - [x] I2.2.h Prevent required control names/values from appearing only in free-form prompt fields; lint compiler/UI/contracts/import/export. Evidence: deliberate hidden-control failures. - [x] I2.3 Validate reference media kind, rights, checksum, dimensions, duration, codec, and moderation before planning. Evidence: invalid inputs never reach a provider. - [x] I2.3.a Resolve immutable authorized reference bytes/metadata and verify tenant/project/actor/property access, state, retention, and no mutable URL-only dependency. Evidence: reference resolver tests. - [x] I2.3.b Sniff actual media/container/asset kind and verify it is supported by declared role, asset kind, workflow class, model/provider, and target. Evidence: kind mismatch tests. - [x] I2.3.c Verify license/ownership/attribution/derivative/training/ territory/term and identity/voice/biometric consent evidence/freshness/ revocation. Evidence: rights/consent tests. - [x] I2.3.d Rehash stored bytes with approved algorithm and compare metadata/ provenance/manifest; quarantine corruption. Evidence: checksum spoof tests. - [x] I2.3.e Validate image/texture/3D dimensions/units/axes/resolution/point/ polygon/texture/channel limits and role alignment. Evidence: dimension boundary tests. - [x] I2.3.f Validate video/audio/animation duration/frame/sample/beat/time base/rate/track/channel/synchronization limits. Evidence: duration tests. - [x] I2.3.g Validate codec/container/profile/level/bit depth/color/HDR/ compression/3D format/extensions and decode/parser resource limits. Evidence: codec/format tests. - [x] I2.3.h Require current malware/content/child/identity/safety/moderation/ archive/domain scans bound to the same hash. Evidence: scan freshness tests. - [x] I2.3.i Stop compilation/planning/provider calls and return exact invalid/unsupported/unauthorized/stale/quarantined reason. Evidence: zero-provider-call negative assertions. - [ ] I2.4 Implement workflow-template selection by capability and audience. Evidence: tier-forbidden workflows never appear or dispatch. - [x] I2.4.a Query approved active workflow versions by asset kind/operation/ required capabilities/input-output/profile/target and current dependency compatibility. Evidence: candidate query tests. - [x] I2.4.b Filter by canonical actor tier, audience/host allowlist, entitlement, tenant/project policy, classification, and workflow exposure. Evidence: tier filter tests. - [x] I2.4.c Filter revoked/deprecated-expired/quarantined/incompatible/ unavailable/not-configured/provider/resource/budget/rights/safety candidates with exact reasons. Evidence: eligibility tests. - [x] I2.4.d Rank/select deterministically by policy, compatibility, quality, latency, cost, capacity, target, and explicit user choice with stable tie-break and reason. Evidence: selection fixtures. - [x] I2.4.e Return allowed candidate summaries/details appropriate to audience and redact graph/node/model/provider internals from curated tiers. Evidence: property leak tests. - [x] I2.4.f Revalidate exact workflow/version/audience/host/dependencies at planning and dispatch; reject direct forbidden IDs. Evidence: bypass/ race tests. - [ ] I2.4.g Emit capability/ineligibility state to UI/API and audit selected/ rejected workflow decisions. Evidence: end-to-end tests. - [x] I2.5 Implement model selection through the governed registry. Evidence: quarantined, incompatible, unlicensed, or environment-inadmissible models are unavailable with reasons. - [x] I2.5.a Query models/versions/checkpoints/adapters by required workflow/ node/task/modality/asset/profile/input-output/provider/runtime/hardware capabilities. Evidence: candidate query tests. - [x] I2.5.b Require approved active lifecycle, verified artifact hash/source/ signature/security scans, current evaluation, and nonrevoked state. Evidence: lifecycle tests. - [x] I2.5.c Require compatible architecture/version/precision/format/context/ adapter/LoRA/node/workflow/provider/endpoint/resource and target. Evidence: compatibility tests. - [x] I2.5.d Require license/usage/training/derivative/attribution/territory/ commercial rights and identity/content policy for actor/audience/use. Evidence: license tests. - [x] I2.5.e Require environment promotion/admission, regional availability, entitlement/quota/capacity/budget, and target data residency. Evidence: environment tests. - [x] I2.5.f Rank allowed candidates deterministically by policy/quality/ latency/cost/capacity/reproducibility/target and record alternatives/ rejection reasons. Evidence: selection fixtures. - [x] I2.5.g Expose audience-safe metadata and typed reasons for quarantined/ incompatible/unlicensed/inadmissible/not-configured/unavailable without leaking private model/provider detail. Evidence: UI/API tests. - [x] I2.5.h Revalidate model/version/hash/licensing/evaluation/promotion/ endpoint at dispatch and block stale direct references. Evidence: race tests. - [x] I2.6 Implement LoRA/modifier selection only in authorized AAA/operator hosts. Evidence: curated payload leak audit passes. - [x] I2.6.a Register LoRA/adapter/modifier ID/version/hash/source/base-model/ target-module/rank/trigger/strength range/license/safety/identity/style/ asset/workflow compatibility and lifecycle. Evidence: modifier schema. - [x] I2.6.b Resolve operator and AAA actor/host/tier/entitlement/tenant/ project/use authorization at discovery and mutation. Evidence: authorization tests. - [x] I2.6.c Filter approved/nonquarantined/compatible/licensed/environment- admitted/provider-supported modifiers and multi-modifier combinations. Evidence: eligibility tests. - [x] I2.6.d Expose typed search/select/order/weight/schedule/mask/region/ enable/preset controls with ranges and effective influence diagnostics. Evidence: AAA/operator UI tests. - [x] I2.6.e Revalidate exact modifier versions/hashes/combination/audience at planning/dispatch and persist effective provenance/parameters. Evidence: dispatch tests. - [x] I2.6.f Omit modifier IDs/names/hashes/triggers/weights/schedules/base- model linkage and unsupported hints entirely from curated contracts/ routes/bundles/telemetry. Evidence: curated leak scan. - [x] I2.6.g Reject direct API/query/body/deep-link/import attempts from curated/contemplative users without revealing existence. Evidence: negative tests. - [x] I2.7 Implement sampler and advanced node controls only in authorized hosts. Evidence: route and property authorization tests. - [x] I2.7.a Register sampler/scheduler/step/CFG/seed/denoise/precision/batch/ node/port/parameter/subgraph/custom-node controls with versions/types/ units/ranges/compatibility/risk/resource/cost. Evidence: control schema. - [x] I2.7.b Assign operator versus AAA view/edit/import/execute rights per workflow class/node/control and prohibit curated/contemplative exposure. Evidence: permission matrix. - [x] I2.7.c Build typed controls with validation/default provenance/ dependency constraints/effective values/cost-quality-latency impact and no arbitrary JSON/code. Evidence: UI/API tests. - [x] I2.7.d Enforce node catalog/signature/license/security/sandbox/network/ filesystem/resource policy and graph compatibility. Evidence: custom node security tests. - [x] I2.7.e Revalidate actor/host/workflow/version/node/parameter/policy/ capacity at plan/dispatch and persist effective graph/controls. Evidence: dispatch tests. - [x] I2.7.f Remove/redact controls and raw values from lower-tier responses, errors, URLs, imports/exports, provenance summaries, logs, and capability hints. Evidence: leak tests. - [x] I2.7.g Test route, object/property/function authorization and direct/ nested/alias/unknown-field/mass-assignment bypass. Evidence: adversarial authorization suite. - [x] I2.8 Implement best-of-N variant requests with estimated cost and resource reservation. Evidence: dispatch requires explicit confirmation above the configured threshold. - [x] I2.8.a Define requested count, candidate count, diversity strategy, selection strategy, seed policy, per-variant controls, and hard maximums as typed fields. Evidence: best-of-N contract tests. - [x] I2.8.b Expand one request into deterministic candidate plans with unique run/output identities and shared request/brief lineage. Evidence: expansion fixtures. - [x] I2.8.c Estimate compute, provider, storage, egress, evaluation, and post-processing cost for the complete candidate set before reservation. Evidence: estimate tests. - [x] I2.8.d Reserve quota, budget, queue, GPU/CPU/VRAM, and storage for the confirmed set atomically or return an exact shortfall. Evidence: reservation contention tests. - [x] I2.8.e Require typed confirmation when configured count/cost/resource/ latency thresholds are crossed and bind it to the unchanged estimate. Evidence: stale-confirmation tests. - [x] I2.8.f Dispatch only confirmed/reserved candidates with bounded fan-out, cancellation, partial-failure, retry, and reservation-release behavior. Evidence: execution race tests. - [x] I2.8.g Reconcile actual per-variant and aggregate usage/cost, preserving failed/cancelled candidates and selection state. Evidence: reconciliation fixtures. - [x] I2.9 Implement manual and generated variant grouping. Evidence: generated scores remain provider/gate values and manual variants show score absence. - [x] I2.9.a Define a stable variant-set identity, ordering, labels, roles, parent/revision links, source discriminator, and membership rules. Evidence: grouping schema tests. - [x] I2.9.b Add authorized manual assets without inventing generation run, model, seed, provider, prompt, or automated score provenance. Evidence: manual variant fixtures. - [x] I2.9.c Add generated assets only through immutable run/output lineage and retain provider measurements and gate results as attributed values. Evidence: generated variant fixtures. - [x] I2.9.d Prevent manual edits, regrouping, imports, or API payloads from rewriting source identity or converting missing scores into zero/pass. Evidence: provenance mutation tests. - [x] I2.9.e Enforce asset-kind/profile/comparison compatibility while preserving mixed-source groups explicitly allowed by policy. Evidence: compatibility tests. - [x] I2.9.f Record membership, reorder, remove, merge, split, and archive decisions without deleting historical group state. Evidence: audit history tests. - [ ] I2.10 Implement side-by-side and A/B comparison with synchronized image/video/audio/3D controls. Evidence: selection and playback state are stable and accessible. - [x] I2.10.a Define comparison session, participant, source revision, layout, synchronized state, annotation, and decision contracts. Evidence: comparison schema tests. - [x] I2.10.b Implement image pan/zoom/fit/pixel/alpha/difference controls synchronized in common coordinates with deliberate unlinking. Evidence: image interaction tests. - [x] I2.10.c Implement video play/pause/scrub/frame/timecode/rate/loop/audio controls with duration/rate mismatch policies. Evidence: video sync tests. - [x] I2.10.d Implement audio play/pause/scrub/loop/gain/mute/channel/waveform/ loudness controls without auto-normalizing away measured differences. Evidence: audio comparison tests. - [x] I2.10.e Implement 3D camera/orbit/pan/zoom/light/background/material/ animation/LOD/wireframe controls with unit/axis/bounds reconciliation. Evidence: 3D comparison tests. - [ ] I2.10.f Present nonvisual metadata, provenance, raw gate values, thresholds, uncertainty, rights, and target compatibility alongside the media. Evidence: accessible comparison audit. - [ ] I2.10.g Preserve keyboard focus, screen-reader labels, participant identity, synchronized state, and current selection across rerender, reconnect, and permitted deep link. Evidence: accessibility/state tests. - [x] I2.10.h Commit A/B preference or multi-candidate selection only against the exact compared revisions and reject stale/unauthorized choices. Evidence: selection concurrency tests. - [x] I2.11 Implement decision records for select, reject, park, or regenerate. Evidence: chosen and rejected output IDs remain linked. - [x] I2.11.a Define immutable decision identity, actor/authority, timestamp, compared set/revisions, disposition, reasons, evidence, comments, and supersession linkage. Evidence: decision schema tests. - [x] I2.11.b Implement select with one or explicitly multiple chosen output revisions and retain all nonselected candidates. Evidence: selection tests. - [x] I2.11.c Implement reject with typed reason codes, optional annotations, remediation, and no asset deletion. Evidence: rejection tests. - [x] I2.11.d Implement park with owner, review trigger/date, hold reason, and restoration semantics. Evidence: parked-state tests. - [x] I2.11.e Implement regenerate as a new request/run linked to selected source inputs, requested changes, and preserved prior output. Evidence: regeneration lineage tests. - [x] I2.11.f Enforce actor/tier/project/state permissions and optimistic concurrency for each disposition. Evidence: authorization/race tests. - [x] I2.11.g Surface current and superseded decisions in UI/API/export/audit without allowing later outcomes to rewrite history. Evidence: history projection tests. - [x] I2.12 Implement prompt/version diff. Evidence: differences distinguish user brief, compiled spec, workflow, model, seed, and policy. - [x] I2.12.a Resolve two authorized immutable run/output/brief revisions and reject incomparable or redacted targets. Evidence: diff input tests. - [x] I2.12.b Diff user-authored brief fields with semantic field/list/unit/ reference changes distinct from prose formatting. Evidence: brief diff fixtures. - [x] I2.12.c Diff canonical compiled specs including derived/defaulted/ omitted/unsupported fields and compiler/template versions. Evidence: spec diff fixtures. - [x] I2.12.d Diff workflow template/version/graph/control/dependency changes at the highest detail authorized for the audience. Evidence: workflow diff tests. - [x] I2.12.e Diff model/checkpoint/adapter/modifier/provider/runtime changes with audience-appropriate redaction. Evidence: model diff tests. - [x] I2.12.f Diff seed/randomness/candidate/conditioning and effective parameter changes without implying causation. Evidence: execution diff tests. - [x] I2.12.g Diff policy/code/evaluator/rights/safety/target-profile versions and distinguish policy-only verdict changes. Evidence: policy diff tests. - [x] I2.12.h Render added/removed/changed/unchanged/unknown/redacted states accessibly and export the same typed diff. Evidence: UI/API parity tests. - [x] I2.13 Implement reusable brief presets with inheritance and code floors. Evidence: preset overrides cannot loosen safety or rights requirements. - [x] I2.13.a Define preset identity, scope, owner, audience, asset/workflow compatibility, version, lifecycle, typed values, parent, and code-floor references. Evidence: preset schema tests. - [x] I2.13.b Resolve single-parent inheritance with cycle/depth detection and exact version pinning. Evidence: inheritance tests. - [x] I2.13.c Merge scalar/list/map/reference/constraint fields with explicit per-field replace/append/remove/lock rules. Evidence: merge fixtures. - [x] I2.13.d Enforce safety, rights, consent, privacy, retention, budget, and delivery code floors after every inheritance and user override step. Evidence: floor-bypass tests. - [x] I2.13.e Preview inherited/defaulted/overridden/locked/effective values and their provenance before apply. Evidence: preset preview tests. - [x] I2.13.f Version edits immutably, migrate or pin dependent briefs explicitly, and preserve reproducibility of historical runs. Evidence: version/migration tests. - [x] I2.13.g Authorize create/read/update/archive/share/import/export by personal/project/tenant/system scope and audience. Evidence: scope authorization tests. - [x] I2.14 Implement import/export of portable brief specs. Evidence: round-trip is versioned, validated, and strips secrets. - [x] I2.14.a Define a versioned portable envelope with manifest, canonical brief spec, referenced immutable identities, compatibility metadata, provenance summary, and integrity hash. Evidence: envelope schema. - [x] I2.14.b Export only audience-authorized portable fields and omit credentials, signed URLs, provider internals, private prompts, hidden policy, tenant metadata, and nonportable local paths. Evidence: secret/ property leak tests. - [x] I2.14.c Represent unavailable, redacted, external, and intentionally omitted references explicitly rather than embedding mutable links. Evidence: reference portability tests. - [x] I2.14.d Parse imports with size/depth/count/format/unknown-field limits, version compatibility, signature/hash checks, and safe archive handling. Evidence: hostile import tests. - [x] I2.14.e Validate imported typed values, rights/consent, asset/workflow/ model references, code floors, and target compatibility before preview. Evidence: import validation tests. - [x] I2.14.f Preview migrations, substitutions, redactions, missing dependencies, conflicts, and effective values before authorized commit. Evidence: import preview tests. - [x] I2.14.g Round-trip canonical supported specs byte-semantically while preserving versions and never converting omissions to defaults. Evidence: golden round-trip suite. - [ ] I2.15 Implement continuity-profile authoring for characters, wardrobe, props, environments, lighting, palette, lens, camera, and motion across shots or asset sets. Evidence: profile revisions, drift thresholds, diagnostics, and authorized overrides remain linked to every output. - [x] I2.15.a Define versioned continuity-profile identity, scope, owners, target asset/sequence membership, reference sources, constraints, thresholds, overrides, and lifecycle. Evidence: profile schema. - [x] I2.15.b Author character identity, anatomy, age presentation, facial/ body features, silhouette, scale, pose, expression, and consent-bound reference constraints. Evidence: character continuity tests. - [x] I2.15.c Author wardrobe silhouette, garment layers, materials, colors, patterns, accessories, state/damage, and shot-to-shot change rules. Evidence: wardrobe tests. - [x] I2.15.d Author prop identity, dimensions, materials, markings, handedness, ownership, placement, interaction, and state transitions. Evidence: prop tests. - [x] I2.15.e Author environment layout, scale, geography, architecture, set-dressing anchors, weather, time, and persistent state. Evidence: environment tests. - [x] I2.15.f Author lighting source/type/position/direction/color/intensity/ exposure/shadow/atmosphere continuity and intended changes. Evidence: lighting tests. - [x] I2.15.g Author palette tokens, color-space values, allowed variance, semantic usage, accessibility constraints, and intentional exceptions. Evidence: palette tests. - [x] I2.15.h Author lens/focal/aperture/focus/distortion/sensor/aspect/crop continuity in explicit units. Evidence: lens tests. - [x] I2.15.i Author camera position/orientation/height/distance/framing/ eyeline/screen direction/axis and transition rules. Evidence: camera tests. - [x] I2.15.j Author subject/object/camera motion paths, timing, velocity, acceleration, easing, cycles, and collision/contact constraints. Evidence: motion tests. - [x] I2.15.k Version profile edits immutably and record which exact revision each plan, run, shot, output, and evaluation consumed. Evidence: revision-lineage tests. - [x] I2.15.l Calculate typed per-dimension drift measurements, thresholds, uncertainty, unavailable status, and cross-shot/set diagnostics. Evidence: calibrated drift fixtures. - [x] I2.15.m Authorize bounded, reasoned, expiring dimension-level overrides without changing raw measurements or profile history. Evidence: override authorization tests. - [ ] I2.15.n Present effective constraints, conflicts, drift, overrides, and remediation in authoring/comparison/review views. Evidence: accessible end-to-end continuity tests. - [x] I2.16 Implement authorized conditioning stacks for pose, depth, edges, line art, segmentation, normals, style, face identity, masks, camera paths, motion vectors, and multi-control strength schedules. Evidence: typed UI/API parity and effective-control provenance. - [x] I2.16.a Define ordered conditioning-stack and layer contracts with kind, source/version/hash, preprocessing, spatial/temporal scope, strength schedule, blend, model/workflow compatibility, and provenance. Evidence: conditioning schema tests. - [x] I2.16.b Implement pose controls for skeleton format, keypoints, confidence, people/track association, occlusion, transforms, and frame range. Evidence: pose fixtures. - [x] I2.16.c Implement depth controls for units, range, inversion, clipping, normalization, confidence, camera, and resolution alignment. Evidence: depth fixtures. - [x] I2.16.d Implement edge and line-art controls for detector/version, threshold, scale, polarity, cleanup, weight, and resolution. Evidence: edge/line fixtures. - [x] I2.16.e Implement segmentation controls for label vocabulary/version, instance IDs, confidence, palette mapping, unknown regions, and masks. Evidence: segmentation fixtures. - [x] I2.16.f Implement normal controls for tangent/object/world space, axes, handedness, range, camera, confidence, and transform. Evidence: normal fixtures. - [x] I2.16.g Implement style controls with authorized reference roles, strength/schedule, region scope, protected attributes, and rights. Evidence: style conditioning tests. - [x] I2.16.h Implement face-identity controls with identity subject, consent, reference quality, region/tracking, strength limits, and audience/policy. Evidence: identity safety tests. - [x] I2.16.i Implement raster/vector/semantic masks with coordinate space, feather/dilate/erode/invert, frame range, version, and edit history. Evidence: mask tests. - [x] I2.16.j Implement camera-path controls with units, coordinate system, transforms, lens, interpolation, timestamps, collision, and bounds. Evidence: camera-path tests. - [x] I2.16.k Implement motion-vector controls with direction convention, units, scale, frame correspondence, confidence, occlusion, and bounds. Evidence: motion-vector tests. - [x] I2.16.l Validate multiple controls for ordering, compatible models/ preprocessors, coordinate/time alignment, aggregate strength/resource limits, and conflicts. Evidence: multi-control tests. - [x] I2.16.m Keep UI and API typed controls/defaults/errors/effective values equivalent and revalidate the exact stack at dispatch. Evidence: UI/API/dispatch parity tests. - [x] I2.17 Implement shot, storyboard, animatic, and sequence authoring with shot order, duration, lens, camera motion, continuity, patch rerender, editorial timing, and render-pass requirements. Evidence: sequence rerender preserves unaffected shot identities and lineage. - [x] I2.17.a Define versioned sequence, shot, board panel, animatic segment, track, transition, render requirement, and dependency contracts. Evidence: sequence schema tests. - [x] I2.17.b Author stable shot identity, order, grouping, branch, dependency, status, owner, and source revision with conflict-safe reordering. Evidence: shot-order tests. - [x] I2.17.c Author duration using frames/timecode/seconds with sequence rate, handles, source/record ranges, retime, and transition overlap. Evidence: timing tests. - [x] I2.17.d Author per-shot lens/sensor/aperture/focus/aspect/framing values in explicit units with continuity-profile linkage. Evidence: lens tests. - [x] I2.17.e Author camera pose/path/interpolation/constraints/shake/collision and preview it in shot context. Evidence: camera-motion tests. - [x] I2.17.f Author storyboard panels with frame/shot linkage, composition, action/dialogue/notes, references, annotations, and revision history. Evidence: storyboard tests. - [x] I2.17.g Assemble animatic picture/dialogue/SFX/music/caption tracks with sync, gain, transitions, placeholders, and missing-media states. Evidence: animatic playback tests. - [x] I2.17.h Apply character/wardrobe/prop/environment/light/palette/camera/ motion continuity profiles and show shot-level conflicts/drift. Evidence: sequence continuity tests. - [x] I2.17.i Define beauty/matte/depth/normal/motion/object/cryptomatte/audio/ caption and target-specific render-pass requirements. Evidence: pass manifest tests. - [x] I2.17.j Plan a patch rerender from exact changed shots/frames/passes and downstream dependencies without silently widening scope. Evidence: invalidation graph tests. - [x] I2.17.k Preserve unaffected shot/output identities, regenerate affected identities, and link old/new plans/runs/assets/edits. Evidence: patch lineage tests. - [x] I2.17.l Export editorial interchange and review proxies with stable IDs, time bases, handles, media refs, captions, and round-trip validation. Evidence: editorial round-trip tests. - [x] I2.18 Implement advanced 3D project authoring for reconstruction, scene assembly, part/semantic edits, texture/material generation, relighting, topology/LOD, rigging, splat editing, and engine/DCC packaging. Evidence: every stage is non-destructive, previewable, cancellable, and separately attributable. - [x] I2.18.a Define versioned 3D project, scene, object, component, geometry, material, rig, animation, camera, light, edit layer, dependency, and package contracts. Evidence: 3D project schemas. - [x] I2.18.b Author reconstruction inputs, calibration, masks, scale, bounds, quality target, reconstruction method, uncertainty, and source linkage. Evidence: reconstruction tests. - [x] I2.18.c Assemble referenced or embedded scenes with stable hierarchy, instances, transforms, units, axes, variants, dependencies, and conflict handling. Evidence: assembly tests. - [x] I2.18.d Apply part-level and semantic select/mask/add/remove/replace/ transform/deform edits as reversible versioned layers. Evidence: semantic edit tests. - [x] I2.18.e Generate/edit texture sets and materials with UV/UDIM mapping, channel semantics, color space, resolution, tiling, seams, baking, and source rights. Evidence: material tests. - [x] I2.18.f Author relighting with environment/source lights, units, color, exposure, shadows, reflections, baking, and original-light preservation. Evidence: relighting tests. - [x] I2.18.g Author topology repair/retopology/remesh/decimation/subdivision, normals, UV, manifold, and target polygon constraints non-destructively. Evidence: topology tests. - [x] I2.18.h Generate and validate ordered LODs, screen thresholds, reduction settings, material/UV preservation, collision, and target budgets. Evidence: LOD tests. - [x] I2.18.i Author skeleton/rig/control/skin/constraint/blend-shape and retargeting stages with bind/reference pose and deformation preview. Evidence: rigging tests. - [x] I2.18.j Edit gaussian-splat crop/mask/transform/opacity/SH/compression/ density/cleanup/merge layers with renderer preview. Evidence: splat edit tests. - [x] I2.18.k Package glTF/GLB/USD/USDZ/FBX and governed DCC/engine targets with dependencies, manifests, hashes, versions, licenses, and import validation. Evidence: packaging round-trip tests. - [x] I2.18.l Give every stage its own plan/run/output/edit identity, preview, progress, cancellation, retry, measurements, cost, and attribution. Evidence: stage lifecycle tests. - [x] I2.18.m Preserve source and prior stage revisions on failure/cancel/ replace and make downstream invalidation explicit. Evidence: destructive edit/race tests. - [ ] I2.19 Implement audio/voice/music project authoring for SFX, foley, dialogue, dubbing, TTS, cloned voice, conversational tracks, music cues, stems, pronunciation, timing, loudness target, and mix package. Evidence: consent, rights, multi-track preview, and output-bundle tests. - [x] I2.19.a Define versioned audio project, timeline, track, clip, take, speaker/voice, cue, stem, automation, mix, transcript, caption, and delivery contracts. Evidence: audio project schemas. - [x] I2.19.b Author SFX cues with event, perspective, environment, intensity, duration, timing, variation, loop, source/generation, and rights. Evidence: SFX tests. - [x] I2.19.c Author foley cues with performer/object/surface/action/contact/ perspective/timing layers and picture sync. Evidence: foley tests. - [x] I2.19.d Author dialogue takes with speaker identity, script revision, language, performance direction, pronunciation, timing, room tone, channel, and consent. Evidence: dialogue tests. - [x] I2.19.e Author dubbing with source segment/transcript/translation, speaker/voice mapping, lip/timing constraints, adaptation notes, and language review. Evidence: dubbing tests. - [x] I2.19.f Author TTS with approved voice/version, text/SSML subset, language, pronunciation lexicon, style/rate/pitch controls, and policy. Evidence: TTS tests. - [x] I2.19.g Author cloned/synthetic identity voice only with verified subject consent/scope/term/revocation, reference rights, watermark/disclosure, audience, and use policy. Evidence: cloned-voice safety tests. - [x] I2.19.h Author conversational multi-speaker turns with stable speaker/ voice mapping, overlap, pauses, interruption, room, continuity, and disclosure. Evidence: conversation tests. - [x] I2.19.i Author music cues with brief, tempo/meter/key, form, duration, hit points, instrumentation, mood, references/rights, loop, and ending. Evidence: music cue tests. - [x] I2.19.j Define dialogue/music/SFX/foley/ambience/aux/master stems and clip/track/bus routing without destructive flattening. Evidence: stem routing tests. - [x] I2.19.k Maintain versioned language/speaker pronunciation lexicons with phonemes, stress, substitutions, context, approval, and provenance. Evidence: pronunciation tests. - [x] I2.19.l Author frame/timecode/sample/beat clip timing, trims, fades, crossfades, stretch, alignment, and synchronization in explicit units. Evidence: timeline edit tests. - [x] I2.19.m Author target loudness/true-peak/dialogue-gated/dynamic-range/ channel/layout/sample/codec constraints and measure rather than assume compliance. Evidence: calibrated loudness tests. - [ ] I2.19.n Preview synchronized multitrack playback, mute/solo/gain/pan/ automation/waveform/transcript/captions accessibly and consistently. Evidence: playback/accessibility tests. - [x] I2.19.o Export versioned mix/stems/captions/transcript/cue sheet/ attribution/consent/rights/measurements in a hashed output bundle. Evidence: bundle manifest/round-trip tests. - [x] I2.20 Implement operator workflow graph authoring with node catalog, typed ports, subgraphs, custom-node/model dependencies, validation, version diff, dry run, benchmark, promotion, and rollback. Evidence: graph injection, incompatible node, and dependency-supply-chain tests. - [x] I2.20.a Define immutable graph/version/node/port/edge/parameter/subgraph/ dependency/validation/benchmark/promotion contracts and canonical serialization. Evidence: workflow graph schemas. - [x] I2.20.b Build an authorized searchable node catalog with signed source, version, input/output types, parameters, capabilities, compatibility, resource risk, license, lifecycle, and audience metadata. Evidence: catalog tests. - [x] I2.20.c Enforce typed port modality/shape/unit/time/coordinate/color/ cardinality/optionality compatibility at connect and validate time. Evidence: port compatibility fixtures. - [x] I2.20.d Author reusable version-pinned subgraphs with declared typed interfaces, parameters, dependencies, scope, and cycle/depth limits. Evidence: subgraph tests. - [x] I2.20.e Resolve custom-node/model/adapter/runtime/package artifacts by immutable version/hash/signature/license/scan/promotion and complete transitive dependency lock. Evidence: supply-chain tests. - [x] I2.20.f Validate required ports, graph cycles, unreachable/dead outputs, parameter ranges, resource bounds, target compatibility, audience, policy, and output contracts. Evidence: graph validation suite. - [x] I2.20.g Diff canonical graph versions by node/edge/port/parameter/ dependency/interface/policy/effective behavior with stable identities. Evidence: graph diff fixtures. - [x] I2.20.h Dry-run type resolution, dependency availability, authorization, resource/cost estimate, and execution plan without provider side effects. Evidence: zero-dispatch dry-run tests. - [x] I2.20.i Benchmark approved fixtures with pinned inputs/environment/ dependencies and record quality/latency/cost/resource/reproducibility. Evidence: benchmark reproducibility tests. - [x] I2.20.j Promote exact signed graph versions through governed environments only after required validation/evaluation/approval evidence. Evidence: promotion gate tests. - [x] I2.20.k Roll back new selection to a prior admitted immutable graph without deleting runs or rewriting their consumed versions. Evidence: rollback/history tests. - [x] I2.20.l Reject code/expression/template/serialized-object/unknown-field/ alias/mass-assignment graph injection and sandbox admitted execution. Evidence: adversarial graph tests. ### I3 — Provider execution, jobs, and resource governance - [x] I3.1 Wire the V1 generation route to a real injected executor in an approved environment. Evidence: credentials remain external and the default stays `not_configured`. - [x] I3.1.a Define the executor port and typed request/result/progress/error/ cancellation contract independently of any provider SDK. Evidence: executor contract tests. - [x] I3.1.b Register real executor implementations only through approved environment composition and keep the default binding explicitly `not_configured`. Evidence: composition tests. - [x] I3.1.c Load credential references from the approved secret provider at execution time without accepting credentials in route payloads, configuration snapshots, logs, or stored plans. Evidence: secret leak tests. - [x] I3.1.d Revalidate actor, project, plan, workflow/model versions, policy, reservation, and idempotency immediately before invoking the executor. Evidence: stale-plan/bypass tests. - [x] I3.1.e Map executor progress, output, refusal, failure, cancellation, usage, and provenance to canonical domain events. Evidence: adapter integration tests. - [x] I3.1.f Prove local/test/unapproved environments make zero provider calls and return the stable not-configured result. Evidence: environment isolation tests. - [x] I3.2 Implement RunPod/ComfyUI adapter capability negotiation. Evidence: unsupported nodes/models are rejected before queueing. - [x] I3.2.a Define the adapter capability document for endpoint/version, queue API, node catalog, models, adapters, formats, limits, progress, cancellation, and result transport. Evidence: capability schema tests. - [x] I3.2.b Fetch and authenticate capability state with timeout, size, schema, freshness, cache, and last-known-state rules. Evidence: negotiation failure tests. - [x] I3.2.c Normalize RunPod endpoint/worker/GPU and ComfyUI node/object-info data into canonical capabilities without trusting display names. Evidence: normalization fixtures. - [x] I3.2.d Compare exact workflow graph, custom nodes, model hashes, adapters, controls, input/output formats, and resource requirements before queue submission. Evidence: compatibility tests. - [x] I3.2.e Reject missing, stale, mismatched, quarantined, or unverified capabilities with typed reasons and no queue side effect. Evidence: zero-queue negative tests. - [x] I3.2.f Detect capability changes between plan and dispatch and require replan rather than silently substituting dependencies. Evidence: race tests. - [x] I3.3 Implement provider routing using health, capability, policy, residency, latency, cost, and capacity. Evidence: known routing fixtures. - [x] I3.3.a Build the candidate set from approved provider endpoints that match exact workflow/model/input/output capabilities. Evidence: candidate tests. - [x] I3.3.b Filter endpoint lifecycle, health/circuit state, policy, tenant/ audience entitlement, regional/data-residency, rights, and security admission. Evidence: eligibility matrix. - [x] I3.3.c Filter live queue/GPU/VRAM/storage/egress capacity and reservation feasibility without overcommitting stale snapshots. Evidence: capacity contention tests. - [x] I3.3.d Rank eligible endpoints deterministically by policy priority, predicted latency, complete cost, capacity headroom, reliability, and stable tie-break. Evidence: routing fixtures. - [x] I3.3.e Record candidates, allowed rejection reasons, selected endpoint identity/version, inputs, estimates, and routing policy version. Evidence: routing decision audit. - [x] I3.3.f Revalidate the chosen endpoint and reservation at dispatch; fail/replan according to policy without unauthorized cross-region or model substitution. Evidence: dispatch race tests. - [x] I3.4 Implement per-family circuit breakers and retry/backoff from the canonical policy. Evidence: clock-controlled state tests. - [x] I3.4.a Define circuit scope keys for provider, endpoint, workflow/model family, operation, region, and failure class to prevent unrelated traffic from sharing state. Evidence: scope tests. - [x] I3.4.b Classify which failures count, do not count, or immediately open each circuit from the canonical versioned policy. Evidence: classifier fixtures. - [x] I3.4.c Implement closed/open/half-open transitions with rolling windows, thresholds, cooldown, bounded probes, concurrency safety, and monotonic time. Evidence: fake-clock state tests. - [x] I3.4.d Implement attempt limits, exponential backoff, jitter, deadline, Retry-After handling, idempotency, and retryable-stage constraints. Evidence: retry schedule tests. - [x] I3.4.e Ensure cancellation, policy denial, validation failure, budget exhaustion, and non-idempotent completed stages are never retried. Evidence: forbidden retry tests. - [x] I3.4.f Persist/restore sufficient breaker state across process restart and emit state/decision metrics without high-cardinality secrets. Evidence: restart/telemetry tests. - [x] I3.5 Distinguish provider refusal, policy denial, capacity exhaustion, timeout, malformed response, worker loss, and internal failure. Evidence: stable failure taxonomy reaches the UI. - [x] I3.5.a Define stable machine codes, categories, retryability, ownership, user-safe message keys, operator detail, and terminal/nonterminal semantics for every failure class. Evidence: error schema tests. - [x] I3.5.b Map provider refusal/status/body signals without exposing provider-private prompts, safety internals, or credentials. Evidence: provider refusal fixtures. - [x] I3.5.c Distinguish canonical policy denial from provider refusal and retain policy version/rule/evidence appropriate to audience. Evidence: policy mapping tests. - [x] I3.5.d Distinguish queue/capacity/quota/reservation exhaustion with responsible scope, recoverability, and safe retry timing. Evidence: capacity error tests. - [x] I3.5.e Distinguish connect/read/overall/deadline timeouts and worker heartbeat/loss/eviction from explicit cancellation. Evidence: timeout/ worker-loss tests. - [x] I3.5.f Validate provider response status, schema, content type, size, artifact manifests, hashes, and required outputs before acceptance. Evidence: malformed response tests. - [x] I3.5.g Preserve unexpected internal failure correlation for operators while UI/API receive stable redacted typed errors. Evidence: projection/ leak tests. - [x] I3.6 Implement durable generation jobs with stage checkpoints. Evidence: worker restart resumes safely or fails explicitly. - [x] I3.6.a Define immutable job identity, versioned plan snapshot, stage DAG, attempt, state, lease, checkpoint, output, error, usage, and event contracts. Evidence: job schemas. - [x] I3.6.b Create jobs idempotently with plan/input/hash/reservation binding in one durable transaction. Evidence: duplicate submission tests. - [x] I3.6.c Claim work with fenced leases, heartbeat, expiry, and compare-and- set transitions so stale workers cannot commit. Evidence: lease race tests. - [x] I3.6.d Checkpoint only validated stage outputs and exact consumed input/ dependency/policy versions with integrity hashes. Evidence: checkpoint integrity tests. - [x] I3.6.e On restart, resume only explicitly resumable idempotent stages; otherwise create a new attempt or terminal explicit failure. Evidence: crash/restart tests. - [x] I3.6.f Handle duplicate/out-of-order progress/results and provider callbacks without regressing state or duplicating assets/cost. Evidence: event ordering tests. - [x] I3.6.g Preserve complete append-only job/stage/attempt history and make current state a reproducible projection. Evidence: replay tests. - [x] I3.7 Implement cancellation propagation to queued and running providers. Evidence: race tests prevent late outputs from appearing successful. - [x] I3.7.a Define authorized cancellation request, reason, scope, actor, timestamp, idempotency, and queued/running/terminal semantics. Evidence: cancellation contract tests. - [x] I3.7.b Atomically mark queued work cancelled and release queue/resource/ budget reservations before any claim can dispatch. Evidence: queue race tests. - [x] I3.7.c Signal running workers/providers using supported cancel handles with timeout, retry, and explicit unsupported/unknown outcome. Evidence: provider cancellation tests. - [x] I3.7.d Fence stage/output commits after cancellation while retaining late provider artifacts only in quarantined operator-visible evidence. Evidence: late-result race tests. - [x] I3.7.e Reconcile actual usage/cost and release unused reservations even when provider cancellation is delayed or fails. Evidence: cancellation accounting tests. - [x] I3.7.f Project cancelled/cancelling/cancel-failed state consistently to UI/API/events and retain immutable history. Evidence: end-to-end tests. - [x] I3.8 Implement deduplication and cache eligibility. Evidence: cache keys include every output-affecting input and policy version. - [x] I3.8.a Define separately when request idempotency, in-flight coalescing, deterministic result reuse, and derived-artifact reuse are permitted. Evidence: eligibility policy tests. - [x] I3.8.b Canonicalize and hash exact input bytes/revisions, prompt spec, workflow graph, models/adapters, effective controls/seed, environment, target, code/policy/evaluator versions, and tenant scope. Evidence: cache-key golden tests. - [x] I3.8.c Exclude nondeterministic, private/identity-sensitive, consent- scoped, expired-rights, quarantined, mutable-dependency, or policy- forbidden runs from reuse. Evidence: exclusion tests. - [x] I3.8.d Coalesce concurrent eligible requests with fenced ownership, independent authorization, cancellation/reference counts, and fair cost attribution. Evidence: concurrency tests. - [x] I3.8.e Store cache metadata, artifact manifests, hashes, provenance, expiry, policy scope, and invalidation reasons without cross-tenant discovery. Evidence: isolation tests. - [x] I3.8.f Revalidate authorization, rights/consent, policy, target, and artifact integrity on every lookup before returning a hit. Evidence: stale-hit tests. - [x] I3.9 Verify cache hits against stored artifact hashes. Evidence: corrupt cache entries are quarantined and recomputed. - [x] I3.9.a Resolve the immutable cached artifact manifest and authorized storage objects without trusting caller-supplied locations. Evidence: resolver tests. - [x] I3.9.b Stream-hash every required artifact and manifest using approved algorithms, enforcing size/count/time/resource limits. Evidence: hash verification tests. - [x] I3.9.c Verify manifest/object hash, length, media signature, dependency, provenance, and encryption/key-version consistency. Evidence: corrupted cache fixtures. - [x] I3.9.d Atomically quarantine the cache record and affected objects with reason/evidence, preventing races from serving the same entry. Evidence: quarantine contention tests. - [x] I3.9.e Recompute through a fresh run identity/reservation and never rewrite the historical corrupt run as successful. Evidence: recompute lineage tests. - [x] I3.9.f Emit bounded integrity/security telemetry and operator alerts without exposing asset content or cross-tenant keys. Evidence: telemetry leak tests. - [x] I3.10 Implement queue priority with anti-starvation and tenant fairness. Evidence: load test demonstrates bounded wait. - [x] I3.10.a Define canonical base-priority classes, allowed actors/reasons, per-tenant/project/user/workflow/provider weights, and non-overridable safety/incident lanes. Evidence: priority policy tests. - [x] I3.10.b Enqueue with immutable submitted time, cost/resource estimate, deadline class, tenant scope, and policy version. Evidence: enqueue schema tests. - [x] I3.10.c Implement weighted fair scheduling with aging/anti-starvation, bounded priority boosts, per-scope concurrency, and deterministic tie-breaks. Evidence: scheduler model tests. - [x] I3.10.d Prevent job splitting, repeated cancel/resubmit, identity/tenant switching, or direct priority fields from gaming order. Evidence: adversarial fairness tests. - [x] I3.10.e Reconcile estimates against actual resource duration and feed bounded future scheduling signals without retroactive priority changes. Evidence: reconciliation tests. - [x] I3.10.f Load-test mixed tenants/priorities/job sizes/failures/cancels to demonstrate throughput, isolation, configured wait bounds, and no starvation. Evidence: queue load report. - [x] I3.11 Implement GPU/CPU/VRAM/storage/egress reservations. Evidence: overcommit and release-on-failure tests. - [x] I3.11.a Define resource kinds, units, scopes, capacity sources, safety headroom, reservation states, expiry, ownership, and accounting contracts. Evidence: reservation schemas. - [x] I3.11.b Calculate per-stage and peak concurrent GPU count/type, CPU, RAM/VRAM, temporary/persistent storage, network, and egress needs from the exact plan. Evidence: requirement fixtures. - [x] I3.11.c Atomically reserve all required scoped resources or none, with fencing token, lease, queue linkage, and exact insufficiency reasons. Evidence: multi-resource contention tests. - [x] I3.11.d Revalidate and consume reservations at dispatch without allowing stale/expired/wrong-job/wrong-endpoint tokens. Evidence: dispatch race tests. - [x] I3.11.e Adjust within authorized bounds for measured usage, rejecting or pausing unapproved expansion instead of silent overcommit. Evidence: resize tests. - [x] I3.11.f Release unused resources idempotently on completion, failure, cancellation, timeout, lease loss, and abandoned job recovery. Evidence: release path tests. - [x] I3.11.g Reconcile reservation ledger to provider/storage/network measurements and alert on leaks/negative/over-capacity invariants. Evidence: reconciliation tests. - [x] I3.12 Implement pre-dispatch estimate and post-run cost reconciliation. Evidence: variance and unbilled failures are visible. - [x] I3.12.a Define versioned price inputs and cost dimensions for provider compute/time, models/nodes, storage, egress, evaluation, post-processing, taxes/fees/credits, and internal allocation. Evidence: pricing schema. - [x] I3.12.b Compute low/expected/high estimates from exact plan, candidate count, resource reservation, retry policy, target, currency, and price version. Evidence: estimate fixtures. - [x] I3.12.c Bind the accepted estimate/threshold confirmation and budget reservation to the immutable plan before dispatch. Evidence: estimate binding tests. - [x] I3.12.d Ingest authenticated provider usage/billing plus canonical worker/storage/egress/evaluator measurements with source timestamps and confidence. Evidence: usage ingestion tests. - [x] I3.12.e Allocate actual cost by run/stage/variant/asset/project/tenant without double-counting retries, cache hits, shared jobs, or partial outputs. Evidence: allocation tests. - [x] I3.12.f Represent unbilled, estimated-only, pending, credited, refunded, disputed, and unknown costs explicitly rather than as zero. Evidence: accounting state tests. - [x] I3.12.g Calculate absolute/relative variance with typed causes and surface configured breach alerts and approval follow-up. Evidence: variance tests. - [x] I3.13 Implement tenant, project, user, workflow, and provider quotas. Evidence: each limit is enforced server-side. - [x] I3.13.a Define versioned quota dimensions, units, rolling/fixed windows, scope hierarchy, soft/hard thresholds, burst, reservation, and reset semantics. Evidence: quota schemas. - [x] I3.13.b Resolve effective quotas from tenant/project/user/workflow/ provider policy without allowing a child scope to loosen a parent hard limit. Evidence: hierarchy tests. - [x] I3.13.c Atomically check and reserve request/count/cost/compute/storage/ egress/concurrency quota at plan confirmation and dispatch. Evidence: quota contention tests. - [x] I3.13.d Count completed, failed, cancelled, retried, cached, shared, and partial work according to explicit per-dimension rules. Evidence: quota accounting tests. - [x] I3.13.e Release/refund only permitted unused reservations and retain consumed usage through retries or scope changes. Evidence: refund tests. - [x] I3.13.f Return audience-safe current/limit/reset/shortfall/retry state and alert before soft/hard thresholds without exposing other tenants. Evidence: UI/API isolation tests. - [x] I3.13.g Test direct route, batch, replay, agent, import, provider callback, and concurrency bypass paths server-side. Evidence: quota bypass suite. - [x] I3.14 Implement worker and endpoint draining for maintenance. Evidence: no new work lands and in-flight policy is honored. - [x] I3.14.a Define active/draining/drained/disabled state, reason, actor, effective/deadline times, in-flight policy, scope, and audit contract. Evidence: drain schema tests. - [x] I3.14.b Authorize drain/restore separately for worker, pool, endpoint, provider, model/workflow family, region, and environment. Evidence: operation authorization tests. - [x] I3.14.c Remove draining targets from new routing/reservation/queue claims atomically while allowing configured already-bound work. Evidence: new- work exclusion tests. - [x] I3.14.d Apply finish, checkpoint-and-migrate, cancel, or deadline-kill policy to each in-flight stage with capability/idempotency validation. Evidence: in-flight matrix tests. - [x] I3.14.e Reassign queued work and only migratable running work with new attempt/endpoint identity and preserved lineage/reservations. Evidence: migration tests. - [x] I3.14.f Determine drained state from zero claims/in-flight callbacks/ leases/reservations and expose progress/blockers. Evidence: drain completion tests. - [x] I3.14.g Restore admission explicitly after health/capability/security checks; never auto-enable expired maintenance targets. Evidence: restore tests. - [x] I3.15 Implement run replay with explicit new-run identity. Evidence: historical executions remain immutable. - [x] I3.15.a Resolve an authorized immutable source run and enumerate exact inputs, plan, workflow/model/dependencies, controls, environment, policy, rights, and unavailable/redacted fields. Evidence: replay eligibility tests. - [x] I3.15.b Distinguish exact replay, replay-under-current-policy, and fork- with-changes as separate typed operations. Evidence: replay mode tests. - [x] I3.15.c Validate current artifact availability/integrity, dependency admission, rights/consent, policy, target, quota, budget, and provider capability before confirmation. Evidence: stale replay tests. - [x] I3.15.d Preview substitutions, version drift, nonreproducible inputs, changed policy, expected cost, and output-identity consequences. Evidence: replay preview tests. - [x] I3.15.e Create a new request/plan/run/attempt identity linked to the immutable source and record replay mode plus explicit changes. Evidence: replay lineage tests. - [x] I3.15.f Never append progress/results/cost/decisions to or alter the source run, even when cache reuse is permitted. Evidence: historical immutability tests. - [x] I3.16 Build brief-to-plane agent plans over `operation-orchestrator`, `job-envelope`, and `token-budget`. Evidence: tool grants, dependencies, stop conditions, approval points, and budget validate before dispatch. - [x] I3.16.a Define versioned Isis agent-plan and step contracts that compose canonical operation, job-envelope, budget, asset, brief, workflow, and provenance identities. Evidence: plan schema tests. - [x] I3.16.b Compile the authorized brief/spec into explicit ordered/DAG steps with typed inputs/outputs, dependencies, pre/postconditions, and completion criteria. Evidence: planning fixtures. - [x] I3.16.c Resolve each tool grant to an allowlisted versioned capability, operation scope, resource bounds, data classification, and actor/audience authority. Evidence: grant tests. - [x] I3.16.d Define hard stop conditions for validation/policy/rights/budget/ timeout/cancellation/dependency/evidence failures and bounded retry/ fallback behavior. Evidence: stop-condition tests. - [x] I3.16.e Insert explicit human approval points only where canonical policy requires them, binding approver role and unchanged evidence/plan. Evidence: approval binding tests. - [x] I3.16.f Allocate per-step and total token/tool/compute/cost/time budgets with non-transferable ceilings and reserve them before dispatch. Evidence: budget allocation tests. - [x] I3.16.g Validate graph acyclicity/reachability, contract compatibility, tool availability, grants, budgets, approvals, and output destinations before any agent execution. Evidence: zero-dispatch invalid-plan tests. - [ ] I3.17 Build Isis-scoped agent run, queue, plan, tool-call, budget, output, and provenance views. Evidence: live traced journey and cross-tenant refusal. - [x] I3.17.a Define audience-safe query projections for agent request, plan, step, queue, run, attempt, tool call, budget, event, output, and lineage. Evidence: view contracts. - [x] I3.17.b Build the run list/detail state model with filters, stable URLs, loading/empty/error/stale/cancelled/partial states, and pagination. Evidence: state tests. - [x] I3.17.c Render plan DAG/step status/dependencies/approval/stop conditions and immutable version details without exposing hidden prompts/tools. Evidence: plan view tests. - [ ] I3.17.d Render queue position/priority class/estimate/reservation and live bounded event progress with reconnect/cursor/deduplication handling. Evidence: live journey tests. - [x] I3.17.e Render each authorized tool call’s tool/version/purpose/status/ timing/budget/input-output schema summary/error and correlated step. Evidence: tool-call view tests. - [x] I3.17.f Render allocated/consumed/remaining token/tool/compute/cost/time budget with unknown/pending/reconciled states. Evidence: budget view tests. - [x] I3.17.g Render proposed/generated outputs, immutable asset/run lineage, provenance, quality/safety gates, decisions, and partial/missing states. Evidence: output/provenance view tests. - [x] I3.17.h Enforce tenant/project/actor/audience/object/property/function authorization on queries, streams, URLs, exports, and actions. Evidence: cross-tenant/adversarial authorization tests. - [ ] I3.17.i Verify keyboard/screen-reader/reduced-motion/responsive behavior and performance with long plans/events/tool-call histories. Evidence: accessibility/performance automation. - [x] I3.18 Intake agent results as attributed proposals or generated assets, never as automatic approvals. Evidence: agents cannot waive gates, advance human signoff, promote environments, or publish. - [x] I3.18.a Define result envelope with agent/run/step/tool/model/version, source inputs, output kind, claim/evidence, confidence, cost, and integrity binding. Evidence: result schema tests. - [x] I3.18.b Validate schema, signature/hash, tenant/project scope, expected step/output contract, size/type, moderation, and provenance on intake. Evidence: hostile result tests. - [x] I3.18.c Store analysis/recommendations/metadata as attributed proposals with proposed state and no mutation of canonical records. Evidence: proposal persistence tests. - [x] I3.18.d Store media outputs as generated asset revisions linked to the exact plan/run/step/tool inputs and pending all applicable gates. Evidence: generated asset lineage tests. - [x] I3.18.e Map no agent result field to approval, waiver, gate pass, promotion, publication, or human identity/authority. Evidence: mass- assignment/bypass tests. - [x] I3.18.f Route proposals/assets into authorized human review with accept/ reject/modify/defer decisions recorded separately. Evidence: review workflow tests. - [x] I3.19 Implement agent pause, redirect, cancel, budget kill, and incident controls. Evidence: race and partial-result tests preserve immutable run history. - [x] I3.19.a Define separate authorized command contracts, eligible states, scope, reason, actor, idempotency, expected version, and outcome for pause/redirect/cancel/budget-kill/incident actions. Evidence: command schemas. - [x] I3.19.b Pause at a safe step/tool boundary, checkpoint resumable state, stop new grants/calls, retain leases as policy permits, and expose blockers. Evidence: pause race tests. - [x] I3.19.c Resume only after revalidating plan/dependencies/grants/policy/ rights/budget/approvals and create a new attempt where required. Evidence: resume validation tests. - [x] I3.19.d Redirect through a new versioned plan revision with explicit changed objectives/steps/tools/budget and preserved completed history. Evidence: redirect lineage tests. - [x] I3.19.e Cancel queued/running steps and downstream dependencies with provider/tool propagation, late-result fencing, and partial-result retention. Evidence: cancellation tests. - [x] I3.19.f Kill on budget ceiling atomically before the next spend, handling in-flight nonrefundable usage and reconciling actual cost. Evidence: budget overshoot tests. - [x] I3.19.g Quarantine/freeze affected runs, outputs, grants, dependencies, and evidence on incident command while preserving investigation access. Evidence: incident containment tests. - [x] I3.19.h Keep append-only command/event/attempt/output history and never recast partial/cancelled/incident results as successful. Evidence: history projection tests. - [x] I3.20 Implement multi-agent/evaluator consensus only as an inspectable decision aid with member identity/version, independence assumptions, votes/scores, disagreement, confidence, timeout/abstention, quorum, escalation, and human decision. Evidence: correlated agents cannot manufacture gate or approval authority. - [x] I3.20.a Define consensus request/member/assessment/vote/score/ abstention/disagreement/quorum/result/escalation contracts with exact versions and evidence refs. Evidence: consensus schemas. - [x] I3.20.b Register each eligible agent/evaluator identity, owner, model/ code/prompt/config version, training/data/provider dependencies, scope, calibration, and lifecycle. Evidence: member registry tests. - [x] I3.20.c Record declared and detected shared model/provider/data/prompt/ tool/dependency lineage as independence assumptions, never as proven independence. Evidence: correlation fixtures. - [x] I3.20.d Collect assessments against the same immutable subject revision, rubric/policy/version, blinded context where required, and per-member timeout. Evidence: collection tests. - [x] I3.20.e Preserve raw votes/scores/reasons/evidence/confidence plus abstention, timeout, error, conflict, and unavailable states. Evidence: assessment projection tests. - [x] I3.20.f Calculate configured aggregation/quorum only from eligible members, applying correlation groups, weights, minimum independence, and deterministic tie behavior. Evidence: aggregation fixtures. - [x] I3.20.g Surface disagreement dimensions, minority assessments, uncertainty, missing members, assumption violations, and escalation reason. Evidence: consensus UI/API tests. - [x] I3.20.h Store consensus as an attributed advisory result and require a separate authorized human/canonical gate decision. Evidence: authority boundary tests. - [x] I3.21 Implement batch LLM/media planning and processing with per-item source/prompt/model/budget, bounded fan-out, partial results, cancellation, retries, aggregation, review, and cost attribution. Evidence: no cross-item context or tenant leak and failed items cannot be hidden by aggregate success. - [x] I3.21.a Define batch, immutable item, dependency, per-item plan/run/ output, aggregate, review, and cost contracts with maximum item/payload limits. Evidence: batch schemas. - [x] I3.21.b Validate every item’s tenant/project/source revision/prompt spec/ workflow/model/rights/policy/target independently before admission. Evidence: mixed-validity intake tests. - [x] I3.21.c Allocate per-item and batch token/tool/compute/cost/time/resource budgets without allowing one item to consume another’s hard ceiling. Evidence: budget isolation tests. - [x] I3.21.d Schedule bounded fan-out with fair queueing, per-provider/tenant concurrency, backpressure, and no unbounded prompt/media materialization. Evidence: batch load tests. - [x] I3.21.e Isolate item context, tools, credentials, temporary files, caches, logs, callbacks, and result destinations. Evidence: cross-item/ cross-tenant leak tests. - [x] I3.21.f Retry only eligible failed item stages with idempotency and attempt limits; never rerun or rewrite successful siblings silently. Evidence: partial retry tests. - [x] I3.21.g Cancel one item or the whole batch with explicit downstream/ in-flight semantics, late-result fencing, and reservation release. Evidence: cancellation race tests. - [x] I3.21.h Aggregate counts/measurements only with success/partial/failure/ cancelled/skipped/unknown denominators and preserve each item’s state. Evidence: aggregate honesty tests. - [x] I3.21.i Route each output through applicable review/gates and prohibit aggregate success from approving failed/unreviewed items. Evidence: review boundary tests. - [x] I3.21.j Attribute estimates/actual cost/variance/retries/cache/shared work to each item and batch total without double counting. Evidence: batch cost reconciliation tests. ### I4 — Asset-kind quality and technical validation - [x] I4.1 Define a versioned gate registry mapping every asset kind and target to mandatory, advisory, and unavailable gates. Evidence: coverage test has no unmapped publishable kind. - [x] I4.1.a Define gate identity/version, evaluator requirements, supported asset/profile/target, applicability, severity, blocking class, inputs, outputs, units, thresholds, and lifecycle. Evidence: gate schema tests. - [x] I4.1.b Register every canonical asset kind and delivery target from the source-of-truth registries without parallel aliases or free-text kinds. Evidence: registry join test. - [x] I4.1.c Classify each gate per asset-kind/target/profile combination as mandatory, advisory, unavailable, or explicitly not applicable with reason. Evidence: matrix fixtures. - [x] I4.1.d Validate required evaluator/model/code/calibration/dependency versions are admitted in the execution environment. Evidence: dependency admission tests. - [x] I4.1.e Resolve the exact gate set deterministically and persist the registry/policy/profile versions consumed by each evaluation. Evidence: resolution tests. - [x] I4.1.f Fail release planning when a publishable asset-kind/target/profile row is missing or a mandatory gate is unavailable. Evidence: coverage and fail-closed tests. - [x] I4.2 Implement image dimension, color-space, alpha, compression, and artifact checks. Evidence: calibrated image fixtures. - [x] I4.2.a Decode supported image formats with byte/pixel/dimension/time/ memory limits and verify declared format against content. Evidence: hostile decoder tests. - [x] I4.2.b Measure width, height, aspect, orientation, DPI/pixel density, and target-specific minimum/maximum/alignment constraints. Evidence: dimension boundary fixtures. - [x] I4.2.c Detect embedded/declared/assumed color space, ICC profile, transfer/primaries, bit depth, gamut, and target conversion requirement. Evidence: color fixtures. - [x] I4.2.d Measure alpha presence/range/premultiplication/fringing/coverage and enforce allowed/required/forbidden alpha by target. Evidence: alpha fixtures. - [x] I4.2.e Identify compression format/quality/subsampling/metadata and measure banding, blocking, ringing, blur, and target size budget. Evidence: compression fixtures. - [x] I4.2.f Detect configured generation/edit artifacts with raw scores, regions, uncertainty, evaluator version, and no unsupported certainty. Evidence: labeled artifact fixtures. - [x] I4.2.g Emit raw measurements separately from target/policy verdicts and remediation. Evidence: image gate contract tests. - [x] I4.3 Implement portrait identity-consistency scoring with consent-aware applicability. Evidence: positive, negative, and not-applicable fixtures. - [x] I4.3.a Resolve authorized identity subject, consent scope/term/status, reference set/revisions, intended use/audience, and comparison asset. Evidence: applicability input tests. - [x] I4.3.b Return explicit not-applicable/blocked when no identity claim, usable reference, valid consent, permitted use, or supported face region exists. Evidence: N/A/refusal fixtures. - [x] I4.3.c Detect and associate faces across reference/output with confidence, multiple-person, occlusion, profile, age, and crop handling. Evidence: association corpus. - [x] I4.3.d Compute calibrated identity similarity per associated face and aggregate only according to versioned policy. Evidence: positive/ negative calibration report. - [x] I4.3.e Report raw similarity, calibration band, uncertainty, association, reference quality, and failure reason without exposing biometric embeddings. Evidence: result/privacy tests. - [x] I4.3.f Enforce retention/access/deletion rules for derived biometric processing artifacts independently of the asset. Evidence: privacy lifecycle tests. - [ ] I4.4 Implement face/hand/anatomy artifact detection. Evidence: labeled evaluation corpus and threshold report. - [x] I4.4.a Define versioned artifact labels, regions, severity, applicability, evaluator outputs, and annotation guidance for faces, hands, limbs, joints, body proportions, and interactions. Evidence: taxonomy schema. - [ ] I4.4.b Assemble licensed, consented, representative positive/negative/ hard-case corpus with demographic, pose, style, crop, occlusion, and multi-person coverage. Evidence: corpus manifest. - [x] I4.4.c Detect face feature count/placement/asymmetry/merging and high-severity structural artifacts with localized confidence. Evidence: face artifact fixtures. - [x] I4.4.d Detect hand/finger count/shape/joint/contact/occlusion artifacts with left/right and person association. Evidence: hand fixtures. - [x] I4.4.e Detect limb/joint/torso/proportion/attachment/intersection and subject-object interaction anomalies. Evidence: anatomy fixtures. - [ ] I4.4.f Calibrate per-label/style/content thresholds and manual-review bands; report precision/recall/false-positive/false-negative slices. Evidence: threshold report. - [x] I4.4.g Emit raw detections/regions/scores/uncertainty separately from policy verdict, respecting sensitive-region access. Evidence: result contract tests. - [x] I4.5 Implement texture resolution, tiling, seam, channel-packing, and PBR consistency checks. Evidence: known material fixtures. - [x] I4.5.a Resolve texture-set membership, material/shader profile, target, UV/UDIM mapping, channel semantics, color spaces, units, and expected resolution. Evidence: texture-set fixtures. - [x] I4.5.b Measure per-map dimensions, aspect, bit depth, mip presence, texel density, UDIM coverage, naming, and target budgets. Evidence: resolution fixtures. - [x] I4.5.c Evaluate intended tile periodicity, border continuity, obvious repetition, scale, and wrap modes in UV context. Evidence: tiling fixtures. - [x] I4.5.d Detect UV island/UDIM boundary seams, padding/bleed, tangent-space normal discontinuity, and channel misalignment. Evidence: seam fixtures. - [x] I4.5.e Verify channel packing/order/range/inversion/defaults for roughness/metalness/AO/height/opacity/masks per target profile. Evidence: packing fixtures. - [x] I4.5.f Verify base-color nonlighting, normal convention/normalization, physical metalness/roughness/range, and cross-map PBR consistency. Evidence: PBR material corpus. - [x] I4.5.g Emit per-map/set raw measures, preview regions, verdicts, and target-specific remediation. Evidence: texture gate tests. - [x] I4.6 Implement video duration, frame-rate, codec, resolution, freeze, duplicate-frame, flicker, and temporal-coherence checks. Evidence: crafted clips yield known results. - [x] I4.6.a Parse container/streams with byte/duration/frame/time/resource limits and verify declared media against decoded content. Evidence: hostile video fixtures. - [x] I4.6.b Measure duration, start/end/time base, frame count, constant/ variable rate, dropped/irregular timestamps, and target tolerances. Evidence: timing fixtures. - [x] I4.6.c Verify codec/profile/level/pixel format/bit depth/chroma/color/HDR/ bitrate/GOP/container and target compatibility. Evidence: codec matrix. - [x] I4.6.d Measure encoded/display resolution, aspect, rotation, crop, safe area, and target dimension/alignment constraints. Evidence: resolution fixtures. - [x] I4.6.e Detect configured freeze intervals and duplicate/near-duplicate frames while distinguishing intentional holds/loops. Evidence: freeze/ duplicate fixtures. - [x] I4.6.f Detect luminance/chroma/exposure flicker with temporal windows, scene-cut awareness, localized regions, and uncertainty. Evidence: flicker fixtures. - [x] I4.6.g Measure temporal identity/geometry/texture/background/motion coherence with scene/shot boundaries and evaluator applicability. Evidence: coherence corpus. - [x] I4.6.h Emit timecoded raw measurements/regions separately from verdicts and remediation. Evidence: video gate contracts. - [x] I4.7 Implement AV-sync and caption/transcript checks where audio is present. Evidence: aligned and misaligned fixtures. - [x] I4.7.a Detect audio presence/tracks/languages/channels and return explicit not-applicable when the profile permits silent media. Evidence: applicability tests. - [x] I4.7.b Normalize video/audio/caption time bases, edits, delays, handles, variable frame rate, and discontinuities without rewriting sources. Evidence: time-base fixtures. - [x] I4.7.c Measure speech-to-mouth and general event-to-sound offset/drift with speaker/event association, confidence, and timecoded regions. Evidence: aligned/misaligned AV fixtures. - [x] I4.7.d Parse caption/subtitle/transcript formats safely and validate encoding, language, cue order, overlap, duration, reading speed, line/ character limits, and target rules. Evidence: caption format tests. - [x] I4.7.e Compare transcript/caption text to speech with language/speaker/ non-speech cue handling, word timestamps, error metrics, and uncertainty. Evidence: transcript accuracy fixtures. - [x] I4.7.f Emit separate raw AV-sync and caption/transcript measurements, not-applicable/unavailable states, verdicts, and remediation. Evidence: result contract tests. - [x] I4.8 Implement audio sample-rate, channel, clipping, silence, loudness, true-peak, noise, and duration checks. Evidence: calibrated WAV fixtures. - [x] I4.8.a Decode supported audio/container formats with byte/sample/channel/ duration/time/memory limits and verify declared content. Evidence: hostile audio fixtures. - [x] I4.8.b Measure sample rate, bit depth/format, channel count/layout/order, phase/polarity, codec/bitrate, and target compatibility. Evidence: format/channel fixtures. - [x] I4.8.c Detect sample/sequence clipping and inter-sample true peaks per channel with exact locations and calibrated oversampling. Evidence: clipping fixtures. - [x] I4.8.d Measure leading/trailing/internal silence, dropout, stuck samples, DC offset, and intended-silence exemptions. Evidence: silence/dropout fixtures. - [x] I4.8.e Measure integrated/short-term/momentary loudness, loudness range, dialogue-gated loudness, and true peak to the target standard. Evidence: calibrated loudness fixtures. - [x] I4.8.f Estimate noise floor/SNR/hum/buzz/hiss/clicks with speech/music/ ambience applicability, regions, and uncertainty. Evidence: noise fixtures. - [x] I4.8.g Measure exact sample duration against declared/timeline/target timing and account for encoder delay/padding. Evidence: duration tests. - [x] I4.8.h Emit per-channel/time-region raw results separately from verdicts and remediation. Evidence: audio gate contracts. - [x] I4.9 Implement mesh topology, manifoldness, watertightness, normals, UV, scale, pivot, material, and polygon-budget checks. Evidence: golden mesh corpus. - [x] I4.9.a Parse supported mesh/scene formats with vertex/face/object/ material/dependency/depth/time/memory limits and content sniffing. Evidence: hostile mesh fixtures. - [x] I4.9.b Measure vertices/edges/faces/triangles/ngons, degenerate/zero- area/duplicate/isolated elements, poles, density, and topology by object. Evidence: topology fixtures. - [x] I4.9.c Detect nonmanifold edges/vertices, boundaries, self-intersections, holes, disconnected shells, and target-specific watertightness. Evidence: manifold/watertight fixtures. - [x] I4.9.d Validate face/vertex/tangent normals for missing/zero/inconsistent/ inverted state, smoothing groups, hard edges, and target convention. Evidence: normal fixtures. - [x] I4.9.e Validate UV sets, required channels, bounds, overlap, distortion, texel density, island padding, UDIM layout, and missing faces. Evidence: UV fixtures. - [x] I4.9.f Resolve declared/source/scene/target units and axes; measure bounds, scale, transforms, origin/pivot, grounding, and orientation. Evidence: scale/pivot fixtures. - [x] I4.9.g Validate material slots/assignments/names/shader compatibility/ texture references and unassigned or unused materials. Evidence: material assignment tests. - [x] I4.9.h Enforce per-object/per-LOD/scene polygon, vertex, material, draw- call, and memory budgets for the selected target. Evidence: budget boundary tests. - [x] I4.9.i Emit per-object and aggregate raw measurements, locations, verdicts, and repair guidance. Evidence: mesh gate contracts. - [x] I4.10 Implement rig hierarchy, bind pose, skin-weight, deformation, and animation-range checks. Evidence: valid and broken rig fixtures. - [x] I4.10.a Parse skeleton/skin/animation data with bone/influence/key/frame/ clip/dependency/resource limits and stable joint identities. Evidence: hostile rig fixtures. - [x] I4.10.b Validate hierarchy roots, parent cycles, duplicate/missing joints, names, required bones, orientation, scale, transforms, and target convention. Evidence: hierarchy fixtures. - [x] I4.10.c Validate bind/reference/rest pose matrices, inverse binds, skeleton/mesh transform agreement, and expected pose/profile. Evidence: bind-pose fixtures. - [x] I4.10.d Measure per-vertex influence count, missing/negative/NaN weights, normalization, tiny weights, joint references, and target limits. Evidence: skin-weight fixtures. - [x] I4.10.e Exercise calibrated poses/clips and detect collapses, excessive stretch, volume loss, penetrations, detached vertices, and joint discontinuities. Evidence: deformation fixtures. - [x] I4.10.f Validate clip names, ranges, frame/time bases, keys, interpolation, loop boundaries, root motion, events, and out-of-range tracks. Evidence: animation-range fixtures. - [x] I4.10.g Emit joint/vertex/clip raw measurements and regions separately from target verdicts. Evidence: rig gate contracts. - [x] I4.11 Implement gaussian-splat geometry, PSNR/SSIM/LPIPS, memory, and renderer-compatibility checks. Evidence: benchmark scene fixtures. - [x] I4.11.a Parse supported splat/container versions with point/property/ coefficient/size/time/memory limits and required-field validation. Evidence: hostile splat fixtures. - [x] I4.11.b Measure point count/density/distribution/bounds/scale/orientation, invalid positions/covariances/scales/rotations/opacities, and outliers. Evidence: geometry fixtures. - [x] I4.11.c Validate spherical-harmonic degree/coefficient count/range, color/opacity encoding, precision, and source-format semantics. Evidence: property fixtures. - [x] I4.11.d Render the same versioned calibrated cameras/reference frames under pinned renderer/config/color settings. Evidence: benchmark render reproducibility tests. - [x] I4.11.e Compute PSNR, SSIM, and LPIPS with explicit masks/color space/ crop/resolution/aggregation and not-applicable state when references are absent. Evidence: metric fixtures. - [x] I4.11.f Measure encoded size, decoded CPU/GPU memory, peak VRAM, upload/ load time, render frame time, and target point budget. Evidence: resource benchmarks. - [x] I4.11.g Test required web/mobile/native/engine renderer feature/format/ precision/SH/compression/device compatibility and degraded modes. Evidence: renderer compatibility matrix. - [x] I4.11.h Emit raw geometry/quality/resource/compatibility results with benchmark versions separately from verdicts. Evidence: splat gate contracts. - [x] I4.12 Implement scene-package reference, dependency, unit, axis, and missing-asset checks. Evidence: broken package fixtures. - [x] I4.12.a Parse package/manifest/scene formats with archive/path/symlink/ entry/size/depth/reference/resource protections. Evidence: hostile package tests. - [x] I4.12.b Build a canonical dependency graph for scenes, subscenes, variants, geometry, materials, textures, rigs, animation, audio, scripts, plugins, and external refs. Evidence: graph fixtures. - [x] I4.12.c Resolve dependencies only within authorized package/registry scope, pin versions/hashes, and reject absolute/traversal/mutable remote references. Evidence: dependency security tests. - [x] I4.12.d Detect missing, unreadable, corrupt, hash-mismatched, duplicate, conflicting, cyclic, unsupported, or unused dependencies with paths. Evidence: broken dependency fixtures. - [x] I4.12.e Reconcile file/object/scene units, axes, handedness, up/forward, transforms, frame/sample rates, and color spaces. Evidence: convention mismatch fixtures. - [x] I4.12.f Validate package manifest completeness, entry scene, target versions, licenses/attribution, provenance, and deterministic inventory. Evidence: manifest tests. - [x] I4.12.g Emit per-dependency/convention raw state, impact graph, verdict, and remediation. Evidence: package gate contracts. - [x] I4.13 Implement delivery-target profiles for web, mobile, broadcast, game engine, DCC, and marketplace. Evidence: one asset can pass one target and fail another for known reasons. - [x] I4.13.a Define immutable target-profile identity/version/lifecycle, supported asset kinds, formats, constraints, mandatory/advisory gates, packaging, metadata, and policy references. Evidence: profile schema. - [x] I4.13.b Author web profiles for browser/runtime/codec/format/color/ dimensions/performance/download/accessibility/security constraints. Evidence: web profile fixtures. - [x] I4.13.c Author mobile profiles for OS/device/GPU/memory/package/codec/ texture/audio/network/store and offline constraints. Evidence: mobile profile fixtures. - [x] I4.13.d Author broadcast profiles for standard/raster/frame/interlace/ color/HDR/audio/loudness/caption/timecode/slate/container constraints. Evidence: broadcast fixtures. - [x] I4.13.e Author game-engine profiles for engine/version/platform/mesh/ texture/material/rig/animation/LOD/collision/performance/import rules. Evidence: engine fixtures. - [x] I4.13.f Author DCC profiles for application/version/plugin/scene/unit/ axis/color/reference/cache/round-trip constraints. Evidence: DCC fixtures. - [x] I4.13.g Author marketplace profiles for category/format/package/ technical/rights/metadata/preview/moderation/submission constraints. Evidence: marketplace fixtures. - [x] I4.13.h Resolve profiles by exact target/version and prove the same measurements yield independently explainable pass/fail/N/A verdicts across targets. Evidence: cross-target golden suite. - [x] I4.14 Persist raw measurements separately from policy verdicts. Evidence: threshold changes can recompute verdicts without reprocessing media. - [x] I4.14.a Define immutable measurement records with subject revision, gate/evaluator/code/model/config/calibration versions, inputs, units, values, regions, uncertainty, applicability, and integrity hash. Evidence: measurement schemas. - [x] I4.14.b Store measurement artifacts and sensitive derived data with classification, authorization, encryption, retention, and deletion rules. Evidence: measurement privacy tests. - [x] I4.14.c Define verdict records that reference measurements plus exact gate-registry/target/policy/threshold versions and never copy ambiguous untyped values. Evidence: verdict schemas. - [x] I4.14.d Evaluate pass/fail/advisory/manual-review/N/A/unavailable/error deterministically from immutable measurements. Evidence: verdict evaluation fixtures. - [x] I4.14.e Recompute new verdict identities after threshold/policy changes without mutating measurements or prior verdicts. Evidence: recompute history tests. - [x] I4.14.f Require media reprocessing when evaluator inputs/code/model/ calibration change and explain why verdict-only recomputation is insufficient. Evidence: invalid recompute tests. - [x] I4.15 Version evaluator code, model, calibration corpus, and thresholds. Evidence: every gate result is reproducible or labeled non-reproducible. - [x] I4.15.a Register evaluator identity/version, source/artifact hash, build/runtime/container, dependencies, configuration, supported inputs, and lifecycle. Evidence: evaluator registry schema. - [x] I4.15.b Register model/checkpoint/preprocessor/tokenizer version/hash/ source/license/security/evaluation and runtime compatibility. Evidence: model dependency tests. - [x] I4.15.c Register calibration corpus version/manifest/hashes/license/ consent/coverage/labels/splits and controlled-access location. Evidence: corpus registry tests. - [x] I4.15.d Register threshold/rubric/aggregation/uncertainty/manual-band/ target-profile versions with approval and effective dates. Evidence: threshold schema tests. - [x] I4.15.e Bind all exact versions and deterministic runtime controls to each measurement; record hardware/provider/environment where relevant. Evidence: execution binding tests. - [x] I4.15.f Reproduce golden results within declared tolerances or label the measurement nonreproducible with the specific uncontrolled source. Evidence: reproducibility suite. - [x] I4.15.g Prevent retired/quarantined/unlicensed/unadmitted dependencies from new runs while retaining historical resolvability. Evidence: lifecycle tests. - [x] I4.16 Add uncertainty and manual-review bands. Evidence: borderline cases never become false automatic passes. - [x] I4.16.a Define permitted uncertainty representation per measurement: confidence interval, calibrated probability, variance, quality flag, unknown, or unavailable. Evidence: uncertainty schema tests. - [x] I4.16.b Propagate input/reference/evaluator/aggregation uncertainty without treating missing or N/A values as zero confidence. Evidence: propagation fixtures. - [x] I4.16.c Define nonoverlapping automatic fail, manual-review, and automatic pass bands per gate/profile/version with boundary inclusivity. Evidence: boundary tests. - [x] I4.16.d Route uncertainty/quality/conflict/missing-dependency conditions into manual review even when the point estimate crosses pass. Evidence: borderline fixtures. - [x] I4.16.e Prohibit aggregation from averaging a manual-review/unknown mandatory gate into automatic pass. Evidence: aggregate bypass tests. - [x] I4.16.f Present point value, units, uncertainty, band, threshold, applicability, evidence, and review reason. Evidence: UI/API tests. - [x] I4.17 Add batch gate execution with per-gate progress and cancellation. Evidence: partial results are preserved but cannot authorize release. - [x] I4.17.a Define evaluation batch, subject, gate item, dependency, attempt, progress, measurement, verdict, cancellation, and aggregate contracts. Evidence: batch gate schemas. - [x] I4.17.b Resolve and freeze exact subjects/revisions/gate registry/ evaluators/target profiles/policies before queueing. Evidence: batch planning tests. - [x] I4.17.c Schedule bounded parallel gate execution by resource class with dependencies, fairness, retries, timeouts, and per-gate isolation. Evidence: scheduler tests. - [x] I4.17.d Emit monotonic per-gate stage/percent/measurement-ready/verdict- ready progress with event id/cursor/deduplication. Evidence: progress stream tests. - [x] I4.17.e Cancel queued/running gates with evaluator propagation, late- result fencing, reservation release, and explicit cancellation outcome. Evidence: cancellation race tests. - [x] I4.17.f Persist valid completed measurements/verdicts from partial runs, failures, and cancellations with exact attempt identities. Evidence: partial preservation tests. - [x] I4.17.g Compute aggregate state with mandatory/advisory/N/A/unavailable/ error/cancelled counts and never emit release authorization. Evidence: aggregate authority tests. - [ ] I4.18 Add accessible quality comparison views. Evidence: raw values, thresholds, units, status, and remediation are available without color or canvas. - [x] I4.18.a Define a typed view model joining exact asset revision, target profile, gate registry, measurement, verdict, uncertainty, override, and evaluation run. Evidence: projection tests. - [x] I4.18.b Present summary counts/status with text/icon/pattern plus filter/ sort/search and explicit mandatory/advisory/N/A/unavailable distinction. Evidence: component/accessibility tests. - [x] I4.18.c Present every raw value, unit, evaluator/version, threshold/ band/operator, uncertainty, applicability, timestamp, and verdict without relying on color. Evidence: detail view tests. - [x] I4.18.d Provide accessible timecoded/spatial/mesh/audio regions using synchronized text tables/lists whenever visual canvas is unavailable. Evidence: noncanvas navigation tests. - [x] I4.18.e Compare asset revisions/targets/evaluation versions without mixing measurements and explain added/removed/changed gates. Evidence: comparison fixtures. - [x] I4.18.f Present authorized remediation, responsible owner, rerun/review action, and immutable evidence links with keyboard-safe focus behavior. Evidence: remediation journey tests. - [ ] I4.18.g Verify screen reader, keyboard, zoom/reflow, contrast, reduced motion, localization/number units, and large gate-set performance. Evidence: automated accessibility/performance tests. ### I5 — Safety, rights, consent, and provenance - [x] I5.1 Enforce model-card and model-version license completeness before dispatch. Evidence: missing or incompatible rights fail closed. - [x] I5.1.a Define required model-card/version license fields for source, license identity/text/version, owner, allowed/prohibited uses, commercial use, derivatives, attribution, territory, term, and evidence. Evidence: license schema tests. - [x] I5.1.b Validate exact model/version/adapters and all transitive licensed dependencies have complete verified nonexpired metadata. Evidence: completeness tests. - [x] I5.1.c Evaluate license compatibility against actor, tenant, project, workflow, input/reference rights, intended use, target, territory, and distribution terms. Evidence: compatibility matrix. - [x] I5.1.d Revalidate licenses/revocations/effective dates immediately before dispatch and bind the decision/evidence versions to the run. Evidence: stale-license race tests. - [x] I5.1.e Return missing/incompatible/expired/revoked/unknown as typed fail-closed outcomes with no provider call. Evidence: zero-dispatch negative tests. - [x] I5.2 Enforce training-data provenance requirements by workflow risk. Evidence: policy fixtures cover unknown, restricted, and approved data. - [x] I5.2.a Define workflow-risk classes and the minimum dataset/source/ collection/license/consent/opt-out/geography/lineage evidence required for each. Evidence: provenance policy schema. - [x] I5.2.b Resolve exact model/version/adapter training-data declarations, dataset versions, upstream sources, known exclusions, and evidence freshness. Evidence: provenance resolver tests. - [x] I5.2.c Classify each dependency as approved, restricted, unknown, incomplete, expired, revoked, or conflicting without treating absence as approval. Evidence: classification fixtures. - [x] I5.2.d Apply intended-use/audience/identity/style/child/protected-source/ commercial risk rules to the resolved provenance graph. Evidence: risk-policy matrix. - [x] I5.2.e Block or require named review according to the ratified risk class and persist the exact decision inputs. Evidence: enforcement tests. - [x] I5.3 Enforce reference-asset rights attestations. Evidence: expired or revoked rights invalidate downstream releases. - [x] I5.3.a Define attestation subject/version/hash, owner/licensor, license/ permission basis, allowed uses, derivative/training rights, attribution, territory, term, restrictions, evidence, and signer authority. Evidence: attestation schema tests. - [x] I5.3.b Verify attestation signature/authority, referenced asset hash, evidence integrity, effective dates, and current revocation state. Evidence: attestation validation tests. - [x] I5.3.c Evaluate scope against the exact conditioning/reference role, workflow/model use, generated derivative, audience, project, target, territory, and publication channel. Evidence: rights matrix. - [x] I5.3.d Bind accepted attestation versions to plan/run/output lineage and propagate required attribution/restrictions. Evidence: lineage tests. - [x] I5.3.e On expiry/revocation/change, mark dependent release eligibility stale and trigger blast-radius/recall policy without rewriting prior evidence. Evidence: invalidation tests. - [x] I5.4 Enforce face-synthesis subject consent with scope, purpose, territory, expiry, and revocation. Evidence: consent matrix tests. - [x] I5.4.a Define verified subject identity, authorized representative, consent evidence/signature, synthesis operations, reference set, purpose/use, audience, project, territory, term, disclosure, retention, and revocation contract. Evidence: face-consent schema. - [x] I5.4.b Verify subject/representative authority and liveness/identity evidence in the approved host without exposing biometric artifacts. Evidence: verification tests. - [x] I5.4.c Match detected/declared subject and requested face identity use to exact consent scope before planning, dispatch, comparison, export, and release. Evidence: consent matrix. - [x] I5.4.d Enforce stricter rules for multiple subjects, minors, public figures, sensitive contexts, cross-purpose reuse, and synthetic subject ambiguity. Evidence: high-risk fixtures. - [x] I5.4.e Propagate expiry/revocation to future use and governed downstream availability while preserving immutable historical proof. Evidence: revocation tests. - [x] I5.5 Enforce voice-cloning consent and speaker verification in the authorized host. Evidence: impersonation and scope-escalation tests. - [x] I5.5.a Define speaker identity, consent grant, voice model/version, reference recordings/hashes, allowed text/use/style/language/audience/ channel/territory/term, disclosure, retention, and revocation. Evidence: voice-consent schema. - [x] I5.5.b Perform speaker identity/liveness/authority verification and reference quality/ownership checks only in the authorized host. Evidence: host-bound verification tests. - [x] I5.5.c Bind trained/enrolled voice artifacts to verified speaker/consent/ source versions and prohibit unauthorized export or model substitution. Evidence: voice artifact lineage tests. - [x] I5.5.d Revalidate requested script, purpose, audience, language/style, channel, territory, term, and actor at preview, generation, and release. Evidence: scope matrix. - [x] I5.5.e Detect and block direct impersonation, claimed-authority, third-party enrollment, replay, cross-project, expired/revoked, and scope- escalation attempts. Evidence: adversarial voice tests. - [x] I5.6 Enforce child-safety restrictions and age-assurance boundaries. Evidence: policy and redaction tests. - [x] I5.6.a Define child-safety operation/content/identity/reference/storage/ sharing/publication restrictions by actor, audience, host, jurisdiction, and uncertainty. Evidence: child-safety policy schema. - [x] I5.6.b Treat declared/detected/uncertain minor status, age-sensitive content, and child identity references with fail-closed escalation rules. Evidence: applicability fixtures. - [x] I5.6.c Accept only approved privacy-preserving age-assurance assertions with issuer, method class, confidence/threshold, scope, freshness, and no raw identity disclosure. Evidence: assertion tests. - [x] I5.6.d Prohibit child sexualization/exploitation, unsafe transformations, biometric/identity misuse, disallowed cloning, and prohibited retention/ sharing at input, plan, dispatch, output, and release. Evidence: end-to-end policy tests. - [x] I5.6.e Redact sensitive child/age evidence from lower-tier UI/API/logs/ exports while retaining authorized safety-review access. Evidence: redaction tests. - [x] I5.6.f Route uncertainty/reportable signals to authorized human safety review and incident/reporting procedures without automatic accusation. Evidence: escalation tests. - [x] I5.7 Implement input and output moderation with explicit uncertainty. Evidence: classifier version, thresholds, and human-review queue. - [x] I5.7.a Define moderation subjects/categories, input/output stages, evaluator versions, thresholds/bands, regions/timecodes, uncertainty, action policy, and audience projections. Evidence: moderation schemas. - [x] I5.7.b Moderate brief text, structured controls, reference media, imported specs/graphs, filenames/metadata, and linked sources before planning/dispatch. Evidence: input coverage tests. - [x] I5.7.c Moderate every generated/derived media component, transcript/ caption/metadata, preview, bundle, and variant before exposure/release. Evidence: output coverage tests. - [x] I5.7.d Combine multiple classifier/rule results without averaging away a blocking category, and preserve conflicts/unavailable/error states. Evidence: aggregation tests. - [x] I5.7.e Persist raw attributed scores/regions/uncertainty separately from policy verdict/action and exact evaluator/threshold versions. Evidence: moderation result tests. - [x] I5.7.f Route configured uncertainty/manual bands to a prioritized human queue with subject lock, evidence, decision, and no false auto-pass. Evidence: review queue tests. - [x] I5.8 Implement similarity/originality screening appropriate to visual, audio, 3D, and video assets. Evidence: results are advisory or blocking only according to ratified policy. - [x] I5.8.a Define protected/reference corpus scope, version, rights/access, modality-specific fingerprints/embeddings, thresholds, uncertainty, and permitted decision use. Evidence: screening policy schema. - [x] I5.8.b Implement visual whole-image and localized composition/content/ style similarity with crop/transform/near-duplicate handling. Evidence: visual similarity fixtures. - [x] I5.8.c Implement audio fingerprint/melody/harmony/rhythm/timbre/voice/ sample similarity with time alignment and licensed-source exclusions. Evidence: audio similarity fixtures. - [x] I5.8.d Implement 3D geometry/topology/shape/texture/material/scene similarity with units/transforms/partial components. Evidence: 3D similarity fixtures. - [x] I5.8.e Implement video frame/shot/temporal/audio similarity with reencoding/crop/rate/edit alignment. Evidence: video fixtures. - [x] I5.8.f Return candidate matches, protected-source identities only when authorized, raw scores/regions, uncertainty, corpus/version, and no unsupported ownership conclusion. Evidence: result/privacy tests. - [x] I5.8.g Apply advisory/manual/blocking action solely from ratified modality/use/risk policy and require human rights review where specified. Evidence: policy-boundary tests. - [x] I5.9 Implement visible watermark policy per audience and asset kind. Evidence: output inspection confirms coverage and legibility. - [x] I5.9.a Define watermark requirements by asset kind, audience, preview/ review/release state, target/channel, disclosure text/mark, placement, persistence, and removal authority. Evidence: policy matrix. - [x] I5.9.b Render image/texture watermarks with safe-area, scale, contrast, opacity, repetition, crop/resize resilience, and alpha/color handling. Evidence: image inspection fixtures. - [x] I5.9.c Render video/animation watermarks with temporal coverage, movement/placement, scene/crop considerations, HDR/color, and captions/ safe areas. Evidence: video inspection fixtures. - [x] I5.9.d Render audio watermarks/disclosures where policy requires with intelligibility, timing, loudness, localization, and accessibility. Evidence: audio disclosure tests. - [x] I5.9.e Apply 3D/splat/package preview overlays or embedded visible disclosure assets without corrupting source geometry/package. Evidence: 3D/package tests. - [x] I5.9.f Verify the final stored/delivered bytes for required legibility/ coverage after target transformation and block on missing marks. Evidence: post-write inspection tests. - [x] I5.9.g Record policy/version/render config/result and govern authorized removal as a new output revision. Evidence: watermark lineage tests. - [x] I5.10 Implement robust invisible watermarking where supported. Evidence: channel-transformation survival evaluation. - [x] I5.10.a Define supported modalities/formats/targets, payload, key/version, embed/detect algorithms, strength/quality limits, disclosure, and unavailable policy. Evidence: invisible-mark schema. - [x] I5.10.b Embed a minimal opaque ledger/output identifier after generation at the correct pipeline stage without encoding sensitive metadata. Evidence: embed/extract tests. - [x] I5.10.c Verify the stored artifact contains the expected mark with confidence and no unacceptable quality/technical-gate regression. Evidence: post-embed validation tests. - [x] I5.10.d Evaluate detection survival across configured resize/crop/ transcode/compression/color/audio resample/time-stretch/noise/screenshot/ recording transformations. Evidence: robustness benchmark. - [x] I5.10.e Measure false-positive/collision/wrong-payload/tamper rates on marked and unmarked calibrated corpora. Evidence: calibration report. - [x] I5.10.f Protect embed/detect keys and detailed parameters, support key rotation, and retain authorized historical verification. Evidence: key lifecycle/security tests. - [x] I5.10.g Return explicit unsupported/unavailable/degraded state and never claim invisible marking from policy intent alone. Evidence: honest-state tests. - [x] I5.11 Implement C2PA Content Credentials with ingredient lineage. Evidence: signed artifacts validate through the pinned toolchain. - [x] I5.11.a Define assertion/claim profile per asset kind/target with creator/ tool identity, actions, ingredients, AI disclosure, rights, timestamps, hashes, and privacy filtering. Evidence: manifest profile tests. - [x] I5.11.b Build ingredient lineage from immutable source/reference/model/ workflow/run/output/edit identities and represent redacted/external/ missing ingredients explicitly. Evidence: lineage mapping fixtures. - [x] I5.11.c Generate canonical manifests bound to final output bytes after target transformation and before registry write verification. Evidence: manifest generation tests. - [x] I5.11.d Sign through approved external key custody with certificate/ timestamp/status checks, rotation, and no private-key application access. Evidence: signing integration tests. - [x] I5.11.e Embed or sidecar credentials according to format/target and keep package references/hash bindings deterministic. Evidence: packaging tests. - [x] I5.11.f Validate signature, trust chain, timestamp, status, asset hash, assertions, ingredients, and policy using the pinned independent toolchain. Evidence: verification fixtures. - [x] I5.11.g Handle unsupported formats/signing failure/invalid credentials as explicit blocking or degraded states per target profile. Evidence: failure-mode tests. - [x] I5.12 Implement external provenance-ledger recovery. Evidence: stripped manifest can be matched without false association. - [x] I5.12.a Define a privacy-minimized ledger record containing opaque asset/ output identity, strong content hash/fingerprint versions, credential digest, issuance/status, and authorized recovery metadata. Evidence: ledger schema. - [x] I5.12.b Write ledger records transactionally with release/output state and verify external acknowledgement/integrity. Evidence: write failure tests. - [x] I5.12.c Recover exact-byte matches by cryptographic hash and transformed candidates by calibrated modality-specific fingerprints as distinct result classes. Evidence: recovery fixtures. - [x] I5.12.d Enforce confidence/collision/ambiguity thresholds and return multiple/no-match/manual-review rather than false association. Evidence: false-match corpus. - [x] I5.12.e Authorize recovery queries, rate-limit enumeration, and redact tenant/creator/source metadata until proof/role permits disclosure. Evidence: privacy/abuse tests. - [x] I5.12.f Respect recall/revocation/deletion/legal-hold status while retaining minimum required provenance proof. Evidence: lifecycle tests. - [x] I5.13 Implement consent, license, model, workflow, and source blast-radius queries. Evidence: revocation preview lists every dependent run, asset, collection, and release. - [x] I5.13.a Build immutable reverse dependency edges from consent, rights/ license, source/reference, dataset/model/adapter, workflow/node, policy, run, output, asset, bundle, collection, and release versions. Evidence: dependency graph tests. - [x] I5.13.b Accept only authorized exact subject/version/hash/revocation inputs and distinguish direct from transitive dependency. Evidence: query contract tests. - [x] I5.13.c Traverse cycles/depth/fan-out safely with stable pagination and complete typed nodes/edges/reasons. Evidence: large graph tests. - [x] I5.13.d Report affected plans/runs/outputs/assets/variants/bundles/ collections/gallery/marketplace/releases/targets and current state. Evidence: blast-radius golden fixtures. - [x] I5.13.e Calculate prospective policy action, urgency, owner, replacement/ remediation, and unresolved/unknown dependencies without mutating them. Evidence: preview tests. - [x] I5.13.f Enforce tenant/project/property-level redaction while preserving accurate authorized aggregate counts. Evidence: cross-tenant tests. - [x] I5.14 Implement recall and quarantine propagation. Evidence: affected gallery items and releases become unavailable according to policy. - [x] I5.14.a Define recall/quarantine case, trigger, subject, scope, severity, actor/authority, policy, target actions, deadlines, status, and evidence. Evidence: case schemas. - [x] I5.14.b Freeze the authorized blast-radius snapshot and require explicit include/exclude reasons for any bounded scope adjustment. Evidence: scope tests. - [x] I5.14.c Quarantine affected model/workflow/source/output/asset/bundle versions from new planning, reuse, review, and release atomically. Evidence: admission tests. - [x] I5.14.d Unpublish/disable affected gallery, marketplace, collection, campaign, download, API, CDN, and target-distribution references according to channel policy. Evidence: propagation integration tests. - [x] I5.14.e Revoke/replace signed URLs, caches, credentials/manifests where supported and verify downstream state; record irrecoverable copies. Evidence: post-action verification tests. - [x] I5.14.f Notify required owners/reviewers/consumers/incidents with audience-safe reasons and track acknowledgements/escalation. Evidence: notification tests. - [x] I5.14.g Restore only via a new authorized case decision after remediation and complete verification; preserve recall/quarantine history. Evidence: restoration tests. - [x] I5.15 Protect biometric and protected-source fields in UI, logs, notifications, exports, and support tools. Evidence: redaction suite. - [x] I5.15.a Classify face/voice embeddings, identity evidence, age assurance, consent artifacts, protected source/corpus, similarity matches, and derived identifiers at schema/property level. Evidence: data inventory. - [x] I5.15.b Define per-role/purpose/host/tenant field visibility, masking, aggregation, use, export, retention, and break-glass rules. Evidence: access matrix. - [x] I5.15.c Apply centralized projection/redaction before UI/API/event/ websocket/search/index/cache exposure. Evidence: property authorization tests. - [x] I5.15.d Apply structured log/trace/metric/error/audit scrubbing and block sensitive values from labels, URLs, exception bodies, and debug dumps. Evidence: telemetry leak tests. - [x] I5.15.e Render notifications/email/webhooks/support views with safe references and separately authorized drill-down. Evidence: notification/ support redaction tests. - [x] I5.15.f Sanitize CSV/JSON/package/portable-spec/evidence exports and protect against hidden metadata/filenames/formulas. Evidence: export leak tests. - [x] I5.15.g Enforce encryption/key separation/retention/deletion and audit every authorized sensitive-field access. Evidence: lifecycle/access tests. - [x] I5.16 Implement authorized exception workflows without mutating original evidence. Evidence: waiver scope, expiry, approver, and audit. - [x] I5.16.a Define exception request, exact subject/version/gate/policy, requested bounded waiver, rationale, evidence, risk, compensating controls, requester, approver roles, term, and status. Evidence: exception schema. - [x] I5.16.b Declare nonwaivable child safety, legal/rights/consent, security, tenant isolation, human-authority, and other code-floor conditions. Evidence: nonwaivable policy tests. - [x] I5.16.c Validate requester/approver separation, role/scope, conflict of interest, evidence completeness, subject freshness, and approval quorum. Evidence: authorization tests. - [x] I5.16.d Record approve/reject/request-changes/withdraw/expire/revoke as immutable decisions linked to original measurements/verdict/evidence. Evidence: decision history tests. - [x] I5.16.e Apply an approved exception only to exact subject revisions, gates/targets/use/audience/territory and validity window; revalidate at each governed action. Evidence: scope escalation tests. - [x] I5.16.f Surface active/expired/revoked exception and compensating controls without changing the underlying failed/raw result. Evidence: projection tests. - [x] I5.16.g Trigger review on subject/policy/evidence change and automatic expiry/revocation actions plus blast-radius/notification. Evidence: lifecycle tests. ### I6 — Persistence, service API, and integration - [ ] I6.1 Decide which existing Isis databases own briefs, plans, runs, variants, gates, rights, and releases. Evidence: ownership ADR prevents a duplicate shadow store. - [x] I6.1.a Inventory existing stores, schemas, repositories, services, tenancy models, transactions, retention, backup, and production data for each Isis aggregate. Evidence: current-state inventory. - [x] I6.1.b Map brief, plan, run/job/stage, variant/output, gate measurement/ verdict, rights/consent/provenance, and release records to exactly one system of record. Evidence: aggregate ownership matrix. - [x] I6.1.c Define read model, derived index/cache, blob, audit, outbox, and analytics ownership separately from canonical mutation ownership. Evidence: data-flow diagram. - [x] I6.1.d Resolve cross-store transaction/consistency, identity/version, tenancy, retention/deletion, migration, failure, and recovery seams. Evidence: consistency decision record. - [ ] I6.1.e Ratify an ADR naming owner/service/store per aggregate and explicitly prohibiting shadow canonical tables. Evidence: approved ADR and schema inventory check. - [ ] I6.2 Add only missing schema through expand/backfill/verify/contract migrations. Evidence: production-size rehearsal. - [x] I6.2.a Diff required contracts against ratified owner schemas and record each reusable field/table/index versus genuine gap. Evidence: schema gap report. - [ ] I6.2.b Add backward-compatible nullable/default-safe columns, tables, constraints, enum representations, and dual-read/write support without destructive rename/drop. Evidence: expand migration tests. - [ ] I6.2.c Backfill in resumable bounded batches with checkpoints, idempotency, throttling, tenant isolation, error quarantine, and observable progress. Evidence: backfill integration tests. - [ ] I6.2.d Verify row counts, null/uniqueness/FK/check invariants, sampled semantic equality, hashes, read paths, and lag before cutover. Evidence: verification report. - [ ] I6.2.e Switch readers/writers through a reversible compatibility phase and monitor errors/latency/data divergence. Evidence: cutover rehearsal. - [ ] I6.2.f Contract old schema only after rollback window and dependent version inventory prove no consumers remain. Evidence: contract gate. - [ ] I6.2.g Rehearse expand/backfill/verify/cutover/rollback/contract against production-size/sparsity/skew with resource and lock measurements. Evidence: migration rehearsal report. - [ ] I6.3 Add indexes for actor, tenant, project, workflow, model, provider, status, asset kind, dates, gate state, and lineage. Evidence: query plans. - [ ] I6.3.a Capture representative list/detail/search/filter/lineage/blast- radius/release query shapes, cardinalities, sort orders, and latency targets from production-scale fixtures. Evidence: workload catalog. - [x] I6.3.b Design tenant-leading composite/partial/covering indexes for actor/project/status/kind/date queue and pagination access paths. Evidence: index rationale. - [x] I6.3.c Design workflow/model/provider/version/status/time indexes for routing, operations, blast radius, and cost analysis. Evidence: query plan fixtures. - [x] I6.3.d Design gate subject/profile/state/freshness and forward/reverse lineage indexes without introducing cross-tenant paths. Evidence: gate/lineage plans. - [ ] I6.3.e Measure read latency, rows scanned, index size, write amplification, lock/build impact, and redundant-index overlap at production scale. Evidence: before/after benchmark. - [ ] I6.3.f Create/drop indexes with online/concurrent safe migrations and regression-plan assertions. Evidence: migration/query-plan tests. - [ ] I6.4 Implement transaction-bound audit and outbox writes for mutations. Evidence: rollback and retry integration tests. - [x] I6.4.a Define canonical mutation/audit/outbox envelope with actor/ authority, tenant/project, request/correlation/idempotency, aggregate/ revision, operation, before/after references, reason, policy, and time. Evidence: event schemas. - [ ] I6.4.b Write aggregate mutation, immutable audit record, and unpublished outbox row in the same owner-database transaction. Evidence: atomicity tests. - [ ] I6.4.c Ensure rollback leaves none of the three writes and retry with the same idempotency key creates no duplicates. Evidence: rollback/retry integration tests. - [ ] I6.4.d Publish outbox rows with leases/fencing, at-least-once delivery, stable event IDs/order keys, retry/backoff, and dead-letter handling. Evidence: publisher crash tests. - [ ] I6.4.e Make consumers idempotent against duplicate/out-of-order events and prevent stale projections from authorizing action. Evidence: consumer ordering tests. - [ ] I6.4.f Apply property classification/redaction to event projections and audit access while preserving authorized forensic evidence. Evidence: event leak tests. - [ ] I6.5 Implement brief/plan/run/variant read APIs with deterministic pagination. Evidence: contract tests. - [x] I6.5.a Define versioned list/detail/filter/sort/include/projection contracts for briefs, plans, runs/stages/attempts, variant sets, outputs, decisions, and lineage. Evidence: API schemas. - [ ] I6.5.b Enforce tenant/project/actor/audience/object/property authorization before query and after joins/includes. Evidence: authorization tests. - [x] I6.5.c Implement allowlisted filters/sorts with stable unique tie-break, bounded page size, opaque signed cursor, and snapshot/continuation semantics. Evidence: pagination mutation tests. - [x] I6.5.d Project explicit missing/redacted/unavailable/not-applicable/ stale states and audience-appropriate details. Evidence: projection fixtures. - [ ] I6.5.e Bound joins/lineage expansion, batch dependent reads, avoid N+1, and verify production-scale query plans. Evidence: performance tests. - [ ] I6.5.f Publish OpenAPI/consumer fixtures for first/middle/final/empty pages, invalid cursors, deleted/changed rows, and role tiers. Evidence: contract suite. - [ ] I6.6 Implement guarded dispatch API with idempotency and budget reservation. Evidence: duplicate-submit and stale-policy tests. - [ ] I6.6.a Define dispatch command/result contracts with exact plan/version, expected state, estimate/confirmation, reservation, actor context, idempotency key, and policy/code versions. Evidence: API schema. - [ ] I6.6.b Authenticate and authorize route/function/object/property; load the canonical plan rather than trusting client-supplied workflow/model/ cost/tool details. Evidence: mass-assignment tests. - [ ] I6.6.c Revalidate plan inputs, rights/consent, safety, dependencies, endpoint capability, approvals, quota, budget, and freshness in one guarded transition. Evidence: guard matrix. - [ ] I6.6.d Atomically bind/consume budget/resource/quota reservation and create durable job/outbox/audit state. Evidence: transaction tests. - [ ] I6.6.e Return the original command result for identical idempotent retry and conflict for key reuse with different canonical input. Evidence: duplicate-submit tests. - [ ] I6.6.f Reject changed policy/plan/evidence/reservation between confirm and dispatch with no provider call. Evidence: TOCTOU tests. - [ ] I6.7 Implement job progress/cancel/retry/replay APIs. Evidence: state and role matrices. - [ ] I6.7.a Define snapshot and cursor-based event/progress contracts for job, stage, attempt, queue, reservation, cost, errors, and outputs. Evidence: progress API schemas. - [ ] I6.7.b Implement bounded authenticated progress reads/streams with event deduplication, reconnect, terminal closure, redaction, and no cross- tenant IDs/counts. Evidence: stream tests. - [ ] I6.7.c Implement cancel commands only for eligible states/roles with expected version, reason, idempotency, propagation status, and audit. Evidence: cancel state matrix. - [ ] I6.7.d Implement retry as a new attempt only for canonical retryable failures/stages under current policy/budget/dependency checks. Evidence: retry state matrix. - [ ] I6.7.e Implement replay as a new run identity with exact/current/fork mode, preview, confirmation, and immutable source linkage. Evidence: replay role/state tests. - [ ] I6.7.f Reject direct terminal-state rewrites, arbitrary retry-from-stage, hidden control changes, and stale expected versions. Evidence: adversarial command tests. - [ ] I6.8 Implement gate run/result/rerun APIs. Evidence: stale result cannot satisfy publish eligibility. - [ ] I6.8.a Define gate-plan/run/item/progress/measurement/verdict/aggregate/ freshness/rerun contracts with exact subject and evaluator versions. Evidence: gate API schemas. - [ ] I6.8.b Resolve required gates server-side from asset kind/target/profile/ registry rather than accepting a client-declared passing set. Evidence: gate resolution tests. - [ ] I6.8.c Create/run/cancel gate batches with authorization, idempotency, resource limits, and immutable subject revision binding. Evidence: run command tests. - [ ] I6.8.d Read raw measurements/verdicts/regions/uncertainty with field- level authorization and deterministic pagination. Evidence: result API tests. - [ ] I6.8.e Compute freshness from subject/evaluator/gate-registry/profile/ policy/dependency versions at read and release-check time. Evidence: stale-result tests. - [ ] I6.8.f Rerun creates new evaluation identities, preserves old results, states reason/scope, and cannot promote release state. Evidence: rerun history tests. - [ ] I6.9 Implement rights, consent, and provenance APIs with field-level authorization. Evidence: protected-property tests. - [ ] I6.9.a Define versioned rights/attestation/consent/subject/source/ ingredient/credential/ledger/blast-radius contracts with explicit redacted/unknown/expired/revoked states. Evidence: API schemas. - [ ] I6.9.b Separate metadata, evidence upload/retrieval, verification, grant/revoke, lineage query, and recovery operations by permission and host. Evidence: operation authorization matrix. - [ ] I6.9.c Enforce tenant/project/subject/purpose/object/property rights on every nested field, include, search, export, and error. Evidence: protected-property tests. - [ ] I6.9.d Accept evidence through immutable hashed storage references with content/size/scan/classification/retention validation. Evidence: hostile evidence upload tests. - [ ] I6.9.e Make consent/right changes versioned commands that trigger outbox/audit/blast-radius state without rewriting consumed evidence. Evidence: revocation integration tests. - [ ] I6.9.f Return privacy-safe counts/cursors and prevent enumeration through timing, not-found/forbidden differences, or identifiers. Evidence: enumeration tests. - [ ] I6.10 Implement release plan/execute/verify/recall APIs. Evidence: time-of-check/time-of-use race test. - [ ] I6.10.a Define immutable release candidate/target plan, prerequisite snapshot, confirmation, execution step, verification, receipt, failure, rollback, and recall contracts. Evidence: release API schemas. - [ ] I6.10.b Plan server-side from exact asset/bundle revisions, target profiles, gates, rights/consent, provenance, approvals, destinations, capacity, cost, and policy. Evidence: planning tests. - [ ] I6.10.c Require authorized confirmation bound to the unchanged plan/ prerequisite hashes and idempotency key. Evidence: stale-confirmation tests. - [ ] I6.10.d Revalidate every prerequisite immediately before atomic release transition and each external target write. Evidence: TOCTOU tests. - [ ] I6.10.e Execute target steps with durable checkpoints, idempotent writes, partial-failure visibility, compensation/rollback, and immutable receipts. Evidence: failure recovery tests. - [ ] I6.10.f Verify final external/registry/gallery bytes, hashes, manifests, metadata, visibility, and URLs before success. Evidence: post-write verification tests. - [ ] I6.10.g Recall by authorized case/scope with blast-radius preview, propagation, verification, and immutable history. Evidence: recall API tests. - [ ] I6.11 Implement gallery promotion from Yemaya to Oshun editorial. Evidence: original AAA output and curated derivative retain lineage. - [ ] I6.11.a Define promotion request/candidate/decision contracts linking exact Yemaya project/output/revision and intended Oshun editorial collection/use/audience. Evidence: promotion schemas. - [ ] I6.11.b Authorize source project/output access, promotion authority, destination editorial scope, and protected-field projection across service boundaries. Evidence: cross-host authorization tests. - [ ] I6.11.c Revalidate source integrity, asset kind/target compatibility, safety/rights/consent/provenance/gates, and source lifecycle before acceptance. Evidence: eligibility tests. - [ ] I6.11.d Create an Oshun curated derivative/revision with new identity, bounded editorial metadata/transforms, and immutable ingredient linkage to the original AAA output. Evidence: lineage tests. - [ ] I6.11.e Route the derivative through Oshun editorial review/release without granting Yemaya approval/publication authority. Evidence: authority boundary tests. - [ ] I6.11.f Propagate source supersession/quarantine/recall/rights changes through the derivative dependency edge. Evidence: lifecycle integration tests. - [ ] I6.12 Implement signed deep links among Isis, Yemaya, Oshun Studio, and output gallery. Evidence: tenant, expiry, permission, and replay tests. - [ ] I6.12.a Define allowlisted link intents/hosts/routes and minimal claims for opaque subject reference, tenant/project, audience, issuer, target, issued/expiry/not-before, nonce, and version. Evidence: link schema. - [ ] I6.12.b Issue links only after source authorization using externally managed rotating signing keys and canonical URL encoding. Evidence: issuance tests. - [ ] I6.12.c Validate signature/key/status, issuer/audience/host/route, timestamps/skew, nonce/replay policy, and claim limits before routing. Evidence: validation tests. - [ ] I6.12.d Reauthorize the current actor against the canonical referenced object/property/function after validation; never treat possession as access. Evidence: tenant/permission tests. - [ ] I6.12.e Avoid credentials, private metadata, raw IDs where opaque refs suffice, return safe expired/invalid/forbidden states, and scrub referrers/logs. Evidence: link leak tests. - [ ] I6.12.f Test forward/back navigation, logged-out continuation, consumed/ replayed links, moved/deleted/quarantined objects, and host mismatch. Evidence: cross-host journey tests. - [ ] I6.13 Implement capability/health APIs per host audience. Evidence: unauthorized capability details do not leak. - [ ] I6.13.a Define separate public/curated/AAA/operator capability and health projections with stable available/degraded/unavailable/not-configured/ unauthorized semantics. Evidence: projection schemas. - [ ] I6.13.b Derive effective capability from canonical audience/host policy, workflow/model/provider admission, dependencies, quota/capacity, and current health. Evidence: derivation tests. - [ ] I6.13.c Expose only high-level asset/operation/control availability and remediation appropriate to curated/AAA users. Evidence: lower-tier contract fixtures. - [ ] I6.13.d Expose bounded endpoint/worker/model/workflow dependency detail only to authorized operators with field-level controls. Evidence: operator contract tests. - [ ] I6.13.e Apply freshness/cache/stale/timeout/partial aggregation rules and never translate unknown/not-configured into healthy. Evidence: failure state tests. - [ ] I6.13.f Scan response/error/headers/telemetry for provider URLs, model/ node IDs, capacity, tenant, credentials, and hidden features by audience. Evidence: capability leak suite. - [ ] I6.14 Add consumer-driven contracts for all three hosts. Evidence: incompatible API change fails CI. - [ ] I6.14.a Inventory Isis operator, Yemaya AAA, and Oshun curated/gallery consumers, versions, routes, events, fields, actions, and audience assumptions. Evidence: consumer inventory. - [ ] I6.14.b Capture provider contracts for success, empty, partial, stale, degraded, not-configured, unauthorized, validation, conflict, rate/ quota, and server failure cases. Evidence: contract fixtures. - [ ] I6.14.c Capture property absence/redaction, enums/discriminators, units, pagination/cursors, idempotency, versions, and error codes rather than example-only shapes. Evidence: schema assertions. - [ ] I6.14.d Verify each consumer contract against the real provider/service implementation and ratified source-of-truth registries in CI. Evidence: provider verification. - [ ] I6.14.e Verify deployed/provider version compatibility before consumer release and publish contract artifacts with ownership. Evidence: deployment gate. - [ ] I6.14.f Fail breaking removal/type/semantic/auth/audience changes while allowing explicitly compatible additive evolution. Evidence: deliberate breaking-change test. - [ ] I6.15 Add two-tenant integration coverage across run, blob, search, lineage, export, and recall. Evidence: no cross-tenant result or count leakage. - [ ] I6.15.a Provision two tenants with colliding human names, projects, filenames, tags, timestamps, model/workflow use, and distinct actors/ roles/data. Evidence: isolation fixture. - [ ] I6.15.b Exercise plan/dispatch/job/progress/cancel/retry/replay/output/ variant reads and direct foreign IDs/cursors/idempotency keys. Evidence: run isolation tests. - [ ] I6.15.c Exercise blob upload/download/signed URL/hash/cache/derivative/ temporary object and guessed-path access. Evidence: storage isolation tests. - [ ] I6.15.d Exercise search/filter/sort/autocomplete/facets/counts/ suggestions/index lag and foreign identifiers. Evidence: search isolation tests. - [ ] I6.15.e Exercise forward/reverse lineage, provenance ingredients, blast-radius, comparison, gate, audit, and aggregate counts. Evidence: graph isolation tests. - [ ] I6.15.f Exercise JSON/CSV/package/portable-spec/evidence/bundle exports, jobs, download URLs, filenames, metadata, and hidden sheets/entries. Evidence: export isolation tests. - [ ] I6.15.g Exercise quarantine/recall/unpublish/notification propagation and prove one tenant’s action cannot mutate or disclose the other. Evidence: recall isolation tests. - [ ] I6.15.h Inspect API/UI/error/timing/log/trace/event/cache/CDN/queue channels for result, identifier, existence, and count leakage. Evidence: cross-channel isolation report. ### I7 — Operator, AAA, and curated user experience - [ ] I7.1 Refactor the Isis operator dashboard around queue health, provider health, release gates, spend, incidents, and actionable exceptions. Evidence: live-data Playwright journey. - [ ] I7.1.a Define the operator’s primary triage questions, canonical live projections, refresh/staleness semantics, permissions, and action ownership for every dashboard datum. Evidence: dashboard view contract. - [ ] I7.1.b Compose a restrained operations workspace with queue and incident attention first, supporting health/spend/gate context second, and no decorative hero or repeated card grid. Evidence: approved responsive layout spec. - [ ] I7.1.c Present queue age/depth/capacity/fairness, provider/circuit/ maintenance state, gate blockers/freshness, spend/variance, and incident severity with explicit units and timestamps. Evidence: projection tests. - [ ] I7.1.d Build actionable exception lists grouped by owner/severity/ deadline with stable filters, URLs, drill-down context, and bounded live updates. Evidence: exception interaction tests. - [ ] I7.1.e Gate pause/drain/retry/quarantine/budget/incident actions by exact object state, permission, confirmation, reason, and optimistic concurrency. Evidence: action authorization tests. - [ ] I7.1.f Render loading/empty/stale/degraded/partial/not-configured/error/ disconnected states without implying green health. Evidence: state matrix tests. - [ ] I7.1.g Verify live incident-to-detail-to-remediation-to-recovery journey, keyboard/screen reader/zoom/responsive behavior, and high-volume performance in Playwright. Evidence: dashboard E2E. - [ ] I7.2 Complete the operator workflow-template registry and lifecycle UI. Evidence: draft through archive with review and audit. - [ ] I7.2.a Build searchable/filterable registry list and detail projections for identity/version, lifecycle, asset/operation/audience, owner, dependencies, evaluations, environments, and usage. Evidence: registry UI tests. - [ ] I7.2.b Build typed create/edit/version authoring for metadata, graph/ subgraph refs, controls, compatibility, rights, resource estimates, and target profiles without arbitrary JSON. Evidence: authoring tests. - [ ] I7.2.c Show canonical graph validation, dependency locks, security/ license scans, dry runs, benchmarks, diffs, and missing evidence before review. Evidence: validation view tests. - [ ] I7.2.d Implement submit/request-changes/approve/reject with reviewer role, comments, exact version/evidence binding, and immutable decisions. Evidence: review journey. - [ ] I7.2.e Implement promote/deprecate/revoke/quarantine/archive/restore actions with blast-radius preview, environment rules, confirmation, and audit. Evidence: lifecycle journey. - [ ] I7.2.f Present version history, current/admitted selections, consumers, runs, decisions, audit, and rollback options without rewriting history. Evidence: history tests. - [ ] I7.2.g Verify concurrency, stale evidence, direct URL/field/function authorization, accessibility, and large-registry performance. Evidence: adversarial Playwright suite. - [ ] I7.3 Complete the operator model/model-version intake and quarantine UI. Evidence: license, scan, evaluation, promotion, and revoke journey. - [ ] I7.3.a Build model/version intake for immutable source/artifact hash, architecture/format/runtime, files, dependencies, owner, license/model card, intended uses, and provider compatibility. Evidence: intake tests. - [ ] I7.3.b Present upload/remote retrieval progress and malware/signature/ format/safe-parser scan results with quarantined-by-default state. Evidence: scan journey. - [ ] I7.3.c Present license, training-data provenance, rights restrictions, model-card completeness, security risks, and exact blocking gaps. Evidence: evidence view tests. - [ ] I7.3.d Configure and track calibrated quality/safety/performance/ compatibility evaluations, fixtures, results, uncertainty, and failures. Evidence: evaluation journey. - [ ] I7.3.e Compare versions/models on authorized measurements, target fit, latency/cost/resources, rights, and risk without hiding unavailable data. Evidence: comparison tests. - [ ] I7.3.f Implement review/promote/deprecate/quarantine/revoke/archive with exact artifact/evidence binding, environment progression, blast-radius, reason, and confirmation. Evidence: lifecycle journey. - [ ] I7.3.g Show immutable provenance/decisions/audit/consumers/runs and verify stale-version, supply-chain, mass-assignment, accessibility, and performance cases. Evidence: model registry E2E. - [ ] I7.4 Complete the provider endpoint and failover UI. Evidence: health, circuit state, maintenance, and routing reasons are live. - [ ] I7.4.a Build endpoint/pool/provider topology views with class, region, environment, capability versions, model/node images, GPU/resources, capacity, lifecycle, owner, and last update. Evidence: topology tests. - [ ] I7.4.b Present probe/queue/worker/provider health, freshness, partial/ unknown/not-configured states, incidents, and SLO history separately. Evidence: health state tests. - [ ] I7.4.c Present per-family circuit closed/open/half-open state, counted failures, thresholds, cooldown/probes, and recent decisions. Evidence: circuit view tests. - [ ] I7.4.d Explain routing candidates, filters, selected endpoint, policy, capability/residency/cost/latency/capacity reasons, and audience-safe redactions. Evidence: routing inspector tests. - [ ] I7.4.e Implement authorized drain/restore/disable/probe/canary/failover actions with in-flight preview, deadlines, reason, expected version, and audit. Evidence: maintenance journey. - [ ] I7.4.f Stream live changes with cursor/reconnect/dedup/stale handling and verify failover, race, direct-action authorization, accessibility, and large-fleet performance. Evidence: controlled failover Playwright test. - [ ] I7.5 Complete the job/run explorer with stage logs, resource use, cost, output, retry, cancel, and replay. Evidence: injected failure journey. - [ ] I7.5.a Build deterministic search/filter/sort/pagination for request, plan, job, run/attempt, workflow/model/provider, actor/project, status, asset kind, cost, date, and incident. Evidence: explorer list tests. - [ ] I7.5.b Build run detail timeline/DAG with queue, reservation, stage, checkpoint, attempt, provider/tool, output, gate, decision, and terminal state identities. Evidence: journey projection tests. - [ ] I7.5.c Present structured redacted stage events/logs/errors with levels, timestamps, correlations, retries, downloadable evidence, and bounded streaming. Evidence: log view/security tests. - [ ] I7.5.d Present estimated/reserved/actual CPU/GPU/VRAM/storage/egress/time/ cost by stage and run, including pending/unbilled/variance. Evidence: resource/cost view tests. - [ ] I7.5.e Present output previews/manifests/hashes/provenance/gates/ quarantine/partial/missing state appropriate to each asset kind. Evidence: output projection tests. - [ ] I7.5.f Implement cancel/retry/replay with state/role eligibility, impact/cost preview, reason/confirmation, concurrency, and immutable new attempt/run lineage. Evidence: command tests. - [ ] I7.5.g Verify injected provider refusal/timeout/worker loss/malformed result/late output/recovery plus cross-tenant, accessibility, and long- history performance behavior. Evidence: failure Playwright journey. - [ ] I7.6 Complete the output comparison workspace for each supported asset kind. Evidence: synchronized, accessible comparison tests. - [ ] I7.6.a Resolve authorized exact candidate revisions and common typed comparison/provenance/gate/decision state with incompatible-kind handling. Evidence: workspace contract tests. - [ ] I7.6.b Implement synchronized image/portrait/texture pan/zoom/fit/pixel/ alpha/diff and region annotation. Evidence: raster comparison tests. - [ ] I7.6.c Implement synchronized video/animation/sequence frame/timecode/ playback/rate/loop/audio/caption and shot/pass alignment. Evidence: temporal comparison tests. - [ ] I7.6.d Implement synchronized audio/voice/music playback/waveform/ loudness/channel/stem/transcript and time-region annotation. Evidence: audio comparison tests. - [ ] I7.6.e Implement synchronized mesh/rig/splat/scene camera/light/material/ animation/LOD/wireframe/bounds and object-region annotation. Evidence: 3D comparison tests. - [ ] I7.6.f Present raw gate values/units/thresholds/uncertainty, prompt/ workflow/model/policy diffs, rights, provenance, cost, and target fit. Evidence: metadata comparison tests. - [ ] I7.6.g Implement select/reject/park/regenerate/comment decisions against exact revisions with stale/concurrent state handling. Evidence: decision tests. - [ ] I7.6.h Provide text/table alternatives to every canvas, full keyboard/ screen-reader/zoom/reduced-motion parity, responsive inspection, and large-media performance. Evidence: synchronized accessible E2E. - [ ] I7.7 Complete the release-gate dashboard with freshness and remediation. Evidence: stale or unavailable evidence cannot look green. - [ ] I7.7.a Build candidate/target gate-set projection with mandatory/ advisory/N/A/unavailable/error/manual states, raw measurements, uncertainty, overrides, and exact versions. Evidence: projection tests. - [ ] I7.7.b Present overall readiness as a derived explanation with counts and blockers, never as a standalone color or client-authored boolean. Evidence: readiness tests. - [ ] I7.7.c Calculate and display subject/evaluator/registry/profile/policy/ rights/consent freshness and exact invalidating changes. Evidence: freshness fixtures. - [ ] I7.7.d Provide filters/grouping by category/owner/severity/target/status, accessible measurement details, evidence links, regions/timecodes, and comparison. Evidence: dashboard interaction tests. - [ ] I7.7.e Route each blocker to authorized remediation, rerun, review, or exception request with impact/cost, state eligibility, and immutable outcomes. Evidence: remediation journey. - [ ] I7.7.f Test stale/unavailable/error/unknown/cancelled/partial data, direct release attempt, concurrent evidence change, accessibility, and large gate matrices. Evidence: fail-closed Playwright suite. - [ ] I7.8 Complete the provenance inspector and recall workflow. Evidence: tamper, revoke, and blast-radius journey. - [ ] I7.8.a Build a typed lineage graph/list projection for sources/ references, briefs/specs, workflows/nodes, models/adapters, runs/stages, outputs/edits, credentials, bundles, collections, and releases. Evidence: inspector contract tests. - [ ] I7.8.b Render forward/reverse paths with stable identities/versions/ hashes, relationship reasons, redactions, cycles, pagination, and a complete noncanvas tree/table alternative. Evidence: lineage UI tests. - [ ] I7.8.c Verify artifact/manifest/credential signatures/hashes and show valid/invalid/missing/stripped/unknown status with tool/version/time. Evidence: tamper journey. - [ ] I7.8.d Build blast-radius query/preview for source/consent/license/model/ workflow/output changes with direct/transitive items, targets, owners, actions, and unknowns. Evidence: preview tests. - [ ] I7.8.e Implement authorized quarantine/recall case creation, scoped confirmation, progress, partial failures, target receipts, notification, and restoration review. Evidence: recall journey. - [ ] I7.8.f Enforce sensitive provenance field controls, tenant isolation, large-graph performance, keyboard/screen-reader navigation, and immutable case history. Evidence: security/accessibility tests. - [ ] I7.9 Integrate AAA brief, graph, model, training, voice, music, 3D, and post-process surfaces into Yemaya Studio navigation. Evidence: no duplicated Isis operator controls. - [ ] I7.9.a Map each AAA surface to a Yemaya project/asset/shot/sequence context, authorized roles, Isis route/capability, and return location. Evidence: navigation integration matrix. - [ ] I7.9.b Add restrained project-level workbench navigation and command palette entries for brief, graph, model, training, voice, music, 3D, and post-process without a second global nav. Evidence: navigation tests. - [ ] I7.9.c Reuse Isis APIs/contracts and audience-safe projections while keeping provider fleet, global registry lifecycle, incidents, billing, and security administration in operator hosts. Evidence: boundary tests. - [ ] I7.9.d Preserve selected project/asset/shot/sequence/revision and unsaved state warnings across tool transitions and deep links. Evidence: context journey. - [ ] I7.9.e Render feature unavailable/degraded/not-configured/unauthorized states from capabilities with safe remediation and no hidden-feature hints. Evidence: capability state tests. - [ ] I7.9.f Verify direct URL/role/property/function authorization, keyboard/ screen-reader/responsive navigation, and that no operator control/API is copied into Yemaya. Evidence: AAA boundary Playwright suite. - [ ] I7.10 Implement handoff from Yemaya project context to an Isis run and back. Evidence: project, shot/asset, actor, and lineage persist. - [ ] I7.10.a Define handoff intent/envelope for tenant/project, asset/shot/ sequence/revisions, brief/spec, requested operation, actor/audience, return route, expiry, nonce, and signature. Evidence: handoff schema. - [ ] I7.10.b Validate Yemaya context access and current revisions before issuing the minimal signed Isis link/request. Evidence: issuance tests. - [ ] I7.10.c Reauthorize Isis actor/object/function, validate link freshness/ replay, resolve canonical inputs, and preview substitutions/missing dependencies before plan creation. Evidence: acceptance tests. - [ ] I7.10.d Create Isis request/plan/run with immutable Yemaya source links and carry only authorized project/shot/asset metadata. Evidence: run lineage tests. - [ ] I7.10.e Return via a signed intent to the exact permitted Yemaya context and highlight resulting proposal/output/revision without assuming it was accepted. Evidence: return journey. - [ ] I7.10.f Handle logged-out, expired, changed/deleted/quarantined context, cancellation, failure, multiple outputs, and cross-tenant attempts. Evidence: handoff Playwright matrix. - [ ] I7.11 Complete curated Oshun Studio generation cards for illustration, narration, ambient audio, explainer, caption/dub, accessibility, music, and approved 3D briefings. Evidence: tier allowlist tests. - [ ] I7.11.a Define the curated generation-card contract for approved operation, audience/host, typed high-level inputs, references, cost/time estimate, confirmation, progress, output, and safe errors. Evidence: card schema tests. - [ ] I7.11.b Implement illustration briefing for subject/purpose/style/ composition/aspect/palette/required/excluded elements and authorized references. Evidence: illustration journey. - [ ] I7.11.c Implement narration briefing for approved voice/language/tone/ pace/pronunciation/script/timing/format with consent-safe choices. Evidence: narration journey. - [ ] I7.11.d Implement ambient-audio briefing for environment/events/mood/ perspective/duration/loop/loudness/channel/format. Evidence: ambient audio journey. - [ ] I7.11.e Implement explainer briefing for audience/objective/script/ scenes/style/duration/narration/captions/aspect/target. Evidence: explainer journey. - [ ] I7.11.f Implement caption/dub briefing for source/language/transcript/ translation/speaker mapping/timing/style/format/review. Evidence: caption/dub journey. - [ ] I7.11.g Implement accessibility briefing for alt text, audio description, captions/transcript, reading level, language, timing, and target. Evidence: accessibility asset journey. - [ ] I7.11.h Implement music briefing for purpose/mood/tempo/form/duration/ instrumentation/hit points/loop/stems/format with rights-safe references. Evidence: music journey. - [ ] I7.11.i Implement approved 3D briefing for asset/use/subject/style/ dimensions/units/views/materials/poly/texture/rig/format/target without graph/model controls. Evidence: 3D journey. - [ ] I7.11.j Derive availability/defaults/validation/estimate from canonical capabilities and submit through the same governed plan/dispatch APIs. Evidence: tier allowlist/contract tests. - [ ] I7.12 Ensure curated cards expose only approved high-level controls. Evidence: raw-graph/model/provider leak scan passes. - [ ] I7.12.a Ratify a per-card allowlist of field names/types/values/defaults/ validation/errors and permitted provenance/capability summaries. Evidence: curated control matrix. - [ ] I7.12.b Generate curated projections from typed server contracts rather than hiding AAA/operator controls with client CSS or feature flags. Evidence: projection tests. - [ ] I7.12.c Reject unknown/nested/alias/raw JSON fields, workflow/model/node/ sampler/provider IDs, advanced parameter names, and mass assignment at the curated API. Evidence: adversarial request tests. - [ ] I7.12.d Remove hidden details from HTML/JS bundles, responses, errors, URLs, state stores, telemetry, exports, deep links, and capability hints. Evidence: static/runtime property leak scan. - [ ] I7.12.e Keep approved high-level values mapped deterministically to governed specs/presets and show audience-safe effective summaries. Evidence: mapping golden tests. - [ ] I7.12.f Test every card as curated/contemplative/AAA/operator actors, direct routes, crafted payloads, stale links, and changed tier. Evidence: tier authorization Playwright suite. - [ ] I7.13 Complete the Oshun output gallery with lineage, status, quality, rights, replay eligibility, and editorial promotion. Evidence: live-data journey. - [ ] I7.13.a Define gallery list/detail projection for exact asset/output revision, preview, source, status, target, generated/manual identity, audience, and current availability. Evidence: gallery contracts. - [ ] I7.13.b Implement deterministic search/filter/sort/pagination and collection/group views with restrained media-led hierarchy and complete loading/empty/error/stale/offline states. Evidence: gallery list tests. - [ ] I7.13.c Present authorized brief/run/output/ingredient lineage, decision history, transformations, provenance credential, and unavailable/ redacted links. Evidence: lineage detail tests. - [ ] I7.13.d Present quality raw measures/verdicts/freshness, rights/consent/ attribution/expiry, safety state, target compatibility, and recall status without false green aggregation. Evidence: status tests. - [ ] I7.13.e Calculate replay eligibility from current inputs/dependencies/ policy/rights/capacity with mode, drift, estimate, and exact reason. Evidence: replay projection tests. - [ ] I7.13.f Implement editorial promotion request/preview/submit/status with destination scope, derivative lineage, role separation, and no direct publication. Evidence: promotion journey. - [ ] I7.13.g Verify live generation-to-gallery-to-promotion, cross-tenant/ property authorization, keyboard/screen-reader/zoom/responsive behavior, and large-gallery performance. Evidence: gallery Playwright E2E. - [ ] I7.14 Implement honest fixture, provider-gated, degraded, and offline states in every Isis-related host. Evidence: state matrix. - [ ] I7.14.a Define canonical data-origin and service-state discriminators for live, fixture/demo, provider-gated, not-configured, degraded, partial, stale, offline-cached, offline-unavailable, and unauthorized. Evidence: state schema. - [ ] I7.14.b Label fixture/demo data persistently in UI/API/export and prevent its mutation/promotion/release from masquerading as production. Evidence: fixture boundary tests. - [ ] I7.14.c Present provider-gated state with audience-safe dependency/ configuration reason, available alternatives, and no simulated success. Evidence: provider state tests. - [ ] I7.14.d Present degraded/partial/stale state per capability/data region with timestamp, missing functions, safe actions, and no global healthy implication. Evidence: degraded state tests. - [ ] I7.14.e Define offline read cache scope/freshness/classification and disable network-required/unsafe mutations with queued-action policy made explicit. Evidence: offline behavior tests. - [ ] I7.14.f Exercise every state across Isis operator, Yemaya AAA, Oshun Studio, and gallery with reconnect/recovery and accessible announcements. Evidence: cross-host state matrix. - [ ] I7.15 Add keyboard and screen-reader parity to media, graph, and 3D surfaces. Evidence: semantic alternative journeys. - [ ] I7.15.a Define logical focus order, landmarks, headings, labels, instructions, status announcements, shortcuts, and escape behavior for each complex surface. Evidence: accessibility interaction spec. - [ ] I7.15.b Provide image/video/audio controls, timelines, regions, annotations, tracks, captions/transcripts, and measurements through native/ARIA semantics and keyboard operation. Evidence: media tests. - [ ] I7.15.c Provide graph node/port/edge/subgraph/errors/selection/reorder/ connect/delete operations through synchronized tree/list/forms rather than pointer-only canvas. Evidence: graph alternative journey. - [ ] I7.15.d Provide 3D scene hierarchy/objects/components/transforms/ materials/animation/camera/measurements/annotations through synchronized tree/table/forms. Evidence: 3D alternative journey. - [ ] I7.15.e Synchronize visual and semantic selection/focus/state without duplicate announcements, keyboard traps, lost focus, or hidden updates. Evidence: focus/state tests. - [ ] I7.15.f Verify screen reader/browser combinations, keyboard-only, 200– 400% zoom/reflow, contrast, reduced motion, high contrast, and long- content virtualization. Evidence: semantic E2E suite. - [ ] I7.16 Add responsive review surfaces without forcing full graph/3D editing onto mobile. Evidence: mobile can inspect, comment, approve, and act on incidents. - [ ] I7.16.a Define wide, compact, and single-column review information/ action hierarchy with mobile scope limited to safe inspection and review operations. Evidence: responsive behavior spec. - [ ] I7.16.b Build mobile asset/media preview and metadata/gate/provenance/ rights inspector with progressive sections and persistent subject identity. Evidence: mobile inspection tests. - [ ] I7.16.c Provide graph and 3D semantic tree/list/detail/diff snapshots on mobile without loading or exposing the full authoring editor. Evidence: mobile graph/3D tests. - [ ] I7.16.d Implement anchored comment create/edit/resolve and attachment/ mention behavior with accessible target context. Evidence: mobile comment journey. - [ ] I7.16.e Implement approve/reject/request-changes/exception/incident actions only where role/state/evidence permit, with impact, reason, confirmation, and stale-state conflict. Evidence: mobile action tests. - [ ] I7.16.f Verify touch targets, orientation, safe areas, keyboard, screen reader, zoom, reduced motion, slow/offline/reconnect, and desktop/mobile decision parity. Evidence: responsive Playwright matrix. - [ ] I7.17 Complete parity/coverage monitors for generation types, workflows, models, outputs, provider APIs, SDKs, and UI controls. Evidence: every divergence links to the exact missing contract/route/control and cannot be dismissed without a disposition. - [ ] I7.17.a Define canonical coverage dimensions/identities/versions for asset kind, operation, workflow, model, provider capability, API/SDK, host/audience, control, output/target, and required evidence. Evidence: coverage schema. - [ ] I7.17.b Ingest source-of-truth registries, admitted workflow/model/ provider runtime capability, API schemas, SDK surfaces, UI manifests, and automated-test evidence with freshness. Evidence: adapters tests. - [ ] I7.17.c Compute expected-versus-observed rows and classify missing, incompatible, stale, unauthorized exposure, undocumented, untested, or intentionally unavailable. Evidence: parity fixtures. - [ ] I7.17.d Link each divergence to exact registry entity, contract field, route/function, SDK method, UI control/host, test, owner, and source revision. Evidence: traceability tests. - [ ] I7.17.e Require disposition with reason/owner/expiry/evidence as fix, planned, accepted gap, not applicable, or policy-forbidden; prohibit dismissal/deletion. Evidence: disposition tests. - [ ] I7.17.f Alert on new/regressed/expired/stale divergence and gate releases according to severity without conflating hidden features with missing ones. Evidence: monitor/release tests. - [ ] I7.17.g Present filters/trends/diffs/ownership and export the same typed evidence accessibly at production scale. Evidence: monitor UI tests. - [ ] I7.18 Complete RunPod fleet and economics operations for endpoint classes, model/node images, warm/cold policy, GPU topology, cache, canary, drain/rollback, SLO, and cost attribution. Evidence: live topology and controlled failover journey. - [ ] I7.18.a Define endpoint class/pool/worker/GPU/image/model/node/cache/ lifecycle/capacity/cost/SLO contracts and ingest authenticated live topology. Evidence: fleet schema/integration tests. - [ ] I7.18.b Manage signed/scanned/pinned model-node images and exact endpoint compatibility, rollout state, dependencies, and supply-chain evidence. Evidence: image admission journey. - [ ] I7.18.c Configure warm/min/max/idle/cold-start/autoscale/concurrency/ region/GPU topology policy with capacity/cost/SLO preview and bounds. Evidence: scaling policy tests. - [ ] I7.18.d Inspect cache layers/keys/contents/size/hit/miss/eviction/ integrity/warmup by authorized scope without exposing tenant data. Evidence: cache operations tests. - [ ] I7.18.e Roll out canaries with bounded traffic/capacity, comparison metrics, abort thresholds, observation window, and automatic/manual promotion rules. Evidence: canary journey. - [ ] I7.18.f Execute drain/failover/rollback with in-flight policy, reservation migration, health/capability validation, immutable decisions, and post-action verification. Evidence: controlled failover journey. - [ ] I7.18.g Present SLOs, queue/runtime/reliability/cold-start/resource efficiency, complete fixed/variable/egress/cache costs, allocation, and variance by class/pool/workflow/model/tenant. Evidence: economics tests. - [ ] I7.18.h Enforce operator roles, two-person high-impact controls, confirmation, rate limits, concurrency, emergency stop, audit, and accessible large-fleet UI. Evidence: abuse/operations suite. - [ ] I7.19 Complete model discovery and supply workflows for registry search, Civitai intake, collections, license/model cards, malware scanning, comparison, quality evaluation, model merging, fine-tuning/LoRA, promotion, quarantine, and revoke. Evidence: no external model or derivative reaches production without a complete evidence chain. - [ ] I7.19.a Build governed internal/external model discovery with allowlisted sources, authenticated metadata, filters, stable source/version IDs, snapshots, and no automatic admission. Evidence: discovery tests. - [ ] I7.19.b Intake Civitai/other approved artifacts by immutable download hash, source snapshot, uploader, files/dependencies, license/model card, training provenance, tags/triggers, and quarantine state. Evidence: external intake journey. - [ ] I7.19.c Build versioned curated collections with membership rationale, audience/use/target, compatibility, lifecycle, owner, and no lifecycle authority over member models. Evidence: collection tests. - [ ] I7.19.d Run malware/archive/format/serialization/signature/dependency/ vulnerability scans in isolated bounded processing and retain results. Evidence: hostile artifact suite. - [ ] I7.19.e Compare models/versions on rights, provenance, compatibility, quality/safety calibration, latency/cost/resources, outputs, and uncertainty using pinned fixtures. Evidence: comparison journey. - [ ] I7.19.f Define model merge inputs/weights/method/config/tool/environment/ license compatibility, generate a new artifact identity, and rerun full admission evidence. Evidence: merge lineage tests. - [ ] I7.19.g Define fine-tune/LoRA dataset/splits/consent/rights/filtering, base model, method/config/seed/compute, checkpoints/evaluations, and new artifact lineage. Evidence: training journey. - [ ] I7.19.h Promote exact admitted versions only after complete license/ provenance/security/quality/safety/compatibility approvals; quarantine/ revoke with blast radius and fail-closed routing. Evidence: lifecycle journey. - [ ] I7.20 Complete workflow and asset marketplaces only for authorized audiences, including submission, review, compatibility, versioning, pricing/entitlement, creator attribution, abuse, takedown, and payout reconciliation. Evidence: marketplace and creator-monetization journeys cannot bypass generation or release gates. - [ ] I7.20.a Define audience/host/region/tenant marketplace enablement and separate workflow-template, model/modifier, preset, source asset, and generated asset item contracts. Evidence: authorization matrix. - [ ] I7.20.b Implement creator enrollment/identity/tax/payout/rights authority, item submission, immutable files/hashes/dependencies, metadata, license, pricing, and attribution. Evidence: creator submission journey. - [ ] I7.20.c Run type-specific security/rights/consent/provenance/quality/ safety/compatibility/generation/release gates and independent human review before listing. Evidence: review gate tests. - [ ] I7.20.d Version items immutably with compatibility matrices, dependency locks, migration/deprecation/revoke behavior, consumer notices, and historical entitlement. Evidence: version lifecycle tests. - [ ] I7.20.e Implement offers/prices/currencies/taxes/fees/refunds/promotions, entitlements/seats/terms/regions, purchase, receipt, and server-side use authorization. Evidence: commerce tests. - [ ] I7.20.f Preserve creator/source/version attribution through download/use/ derivative/generation/release and calculate royalty/payout ledger from verified events. Evidence: attribution journey. - [ ] I7.20.g Detect/report abuse, malware, fraud, stolen content, impersonation, review manipulation, license breach, and policy violations with case evidence and anti-retaliation controls. Evidence: abuse tests. - [ ] I7.20.h Execute takedown/quarantine/recall/appeal/restore with blast radius, consumer state, downloads/caches, payouts/holds, notifications, and immutable decisions. Evidence: takedown journey. - [ ] I7.20.i Reconcile order/refund/fee/tax/royalty/hold/payout/chargeback per item/version/creator/currency and expose discrepancies without double payment. Evidence: payout reconciliation tests. - [ ] I7.20.j Verify direct API/deep-link/import entitlement bypass, cross- tenant access, gate bypass, creator self-approval, accessibility, and marketplace scale. Evidence: monetization E2E suite. - [ ] I7.21 Complete operator security and financial controls for entitlements, quotas, budgets, cost optimization, chargeback fraud, suspicious activity, account protection, anomaly triage, feature flags, and emergency kills. Evidence: every recommendation is explainable and every mutation is authorized, audited, reversible where possible, and tested against abuse. - [ ] I7.21.a Build effective-entitlement inspector/change workflow with source, scope, conditions, expiry, conflicts, preview, reason, approval, propagation, and revocation. Evidence: entitlement journey. - [ ] I7.21.b Build quota/budget inspector and bounded change workflow for hierarchy, window, usage/reservations, forecasts, thresholds, alerts, exceptions, and effective date. Evidence: quota/budget journey. - [ ] I7.21.c Generate cost-optimization recommendations from attributed versioned measurements with assumptions, confidence, projected savings/ quality/latency/capacity impact, alternatives, and no automatic apply. Evidence: recommendation explainability tests. - [ ] I7.21.d Detect chargeback/payout/refund/purchase/usage fraud signals, preserve event/feature/rule/model versions, avoid protected-attribute inference, and route to human cases. Evidence: fraud triage tests. - [ ] I7.21.e Build suspicious-activity/anomaly triage for auth, data access, model/workflow intake, dispatch, spend, provider, marketplace, and release with baseline/threshold/uncertainty. Evidence: anomaly journey. - [ ] I7.21.f Implement account/session/API-key/device protection, step-up authentication, lock/recovery, session revoke, and high-risk action confirmation without exposing secrets. Evidence: account abuse tests. - [ ] I7.21.g Govern feature flags by typed scope/audience/environment/ prerequisite/owner/expiry, staged rollout, evaluation, rollback, and audit; prohibit flags from bypassing code floors. Evidence: flag tests. - [ ] I7.21.h Implement scoped emergency kills for route/workflow/model/ provider/tool/marketplace/release with two-person authority where required, immediate propagation, in-flight policy, and restore gate. Evidence: kill-switch game day. - [ ] I7.21.i Make every mutation previewable, permission/state checked, reasoned, confirmed, optimistic-concurrency safe, immutable in audit, and reversibly compensated where possible. Evidence: control invariant suite. - [ ] I7.21.j Test insider, confused-deputy, mass-assignment, replay, race, enumeration, cross-tenant, cost-evasion, fraud, and emergency-abuse paths plus accessible operator recovery. Evidence: adversarial E2E suite. ### I8 — Review, release, gallery, and lifecycle - [ ] I8.1 Define review templates by asset kind, risk, audience, and delivery target. Evidence: required roles and quorum matrix. - [ ] I8.1.a Define immutable review-template identity/version/lifecycle, applicability selectors, required review dimensions, roles, quorum, sequence/parallelism, deadlines, escalation, and code floors. Evidence: review template schema. - [ ] I8.1.b Map every publishable asset kind/profile to the applicable visual/audio/3D/editorial/technical review dimensions. Evidence: asset coverage matrix. - [ ] I8.1.c Add risk-class requirements for child/identity/voice/biometric/ sensitive content, protected sources, high-cost, high-reach, and novel workflows. Evidence: risk matrix. - [ ] I8.1.d Add audience/host/use/territory/channel and delivery-target- specific reviewer roles, evidence, and acceptance criteria. Evidence: audience/target matrix. - [ ] I8.1.e Validate separation of requester/creator/reviewer/approver and quorum independence, conflicts, substitutions, and abstention. Evidence: role/quorum policy tests. - [ ] I8.1.f Resolve the exact template/version deterministically at candidate creation and invalidate eligibility when applicability changes. Evidence: resolution/freshness tests. - [ ] I8.2 Add anchored review comments for regions, frames, timecodes, graph nodes, mesh parts, and audio ranges. Evidence: anchor survival tests. - [ ] I8.2.a Define immutable comment/thread/reply identity, subject revision, typed anchor, author, visibility, status, mentions, attachments, resolution, and supersession. Evidence: comment schema tests. - [ ] I8.2.b Implement image/video region anchors in canonical pixel/ normalized/frame coordinate space with crop/orientation/version context. Evidence: region anchor tests. - [ ] I8.2.c Implement frame/timecode/shot/range anchors with rate/time-base/ sequence revision and retime/edit mapping. Evidence: temporal anchor tests. - [ ] I8.2.d Implement graph node/port/edge/parameter/subgraph anchors using stable graph entity/version identities rather than screen coordinates. Evidence: graph anchor tests. - [ ] I8.2.e Implement mesh/scene object/component/face/vertex/UV/material/ animation anchors with stable semantic IDs and transform/LOD context. Evidence: 3D anchor tests. - [ ] I8.2.f Implement audio sample/timecode/clip/track/channel/speaker/ transcript-token ranges with sample/time-base context. Evidence: audio anchor tests. - [ ] I8.2.g Map anchors across compatible revisions with exact/shifted/ ambiguous/orphaned status and preserve the original anchor. Evidence: revision survival tests. - [ ] I8.2.h Provide synchronized accessible anchor lists/navigation, authorization, notifications, resolve/reopen history, and no comment authority over approval. Evidence: review UI/API tests. - [ ] I8.3 Add safety, rights, identity, quality, brand/editorial, and technical signoff gates. Evidence: separation-of-duties policy tests. - [ ] I8.3.a Define distinct signoff contracts for safety, rights/consent, identity, quality, brand/editorial, and technical/target dimensions with required evidence and decision codes. Evidence: signoff schemas. - [ ] I8.3.b Resolve eligible reviewers/approvers, role separation, conflict- of-interest, quorum, delegated/substitute rules, and expiry per dimension. Evidence: duty matrix. - [ ] I8.3.c Bind each signoff to exact candidate/bundle revision and hashes, target, measurements/verdicts, policy/template versions, comments, and evidence snapshot. Evidence: binding tests. - [ ] I8.3.d Implement approve/reject/request-changes/abstain with immutable decision, rationale, conditions, and no cross-dimension authority. Evidence: decision tests. - [ ] I8.3.e Calculate aggregate readiness only when every required dimension has fresh valid quorum and no blocking conflict/condition. Evidence: aggregation tests. - [ ] I8.3.f Invalidate affected signoffs on subject/evidence/policy/role/ rights change without deleting prior decisions. Evidence: freshness tests. - [ ] I8.4 Lock approved release candidates to exact revisions and hashes. Evidence: post-approval mutation invalidates approval. - [ ] I8.4.a Define release-candidate manifest listing exact asset/output/edit/ metadata/rights/provenance/gate/target-profile/dependency revisions and cryptographic hashes. Evidence: candidate schema. - [ ] I8.4.b Canonicalize and hash the complete candidate manifest and required files before review begins. Evidence: hash golden tests. - [ ] I8.4.c Bind every review/signoff/exception/confirmation to the manifest digest and immutable candidate identity. Evidence: approval binding tests. - [ ] I8.4.d Make approved candidate records immutable and route any content/ metadata/dependency change through a new revision/candidate. Evidence: mutation refusal tests. - [ ] I8.4.e Rehash/revalidate manifest and stored bytes at release planning, immediately before execute, and after target assembly. Evidence: TOCTOU tests. - [ ] I8.4.f Mark prior approvals stale when any bound version/hash/policy/ evidence changes while retaining historical approval. Evidence: invalidation tests. - [ ] I8.5 Assemble deterministic output bundles per target. Evidence: golden bundle round-trip for every publishable asset kind. - [ ] I8.5.a Define target bundle manifest for entry assets, derivatives, dependencies, metadata, captions/transcripts, provenance, rights/ attribution, checksums, target profile, and tool versions. Evidence: bundle schema. - [ ] I8.5.b Resolve only exact authorized release-candidate files/ dependencies and fail on missing/mutable/ambiguous/quarantined inputs. Evidence: input resolution tests. - [ ] I8.5.c Transform/package each publishable asset kind with pinned tools, configs, locale/time/random/order controls, and reproducible filenames. Evidence: per-kind assembly fixtures. - [ ] I8.5.d Generate normalized metadata, accessibility files, rights/ attribution, C2PA/ledger links, target descriptors, and checksums from canonical records. Evidence: metadata mapping tests. - [ ] I8.5.e Prevent secrets/private fields/path traversal/symlinks/hidden files/unsafe archives and enforce file/count/size/resource budgets. Evidence: hostile bundle tests. - [ ] I8.5.f Canonically order and serialize manifests/archive entries/ timestamps/permissions/compression so identical inputs produce identical hashes where format permits. Evidence: determinism tests. - [ ] I8.5.g Parse and validate every golden bundle through the target consumer/importer and compare semantic round-trip. Evidence: per-target round-trip suite. - [ ] I8.6 Verify outputs after write in output registry, gallery, marketplace, or downstream store. Evidence: read-back mismatch fails release. - [ ] I8.6.a Define per-destination write receipt and verification contract for canonical object/version, bytes/hash/length/content type, manifest, metadata, visibility, URL, status, and timestamp. Evidence: receipt schemas. - [ ] I8.6.b Write idempotently using destination-native conditional/versioned operations and retain immutable request/response correlation. Evidence: duplicate-write tests. - [ ] I8.6.c Read back from the authoritative destination rather than local request/cache and verify bytes/hash/length/format/manifest/dependencies. Evidence: read-back integrity tests. - [ ] I8.6.d Verify destination metadata, permissions/audience, publication/ listing state, target URL/download behavior, cache/CDN state, and provenance credential. Evidence: visibility tests. - [ ] I8.6.e Treat timeout/partial/unknown/mismatch as unverified and block release success; retry or compensate idempotently. Evidence: failure injection tests. - [ ] I8.6.f Persist signed/hashed verification evidence and recheck after downstream transformations or configured propagation delay. Evidence: delayed verification tests. - [ ] I8.7 Implement collection and campaign curation through versioned bundles. Evidence: no direct catalog mutation. - [ ] I8.7.a Define collection/campaign bundle identity/version, purpose, audience, owner, schedule, ordered members/exact revisions, metadata, targets, constraints, and lifecycle. Evidence: curation schema. - [ ] I8.7.b Add/remove/reorder/group/feature members only through a new draft bundle revision with reason and optimistic concurrency. Evidence: curation edit tests. - [ ] I8.7.c Validate each member’s availability, target compatibility, rights/consent, gates, provenance, editorial approval, and campaign steering constraints. Evidence: membership tests. - [ ] I8.7.d Preview deterministic catalog/gallery/channel diffs, assets/ metadata/order/schedule/dependencies, and removals before approval. Evidence: publication preview tests. - [ ] I8.7.e Review/approve/release the exact bundle manifest through governed release APIs; prohibit direct catalog/gallery mutation. Evidence: boundary tests. - [ ] I8.7.f Preserve released bundle history and propagate member quarantine/ recall/expiry through explicit successor/incident state. Evidence: lifecycle tests. - [ ] I8.8 Implement supersession, archive, unpublish, quarantine, and recall. Evidence: downstream state and lineage remain coherent. - [ ] I8.8.a Define separate lifecycle command/state/reason/authority/ effective-time/target/notification/verification contracts for supersede, archive, unpublish, quarantine, and recall. Evidence: lifecycle schemas. - [ ] I8.8.b Supersede by linking an eligible replacement revision/bundle, migration/effective behavior, prior availability, and consumer notice without rewriting the predecessor. Evidence: supersession tests. - [ ] I8.8.c Archive inactive authoring/catalog records from routine discovery while retaining authorized history, links, and restore rules. Evidence: archive tests. - [ ] I8.8.d Unpublish distribution/listing visibility by explicit targets while preserving source asset/release evidence and recording residual copies. Evidence: unpublish tests. - [ ] I8.8.e Quarantine suspected versions from reuse/review/release/delivery with incident scope, restricted evidence, and fail-closed dependency propagation. Evidence: quarantine tests. - [ ] I8.8.f Recall confirmed affected versions through complete blast radius, downstream disable/removal, notification, receipt, and verification. Evidence: recall tests. - [ ] I8.8.g Project coherent current/historical state across lineage, search, gallery, marketplace, collections, campaigns, URLs, caches, and exports. Evidence: cross-system lifecycle tests. - [ ] I8.9 Implement scheduled drops with generation and review capacity reservation. Evidence: overbook and missed-dependency tests. - [ ] I8.9.a Define scheduled-drop identity/version, timezone/locale, release window, targets, campaign bundle, required generation/gates/reviews, deadlines, dependencies, fallback, owner, and status. Evidence: drop schema. - [ ] I8.9.b Build a dependency DAG and backward schedule for generation, evaluation, review, correction, packaging, distribution, verification, and notification with buffers. Evidence: schedule fixtures. - [ ] I8.9.c Forecast and reserve provider/queue/GPU/storage/budget plus named reviewer/approver capacity for the required windows. Evidence: capacity reservation tests. - [ ] I8.9.d Reject overlapping/overbooked reservations and detect holidays/ working hours/region/target embargo conflicts with exact shortfalls. Evidence: overbook tests. - [ ] I8.9.e Monitor dependency completion/freshness/slippage/capacity and recalculate risk without silently moving the ratified release window. Evidence: missed-dependency tests. - [ ] I8.9.f Execute hold/delay/reduce-scope/cancel/fallback only through authorized impact preview and immutable schedule revision/decision. Evidence: contingency tests. - [ ] I8.9.g Trigger release only when current candidate/approvals/gates/ rights/capacity remain valid and verify all targets. Evidence: scheduled release journey. - [ ] I8.10 Implement rights/consent expiry monitoring for released assets. Evidence: warnings and automatic policy actions fire at known times. - [ ] I8.10.a Index exact rights/consent grant versions, effective/expiry/ review dates, territory/use/target scope, revocation, and dependent released assets/bundles/targets. Evidence: expiry index tests. - [ ] I8.10.b Calculate next action using timezone-safe instants and versioned warning/action windows, including missing/indefinite/unknown dates. Evidence: fake-clock boundary tests. - [ ] I8.10.c Run fenced idempotent monitoring with missed-run catch-up, duplicate prevention, clock skew, pagination, and production-scale throughput. Evidence: scheduler tests. - [ ] I8.10.d Notify configured owners/reviewers/legal/subjects before expiry with safe asset/scope/action/deadline details and escalation. Evidence: warning tests. - [ ] I8.10.e At action time revalidate grant/dependencies and automatically hold/unpublish/quarantine/recall only as canonical policy authorizes. Evidence: timed action tests. - [ ] I8.10.f Cancel/reschedule obsolete timers on renewal/replacement/ revocation/supersession and retain immutable event/action history. Evidence: lifecycle tests. - [ ] I8.11 Implement release notification and incident routing. Evidence: protected metadata is redacted. - [ ] I8.11.a Define versioned event-to-recipient/channel/template/escalation rules for planned/succeeded/partial/failed/verified/recalled releases and incidents. Evidence: routing schema. - [ ] I8.11.b Resolve recipients by tenant/project/target/role/on-call/ subscription/purpose and reauthorize protected detail at delivery time. Evidence: recipient tests. - [ ] I8.11.c Render localized accessible templates from allowlisted audience- safe fields with explicit status, asset/release ref, target, time, action, owner, and deep link. Evidence: template tests. - [ ] I8.11.d Redact biometric/child/source/provider/credential/private prompt/ rights evidence and cross-tenant metadata from subject/body/attachments/ URLs. Evidence: notification leak suite. - [ ] I8.11.e Deliver idempotently over in-app/email/webhook/paging channels with retry/backoff/rate limits/dedup/threading/preferences and receipts. Evidence: delivery integration tests. - [ ] I8.11.f Escalate unacknowledged/high-severity/failed routes by policy and preserve delivery/acknowledgement/audit without treating notification as remediation. Evidence: escalation tests. - [ ] I8.12 Implement recovery of failed multi-target release. Evidence: compensation and retry preserve idempotency. - [ ] I8.12.a Persist per-target/per-step planned/executing/written/verified/ failed/unknown/compensating/rolled-back state and immutable receipts. Evidence: release state tests. - [ ] I8.12.b On interruption, reconcile authoritative destination state by idempotency key/version/hash before deciding retry or compensation. Evidence: crash recovery tests. - [ ] I8.12.c Classify targets/steps as safely retryable, compensatable, manually recoverable, or irreversible with exact reason. Evidence: recovery policy matrix. - [ ] I8.12.d Retry only missing/failed idempotent writes against the unchanged candidate/plan and never duplicate verified successful targets. Evidence: partial retry tests. - [ ] I8.12.e Compensate configured successful targets in dependency-safe order and verify removal/reversion while recording residual copies. Evidence: compensation tests. - [ ] I8.12.f Require fresh authorization/evidence/rights/target eligibility and impact preview for resume/retry/compensate/manual-complete commands. Evidence: stale recovery tests. - [ ] I8.12.g Derive final succeeded/partial/failed/rolled-back/manual state honestly and retain every attempt/receipt/cost/notification. Evidence: recovery history tests. - [ ] I8.13 Build campaign/program steering overlays that may tighten workflow, quality, safety, rights, budget, and audience limits but never loosen platform floors. Evidence: property tests and impact preview. - [ ] I8.13.a Define versioned overlay identity/scope/priority/lifecycle and typed workflow allow/deny, quality threshold, safety/rights requirement, budget/quota, audience/target, schedule, and owner fields. Evidence: overlay schema. - [ ] I8.13.b Resolve applicable platform/tenant/program/campaign/project policies in canonical precedence with conflict and cycle detection. Evidence: resolution tests. - [ ] I8.13.c Merge overlays only by intersection, stricter threshold, lower ceiling, additional requirement, or narrower audience/target semantics. Evidence: field-level merge property tests. - [ ] I8.13.d Reject any direct/indirect/default/omission/inheritance attempt to loosen code-owned safety, rights, consent, privacy, security, spend, or authority floors. Evidence: monotonicity property tests. - [ ] I8.13.e Preview affected workflows/models/controls/gates/budgets/users/ scheduled work/releases, conflicts, and new blockers before activation. Evidence: impact preview tests. - [ ] I8.13.f Review/approve/version/schedule/deactivate with role separation, exact effective dates, audit, rollback to prior stricter state, and dependent revalidation. Evidence: overlay lifecycle tests. - [ ] I8.14 Build UI-governed asset-kind, use-case, campaign, style, delivery, and gallery taxonomy registries over code-owned floors. Evidence: versioned review, alias, deprecation, localization, and migration journey. - [ ] I8.14.a Define separate typed registry entry/version/lifecycle contracts for asset kind, use case, campaign, style, delivery target/profile, and gallery taxonomy with stable code. Evidence: registry schemas. - [ ] I8.14.b Declare code-owned noneditable identities, safety/rights/ compatibility semantics, required fields, forbidden relationships, and fallback behavior as registry floors. Evidence: floor tests. - [ ] I8.14.c Build operator list/detail/create-draft/edit/diff/validation UI with typed fields, restrained hierarchy, ownership, dependencies, usage, and no arbitrary JSON. Evidence: authoring tests. - [ ] I8.14.d Implement alias creation/resolution with scope, uniqueness, collision/cycle checks, canonical identity retention, and no silent semantic merge. Evidence: alias tests. - [ ] I8.14.e Implement localization for labels/descriptions/help/search terms with locale fallback, completeness, translator context, and no localized identity keys. Evidence: localization tests. - [ ] I8.14.f Review/approve/publish/deprecate/supersede/archive registry versions with role separation, effective dates, audit, and consumer compatibility checks. Evidence: lifecycle journey. - [ ] I8.14.g Preview and execute resumable migrations of dependent briefs/ assets/workflows/collections/releases with exact mapping, conflicts, unchanged history, and rollback. Evidence: migration journey. - [ ] I8.14.h Verify unknown/deprecated/missing entries fail or degrade safely in every consumer, with contract/parity/accessibility/performance tests. Evidence: cross-host registry suite. ### I9 — Isis observability, evaluation, and launch gates - [ ] I9.1 Instrument plan, dispatch, provider, stage, gate, review, release, and recall traces with bounded attributes. Evidence: trace walkthrough. - [ ] I9.1.a Define canonical trace/span names, parents/links, status, events, sampling, retention, and schema versions for every listed lifecycle. Evidence: telemetry semantic convention. - [ ] I9.1.b Propagate approved trace/correlation/request/job/run/stage/release context across HTTP, queue, worker, provider, storage, outbox, and downstream target boundaries. Evidence: propagation tests. - [ ] I9.1.c Allowlist bounded low-cardinality tenant-safe attributes for asset/workflow/model/provider classes, state, failure class, target, and policy versions. Evidence: cardinality review. - [ ] I9.1.d Exclude prompts/media/source titles/identity/biometrics/secrets/ URLs/raw IDs and apply centralized scrubbing to events/errors. Evidence: trace privacy tests. - [ ] I9.1.e Instrument success/failure/cancel/retry/cache/partial/rollback/ recall transitions and asynchronous span links without false parentage. Evidence: lifecycle trace tests. - [ ] I9.1.f Walk a complete brief-to-recall journey and reconstruct every seam from traces plus canonical records. Evidence: trace walkthrough. - [ ] I9.2 Track queue delay, runtime, success, failure class, quality, moderation, cache, cost, and release conversion by safe dimensions. Evidence: metric schema review. - [ ] I9.2.a Define each counter/gauge/histogram name, unit, numerator/ denominator, event source, aggregation window, owner, and schema version. Evidence: metric catalog. - [ ] I9.2.b Instrument queue wait/age/depth, execution/stage duration, throughput, success/partial/failure/cancel/retry, and stable failure taxonomy. Evidence: metric tests. - [ ] I9.2.c Instrument raw quality/moderation band distributions and unavailable/manual-review rates without exposing sensitive categories to unauthorized dimensions. Evidence: safety metric review. - [ ] I9.2.d Instrument cache lookup/eligible/hit/miss/corrupt/quarantine/ recompute and estimate/reservation/actual/pending/variance costs. Evidence: cache/cost metric tests. - [ ] I9.2.e Define release funnel denominators from generated through gated/ reviewed/bundled/written/verified/retained/recall states without hiding failed or excluded items. Evidence: conversion fixtures. - [ ] I9.2.f Enforce allowlisted low-cardinality tenant-safe dimensions, aggregation/privacy thresholds, and cardinality/volume budgets. Evidence: metric schema/privacy review. - [ ] I9.3 Define SLOs for plan, dispatch acknowledgement, queue age, provider success, artifact durability, gate freshness, and release verification. Evidence: error-budget policy. - [ ] I9.3.a Define user/system journey, population, eligibility, exclusions, measurement point, SLI formula, window, target, and owner for each SLO. Evidence: SLO specification. - [ ] I9.3.b Define plan latency, dispatch acknowledgement, queue age, provider success, artifact durability, gate freshness, and release verification SLIs from canonical metrics/events. Evidence: SLI query tests. - [ ] I9.3.c Segment only by actionable safe service tier/region/provider/ workflow/target classes and prevent small-tenant disclosure. Evidence: SLO dimension review. - [ ] I9.3.d Define multi-window burn alerts, paging/ticket thresholds, missing-data behavior, maintenance/exclusion rules, and ownership. Evidence: alert simulation. - [ ] I9.3.e Define error-budget consumption, release/rollout/freeze policy, exception authority, recovery criteria, and historical amendments. Evidence: ratified error-budget policy. - [ ] I9.4 Build provider and worker fault-injection tests. Evidence: throttle, timeout, malformed output, worker loss, and split-brain cases. - [ ] I9.4.a Build hermetic controllable provider/worker/queue/callback/storage fault fixtures with deterministic clocks, IDs, and failure points. Evidence: fault harness tests. - [ ] I9.4.b Inject rate limit/throttle/capacity/refusal with Retry-After and verify taxonomy, backoff, circuit, reservation, and UI state. Evidence: throttle tests. - [ ] I9.4.c Inject connect/read/overall/deadline timeouts before, during, and after provider acceptance/output write. Evidence: timeout tests. - [ ] I9.4.d Inject malformed status/schema/content type/oversize/artifact/ manifest/hash/callback data and verify quarantine/no success. Evidence: malformed output tests. - [ ] I9.4.e Kill/evict/restart workers at each checkpoint and verify fenced lease, explicit resume/new attempt/failure, no duplicate output/cost. Evidence: worker-loss tests. - [ ] I9.4.f Simulate lease expiry/network partition/two workers/late callback and prove stale actors cannot commit terminal state. Evidence: split- brain tests. - [ ] I9.4.g Verify telemetry, alert, cancellation, cleanup, resource release, and immutable history for every injected case. Evidence: fault coverage report. - [ ] I9.5 Build known-value tests for every technical quality gate. Evidence: gate registry coverage test. - [ ] I9.5.a Enumerate every active technical gate and asset-kind/target/ profile applicability row directly from the gate registry. Evidence: generated coverage manifest. - [ ] I9.5.b Create licensed versioned positive/negative/boundary/N/A/ unsupported/corrupt fixtures with expected raw measurements and units. Evidence: fixture manifests. - [ ] I9.5.c Pin evaluator code/config/dependencies and numeric tolerance/ determinism rules per fixture. Evidence: reproducibility configuration. - [ ] I9.5.d Assert raw measurements, regions/timecodes/object refs, uncertainty/applicability before asserting policy verdicts. Evidence: known-value suites. - [ ] I9.5.e Assert threshold below/equal/above and target-profile changes recompute correct verdicts without reprocessing where permitted. Evidence: boundary tests. - [ ] I9.5.f Fail CI when an active registry row lacks a current fixture or a fixture points to retired/unknown gate versions. Evidence: registry coverage gate. - [ ] I9.6 Build calibrated evaluation suites for model-based safety, similarity, and perceptual gates. Evidence: precision/recall, threshold, subgroup, and uncertainty report. - [ ] I9.6.a Define licensed/consented representative train-free calibration, threshold-selection, and held-out evaluation corpora with provenance, labels, subgroup/risk/style slices, and versioning. Evidence: corpus manifests. - [ ] I9.6.b Define expert annotation guidance, multi-rater process, adjudication, inter-rater reliability, ambiguous/N/A labels, and blinded sampling. Evidence: labeling report. - [ ] I9.6.c Run safety, modality-specific similarity, and perceptual evaluators with pinned versions/configs and retain per-item raw outputs. Evidence: reproducible evaluation runs. - [ ] I9.6.d Report precision/recall/specificity/FPR/FNR/PR or ROC/calibration and confidence intervals at candidate thresholds. Evidence: metric report. - [ ] I9.6.e Report subgroup/content/style/device/quality slices with sample counts, uncertainty, disparity, worst cases, and privacy thresholds. Evidence: subgroup report. - [ ] I9.6.f Select fail/review/pass bands against ratified harm/cost criteria using threshold corpus only, then verify held-out performance. Evidence: threshold decision record. - [ ] I9.6.g Define drift monitoring/recalibration triggers and route uncertain/ low-quality/out-of-distribution cases to human review. Evidence: uncertainty/drift plan. - [ ] I9.7 Build BFF contract tests for every route, role, seam, and failure. Evidence: route inventory coverage is complete. - [ ] I9.7.a Generate/reconcile the complete Isis/Yemaya/Oshun/gallery BFF route-method-operation inventory with handlers, schemas, owners, audiences, consumers, and tests. Evidence: route coverage manifest. - [ ] I9.7.b Assert request/response/content/error schemas, discriminators, versions, units, property absence/redaction, and unknown-field handling. Evidence: schema contract tests. - [ ] I9.7.c Run anonymous/curated/AAA/operator/reviewer/admin and cross- tenant/project object/property/function authorization matrices. Evidence: role contract tests. - [ ] I9.7.d Exercise service/provider/storage/queue/search/publisher seams in success, empty, partial, stale, not-configured, degraded, timeout, conflict, refusal, and malformed modes. Evidence: seam tests. - [ ] I9.7.e Assert pagination/idempotency/concurrency/cursors/deep links/ streaming/reconnect/rate/quota/budget semantics. Evidence: protocol contract tests. - [ ] I9.7.f Fail CI for unclassified routes, untested role/operation rows, or consumer/provider drift. Evidence: inventory coverage gate. - [ ] I9.8 Build real-database and object-store integration tests. Evidence: durable run/output/provenance/recall round-trip. - [ ] I9.8.a Provision isolated real schema/object store/queue/outbox fixtures with migrations, two tenants, encrypted buckets, and deterministic cleanup. Evidence: integration harness. - [ ] I9.8.b Persist brief-to-plan-to-job/stages/checkpoints/attempts/variant/ decision with transactional audit/outbox and restart recovery. Evidence: durable run test. - [ ] I9.8.c Upload/read/hash/cache/quarantine/derive/package output objects and verify metadata, permissions, signed URL, corruption, and retention. Evidence: object round-trip tests. - [ ] I9.8.d Persist source/model/workflow/consent/rights/run/output/credential/ release lineage and verify forward/reverse/blast-radius queries. Evidence: provenance round-trip. - [ ] I9.8.e Execute release write/read-back then revoke/quarantine/recall and verify database/outbox/search/object/gallery target reconciliation. Evidence: recall round-trip. - [ ] I9.8.f Inject commit/outbox/publish/object/queue/process failures and assert idempotent recovery/no orphaned success/cross-tenant leak. Evidence: durability fault tests. - [ ] I9.9 Build golden deterministic bundles for each delivery target. Evidence: validated build/import/read-back. - [ ] I9.9.a Enumerate every supported publishable asset-kind/delivery-target/ profile/version pair and its bundle consumer/validator. Evidence: target coverage manifest. - [ ] I9.9.b Create canonical minimal/full/edge fixtures with pinned source bytes, dependencies, metadata, accessibility, rights, provenance, and expected manifest. Evidence: golden inputs. - [ ] I9.9.c Build twice in clean isolated environments with pinned tools/ locale/time/order/config and compare hashes or declared nondeterministic fields. Evidence: determinism report. - [ ] I9.9.d Validate schema, files, hashes, formats, technical gates, signatures/credentials, target profile, and unsafe-package absence. Evidence: validation reports. - [ ] I9.9.e Import/consume through the target tool/runtime, read back semantic state, and compare expected identity/units/material/timing/metadata. Evidence: import/read-back tests. - [ ] I9.9.f Fail coverage when a supported target pair lacks a current golden, pinned validator, declared loss profile, or current proof. Evidence: bundle coverage gate. - [ ] I9.10 Build full-journey Playwright for operator model intake to release. Evidence: live backing with fixtures explicitly scoped. - [ ] I9.10.a Seed a quarantined model artifact with explicit external source, license/model card/provenance, security scan, evaluation fixtures, and operator/reviewer roles. Evidence: E2E fixture manifest. - [ ] I9.10.b Intake the artifact through the real UI/API/storage path and assert quarantine, hash, dependency, scan, and evidence states. Evidence: intake journey. - [ ] I9.10.c Complete license/provenance review and calibrated evaluations, assert blocking failures, correct them through new evidence/version, and preserve history. Evidence: review journey. - [ ] I9.10.d Promote the exact version to an approved environment with named approval, then select it in an admitted workflow and dispatch a run. Evidence: promotion/dispatch journey. - [ ] I9.10.e Compare output, inspect lineage/gates/cost, approve a locked candidate, assemble/write/read-back a target release. Evidence: release journey. - [ ] I9.10.f Assert direct bypasses, stale evidence, wrong role/tenant, secret/property leak, accessibility, and immutable trace/audit across the journey. Evidence: full Playwright trace. - [ ] I9.11 Build full-journey Playwright for Yemaya brief to gallery promotion. Evidence: cross-host lineage assertions. - [ ] I9.11.a Seed authorized Yemaya project/shot/assets/roles and live or explicitly hermetic Isis capabilities with rights/provenance. Evidence: fixture manifest. - [ ] I9.11.b Author and validate a typed brief in Yemaya, hand off exact context to Isis, preview/confirm the plan, and dispatch. Evidence: outbound handoff test. - [ ] I9.11.c Observe queue/run/stages, return to exact Yemaya context, inspect generated proposal/output, and accept a project revision. Evidence: return journey. - [ ] I9.11.d Promote the exact Yemaya output into an Oshun curated derivative and complete editorial review without inheriting AAA authority. Evidence: editorial boundary test. - [ ] I9.11.e Assert immutable project/shot/brief/plan/run/output/original/ derivative/decision lineage, rights, gates, and audit across hosts. Evidence: cross-host lineage assertions. - [ ] I9.11.f Exercise expired/deleted context, generation failure, stale output, wrong tenant/role, back navigation, accessibility, and no duplicated operator controls. Evidence: negative E2E matrix. - [ ] I9.12 Build full-journey Playwright for curated card generation and editorial promotion. Evidence: tier boundary assertions. - [ ] I9.12.a Seed curated/contemplative and editorial actors, approved card capabilities/presets, provider-gated/live states, and destination collection. Evidence: E2E fixture manifest. - [ ] I9.12.b Complete one representative text/image, audio, temporal, and 3D curated briefing with only approved high-level controls. Evidence: curated card journeys. - [ ] I9.12.c Validate estimate/confirmation/dispatch/progress/failure/output gallery states and audience-safe errors/provenance. Evidence: generation journey. - [ ] I9.12.d Select an exact output and request editorial promotion; complete separate reviewer decision and verified collection release. Evidence: promotion journey. - [ ] I9.12.e Assert raw graph/model/provider/sampler/node/LoRA/private prompt data is absent from UI, payloads, URLs, bundles, errors, and telemetry. Evidence: tier property leak assertions. - [ ] I9.12.f Assert crafted hidden fields/direct routes/deep links/tier switch/ stale output/cross-tenant attempts fail, with accessible responsive journey. Evidence: boundary Playwright matrix. - [ ] I9.13 Run WCAG 2.2 AA automation over critical routes and semantic alternatives. Evidence: reports for themes/viewports/locales. - [ ] I9.13.a Maintain a critical-route/state/action/role inventory covering operator, AAA, curated, gallery, errors, dialogs, live updates, media, graph, and 3D alternatives. Evidence: accessibility coverage manifest. - [ ] I9.13.b Run automated rule scans after stable load and key interactions for every supported light/dark/high-contrast theme. Evidence: theme reports. - [ ] I9.13.c Run keyboard-only focus/order/visibility/trap/shortcut/drag alternative and screen-reader name/role/value/status announcement tests. Evidence: interaction reports. - [ ] I9.13.d Run narrow/mobile/tablet/desktop and 200%/400% zoom/reflow/ orientation/touch-target checks without horizontal two-dimensional scrolling except essential content. Evidence: viewport reports. - [ ] I9.13.e Run default/long-text/RTL/CJK/number/date/unit locale cases plus reduced motion and browser text spacing overrides. Evidence: locale reports. - [ ] I9.13.f Verify noncanvas semantic alternatives provide equivalent inspect/comment/compare/decide operations for media/graph/3D. Evidence: parity journeys. - [ ] I9.13.g Triage every violation with owner/severity/route/state/artifact, block applicable release issues, and retain current reproducible reports. Evidence: zero-blocker accessibility gate. - [ ] I9.14 Run performance and load profiles for comparison, large galleries, queue views, and high-volume jobs. Evidence: budgets pass. - [ ] I9.14.a Ratify client/server/end-to-end latency, interaction, memory, CPU, network, payload, query, throughput, concurrency, and error budgets per scenario/device/network. Evidence: performance budget spec. - [ ] I9.14.b Profile image/video/audio/3D comparison load/sync/scrub/annotation with large candidates and semantic alternatives. Evidence: comparison profile. - [ ] I9.14.c Profile gallery search/filter/pagination/preview/lineage/ virtualization with production-scale assets/collections/metadata. Evidence: gallery profile. - [ ] I9.14.d Load queue/dashboard/run explorer live updates, reconnect, filtering, pagination, and operator actions at production job/event volume. Evidence: queue view profile. - [ ] I9.14.e Load plan/dispatch/worker/provider/callback/gates/storage/outbox/ search/release paths with high-volume mixed jobs/failures/cancels. Evidence: backend load report. - [ ] I9.14.f Measure backpressure/fairness/tail latency/resource/cost/error/ stale behavior and stop tests before unsafe host pressure. Evidence: resource-safe test logs. - [ ] I9.14.g Compare against ratified budgets, capture profiles/traces/query plans, assign regressions, and rerun to current passing reports. Evidence: performance gate. - [ ] I9.15 Run adversarial prompt, graph, upload, SSRF, provenance, auth, tenant, spend, and fixture scans. Evidence: zero release blockers. - [ ] I9.15.a Test prompt/reference/import/retrieved-content injection against system-policy separation, tool grants, data exfiltration, hidden control, and approval claims. Evidence: prompt adversarial suite. - [ ] I9.15.b Test graph/node/subgraph/parameter/custom package injection, unsafe deserialization/code, dependency confusion, cycles, resource abuse, and sandbox escape. Evidence: graph suite. - [ ] I9.15.c Test media/archive/model/package/document uploads for malware, parser bombs, traversal/symlink, polyglot/spoofed type, oversize, and metadata/script payloads. Evidence: upload suite. - [ ] I9.15.d Test URL/provider/webhook/deep-link/import fetch paths for SSRF, DNS rebinding, redirects, credential metadata, internal networks, scheme/ port/host bypass, and response bombs. Evidence: SSRF suite. - [ ] I9.15.e Test provenance hash/signature/manifest/ingredient/watermark/ ledger stripping, substitution, collision, replay, and false recovery. Evidence: provenance suite. - [ ] I9.15.f Test authentication/session/API key, route/function/object/ property authorization, mass assignment, enumeration, CSRF, replay, step-up, and confused deputy. Evidence: auth suite. - [ ] I9.15.g Test two-tenant identifiers/cursors/search/counts/cache/blob/ queue/events/logs/export/recall timing and content isolation. Evidence: tenancy suite. - [ ] I9.15.h Test quota/budget/reservation/cost/priority/batch/cache/refund/ marketplace/chargeback evasion and concurrency. Evidence: spend suite. - [ ] I9.15.i Scan fixture/demo/fallback/placeholder/mock state for production reachability, unlabeled data, simulated success, and release eligibility. Evidence: fixture honesty suite. - [ ] I9.15.j Triage by exploitability/impact with reproducible evidence, owners, fixes, regression tests, and zero unresolved release blockers. Evidence: security gate report. - [ ] I9.16 Re-run generation-tier and Studio-boundary suites. Evidence: no raw machinery is reachable in contemplative Oshun Studio. - [ ] I9.16.a Enumerate contemplative/curated/AAA/operator host routes, operations, controls, contracts, capabilities, bundles, and expected tier availability from canonical policy. Evidence: boundary manifest. - [ ] I9.16.b Crawl/render contemplative Oshun Studio routes and bundles for raw workflow/model/provider/node/sampler/LoRA/graph/training/fleet/ operator identifiers and commands. Evidence: static/runtime leak scan. - [ ] I9.16.c Send direct/guessed/linked/aliased routes and crafted query/body/ nested/unknown fields for every higher-tier operation. Evidence: route/ function authorization tests. - [ ] I9.16.d Test capability/health/error/not-configured/degraded/telemetry/ export/deep-link/search/autocomplete channels for hidden feature detail. Evidence: side-channel tests. - [ ] I9.16.e Verify approved curated cards map only high-level inputs through governed APIs and AAA surfaces remain Yemaya-scoped. Evidence: positive tier journeys. - [ ] I9.16.f Test actor tier/entitlement change mid-session, stale client state/cache, back navigation, service worker/offline cache, and revoked links. Evidence: dynamic boundary tests. - [ ] I9.17 Publish Isis operator and incident runbooks. Evidence: game-day validates provider disable, model revoke, and output recall. - [ ] I9.17.a Inventory operational scenarios, owners/on-call/escalation, prerequisites, permissions, dashboards/queries, commands, evidence, communications, and recovery criteria. Evidence: runbook index. - [ ] I9.17.b Publish provider degradation/disable/drain/failover/restore procedure with in-flight/reservation/cost and verification steps. Evidence: provider runbook. - [ ] I9.17.c Publish model/workflow security/license/safety quarantine/revoke/ replacement/blast-radius procedure. Evidence: model/workflow runbook. - [ ] I9.17.d Publish output/bundle/gallery/marketplace/release quarantine/ recall/downstream verification/notification procedure. Evidence: recall runbook. - [ ] I9.17.e Publish queue/worker/storage/cache/database/search/outbox/ credential/provenance/dependency outage and recovery procedures. Evidence: infrastructure runbooks. - [ ] I9.17.f Publish child/identity/voice/biometric/rights/privacy/security/ spend incidents with restricted evidence and authority/escalation. Evidence: sensitive incident runbooks. - [ ] I9.17.g Execute timed game days for provider disable, model revoke, and output recall; capture gaps, update runbooks/automation, and verify closure. Evidence: game-day reports. - [ ] I9.18 Produce engineering-readiness evidence. Evidence: all required reports are current and linked. - [ ] I9.18.a Define the required readiness index by requirement, capability, host/audience, asset kind, provider/endpoint, target, standard, owner, evidence type, and freshness rule. Evidence: evidence schema. - [ ] I9.18.b Collect current contract/schema/migration/unit/integration/E2E/ accessibility/performance/security/evaluation/DR/runbook reports by immutable commit/artifact links. Evidence: automated evidence index. - [ ] I9.18.c Validate artifact existence/hash, test result/pass state, environment/dependency versions, coverage scope, timestamp/freshness, and no fixture/live ambiguity. Evidence: evidence validator. - [ ] I9.18.d Map every Isis parent/child task and ratified capability/matrix row bidirectionally to evidence or explicit not-applicable decision. Evidence: zero-orphan traceability report. - [ ] I9.18.e Summarize open blockers/risks/exceptions/limitations/owners/ deadlines without allowing summary success to hide failed cells. Evidence: readiness dashboard/report. - [ ] I9.18.f Reproduce the packet from repository and approved external records, sign/version it, and retain prior packets immutably. Evidence: reproducibility test. - [ ] I9.19 Obtain named security/privacy, trust-and-safety, rights, and engineering approvals. Evidence: human approval records. - [ ] I9.19.a Define each approver role/person, authority/scope, required packet sections, independence/conflict rules, decision options, conditions, and expiry. Evidence: approval matrix. - [ ] I9.19.b Freeze the exact commit/build/config/environment/host/audience/ capability/target readiness packet presented for approval. Evidence: approval subject manifest. - [ ] I9.19.c Obtain security/privacy decision over threat model, tests, findings/exceptions, data flows, retention, tenancy, biometrics, and incident readiness. Evidence: named decision. - [ ] I9.19.d Obtain trust-and-safety/rights decision over child/identity/ voice/moderation/originality/consent/licenses/provenance/recall evidence. Evidence: named decisions. - [ ] I9.19.e Obtain engineering decision over architecture, migrations, reliability/SLO, capacity/performance, operations/DR, tests, and known limitations. Evidence: named decision. - [ ] I9.19.f Record approve/reject/conditional/request-changes separately, bind conditions/exceptions/expiry, and invalidate on material subject or evidence change. Evidence: approval lifecycle tests. - [ ] I9.20 Obtain named product launch approval per audience and host. Evidence: human signoff remains separate for operator, AAA, and curated surfaces. - [ ] I9.20.a Define distinct launch cells for Isis operator host, Yemaya AAA integration, Oshun curated Studio, and Oshun gallery with audience, regions, capabilities, providers, targets, flags, and rollout plan. Evidence: launch matrix. - [ ] I9.20.b Assemble cell-specific product evidence for user journeys, utility/usability/accessibility, honest states, documentation/support, analytics, limitations, rollback, and prerequisite governance approvals. Evidence: launch packets. - [ ] I9.20.c Obtain a named authorized product decision independently for each cell rather than inheriting another audience/host’s signoff. Evidence: separate human approval records. - [ ] I9.20.d Bind approval to exact release subject, enablement/flag/region/ provider/target scope, conditions, success/stop metrics, and expiry. Evidence: scope validation. - [ ] I9.20.e Revalidate every cell immediately before rollout and pause only affected cells when approval/evidence/dependency changes. Evidence: prelaunch gate tests. - [ ] I9.20.f Record phased rollout/hold/rollback/outcome and require new approval for material scope expansion. Evidence: launch history. - [ ] I9.21 Run matrix-generated contract, UI, workflow, runtime, bundle, and release tests for every asset family, conditioning mode, consistency strategy, provider/endpoint class, and delivery target ratified in I0.14-I0.17. Evidence: the Cartesian coverage report has no silent, inherited, or untested supported cell. - [ ] I9.21.a Generate canonical matrix dimensions/values/versions and explicit supported/unsupported/not-applicable constraints from I0 decisions and source-of-truth registries. Evidence: matrix manifest. - [ ] I9.21.b Generate only valid constrained cells and require a reasoned disposition for every excluded combination. Evidence: cell enumeration tests. - [ ] I9.21.c Map each supported cell to typed contract/schema/round-trip and audience/host property-authorization proof. Evidence: contract coverage. - [ ] I9.21.d Map each exposed cell to UI control/state/accessibility/ responsive and curated/AAA/operator tier proof. Evidence: UI coverage. - [ ] I9.21.e Map each cell to exact workflow/model/conditioning/continuity/ provider capability negotiation, execution, cancellation, and failure proof. Evidence: workflow/runtime coverage. - [ ] I9.21.f Map each publishable cell to technical/safety/rights gates, deterministic target bundle, write/read-back, and lifecycle proof. Evidence: bundle/release coverage. - [ ] I9.21.g Execute with bounded sharding/resource limits, collect per-cell evidence/failures/skips, and prohibit aggregate pass from hiding a cell. Evidence: resource-safe test report. - [ ] I9.21.h Fail release for supported cells with missing/stale/inherited/ generic-only proof and publish the complete Cartesian coverage report. Evidence: zero-silent-cell gate. - [ ] I9.22 Run full journeys for specialized 3D, cinematic sequence, voice/dubbing, foley/music, marketplace, model intake/training, and parity-monitor workflows. Evidence: each live/exposed capability has current host-specific proof rather than relying on generic generation coverage. - [ ] I9.22.a Run reconstruction-to-semantic-edit/material/LOD/rig/splat/ engine-DCC-package/read-back journey with non-destructive lineage and target gates. Evidence: specialized 3D E2E. - [ ] I9.22.b Run storyboard/animatic/shot continuity/render passes/patch rerender/editorial interchange/release journey with stable unaffected shot identities. Evidence: cinematic E2E. - [ ] I9.22.c Run verified consent through voice enrollment/TTS/clone/dub/ pronunciation/sync/multitrack mix/release/revocation. Evidence: voice/ dubbing E2E. - [ ] I9.22.d Run SFX/foley/music cue/generation/timeline/stems/loudness/mix/ rights/output bundle journey. Evidence: foley/music E2E. - [ ] I9.22.e Run creator enrollment/submission/gates/review/list/purchase/ entitlement/use/attribution/payout/takedown journey. Evidence: marketplace E2E. - [ ] I9.22.f Run external model intake/quarantine/license/security/evaluation/ compare and fine-tune/LoRA/merge lineage through promotion/revoke. Evidence: model supply E2E. - [ ] I9.22.g Run coverage-source ingest/divergence detection/traceability/ disposition/expiry/regression/release blocking journey. Evidence: parity-monitor E2E. - [ ] I9.22.h Execute each journey in its real authorized host/audience with live or explicitly hermetic dependencies, negative tier/tenant cases, accessibility, trace/audit, and current per-capability evidence. Evidence: per-journey live trace bound to the current evidence index. Evidence: specialized journey index. --- ## Phase M — Metis courseware and assessment workbench Metis must support source-to-course authoring, accessible assessment-item production, psychometric review, adaptive sequencing, integrity governance, and standards-compliant institutional delivery. Learner delivery remains a separate surface from authoring and operator adjudication. ### M0 — Product scope, host, and domain decisions - [ ] M0.1 Reconcile `/metis/*`, `/domains/metis`, `/operator/metis`, `apps/metis/admin`, `apps/metis/web`, and proposed Studio routes. Evidence: one canonical route/host map. - [x] M0.1.a Inventory every current route, app entry point, navigation link, deep link, API consumer, audience, mutation, and ownership for the named Metis surfaces. Evidence: current route inventory. - [x] M0.1.b Classify each surface as authoring, institutional setup, educator operations, learner delivery, observer, or operator adjudication. Evidence: audience/host classification. - [ ] M0.1.c Choose canonical route/host for every retained capability and distinguish embedded Studio facade from standalone app/service owner. Evidence: target route map. - [ ] M0.1.d Assign existing routes reuse, redirect-with-expiry, compatibility shim, retire, or net-new disposition with owner and migration date. Evidence: route disposition ledger. - [ ] M0.1.e Validate identity/tenant/context/deep-link/navigation boundaries and prohibit learner/answer-key/integrity/operator leakage. Evidence: route boundary review. - [ ] M0.1.f Ratify the canonical map and add route integrity/drift checks. Evidence: approved map and automated route test. - [ ] M0.2 Resolve the domain-registry `planned` status and launch path before exposing the workbench in the shell. Evidence: approved registry decision. - [ ] M0.2.a Inspect registry status semantics, current Metis deployments/ routes/capabilities, shell visibility logic, feature flags, and consumer assumptions. Evidence: status current-state report. - [ ] M0.2.b Define objective entry/exit criteria for planned, internal, preview, limited availability, generally available, paused, and retired states. Evidence: lifecycle vocabulary. - [ ] M0.2.c Choose Metis launch state/path by host/audience/tenant/region and list prerequisites, dependencies, flags, rollback, and owners. Evidence: registry decision record. - [ ] M0.2.d Ensure shell navigation/capabilities derive from the canonical registry decision and never expose planned routes as usable. Evidence: shell boundary tests. - [ ] M0.2.e Define transition approval/evidence and automatic regression/ incident behavior before changing the registry. Evidence: ratified launch gate. - [ ] M0.3 Define creator, instructional designer, teacher, SME, psychometrician, accessibility reviewer, integrity reviewer, publisher, and tenant-admin roles. Evidence: permission matrix. - [ ] M0.3.a Define each role’s purpose, eligible actor type, tenant/project/ course scope, prerequisites, delegation, conflicts, and lifecycle. Evidence: role definitions. - [ ] M0.3.b Map create/read/edit/comment/review/approve/publish/export/ configure/adjudicate operations for course/source/lesson/item/rubric/ assessment/credential records. Evidence: operation matrix. - [ ] M0.3.c Map protected answer/rationale/grade/learner/profile/integrity/ accommodation/PII/psychometric fields to property-level visibility. Evidence: property matrix. - [ ] M0.3.d Define requester/author/reviewer/approver/publisher separation, conflict-of-interest, quorum, substitute, and break-glass rules. Evidence: separation policy. - [ ] M0.3.e Define tenant-admin boundaries that permit local configuration and assignment but not platform floors, other tenants, or hidden learner/ integrity data. Evidence: admin boundary tests. - [ ] M0.3.f Test direct route/object/property/function, role combination, mid-session revocation, and two-tenant authorization. Evidence: permission test matrix. - [ ] M0.4 Separate authoring data, learner data, assessment evidence, grades, integrity records, and institutional configuration. Evidence: data ownership and classification map. - [ ] M0.4.a Inventory entities/fields/stores/events/APIs/search/indexes/ exports/analytics/backups for each data category. Evidence: data inventory. - [ ] M0.4.b Assign canonical owner/store and classification, purpose, lawful/policy basis, access roles, encryption, retention/deletion, and residency per category. Evidence: ownership/classification map. - [ ] M0.4.c Define minimal versioned projections from learner/grade/integrity/ institutional owners into authoring previews and simulations. Evidence: projection contracts. - [ ] M0.4.d Prohibit copying raw learner history, grades, diagnoses, accommodations, integrity evidence, or institution secrets into course/ item authoring records. Evidence: schema/property tests. - [ ] M0.4.e Define cross-owner identifiers, transactions/events, correction/ deletion/legal-hold propagation, and audit without shared authority. Evidence: boundary flow tests. - [ ] M0.4.f Threat-test search, export, logs, analytics, fixtures, backups, tutor prompts, and previews for cross-category leakage. Evidence: data separation suite. - [ ] M0.5 Decide Metis persistence ownership and database strategy. Evidence: ADR resolves shared `oshun_dev` versus a dedicated database. - [x] M0.5.a Inventory current schemas/tables/migrations/connections/ repositories/data volumes/tenancy/backups and production consumers. Evidence: persistence inventory. - [x] M0.5.b Define aggregate ownership and transaction/consistency/ performance/retention/residency/security requirements for Metis authoring and protected adjacent data. Evidence: requirements matrix. - [x] M0.5.c Compare shared database, dedicated database, and bounded hybrid options for isolation, operational cost, migrations, joins/events, backup/restore, scaling, and ownership. Evidence: option analysis. - [x] M0.5.d Decide canonical IDs and cross-database references/events, avoiding distributed transactions and shadow copies where possible. Evidence: integration design. - [ ] M0.5.e Ratify an ADR selecting the owner/database strategy, migration/ rollback path, operational owner, and rejected alternatives. Evidence: approved ADR. _2026-09-18: the packet exists (the Proposed ADR, its migration plan and its rejected alternatives); what is left is the six named approvals, which no agent may supply (rule 9)._ `blocked:human` - [x] M0.6 Map all `libs/metis/*` packages and canonical contracts to workbench capabilities. Evidence: complete package ledger. - [x] M0.6.a Enumerate package manifests/exports/source/tests/dependencies/ consumers/build targets/owners and detect nested or untracked packages. Evidence: deterministic package inventory. - [x] M0.6.b Extract public contracts/entities/operations/events/jobs/gates/ adapters from each package and link their exact source locations. Evidence: package capability catalog. - [x] M0.6.c Map every package capability to workbench/learner/operator/ institutional feature, canonical owner contract, route/API, and ledger parent task. Evidence: package ledger. - [x] M0.6.d Assign reuse, refactor, move, merge, deprecate, retire, or net-new gap disposition with owner/evidence for duplicates and orphan packages. Evidence: disposition review. - [x] M0.6.e Add bidirectional drift checks so new exports/packages or ledger capabilities cannot remain unmapped. Evidence: zero-orphan audit. - [x] M0.7 Map existing course creation, BYOM, ingest, assessment, tutor, gradebook, and integrity routes. Evidence: reuse/retire/gap dispositions. - [x] M0.7.a Inventory frontend/BFF/service routes, methods, schemas, handlers, auth/roles, data owners, consumers, tests, and live/fixture status for each capability family. Evidence: route inventory. - [x] M0.7.b Trace each route through owner service/store/provider and classify authoring, learner delivery, educator operations, institutional, or adjudication authority. Evidence: route flow map. - [x] M0.7.c Compare routes against canonical contracts and requirements for tenancy, property auth, idempotency, audit, protected data, and honest failure states. Evidence: gap analysis. - [x] M0.7.d Assign per-route reuse, refactor, facade, redirect, retire, replace, or net-new disposition with compatibility/consumer migration. Evidence: route disposition ledger. - [x] M0.7.e Add route/consumer/ledger traceability checks and negative boundary tests for answer keys, grades, integrity records, and BYOM providers. Evidence: route coverage gate. - [x] M0.8 Define content hierarchy: source collection, course, module, lesson, activity, assessment, section, item, stimulus, rubric, objective, standard, and prerequisite. Evidence: hierarchy contract. - [x] M0.8.a Define stable identity/version/tenant/owner/lifecycle/common metadata for every hierarchy entity. Evidence: base entity schema. - [x] M0.8.b Define allowed containment/cardinality/order/reuse relations from source collections through courses/modules/lessons/activities/ assessments/sections/items. Evidence: containment matrix. - [x] M0.8.c Define stimulus-to-item and rubric-to-item/assessment reuse with exact revision pinning and no implicit answer exposure. Evidence: reuse invariants. - [x] M0.8.d Define objective/standard alignment and prerequisite graph edges, scope, weight/coverage, versions, and cycle/orphan semantics. Evidence: graph contracts. - [x] M0.8.e Define clone/reference/embed/fork/supersede/archive/delete/ restore behavior and downstream invalidation per relationship. Evidence: lifecycle invariants. - [x] M0.8.f Publish schemas/goldens for minimal/full/reused/version-diverged/ invalid hierarchies and reconcile existing shapes. Evidence: hierarchy contract suite. - [x] M0.9 Define the authoring maturity model independently from learner progress and grade states. Evidence: vocabulary collision review. - [x] M0.9.a Inventory current authoring, review, publication, learner progress, attempt, mastery, completion, grade, and integrity status vocabularies with owners. Evidence: vocabulary inventory. - [x] M0.9.b Define authoring maturity states/transitions for draft, in review, changes requested, approved, scheduled, published, superseded, archived, quarantined, and retired as applicable. Evidence: state machine. - [x] M0.9.c Define transition actors, prerequisites, guards, concurrency, version effects, audit, rollback/supersession, and invalidation. Evidence: transition matrix. - [x] M0.9.d Keep learner progress/attempt/mastery/completion and grade/ integrity state in their canonical owner vocabularies and projections. Evidence: separation contracts. - [x] M0.9.e Detect identical/ambiguous labels, enum/code reuse, API/UI mapping, analytics conflation, and migration risks. Evidence: collision review. - [x] M0.9.f Test no authoring transition can directly mutate learner/grade/ integrity state and vice versa. Evidence: boundary tests. - [x] M0.10 Threat-model prompt injection, poisoned source material, answer-key leakage, test theft, bias, inaccessible items, model cheating, PII, minors, BYOM abuse, and grade tampering. Evidence: mitigation/test map. - [x] M0.10.a Map assets, actors, trust boundaries, entry points, providers/ models/tools, data stores, exports, integrations, and high-impact actions. Evidence: threat model context. - [x] M0.10.b Model injection/poisoning through uploads, URLs, LMS/repos, extracted text, citations, prompts, BYOM responses, tutor context, and generated media/code. Evidence: injection threat cases. - [x] M0.10.c Model answer/rationale/rubric/test-bank exposure and assessment theft through UI/API/search/export/cache/logs/analytics/tutor/accessibility projections. Evidence: content security cases. - [x] M0.10.d Model bias/unfair/inaccessible items, psychometric misuse, disability inference, translation drift, cultural harm, and automation overclaim. Evidence: fairness/accessibility cases. - [x] M0.10.e Model learner model-assisted cheating, impersonation, collusion, integrity evidence manipulation, false accusation, and appeal denial. Evidence: integrity cases. - [x] M0.10.f Model PII/minor/guardian/educational record/biometric/voice data exposure, overretention, cross-purpose use, and cross-tenant access. Evidence: privacy cases. - [x] M0.10.g Model BYOM credential/model/provider/endpoint/SSRF/spend/ availability/supply-chain abuse and unsafe outputs. Evidence: BYOM cases. - [x] M0.10.h Model grade/credential/approval/publication tampering, replay, mass assignment, concurrency, confused deputy, and audit deletion. Evidence: authority cases. - [x] M0.10.i Assign prevention/detection/response/recovery control, owner, residual risk, verification, incident playbook, and launch gate to every threat. Evidence: mitigation/test traceability matrix. - [ ] M0.11 Define regional education/privacy obligations and institutional policy hooks. Evidence: legal/privacy review with data-retention rules. - [x] M0.11.a Inventory intended regions/jurisdictions, learner age groups, institution types, data subjects, delivery modes, vendors, and data transfers. Evidence: applicability inventory. - [ ] M0.11.b Record counsel/privacy-reviewed education, child/minor, accessibility, assessment, records, consent, AI, biometric/voice, residency, and deletion obligations per applicability cell. Evidence: obligation matrix. _2026-09-18: the matrix carries every category and its open questions; what is left is a named counsel or privacy reviewer reading it (rule 9)._ `blocked:human` - [x] M0.11.c Define code-owned nonwaivable floors and UI-governed institution policy hooks for retention, access, approvals, proctoring, integrity, providers, exports, locales, and communications. Evidence: policy schema. - [x] M0.11.d Define precedence/merge semantics so institution/region policies can tighten but never loosen applicable platform/legal floors. Evidence: monotonicity tests. - [x] M0.11.e Define retention/deletion/legal hold/correction/export/guardian/ consent workflows and downstream processor propagation. Evidence: lifecycle rules. - [ ] M0.11.f Obtain named legal/privacy review with version/effective date, assumptions, open issues, and reevaluation triggers. Evidence: approval record. _2026-09-18: the versioned packet exists; what is left is the named reviewer, the dates and the decision (rule 9)._ `blocked:human` - [ ] M0.12 Define success measures for authoring quality, accessibility, psychometrics, time-to-publish, interoperability, and learner outcomes. Evidence: metric definitions avoid incentivizing harmful shortcuts. - [x] M0.12.a Define authoring quality measures tied to source grounding, objective coverage, correctness, review revisions, gate outcomes, and post-publication corrections. Evidence: quality metric specs. - [x] M0.12.b Define accessibility coverage/defect/learner-use measures by item kind, content type, accommodation, locale, severity, and resolution. Evidence: accessibility metric specs. - [x] M0.12.c Define psychometric measures with sample/uncertainty/privacy, difficulty/discrimination/reliability/DIF/exposure and no small-group misuse. Evidence: psychometric metric specs. - [x] M0.12.d Define time-to-publish stage durations/rework/wait/abandonment with quality/safety/accessibility guardrails so speed cannot reward bypass. Evidence: flow metric specs. - [x] M0.12.e Define standards/package/LMS/import/export compatibility and semantic round-trip measures per version/profile. Evidence: interoperability metric specs. - [x] M0.12.f Define learner-outcome hypotheses and measures with baseline, confounders, consent/privacy, subgroup uncertainty, causal limitations, and no individual high-stakes automation. Evidence: outcome metric review. - [ ] M0.12.g Define owners, sources, formulas/denominators, freshness, privacy thresholds, targets, countermetrics, and review cadence. Evidence: ratified metric catalog. _2026-09-18: all 32 specs carry the catalog fields; what is left is ratification of the proposed targets by named reviewers (rule 9)._ `blocked:human` - [ ] M0.13 Author and ratify `V1/METIS_COURSEWARE_WORKBENCH_DESIGN_2026-07-23.md` with current-state, host, roles, pedagogy, data, API, standards, UI, trust, migration, rollout, and decision records. Evidence: approved doc and resolved review comments. - [x] M0.13.a Establish document scope, requirements traceability, owners, reviewers, source links, terminology, decision log, and evidence format. Evidence: design-doc outline. - [x] M0.13.b Document current apps/routes/packages/contracts/stores/flows/ tests/deployments and explicitly separate live, partial, fixture, and proposed behavior. Evidence: current-state review. - [x] M0.13.c Document canonical hosts/audiences/roles/boundaries, pedagogy/ content model, data ownership/contracts/APIs/jobs/events, and standards profiles. Evidence: architecture sections. - [x] M0.13.d Document UI workbench journeys/responsive/accessibility/offline/ localization, trust/safety/privacy/integrity/rights, and evaluation/ observability/operations. Evidence: experience/trust sections. - [x] M0.13.e Document migration/compatibility/rollout/flags/deprecation/ rollback/readiness and all unresolved options as explicit ADRs. Evidence: migration/decision sections. - [ ] M0.13.f Review against feature inventory/deep dives/code/contracts and resolve or disposition every comment with named domain/security/privacy/ accessibility/engineering/product ratification. Evidence: approved doc. _2026-09-18: the document pins its sources and names six review roles; what is left is the six approvals (rule 9)._ `blocked:human` - [ ] M0.14 Reconcile `V1/features/domain-metis.md`, the V1 feature inventory, deep-dive specifications, standalone apps, service OpenAPI, and every `libs/metis/*` capability at atomic-feature level. Evidence: explicit dispositions include course authoring, curriculum discovery, assessments, tutoring/live voice, mastery/adaptation, knowledge graphs, credentials, prerecorded lectures, agentic media, correctness verification, gradebook, integrity, institutional interoperability, administration, and training-data flywheel. - [x] M0.14.a Build deterministic atomic-feature inventories from each named document, app/route, OpenAPI operation/schema, package export, job/event, and test with source anchors. Evidence: source inventories. - [x] M0.14.b Normalize aliases only through reviewed mappings while retaining source-specific identity and semantics. Evidence: alias map. - [x] M0.14.c Map course/curriculum/assessment/item/rubric/source and standards authoring features bidirectionally to canonical capabilities. Evidence: core authoring rows. - [x] M0.14.d Map tutoring/live voice, learner modeling/mastery/adaptation, knowledge graphs, simulations, correctness verification, and agentic media features with authoring-versus-delivery authority. Evidence: intelligent learning rows. - [x] M0.14.e Map credentials, prerecorded lectures, gradebook, integrity, institutional interoperability/administration, analytics, and training- data flywheel features with data/authority boundaries. Evidence: institutional rows. - [x] M0.14.f Assign reuse/refactor/move/merge/retire/net-new/defer/reject disposition, canonical owner, parent/child task, dependencies, and proof to every source feature. Evidence: disposition ledger. - [ ] M0.14.g Review collisions/orphans/unsupported assertions and add a deterministic bidirectional zero-orphan drift gate. Evidence: approved reconciliation report. _2026-09-18: the deterministic gate exists and proves zero orphans both ways; what is left is the owner's approval of its report and an effective date (rule 9)._ `blocked:human` - [ ] M0.15 Define the boundary among authoring, institutional setup, educator operations, learner delivery, guardian/observer views, and operator adjudication for every Metis feature. Evidence: no learner progress, grade, answer key, integrity evidence, or credential authority is exposed through an authoring convenience route. - [x] M0.15.a Define each surface’s actors, purpose, canonical host/routes, owner services/stores, permitted subject projections, and high-impact actions. Evidence: surface boundary matrix. - [x] M0.15.b Assign every reconciled atomic feature and route to exactly one mutation owner and any read-only facades/deep links. Evidence: ownership ledger. - [x] M0.15.c Define minimal authoring projections of learner progress/profile, grades, integrity, accommodation, and credentials for preview/planning with purpose/field/aggregation limits. Evidence: projection schemas. - [ ] M0.15.d Keep answer keys/rationales/items, detailed integrity evidence, grade corrections, learner PII, and credential issuance/revoke authority within their approved surfaces. Evidence: property/function tests. - [x] M0.15.e Define signed handoffs with current authorization, tenant/ institution/course/subject/revision context, expiry, replay, return intent, and immutable audit. Evidence: handoff contracts. - [ ] M0.15.f Test direct routes, crafted fields, search/export/logs/ notifications, deep links, role changes, and two-tenant leakage across all surface pairs. Evidence: adversarial boundary suite. - [x] M0.16 Map discipline-specific capabilities for mathematics, physical science, life science, social science, language/humanities, and computing—or the current canonical discipline registry—to common and specialized editors, verifiers, media, simulations, and accessibility needs. Evidence: no discipline inherits unsupported generic behavior. - [x] M0.16.a Reconcile named disciplines to the current canonical registry, hierarchy/aliases/versions, institution mappings, and extensibility. Evidence: discipline registry map. - [x] M0.16.b Define common content/objective/source/item/rubric/review/export/ accessibility capabilities and declare their real cross-discipline support. Evidence: common capability rows. - [x] M0.16.c Map mathematics requirements for semantic math, proofs/worked steps, symbolic/numeric verification, graphs, manipulatives, and accessible notation. Evidence: mathematics rows. - [x] M0.16.d Map physical/life science requirements for equations/units, datasets, labs/field evidence, simulations, diagrams, uncertainty, safety/ethics, and accessible alternatives. Evidence: science rows. - [x] M0.16.e Map social science/language/humanities requirements for primary/ secondary sources, claims/perspectives, chronology/maps, text/audio/oral performance, interpretation, and cultural/linguistic review. Evidence: humanities rows. - [x] M0.16.f Map computing requirements for code/editor/runtime/tests/ dependency/sandbox/security, interactive systems, and nonvisual output. Evidence: computing rows. - [x] M0.16.g Map specialized editor, verifier, media/Isis/Yemaya/Euterpe, simulation, item type, export loss, accessibility, and reviewer role for every supported discipline capability. Evidence: discipline matrix. - [x] M0.16.h Mark unsupported/not-applicable/deferred cells explicitly with reasons and fail generic fallback when specialized semantics are required. Evidence: no-inherited-behavior coverage test. ### M1 — Contracts, standards, and content model - [ ] M1.1 Verify all canonical Metis contracts and remove duplicate workbench shapes. Evidence: contract ownership matrix. - [x] M1.1.a Inventory all Metis entities/schemas/types/OpenAPI/event/job/ database/workbench shapes and their definitions, versions, owners, consumers, serializers, and tests. Evidence: contract inventory. - [x] M1.1.b Group shapes by semantic aggregate/operation and distinguish valid command/read/export projections from competing canonical definitions. Evidence: equivalence analysis. - [x] M1.1.c Choose one canonical owner contract per entity/operation and map every duplicate field/enum/version/unit/optional/default difference. Evidence: ownership matrix. - [x] M1.1.d Assign reuse/adapter/migrate/deprecate/remove disposition and consumer migration/compatibility window for every duplicate. Evidence: disposition ledger. - [ ] M1.1.e Add public parse/serialize/round-trip/schema goldens and drift/ forbidden-import checks preventing new workbench-local canonical shapes. Evidence: contract ownership gate. - [x] M1.2 Define immutable course and item revisions with stable identifiers. Evidence: versioning and restore invariants. - [x] M1.2.a Define stable logical IDs separately from immutable revision IDs, tenant/owner, parent/base revision, sequence/label, state, author/reason, timestamps, and integrity hash. Evidence: revision schemas. - [x] M1.2.b Define which course/module/lesson/activity/assessment/item/ stimulus/rubric/objective/metadata relations are captured by a course or item revision manifest. Evidence: revision boundary map. - [x] M1.2.c Create revisions by copy-on-write or explicit references with optimistic concurrency and prohibit in-place changes to consumed/ reviewed/published revisions. Evidence: immutability tests. - [x] M1.2.d Define fork/branch/merge/conflict/supersede/archive/restore/ compare semantics without reusing a historical revision ID. Evidence: lifecycle invariants. - [x] M1.2.e Pin assessments/builds/delivery/attempts/grades/evidence to exact revisions and preserve resolvability after supersession. Evidence: downstream linkage tests. - [x] M1.2.f Restore by creating a new revision semantically equal to the old one with restoration provenance, not by mutating history. Evidence: restore invariants. - [x] M1.3 Define learning objectives with taxonomy, level, measurable verb, criteria, prerequisite, standard alignments, and evidence requirements. Evidence: schema tests. - [x] M1.3.a Define objective identity/version/scope/locale/title/description/ owner/lifecycle and course hierarchy membership. Evidence: base schema. - [x] M1.3.b Define taxonomy identity/version plus objective classification, level, measurable verb, subject/content, context, and allowed extensions. Evidence: taxonomy field tests. - [x] M1.3.c Define observable performance criteria, conditions, mastery/ quality thresholds, units, rubric refs, and acceptable evidence kinds. Evidence: criteria tests. - [x] M1.3.d Define prerequisite/requisite/related objective edges with version, strength, rationale, cycle/orphan/reachability rules. Evidence: prerequisite graph tests. - [x] M1.3.e Define standard/framework/version/jurisdiction/grade-band/code alignments with coverage/strength/rationale/evidence and human review. Evidence: alignment tests. - [x] M1.3.f Define content/activity/item/assessment/evidence coverage links and prevent publication of required objectives without ratified coverage. Evidence: coverage invariants. - [x] M1.4 Define Bloom or ratified cognitive-level vocabulary without hard-coding it as the only pedagogy. Evidence: extensibility test. - [x] M1.4.a Register cognitive/pedagogical taxonomy identity/version/owner/ lifecycle/source/license/locale and stable level codes. Evidence: vocabulary registry schema. - [x] M1.4.b Model Bloom levels/verbs/relations as one admitted vocabulary, including revised/classic profile distinctions where ratified. Evidence: Bloom fixtures. - [x] M1.4.c Allow other approved taxonomies and institution mappings through versioned registry entries rather than enum/code changes. Evidence: alternate taxonomy test. - [x] M1.4.d Define cross-taxonomy mappings as exact/broader/narrower/related/ unmapped with version/rationale and no false equivalence. Evidence: mapping tests. - [x] M1.4.e Make objective/item/UI/API/search/export consume taxonomy+version+ code and render locale labels without relying on Bloom-specific fields. Evidence: consumer extensibility tests. - [x] M1.4.f Handle unknown/deprecated/unavailable taxonomy versions safely and preserve historical meaning. Evidence: lifecycle tests. - [x] M1.5 Define assessment item kinds including selected response, constructed response, essay, math, code, media, simulation, interaction, portfolio, and oral/performance evidence. Evidence: kind registry. - [x] M1.5.a Define versioned kind-registry entry with response/evidence model, interaction capabilities, scoring modes, delivery/runtime requirements, accessibility, standards mappings, security risk, and lifecycle. Evidence: kind schema. - [x] M1.5.b Define selected-response variants for single/multiple choice, ordering, matching, hotspot, and other ratified interactions with option/key invariants. Evidence: selected-response fixtures. - [x] M1.5.c Define constructed-response/essay response formats, length/ language/format constraints, scoring guides, exemplars, and moderation. Evidence: written-response fixtures. - [x] M1.5.d Define math/code response, semantic/executable artifacts, equivalence/tests/sandbox/runtime, partial credit, and accessible alternatives. Evidence: math/code fixtures. - [x] M1.5.e Define media/simulation/interaction inputs, states/events/ recordings, deterministic seeds, telemetry, scoring hooks, fallback, and sandbox. Evidence: interactive fixtures. - [x] M1.5.f Define portfolio and oral/performance evidence submissions, artifact/take/observation/assessor/rubric/consent/retention fields. Evidence: performance evidence fixtures. - [x] M1.5.g Require explicit unsupported/not-applicable behavior across authoring, delivery, accessibility, QTI/LTI/export, analytics, and scoring for every kind. Evidence: registry coverage matrix. - [x] M1.6 Define stimuli and shared passages separately from items. Evidence: one stimulus can safely version and serve multiple items. - [x] M1.6.a Define stimulus logical/revision identity, kind, content blocks, source/citation/rights, locale, accessibility, metadata, lifecycle, and integrity hash. Evidence: stimulus schema. - [x] M1.6.b Define text/passage, image/diagram, audio/video, dataset/table/ chart, code, document, and interactive stimulus-specific fields. Evidence: kind fixtures. - [x] M1.6.c Define item-to-stimulus link with exact revision, role, order, excerpt/locator, presentation context, shared instructions, and dependency invalidation. Evidence: link schema. - [x] M1.6.d Permit one immutable stimulus revision to serve multiple items/ assessments while keeping each item key/scoring/exposure separate. Evidence: reuse tests. - [x] M1.6.e Version source/content/accessibility/localization changes through a new stimulus revision and compute affected items/builds/attempts. Evidence: blast-radius tests. - [x] M1.6.f Prevent stimulus delivery/search/export from exposing linked item answers or unreleased test membership. Evidence: isolation tests. - [x] M1.7 Define answer, rationale, distractor rationale, scoring, feedback, hint, and exposure metadata. Evidence: answer-key fields are protected. - [x] M1.7.a Define protected answer/key forms per item kind with exact item revision, acceptable variants/equivalence/tolerance, ordering, and partial-credit semantics. Evidence: answer schema tests. - [x] M1.7.b Define correct-answer rationale and per-distractor/response-pattern rationales separately from learner-visible feedback. Evidence: rationale schemas. - [x] M1.7.c Define deterministic/rubric/model-assisted/manual scoring method, steps/rules/weights/rounding, evidence, uncertainty, moderation, and version. Evidence: scoring schemas. - [x] M1.7.d Define preattempt/postresponse/postsubmission/postdeadline/ instructor feedback and progressive hint ladders with penalty/exposure conditions. Evidence: feedback/hint tests. - [x] M1.7.e Define item/key/explanation exposure state, audience, window, attempts, secure-delivery/export/search/log/cache rules, and breach response. Evidence: exposure policy tests. - [x] M1.7.f Enforce property-level permissions for answer/rationale/scoring/ distractor fields across UI/API/tutor/search/export/events/analytics and two tenants. Evidence: protected-field suite. - [x] M1.8 Define rubric criteria, levels, descriptors, weights, scoring method, moderation, and evidence refs. Evidence: deterministic score invariants. - [x] M1.8.a Define rubric logical/revision identity, scope, owner, locale, analytic/holistic/single-point method, lifecycle, applicable items/ evidence kinds, and integrity hash. Evidence: rubric schema. - [x] M1.8.b Define stable criteria with objective links, title/description, required flag, weight/points, ordering, dependencies, and evidence requirements. Evidence: criterion tests. - [x] M1.8.c Define ordered performance levels with codes, descriptors, score/point/range, boundary inclusivity, exemplars, and locale variants. Evidence: level tests. - [x] M1.8.d Define weighted/points/custom rule aggregation, missing/N/A/ unscorable handling, rounding, caps/floors, and total-scale mapping. Evidence: exact score fixtures. - [x] M1.8.e Define assessor evidence refs, annotations, confidence, criterion decisions, comments, moderation/second marking, reconciliation, and audit. Evidence: scoring evidence tests. - [x] M1.8.f Version rubrics immutably and pin assessment/scoring/grade records to exact revisions; changes cannot recalculate historical grades without correction workflow. Evidence: versioning invariants. - [x] M1.9 Define accommodations and Personal Needs and Preferences references. Evidence: support requirements remain separate from disability diagnoses. - [x] M1.9.a Adopt/version the applicable PNP/accommodation vocabulary and map support codes to delivery capabilities without copying diagnoses. Evidence: standards mapping. - [x] M1.9.b Define authoring-side support requirement for presentation, content, navigation, timing/scheduling, response, setting, language, and assistive technology compatibility. Evidence: requirement schema. - [x] M1.9.c Define purpose-bound learner PNP projection with opaque learner/ profile ref, requested/approved support codes, source authority, effective term, and no medical detail. Evidence: projection contract. - [x] M1.9.d Define conflicts, mutually exclusive supports, item invalidation, equivalent alternatives, human review, and cannot-deliver behavior. Evidence: compatibility tests. - [x] M1.9.e Enforce field-level access/retention/audit and prohibit inference or storage of disability diagnosis from support selection/use. Evidence: privacy tests. - [x] M1.9.f Verify authoring preview and learner delivery apply the same supported semantics while protected learner records remain external. Evidence: preview/delivery parity tests. - [x] M1.10 Define locale variants, bidirectional text, MathML, SSML, transcripts, captions, long descriptions, tactile refs, and sign-language assets. Evidence: QTI accessibility mapping. - [x] M1.10.a Define locale/language/script/region/direction variant identity, source revision, translation status, fallback, reviewer, and change lineage. Evidence: locale variant schema. - [x] M1.10.b Define Unicode/bidirectional isolation/base direction/mixed- script/numeral/punctuation behavior for content, answers, code, math, metadata, and input. Evidence: bidi fixtures. - [x] M1.10.c Define semantic MathML source, presentation/content profile, speech/braille alternatives, equation refs/labels, and fallback image/ text. Evidence: MathML fixtures. - [x] M1.10.d Define allowlisted SSML profile, language/voice/pronunciation/ prosody/mark semantics, text equivalent, and safe renderer behavior. Evidence: SSML fixtures. - [x] M1.10.e Define transcript and caption tracks with language, speaker, timebase/cues, non-speech audio, review, synchronization, and formats. Evidence: timed-text fixtures. - [x] M1.10.f Define alt text, extended/long description, tactile graphic/ braille-ready refs, data/source linkage, and equivalent learning outcome. Evidence: nonvisual alternative tests. - [x] M1.10.g Define sign-language asset language/community/presenter/consent/ rendition/time alignment and fallback semantics. Evidence: sign-language fixtures. - [x] M1.10.h Map every field/asset to QTI accessibility metadata/content, document explicit loss/unsupported behavior, and round-trip. Evidence: QTI accessibility mapping tests. - [x] M1.11 Define QTI 3 package/import/export profile. Evidence: every supported item kind maps or fails with an explicit incompatibility. - [x] M1.11.a Pin supported QTI 3 specification/version/conformance modules, namespaces, package/resource/manifest profile, extensions, and validator toolchain. Evidence: profile decision. - [x] M1.11.b Map canonical assessment/test/section/item/stimulus/response/ outcome/processing/rubric/objective/metadata identities and versions to QTI constructs. Evidence: field mapping. - [x] M1.11.c Map each item kind/interaction/scoring/feedback/hint/adaptive/ template capability with exact supported/lossy/extension/unsupported disposition. Evidence: item-kind matrix. - [x] M1.11.d Map media/files/MathML/accessibility/locale/bidi/captions/ transcripts/PNP/dependencies and package paths securely. Evidence: content/accessibility matrix. - [x] M1.11.e Import with archive/schema/size/path/resource protections, preview/migration/conflict/reporting, immutable source package, and no answer-key exposure. Evidence: hostile import tests. - [x] M1.11.f Export deterministic validated packages with exact revisions, standards metadata, checksums, rights, declared extensions/loss report, and no secrets/private fields. Evidence: golden exports. - [x] M1.11.g Round-trip every supported item-kind/profile through pinned independent validators/consumers and fail explicitly for incompatible cells. Evidence: QTI conformance suite. - [ ] M1.12 Define LTI 1.3/LTI Advantage launch, deep-link, roles, and grade service profile. Evidence: standards matrix. - [x] M1.12.a Pin LTI 1.3/LTI Advantage service versions/conformance, deployment/issuer/client/key registration, platforms, privacy profile, and supported flows. Evidence: profile decision. - [x] M1.12.b Define OIDC login and resource-link launch validation for issuer, audience/client, deployment, nonce/state, message type/version, target link, roles, context, resource, user, locale, and custom claims. Evidence: launch contract tests. - [x] M1.12.c Map institutional/course/section/role claims to canonical identities and least-privilege authoring/learner/educator operations without trusting display fields. Evidence: role mapping matrix. - [x] M1.12.d Define deep-link request/response for course/content/assessment selection, exact revision/resource, placement, availability, grade settings, signing, and return validation. Evidence: deep-link tests. - [x] M1.12.e Define Names and Role Provisioning scope/pagination/freshness/ privacy plus Assignment and Grade Services line-item/score/result directionality, idempotency, correction, and visibility. Evidence: service contract tests. - [x] M1.12.f Define key rotation/JWKS cache, replay/clock skew, launch expiry, logout/session, error/redaction, and tenant/deployment isolation. Evidence: security tests. - [ ] M1.12.g Run platform/tool conformance and consumer-driven tests for each supported flow/role/failure, declaring unsupported cells. Evidence: LTI standards matrix. - [ ] M1.13 Define OneRoster, Caliper, Open Badges, SCORM, and xAPI profiles. Evidence: source-of-truth and directionality for each field. - [x] M1.13.a Pin version/conformance/transport/auth/profile/extensions/ validators and system-of-record ownership for every listed standard. Evidence: standards decision matrix. - [x] M1.13.b Define OneRoster organization/course/class/term/user/enrollment/ academic-session/category/line-item/result mappings, directionality, identifiers, delta, deletion, and conflict rules. Evidence: OneRoster mapping tests. - [x] M1.13.c Define Caliper entity/event/action/actor/object/generated/ membership/assessment/grade semantics, profile versions, privacy, event ordering, and delivery. Evidence: Caliper mapping tests. - [x] M1.13.d Define Open Badges issuer/profile/achievement/alignment/criteria/ evidence/assertion/recipient/status/endorsement mapping and verification direction. Evidence: Open Badges tests. - [x] M1.13.e Define SCORM package/manifest/SCO/asset/sequencing/runtime data/ completion/success/score/interaction/bookmark/error mappings and sandbox. Evidence: SCORM profile tests. - [x] M1.13.f Define xAPI actor/verb/object/result/context/authority/statement refs/attachments/state/activity/profile mapping, LRS direction, voiding, and privacy. Evidence: xAPI profile tests. - [ ] M1.13.g Document lossy/unsupported/conflicting fields, canonical precedence, version negotiation, and round-trip/conformance evidence per profile. Evidence: cross-standard matrix. - [x] M1.14 Define psychometric metadata for classical item statistics, 1PL, 2PL, 3PL, calibration sample, standard error, DIF, exposure, and status. Evidence: schema invariants and privacy review. - [x] M1.14.a Define analysis/calibration identity/version, exact item revision, population/sample/filter/window, method/software/config, owner, and lifecycle. Evidence: psychometric run schema. - [x] M1.14.b Define classical difficulty/facility, discrimination, point- biserial, option/distractor statistics, reliability contribution, missingness, counts, and uncertainty. Evidence: CTT schema tests. - [x] M1.14.c Define 1PL/2PL/3PL ability scale, difficulty, discrimination, guessing, information/fit, parameter constraints, transformation/linking, standard errors, and convergence. Evidence: IRT schema tests. - [x] M1.14.d Define calibration sample inclusion/exclusion, size, weights, representativeness, administration/item versions, privacy threshold, and data quality. Evidence: sample invariants. - [x] M1.14.e Define DIF group descriptors through privacy-preserving approved dimensions, method, reference/focal groups, effect/significance/ uncertainty, sample floors, and review outcome. Evidence: DIF tests. - [x] M1.14.f Define exposure count/rate/window/population/administration/ security classification and active/field-test/calibrating/review/ approved/retired/compromised status. Evidence: exposure/status tests. - [x] M1.14.g Separate raw/estimated statistics from policy/quality decisions, pin versions, protect small groups/learner data, and prohibit unsupported individual inference. Evidence: privacy/invariant review. - [x] M1.15 Define academic-integrity evidence, classifier outputs, decisions, appeals, and audit references. Evidence: competing integrity vocabularies are reconciled without lossy mapping. - [x] M1.15.a Inventory/reconcile plagiarism, proctoring, authorship, similarity, behavior, device/session, assessment-security, incident, decision, and appeal vocabularies with versioned mappings. Evidence: vocabulary map. - [x] M1.15.b Define evidence identity/version/source/collector, learner/ attempt/item refs, event/time range, integrity hash, classification, access, retention, chain of custody, and redaction. Evidence: evidence schema. - [x] M1.15.c Define classifier/rule output with model/code/config/version, input refs, scores/features, uncertainty, applicability, limitations, threshold, and no direct misconduct conclusion. Evidence: output schema. - [x] M1.15.d Define human case/decision with allegation/category, evidence reviewed, standard/policy, actor/authority, rationale, outcome, consequence recommendation, and separation from grade mutation. Evidence: decision schema. - [x] M1.15.e Define appeal filing/evidence/access/independent reviewer/ deadlines/stay/outcome/remedy and link it without overwriting the original decision. Evidence: appeal contract. - [x] M1.15.f Define append-only audit refs for collection/access/redaction/ sharing/decision/appeal/correction/deletion/legal hold and institution boundary. Evidence: audit tests. - [x] M1.15.g Preserve source vocabulary and semantic loss status through mappings; reject lossy automatic adjudication. Evidence: reconciliation invariants. - [x] M1.16 Define gradebook correction and visibility contracts. Evidence: append-only correction and role-redaction tests. - [x] M1.16.a Define grade record identity/version for learner, course/ assessment/item/attempt revisions, score/value/status, scale, source, grader, timestamps, and evidence refs. Evidence: grade schema. - [x] M1.16.b Define append-only correction command with target grade version, reason/category, old/new values, evidence, requester, approver, effective time, and idempotency. Evidence: correction schema. - [x] M1.16.c Define recalculate, regrade, override, void, excuse, late/ incomplete, moderation, appeal, and import correction semantics separately. Evidence: correction-type tests. - [x] M1.16.d Enforce eligible states/roles, separation of duties, expected version, policy, scale/range, downstream aggregate impacts, and audit. Evidence: correction guard tests. - [x] M1.16.e Define field/action visibility for learner, guardian, teacher, assessor, administrator, integrity reviewer, support, and integrations by release window/privacy. Evidence: visibility matrix. - [x] M1.16.f Project current grade from immutable history, preserve prior values/reasons, notify affected actors safely, and propagate LTI/ OneRoster corrections idempotently. Evidence: end-to-end tests. - [x] M1.17 Define course-build and assessment-evidence bundles. Evidence: canonical contract goldens validate. - [x] M1.17.a Define course-build bundle manifest with exact course hierarchy/ content/objective/standard/item/stimulus/rubric/media/localization/ accessibility revisions, dependencies, target profile, and hashes. Evidence: course bundle schema. - [x] M1.17.b Define assessment-evidence bundle manifest with assessment/item/ stimulus/rubric revisions, delivery config, response/evidence refs, scoring/moderation, integrity, accommodations projection, grades/ corrections, and protected-field partitions. Evidence: evidence schema. - [x] M1.17.c Define encryption/signature/access/retention/redaction/selective disclosure for learner/answer/integrity evidence separately from publishable course content. Evidence: security tests. - [x] M1.17.d Resolve exact dependencies, normalize manifest/order/filenames/ timestamps, compute hashes, and declare external/redacted/missing refs. Evidence: determinism tests. - [x] M1.17.e Define version/migration/compatibility/loss/validator/import/read- back semantics for each target consumer. Evidence: compatibility tests. - [x] M1.17.f Create minimal/full/multilocale/accessibility/interactive/ protected-evidence goldens and validate independent round-trip. Evidence: canonical bundle suite. - [ ] M1.18 Add machine-readable standards/version metadata to every exported package. Evidence: compatibility probe. - [x] M1.18.a Define common package metadata for format/profile/spec version, conformance modules, extensions, producer/version, build/contract version, target, locale, generated time policy, and manifest digest. Evidence: metadata schema. - [x] M1.18.b Map common metadata into QTI/LTI-deep-link/OneRoster/Caliper/ Open Badges/SCORM/xAPI/course-build/lecture package-native locations. Evidence: per-standard mapping. - [x] M1.18.c Declare supported/required/optional/extension/lossy/unsupported features and dependency/runtime versions machine-readably. Evidence: capability manifest tests. - [x] M1.18.d Sign/hash metadata with the package and prevent divergence between human documentation, filename, manifest, and payload. Evidence: integrity tests. - [x] M1.18.e Build a pre-import compatibility probe returning compatible, migration-required, degraded/lossy, unsupported, invalid, or unknown with exact reasons. Evidence: probe tests. - [ ] M1.18.f Verify every exporter emits current metadata and every importer enforces it rather than guessing from content. Evidence: export coverage gate. - [x] M1.19 Define credential template, requirement, evidence, issuer, recipient projection, achievement, badge, endorsement, issuance, verification, expiry, revocation, and replacement contracts. Evidence: Open Badges mapping and authority/privacy invariants. - [x] M1.19.a Define credential template/revision identity, title/description/ image, type, locale, issuer eligibility, achievement alignment, criteria, evidence policy, validity, and lifecycle. Evidence: template schema. - [x] M1.19.b Define nested all/any/count/sequence/time/grade/mastery/course/ assessment/experience requirements with exact revisions and deterministic evaluation. Evidence: requirement tests. - [x] M1.19.c Define evidence refs/types/issuer/source/subject/integrity/ verification/access/retention and minimize learner detail exposed to authoring or public verifiers. Evidence: evidence contracts. - [x] M1.19.d Define issuer identity/authority/keys/status/endorsements plus privacy-preserving recipient identifier/proof and subject binding. Evidence: issuer/recipient tests. - [x] M1.19.e Define achievement/badge/assertion/endorsement mapping to Open Badges with alignments, criteria, evidence, dates, status, signatures, hosted/signed forms, and extensions. Evidence: mapping goldens. - [x] M1.19.f Define issuance request/evaluation/approval/signing/delivery/ receipt idempotency and prohibit course authors from self-granting issuer or recipient authority. Evidence: issuance tests. - [x] M1.19.g Define verification for signature/hash/issuer/status/recipient/ evidence/expiry/revocation and privacy-safe public responses. Evidence: verifier tests. - [x] M1.19.h Define expiry/renewal/revocation/replacement/supersession with reason, effective time, status lists/notifications, lineage, and no history rewrite. Evidence: lifecycle invariants. - [x] M1.20 Define prerecorded lecture packages with script, segment, speaker or avatar, voice/likeness consent, slides/diagrams, demonstrations, captions, transcript, audio description, translations, media renditions, sources, checks, and playback manifest. Evidence: versioned package goldens. - [x] M1.20.a Define lecture/package/logical/revision identity, course/lesson/ objective links, locale, duration/timebase, owner, lifecycle, target, and integrity manifest. Evidence: lecture schema. - [x] M1.20.b Define versioned script and segment/chapter records with text, objectives, sources/citations, timing, speaker, visual/demo cues, and revision dependencies. Evidence: script/segment tests. - [x] M1.20.c Define human/synthetic/avatar presenter identity, role, language, pronunciation, performance, voice/likeness/model/source consent scope, disclosure, expiry, and revocation. Evidence: presenter contracts. - [x] M1.20.d Define slides/diagrams/charts/code/labs/demonstrations/media ingredients with exact source/data/code/renderer/rights/provenance and segment alignment. Evidence: visual ingredient tests. - [x] M1.20.e Define transcript/caption/audio-description/sign-language/ translation variants with language, timing, speaker/non-speech cues, review, and source-revision linkage. Evidence: accessibility contracts. - [x] M1.20.f Define video/audio/slide/text rendition profiles with codec/ dimensions/rate/color/loudness/bitrate/device/bandwidth/offline and quality checks. Evidence: rendition tests. - [x] M1.20.g Define correctness/source, safety, consent/rights, accessibility, sync, technical, target, and reviewer evidence required per package. Evidence: check registry. - [x] M1.20.h Define playback manifest for chapters/tracks/renditions/ captions/descriptions/translations/download/streaming/fallback with exact hashes and no hidden authority. Evidence: playback tests. - [x] M1.20.i Produce deterministic minimal/full/multilingual/accessible/ avatar/demo goldens and validate package/playback round-trip. Evidence: lecture package suite. - [x] M1.21 Define tutoring configuration for persona, pedagogy, hint ladder, source set, course/item revision, learner-context projection, live voice/text mode, tools, escalation, safety, integrity mode, and session retention. Evidence: authoring settings cannot grant the tutor forbidden learner or answer-key access. - [x] M1.21.a Define immutable tutor configuration/revision identity, owner/ approver, applicable course/lesson/objective/item/locale/audience, lifecycle, and code/institution floors. Evidence: config schema. - [x] M1.21.b Define bounded persona/tone/language/disclosure and versioned pedagogy/strategy/scaffolding rules without impersonation or hidden human claims. Evidence: persona/pedagogy tests. - [x] M1.21.c Define hint ladder stages, eligibility, attempt/timing triggers, source/rationale boundaries, penalties, exhaustion, and protected-answer nonexposure. Evidence: hint tests. - [x] M1.21.d Define authorized source collection/course/item revision set, retrieval/citation policy, update/retraction invalidation, and fail- closed grounding behavior. Evidence: source-set tests. - [x] M1.21.e Define minimized learner-context projection fields/purpose/ freshness/retention and prohibit raw profile/grade/integrity/diagnosis/ answer-key access. Evidence: context property tests. - [x] M1.21.f Define text/live voice input-output, speaker/voice consent, transcript/caption, interruption, latency, recording, disclosure, and degraded-mode behavior. Evidence: modality tests. - [x] M1.21.g Define allowlisted versioned tools, typed grants, resource/ network/data limits, confirmation, outputs, audit, and no configuration- granted privilege. Evidence: tool authorization tests. - [x] M1.21.h Define safety, child/privacy, self-harm/escalation, academic- integrity modes per assessment state, refusal, educator handoff, and incident paths. Evidence: policy matrix. - [x] M1.21.i Define session duration/context/history/summary/retention/ deletion/export/analytics and exact configuration/course/model versions. Evidence: session lifecycle tests. - [x] M1.22 Define learner-profile and preference projections used by preview, adaptation, accessibility, and tutor simulation without copying protected learner records into authoring storage. Evidence: minimization and purpose-boundary tests. - [x] M1.22.a Inventory candidate learner/profile/preference/PNP/mastery/ progress/grade/integrity fields, canonical owners, classifications, and prohibited authoring uses. Evidence: field inventory. - [x] M1.22.b Define separate purpose-bound projections for anonymous author preview, authorized adaptation, accessibility delivery, tutor session, and synthetic simulation. Evidence: projection schemas. - [x] M1.22.c Use opaque subject/profile/simulation identities and expose only minimum locale, support capability, prior-knowledge band, preferences, and contextual state required for each purpose. Evidence: minimization tests. - [x] M1.22.d Represent unknown/withheld/not-applicable/stale values explicitly and prevent inference of diagnoses, protected traits, grade, or integrity status. Evidence: inference tests. - [x] M1.22.e Authorize issuer/consumer/purpose/tenant/course/session, bind source/freshness/expiry, prevent caching/authoring persistence, and audit access. Evidence: purpose-boundary tests. - [x] M1.22.f Define correction/revocation/deletion/session-end invalidation and prove projections disappear from temporary stores/logs/prompts/exports. Evidence: lifecycle tests. - [x] M1.22.g Build synthetic profile fixtures for authoring simulations so real learners are never required for general preview/testing. Evidence: simulation isolation tests. ### M2 — Source ingest, grounding, and curriculum planning - [x] M2.1 Implement source intake from upload, URL, feed, LMS, repository, DOI, and manual record. Evidence: each path records provenance and checksum. - [x] M2.1.a Define immutable source/intake/version/provenance/checksum, connector, authority, rights, classification, and lifecycle contracts. Evidence: intake schemas. - [x] M2.1.b Implement bounded multipart upload with content sniffing, hash- while-streaming, temporary quarantine, and tenant isolation. Evidence: upload tests. - [x] M2.1.c Implement allowlisted URL/feed retrieval with SSRF/redirect/DNS/ size/type/time protections and immutable retrieval receipt. Evidence: network intake tests. - [x] M2.1.d Implement LMS/repository connectors with scoped credentials, stable external IDs/versions, pagination/rate limits, and deletion/ update semantics. Evidence: connector tests. - [x] M2.1.e Resolve DOI metadata/content through approved registries with authoritative identifier, edition/version, access/rights, and no false full-text assumption. Evidence: DOI fixtures. - [x] M2.1.f Implement manual bibliographic/source record with required provenance/evidence and explicit no-bytes/unchecked status. Evidence: manual intake tests. - [x] M2.1.g Normalize all paths to one source-version record with original locator, retrieval time, content hash, connector/tool versions, and audit. Evidence: cross-path parity tests. - [x] M2.2 Quarantine and scan source uploads. Evidence: malicious document, archive, macro, and oversize fixtures. - [x] M2.2.a Store new bytes in nonpublic nonexecutable quarantine with opaque names, tenant scope, encryption, limits, and no downstream parser access. Evidence: quarantine tests. - [x] M2.2.b Scan malware/signatures, content type/polyglot, macros/scripts/ active content, archive traversal/symlinks/nesting/bombs, and parser exploit indicators. Evidence: malicious fixture suite. - [x] M2.2.c Enforce compressed/uncompressed size, file/count/depth, page/ object/media, CPU/time/memory, and password/encryption rules. Evidence: boundary tests. - [x] M2.2.d Record scanner/database/version/config/hash/results and classify clean/quarantined/rejected/manual/unavailable without false clean state. Evidence: result schema tests. - [x] M2.2.e Admit exact scanned hash only after all required scans; rescan on scanner/policy/freshness change and retain prior evidence. Evidence: admission/race tests. - [x] M2.3 Extract text, structure, tables, equations, media, and metadata with page/section anchors. Evidence: golden corpus. - [x] M2.3.a Define extraction document/node/anchor/confidence/error contracts with exact source hash and extractor/config versions. Evidence: extraction schema. - [x] M2.3.b Extract ordered text, headings/sections/lists/footnotes/citations/ reading order with page/region/character anchors. Evidence: structure goldens. - [x] M2.3.c Extract tables with cells/spans/headers/captions/units/footnotes and page regions; preserve image fallback. Evidence: table goldens. - [x] M2.3.d Extract equations as source/math representation plus visible text/ image, labels, variables, and page regions without inventing semantics. Evidence: equation goldens. - [x] M2.3.e Extract embedded images/audio/video/files with hashes, captions/ alt text, time/page anchors, technical metadata, and source rights. Evidence: media goldens. - [x] M2.3.f Extract bibliographic/document metadata with source-versus-derived provenance, normalization, confidence, and conflicts. Evidence: metadata fixtures. - [x] M2.3.g Test multilingual/RTL/scanned/OCR/complex layout/malformed/ password/partial cases against licensed golden corpus. Evidence: extraction quality report. - [x] M2.4 Preserve original bytes and extraction version. Evidence: re-extraction does not rewrite historical evidence. - [x] M2.4.a Store original bytes immutably by content hash with source-version manifest, encryption, access, retention, and legal-hold metadata. Evidence: storage integrity tests. - [x] M2.4.b Define extraction-run identity with exact source hash, parser/OCR/ model/config/runtime versions, status, outputs, errors, and timestamps. Evidence: extraction run schema. - [x] M2.4.c Persist extracted artifacts/anchors under the run identity and forbid in-place correction or replacement. Evidence: immutability tests. - [x] M2.4.d Re-extract as a new run, compare/diff outputs, migrate accepted anchors explicitly, and retain consumers of old evidence. Evidence: re-extraction tests. - [x] M2.4.e Verify stored source/extraction hashes on read/reuse and quarantine corruption without rewriting history. Evidence: corruption tests. - [x] M2.5 Implement source authority, license, currency, jurisdiction, and audience metadata. Evidence: validation and review UI. - [x] M2.5.a Define publisher/author/institution/issuer authority identity, evidence, role, credentials, reputation limits, and verification state. Evidence: authority schema. - [x] M2.5.b Define source/license/version/owner, access/use/reproduce/adapt/ teach/train/distribute rights, attribution, territory, term, and evidence. Evidence: license schema. - [x] M2.5.c Define published/updated/retrieved/reviewed/effective/expired dates, supersession/retraction, subject volatility, and currency review interval. Evidence: currency tests. - [x] M2.5.d Define jurisdiction/geographic scope/applicability/conflicts and intended learner age/grade/language/prerequisite/accessibility audience. Evidence: jurisdiction/audience schemas. - [x] M2.5.e Validate completeness/compatibility/freshness and present raw metadata/evidence/conflicts/reviewer decision separately. Evidence: validation/review UI tests. - [x] M2.6 Implement claim extraction behind the fenced provider seam. Evidence: proposals require human confirmation. - [x] M2.6.a Define claim proposal with exact source/extraction revision, text/normalized proposition, type/scope/qualifiers, locators, confidence, provider/model/prompt/config version, and status. Evidence: schema tests. - [x] M2.6.b Send only authorized bounded source passages/instructions through the injected provider, fenced as untrusted data with no tools/authority. Evidence: injection/data-minimization tests. - [x] M2.6.c Validate provider schema/locators/quotes/size, reject unsupported source assertions, and persist refusal/malformed/unavailable honestly. Evidence: provider seam tests. - [x] M2.6.d Present proposals with source context, uncertainty, duplicates/ conflicts, and accept/edit/reject/defer actions. Evidence: review tests. - [x] M2.6.e Create canonical claim revisions only from explicit authorized human decisions; preserve original proposal/model provenance. Evidence: authority boundary tests. - [x] M2.7 Implement citation attachment with page, section, paragraph, timecode, dataset slice, or URI fragment locators. Evidence: locator validation fixtures. - [x] M2.7.a Define citation identity/version, claim/content target, exact source/extraction revision, locator kind/value, quote/context, role, author, and verification state. Evidence: citation schema. - [x] M2.7.b Implement page/region, heading/section, paragraph/character, media timecode/range, dataset row/column/filter/version, and URI fragment locators as typed variants. Evidence: locator fixtures. - [x] M2.7.c Validate locator syntax/bounds/source-kind/revision and resolve to exact content without mutable URL/page assumptions. Evidence: validation tests. - [x] M2.7.d Detect source/extraction changes that make locators exact, shifted, ambiguous, orphaned, or invalid and require re-review. Evidence: anchor survival tests. - [x] M2.7.e Render/export accessible citation context and preserve rights/ excerpt limits without exposing protected sources. Evidence: citation UI/ export tests. - [x] M2.8 Implement high-risk severity floors for health, legal, safety, and other ratified domains. Evidence: authoritative-source requirements. - [x] M2.8.a Define versioned risk-domain registry, severity levels, claim/use/ audience applicability, and nonwaivable code floors. Evidence: risk schema. - [x] M2.8.b Define minimum source authority, recency, jurisdiction, corroboration, citation, reviewer qualification, disclaimer/escalation, and update monitoring per severity. Evidence: requirement matrix. - [x] M2.8.c Classify curriculum claims/lessons/items/tutor settings using typed evidence and route ambiguous/high severity to human review. Evidence: classification tests. - [x] M2.8.d Block planning/publication/tutor use when authoritative-source or qualified-review requirements are missing/stale/conflicting. Evidence: fail-closed tests. - [x] M2.8.e Test institution overlays can tighten but never loosen floors and that source withdrawal propagates. Evidence: monotonicity/lifecycle tests. - [x] M2.9 Implement source update/retraction blast radius across lessons, items, feedback, tutor prompts, and published courses. Evidence: known-value propagation test. - [x] M2.9.a Maintain forward/reverse versioned dependency edges from source/ extraction/claim/citation into all named consumers and release bundles. Evidence: dependency graph tests. - [x] M2.9.b Ingest verified update/supersession/retraction/rights change with effective time, reason, authority, scope, and source identity matching. Evidence: change intake tests. - [x] M2.9.c Traverse direct/transitive impacts with stable pagination, reason/path/current revision/status, unknown dependencies, and tenant/ property authorization. Evidence: blast-radius fixtures. - [x] M2.9.d Mark affected draft/review/published/tutor/delivery eligibility stale or blocked according to risk policy without deleting history. Evidence: propagation tests. - [x] M2.9.e Route owners to re-source/revise/review/rebuild/unpublish and verify all downstream states/read-backs. Evidence: known-value end-to-end test. - [x] M2.10 Implement curriculum brief capture with audience, prerequisites, outcomes, constraints, standards, duration, modality, locale, and assessment strategy. Evidence: required-field gate. - [x] M2.10.a Define versioned brief identity/scope/owner/course/program, intended learners/grade/age/context, enrollment scale, and source refs. Evidence: brief schema. - [x] M2.10.b Capture prerequisite knowledge/skills/evidence and target learning outcomes/objectives with measurable criteria. Evidence: prerequisite/outcome tests. - [x] M2.10.c Capture standards/framework/version/coverage, institution/region/ safety/accessibility/rights/technology/budget/schedule constraints. Evidence: constraint tests. - [x] M2.10.d Capture total/calendar/seat/self-study duration, synchronous/ asynchronous/in-person/online/blended modality, locale/language, device/ bandwidth/offline requirements. Evidence: delivery tests. - [x] M2.10.e Capture formative/summative/diagnostic/authentic assessment strategy, weighting/frequency/security/accommodation/feedback constraints. Evidence: assessment strategy tests. - [x] M2.10.f Validate required/conditional fields, conflicts, units, compatibility, code/institution floors, and reviewer acceptance before planning. Evidence: required-field gate. - [x] M2.11 Implement objective and concept-map authoring. Evidence: cycle, orphan, unreachable objective, and prerequisite checks. - [x] M2.11.a Build typed objective create/edit/version/link UI/API with taxonomy, criteria, standards, evidence, ownership, and validation. Evidence: objective authoring tests. - [x] M2.11.b Define concept node identity/type/version/source/locale and prerequisite/part-of/example/contrast/causal/related relationship kinds. Evidence: concept graph schema. - [x] M2.11.c Build accessible graph plus synchronized tree/list/table operations for add/link/unlink/reorder/group/annotate/import. Evidence: semantic UI tests. - [x] M2.11.d Detect cycles where forbidden, self/duplicate/conflicting edges, orphan objectives/concepts, missing roots, and unreachable outcomes. Evidence: graph validation fixtures. - [x] M2.11.e Validate prerequisite ordering against modules/lessons/ assessments and surface remediation without automatic destructive edits. Evidence: sequencing tests. - [x] M2.12 Implement standards-alignment suggestions behind the provider seam. Evidence: human acceptance and source/version attribution. - [x] M2.12.a Define alignment proposal for exact objective/content/item and standard framework/version/code, strength/coverage, rationale, source locators, confidence, and provider provenance. Evidence: schema tests. - [x] M2.12.b Retrieve only authorized current standard text/metadata and send bounded inputs through the fenced provider with injection resistance. Evidence: provider input tests. - [x] M2.12.c Validate proposed codes/versions/locators against the canonical standards registry and deduplicate/conflict-check. Evidence: validation tests. - [x] M2.12.d Present source text/diff/confidence/limitations and require human accept/edit/reject with reviewer authority. Evidence: review journey. - [x] M2.12.e Persist accepted alignment separately from proposal and invalidate/review on objective or standard revision change. Evidence: lineage tests. - [x] M2.13 Implement course-outline divergence. Evidence: N variants preserve generated structure and score provenance. - [x] M2.13.a Define outline variant/set contracts with stable module/lesson/ objective structure IDs, source brief/revisions, generation plan, and provider provenance. Evidence: outline schemas. - [x] M2.13.b Generate N bounded variants with explicit diversity strategy, seeds/controls, budget/cost confirmation, and unique identities. Evidence: divergence tests. - [x] M2.13.c Validate every variant for hierarchy, objective/prerequisite/ standards/coverage/workload constraints before comparison. Evidence: outline validation tests. - [x] M2.13.d Record provider/evaluator/human scores with rubric/version/ uncertainty separately; manual variants show absent generated scores. Evidence: score provenance tests. - [x] M2.13.e Compare/select/reject/merge/fork variants through decision records while retaining all original structures. Evidence: decision journey. - [x] M2.14 Implement workload and seat-time estimation. Evidence: deterministic calculation with modality-specific assumptions. - [x] M2.14.a Define versioned effort model for reading/listening/viewing, instruction, discussion, practice, assessment, project/lab/simulation, feedback, and navigation with units/assumptions. Evidence: model schema. - [x] M2.14.b Derive content/activity quantities from exact outline/course revision and apply modality, difficulty, learner-band, language, accessibility, and synchronous/self-paced factors. Evidence: calculation fixtures. - [x] M2.14.c Calculate learner effort, instructor/facilitator workload, seat time, independent time, calendar duration, range/uncertainty, and bottlenecks separately. Evidence: estimate tests. - [x] M2.14.d Expose per-component inputs/formulas/assumptions/overrides/source and never hide unknown work as zero. Evidence: explainability tests. - [x] M2.14.e Compare estimate to brief/institution constraints and require authorized reasoned overrides without changing raw calculations. Evidence: constraint tests. - [x] M2.15 Implement objective-to-content-to-assessment coverage matrices. Evidence: undercoverage and overassessment gates. - [x] M2.15.a Build exact revision links from objectives to modules/lessons/ blocks/activities/practice/items/assessments/rubrics and evidence. Evidence: coverage graph tests. - [x] M2.15.b Define instructional/introduced/practiced/reinforced/assessed/ mastered coverage roles, depth/cognitive level, weight, and required thresholds. Evidence: coverage vocabulary. - [x] M2.15.c Compute accessible objective-by-content-by-assessment matrices with direct/indirect, missing, stale, unsupported, and duplicated links. Evidence: matrix fixtures. - [x] M2.15.d Detect required objective undercoverage, content without objective, assessment without instruction, excessive weight/frequency, level mismatch, and overassessment. Evidence: gate tests. - [x] M2.15.e Present raw links/measures and remediation separately from policy verdict; recompute on revision/threshold changes. Evidence: UI/API tests. - [x] M2.16 Implement curriculum decision records. Evidence: selected, rejected, and superseded outlines remain traceable. - [x] M2.16.a Define immutable decision identity, actor/authority, compared outline revisions, selected/rejected/deferred/merged disposition, rationale, evidence, conditions, and timestamp. Evidence: decision schema. - [x] M2.16.b Bind selection to exact outline/brief/objective/standards/ workload/coverage versions and retain all alternatives. Evidence: selection tests. - [x] M2.16.c Record rejection/defer reasons and requested changes without deleting or modifying the outline. Evidence: negative decision tests. - [x] M2.16.d Record merge/fork as a new outline revision with explicit source variant contributions and decisions. Evidence: merge lineage tests. - [x] M2.16.e Supersede through a new decision linked to the prior decision and preserve current/historical projection. Evidence: traceability tests. - [x] M2.17 Build curriculum discovery across existing courses, open resources, standards, concept graphs, prerequisites, credentials, and institution catalogs with rights, authority, version, locale, and reuse diagnostics. Evidence: discovery never silently imports or republishes content. - [x] M2.17.a Define discovery index/result/source/version contracts and connectors for each named catalog type with provenance/freshness. Evidence: discovery schemas. - [x] M2.17.b Ingest only authorized metadata/excerpts/fingerprints with rights, authority, locale, standards/objectives/concepts/prerequisites/ credential relations. Evidence: connector tests. - [x] M2.17.c Implement permission-aware search/filter/facet/rank/compare with exact source, version, match rationale, currency, and no protected answer/learner leakage. Evidence: query tests. - [x] M2.17.d Diagnose reuse compatibility for license, audience, locale, standards, prerequisites, level, accessibility, target, source quality, and update risk. Evidence: diagnostic fixtures. - [x] M2.17.e Implement preview/bookmark/request-import/link-as-reference as explicit actions; require review/rights/validation before canonical authoring use. Evidence: no-silent-import tests. - [x] M2.18 Build discipline-aware planning templates and verification requirements for proofs/worked solutions, lab or field evidence, data analysis, source interpretation, language performance, and executable computing artifacts. Evidence: specialized requirements remain typed and survive standards export where supported. - [x] M2.18.a Define versioned discipline template with applicability, specialized typed blocks, verification/gate/reviewer/accessibility/ standards-export requirements, inheritance, and code floors. Evidence: template schema. - [x] M2.18.b Define proof/worked-solution premises/steps/justifications/ notation/equivalence/checker/manual review and semantic math alternatives. Evidence: mathematics templates. - [x] M2.18.c Define lab/field question/method/materials/safety/ethics/ observations/data/uncertainty/analysis/reproducibility evidence. Evidence: lab templates. - [x] M2.18.d Define dataset/source/version/variables/units/cleaning/method/ code/results/visualization/uncertainty/reproducibility for data analysis. Evidence: data templates. - [x] M2.18.e Define primary/secondary source context/authority/perspective/ claim/citation/corroboration/counterevidence for interpretation. Evidence: source interpretation templates. - [x] M2.18.f Define language/oral performance prompt/context/language/skills/ recording/consent/rubric/assessor/accessibility evidence. Evidence: performance templates. - [x] M2.18.g Define code/runtime/dependencies/input/output/tests/seed/resource/ network/security/accessibility/reproducibility for computing artifacts. Evidence: computing templates. - [x] M2.18.h Map each typed field to applicable QTI/course/standards export or explicit extension/loss/incompatibility and round-trip it. Evidence: export survival tests. ### M3 — Lesson, activity, media, and rubric authoring - [x] M3.1 Build course and module boards with guarded maturity transitions. Evidence: server-enforced move tests. - [x] M3.1.a Define board columns/grouping/order/filter view from canonical course/module revision and maturity state. Evidence: board view tests. - [x] M3.1.b Implement accessible create/open/reorder/group operations with keyboard/non-drag alternatives and optimistic concurrency. Evidence: board interaction tests. - [x] M3.1.c Resolve allowed maturity transitions, roles, prerequisites, blockers, review/approval, reason, and version effect server-side. Evidence: transition matrix tests. - [x] M3.1.d Reject crafted moves, stale revisions, missing gates, unauthorized roles, and cross-tenant IDs; preserve immutable transition history. Evidence: server-enforced negative tests. - [x] M3.2 Build the lesson dossier with objectives, prerequisites, sources, content, activities, assessments, assets, gates, review, and history. Evidence: live-data browser journey. - [x] M3.2.a Define one typed lesson dossier projection joining exact lesson/ course revision and all named relationships with freshness/redaction. Evidence: dossier contract. - [x] M3.2.b Present objectives/prerequisites/coverage and source/citation/ authority/currency/rights with conflicts and missing requirements. Evidence: curriculum/source panels. - [x] M3.2.c Present ordered content/activities/assessments/rubrics/assets/ accessibility variants and dependency state. Evidence: content panels. - [x] M3.2.d Present quality/safety/accessibility/correctness gates, comments/ reviews/approvals, maturity, publication readiness, and remediation. Evidence: gate/review panels. - [x] M3.2.e Present revision/diff/decision/audit/published-build/use history with stable deep links and no answer-key exposure. Evidence: history tests. - [x] M3.2.f Verify live edit-review-preview journey, direct property auth, responsive accessibility, and large-dossier performance. Evidence: browser E2E. - [x] M3.3 Build a structured lesson block editor for prose, callout, example, equation, code, image, audio, video, interaction, practice, reflection, and assessment link. Evidence: block registry coverage. - [x] M3.3.a Define versioned block registry entry, shared identity/order/ locale/source/objective/accessibility fields, per-kind schema, renderer, validator, and export mappings. Evidence: registry schema. - [x] M3.3.b Implement typed editors/previews for prose/callout/example and semantic equation/code blocks. Evidence: text/technical block tests. - [x] M3.3.c Implement governed image/audio/video attachment blocks with captions/transcripts/descriptions/rights/provenance. Evidence: media block tests. - [x] M3.3.d Implement sandboxed interaction, practice, reflection, and exact assessment/item link blocks without copying protected answers. Evidence: activity block tests. - [x] M3.3.e Implement insert/duplicate/reference/reorder/nest/convert/delete/ restore with stable IDs, depth rules, dependency invalidation, and non-drag controls. Evidence: editing tests. - [x] M3.3.f Fail coverage for any registered block lacking editor, learner renderer, validation, accessibility, localization, import/export, preview, and test disposition. Evidence: block registry gate. - [x] M3.4 Build semantic MathML and accessible code/example editing. Evidence: screen-reader and copy/export tests. - [x] M3.4.a Author validated MathML source with visual preview, semantic tree, labels/numbering, variable/units context, speech/braille text, and image fallback. Evidence: math editor tests. - [x] M3.4.b Preserve semantic MathML through save/diff/copy/paste/QTI/export/ learner render without raster-only substitution. Evidence: round-trip tests. - [x] M3.4.c Author code with language/version, plain text, line semantics, annotations, input/output/example/test refs, and no formatting-only meaning. Evidence: code editor tests. - [x] M3.4.d Provide accessible syntax/error/result descriptions, keyboard operation, copy behavior, wrapping/zoom/high contrast, and screen-reader navigation. Evidence: accessibility tests. - [x] M3.4.e Sanitize markup/code, fence execution separately, and verify exports cannot inject scripts/styles or leak hidden answers. Evidence: security/export tests. - [x] M3.5 Build media attachment through the governed Isis gallery. Evidence: source, rights, alt text, transcript, captions, and provenance gates. - [x] M3.5.a Query/select only curated audience-authorized gallery asset revisions by kind/locale/target/status with current capability state. Evidence: gallery selector tests. - [x] M3.5.b Attach exact immutable asset/output revision and approved derivative/rendition role without copying or rewriting Isis lineage. Evidence: attachment schema tests. - [x] M3.5.c Require source/rights/consent/provenance/quality/safety/target eligibility and propagate expiry/quarantine/recall. Evidence: gate tests. - [x] M3.5.d Require kind-appropriate alt text/long description/transcript/ captions/audio description/sign-language or reviewed N/A reason. Evidence: accessibility gate tests. - [x] M3.5.e Preview through the learner renderer and verify media, metadata, accessibility tracks, permissions, and offline/bandwidth variants. Evidence: attachment E2E. - [x] M3.6 Build interactive-activity configuration with preview isolation. Evidence: untrusted embeds cannot access parent credentials or data. - [x] M3.6.a Define allowlisted activity/runtime version, typed parameters, initial/reset state, objectives, events, data needs, sizing, offline, accessibility alternative, and target. Evidence: config schema. - [x] M3.6.b Validate parameter ranges/dependencies/seed/resource/network/ browser permissions/content security and prohibit arbitrary code/URLs. Evidence: validation tests. - [x] M3.6.c Render preview in origin/process sandbox with explicit message protocol, capability grants, time/memory/storage/network limits, and teardown. Evidence: sandbox tests. - [x] M3.6.d Use synthetic sample identity/context and prevent access to parent cookies/storage/credentials/DOM/network, real learner data, or answer keys. Evidence: escape tests. - [x] M3.6.e Capture deterministic events/results/errors for preview validation without recording as real attempts or grades. Evidence: preview tests. - [x] M3.7 Build rubric authoring with weight validation and exemplar evidence. Evidence: exact weighted-score fixtures. - [x] M3.7.a Build typed rubric/criterion/level/descriptors/points/weights/ ordering/objective/item/evidence authoring with immutable revisions. Evidence: authoring tests. - [x] M3.7.b Validate unique criteria/levels, complete descriptors, ordered/ nonoverlapping score ranges, weights/totals, required evidence, locale, and scoring method. Evidence: validation tests. - [x] M3.7.c Attach authorized exemplar artifact/revision, criterion/level mapping, annotation, rights/consent, redaction, and reviewer approval. Evidence: exemplar tests. - [x] M3.7.d Preview learner/assessor versions with protected exemplar/key fields separated and accessible table/nonvisual semantics. Evidence: role preview tests. - [x] M3.7.e Calculate exact scores for boundary/missing/N/A/rounding/ moderation cases and pin delivered items to rubric revision. Evidence: weighted-score fixtures. - [x] M3.8 Build authoring-time readability and language-complexity analysis. Evidence: server-computed known-value tests. - [x] M3.8.a Define supported language/locale/age/grade/content-kind applicability, metrics/features, units, versions, thresholds, and limitations. Evidence: analysis schema. - [x] M3.8.b Compute server-side token/sentence/word/syllable/lexical/syntactic/ cohesion/domain-term features on exact block/lesson revision. Evidence: known-value fixtures. - [x] M3.8.c Return raw measures/regions/assumptions/uncertainty/N/A separately from institution policy bands and suggestions. Evidence: result tests. - [x] M3.8.d Avoid penalizing proper nouns, technical terms, quotations, code, math, multilingual/learner-level intentional text without applicability context. Evidence: false-positive tests. - [x] M3.8.e Present advisory evidence with source/version and author accept/ dismiss/revise decision; never auto-rewrite. Evidence: review UI tests. - [x] M3.9 Build terminology and glossary lint. Evidence: locale-aware, course-scoped results. - [x] M3.9.a Define versioned course/locale glossary entries, preferred/ allowed/deprecated/forbidden terms, definitions, variants, context, capitalization, links, and ownership. Evidence: glossary schema. - [x] M3.9.b Tokenize/normalize by locale/script while excluding code, math, citations, quoted source, names, and configured contexts. Evidence: locale fixtures. - [x] M3.9.c Detect undefined/inconsistent/deprecated/forbidden/ambiguous terms, acronym first use, spelling/casing, and glossary-link drift with exact ranges. Evidence: lint tests. - [x] M3.9.d Scope results to exact course/glossary/lesson revisions and distinguish inherited/institution/domain terms and conflicts. Evidence: scope tests. - [x] M3.9.e Present replace/add-definition/link/allow-context/dismiss actions with human decision and no destructive bulk edit. Evidence: lint UI tests. - [x] M3.10 Build inclusivity and bias assist as review evidence, not an unchallengeable truth score. Evidence: model/version/uncertainty visible. - [x] M3.10.a Define versioned review dimensions/rubrics, applicability, evidence units, evaluator/provider/model/config, thresholds/manual bands, limitations, and protected-data policy. Evidence: assist schema. - [x] M3.10.b Analyze exact content/item/media revision for representation, stereotypes, exclusionary language/context, cultural/linguistic bias, accessibility, and assessment construct-irrelevant barriers. Evidence: calibrated fixtures. - [x] M3.10.c Return attributed findings with text/region/item anchor, category, rationale, score/confidence/uncertainty, counterevidence, and N/A/error. Evidence: result tests. - [x] M3.10.d Display evaluator/model/version/corpus limits and avoid one aggregate “bias score” or automatic truth/author blame. Evidence: UI tests. - [x] M3.10.e Require authorized human accept/reject/reframe/request-specialist review decisions, preserving proposal and disagreement. Evidence: authority tests. - [x] M3.11 Build lesson duration and cognitive-load estimates. Evidence: assumptions and confidence shown. - [x] M3.11.a Define per-block/activity/media/assessment time and intrinsic/ extraneous/germane or ratified load model with versions/units/ assumptions/applicability. Evidence: estimate schema. - [x] M3.11.b Compute active/passive/synchronous/independent duration and load by segment from exact content quantities, modality, difficulty, prerequisites, language, device, and supports. Evidence: fixtures. - [x] M3.11.c Aggregate sequence peaks, sustained load, switching, redundancy, pacing, breaks, and total ranges with uncertainty. Evidence: sequence tests. - [x] M3.11.d Compare against brief/institution/learner-band constraints and surface assumptions/data gaps/remediation without treating estimates as fact. Evidence: explainability tests. - [x] M3.11.e Record author override with reason and preserve calculated values separately; recompute on revision/model change. Evidence: lifecycle tests. - [x] M3.12 Build learner preview using the real delivery renderer and permission-safe sample identity. Evidence: author/learner parity test. - [x] M3.12.a Invoke the same versioned renderer/runtime/target contracts used by learner delivery against an exact unpublished course/lesson build. Evidence: renderer parity tests. - [x] M3.12.b Issue a synthetic sample identity with no real enrollment/ learner/grade/integrity authority and a bounded preview session. Evidence: identity isolation tests. - [x] M3.12.c Project selected synthetic locale/preferences/PNP/prerequisite/ progress states without copying real learner records. Evidence: context tests. - [x] M3.12.d Prevent preview interactions from creating real attempts, grades, credentials, analytics, notifications, integrity cases, or LTI/ LMS writes. Evidence: side-effect tests. - [x] M3.12.e Compare author preview DOM/media/interaction/accessibility/ scoring-safe behavior to learner delivery for the same build. Evidence: parity journey. - [x] M3.13 Build device, theme, locale, accommodation, offline, and bandwidth preview modes. Evidence: preview matrix. - [x] M3.13.a Define supported viewport/input/device capabilities, themes/ contrast/motion, locales/direction, PNP supports, connectivity/cache, and network profiles as versioned preview presets. Evidence: preset schema. - [x] M3.13.b Apply presets to the real learner renderer without claiming hardware/assistive-technology emulation beyond measured capabilities. Evidence: preview accuracy tests. - [x] M3.13.c Verify content/layout/input/media/interaction/accessibility/ localization behavior and explicit unsupported/degraded state for every valid matrix cell. Evidence: preview matrix. - [x] M3.13.d Simulate offline/intermittent/slow/high-latency/limited-data behavior with cache provenance, fallback, retries, and no hidden success. Evidence: network tests. - [x] M3.13.e Save/share a bounded preview configuration and findings without learner identity or false conformance certification. Evidence: report tests. - [x] M3.14 Build autosave, revision history, semantic diff, restore, and concurrent conflict resolution. Evidence: Playwright conflict journey. - [x] M3.14.a Implement local draft state and debounced idempotent server autosave with expected revision, dirty/saving/saved/offline/error/ conflict indicators, retry, and unload recovery. Evidence: autosave tests. - [x] M3.14.b Persist immutable authoring revisions/checkpoints with author/ reason/time/base, changed entities, and audit; avoid revision explosion from transient UI state. Evidence: history tests. - [x] M3.14.c Compute semantic block/field/relationship/objective/source/ accessibility diffs using stable IDs and protected-field redaction. Evidence: diff fixtures. - [x] M3.14.d Restore by creating a new revision from an authorized historical version with impact/stale approval preview. Evidence: restore tests. - [x] M3.14.e Detect concurrent edits at entity/field/list level, present mine/theirs/base, support safe merge/manual resolution, and forbid last- write-wins data loss. Evidence: conflict tests. - [x] M3.14.f Run two-editor/offline/reconnect/reorder/delete/restore/ permission-revocation accessible Playwright journey. Evidence: conflict E2E. - [x] M3.15 Build explicit AI assist for rewrite, example, hint, feedback, and localization. Evidence: per-block accept and AI attribution. - [x] M3.15.a Define assist request/proposal contracts for each operation with exact block/course/source/objective/item/locale revisions, instructions, provider provenance, cost, and status. Evidence: assist schemas. - [x] M3.15.b Send only authorized bounded content/source context through the fenced provider with answer-key/integrity/learner-data exclusions and injection resistance. Evidence: context boundary tests. - [x] M3.15.c Validate operation-specific output structure, citations, protected fields, locale, accessibility, safety, and malformed/refusal/ unavailable/budget states. Evidence: provider tests. - [x] M3.15.d Present per-block diff/source/uncertainty/attribution and require explicit accept/edit/reject; never replace content automatically. Evidence: review UI tests. - [x] M3.15.e Accept as a new attributed revision, preserve proposal and human edits, and recompute affected correctness/accessibility/gates. Evidence: lineage tests. - [x] M3.16 Build lesson-template inheritance with code/institution floors. Evidence: tenant templates cannot loosen safety or accessibility. - [x] M3.16.a Define versioned template identity/scope/applicability, parent, typed block skeleton/defaults/constraints/required gates, owner, lifecycle, and code-floor refs. Evidence: template schema. - [x] M3.16.b Resolve exact parent chain with cycle/depth/version handling and explicit per-field/block merge/replace/append/remove/lock semantics. Evidence: inheritance tests. - [x] M3.16.c Apply code, regional, institution, program, and course floors monotonically for safety, rights, sources, accessibility, assessment integrity, privacy, and standards. Evidence: floor property tests. - [x] M3.16.d Preview inherited/defaulted/overridden/locked/conflicting values and effective requirements before instantiation/update. Evidence: effective template tests. - [x] M3.16.e Version/publish/deprecate templates and explicitly pin/migrate lesson consumers without altering historical revisions. Evidence: lifecycle tests. - [x] M3.17 Build diagram, chart, graph, presentation, audio/TTS, video, and Manim-style executable-animation authoring pipelines with source/data binding, preview, versioning, cancellation, cost, and per-artifact accessibility alternatives. Evidence: no generated teaching media can be accepted without its source, code/data, renderer, and critic evidence. - [x] M3.17.a Define a common teaching-media project/stage/artifact contract with objective/content/source/data/code/spec/renderer/model/tool/version, cost, progress, output, gates, and lineage. Evidence: media schemas. - [x] M3.17.b Implement diagram/illustration pipeline with semantic elements/ labels/relationships, source grounding, alt/long description, and editable vector/spec where supported. Evidence: diagram tests. - [x] M3.17.c Implement data chart/graph pipeline with immutable dataset slice, transform code, units/scales/labels, statistical checks, data table/ narrative alternative, and reproducible render. Evidence: chart tests. - [x] M3.17.d Implement presentation pipeline with slide/notes/source/media/ reading-order/contrast/layout contracts and accessible export. Evidence: presentation tests. - [x] M3.17.e Implement audio/TTS pipeline with script/source, approved voice/ consent, pronunciation, timing, loudness, transcript, and downloadable accessible text. Evidence: audio tests. - [x] M3.17.f Implement video pipeline with script/storyboard/scenes/media/ narration/captions/transcript/audio description/renditions and sync. Evidence: video tests. - [x] M3.17.g Implement Manim-style animation with versioned source/code/data/ environment/seed/assets, sandboxed render, frame/time validation, captions/descriptions, and nonanimated equivalent. Evidence: animation tests. - [x] M3.17.h Provide preview/progress/cancel/retry/partial/error/cost/ regeneration and immutable revision semantics per stage. Evidence: lifecycle tests. - [x] M3.17.i Require source/correctness/code-data-renderer/provenance/rights/ safety/accessibility/technical/critic evidence before educator acceptance. Evidence: acceptance gate. - [x] M3.18 Build the author→critic→media loop as an inspectable proposal workflow: lesson-to-scene plan, code/spec generation, sandbox render, visual/layout/correctness critique, revision, and educator acceptance. Evidence: the loop stops on budget, policy, renderer, or verification failure and never self-publishes. - [x] M3.18.a Define loop/iteration/agent/tool/plan/spec/render/critique/ revision/proposal/decision contracts with exact versions and budgets. Evidence: workflow schemas. - [x] M3.18.b Convert exact lesson/objectives/sources/accessibility/target into an educator-reviewable scene/artifact plan before generation. Evidence: planning tests. - [x] M3.18.c Generate typed code/spec only through allowlisted tools/models with source/data binding, dependency locks, and fenced untrusted content. Evidence: generation tests. - [x] M3.18.d Render in a network/filesystem/resource/time-limited sandbox, retain logs/outputs/checksums, and stop on renderer/security failure. Evidence: sandbox tests. - [x] M3.18.e Run separate visual/layout/accessibility/correctness/source/ technical critics with attributed findings, uncertainty, disagreement, and no approval authority. Evidence: critic tests. - [x] M3.18.f Produce bounded revisions linked to findings with maximum iterations/token/tool/compute/cost/time and explicit stop/timeout/ abstention/partial state. Evidence: loop-control tests. - [x] M3.18.g Require educator inspect/accept/edit/reject for the exact final proposal and route it through normal gates; prohibit self-publication or self-waiver. Evidence: authority boundary tests. - [x] M3.19 Build prerecorded lecture-package authoring for script, timing, presenter/avatar, pronunciation, voice, slides, diagrams, demonstrations, chapters, captions, transcript, audio description, localization, renditions, and learner preview. Evidence: media, consent, correctness, accessibility, and target-playback gates. - [x] M3.19.a Build structured script/segment/chapter/source/citation/objective editing with timing and dependency-aware revisions. Evidence: script authoring tests. - [x] M3.19.b Build presenter/avatar/voice/language/pronunciation/performance selection with identity, consent, rights, disclosure, and expiry state. Evidence: presenter tests. - [x] M3.19.c Build slides/diagrams/charts/code/demonstration cue authoring and exact media/source/data/code links synchronized to segments. Evidence: visual authoring tests. - [x] M3.19.d Build captions/transcript/audio description/sign-language/ translation review with speaker/time alignment and source-revision invalidation. Evidence: accessibility authoring tests. - [x] M3.19.e Build video/audio/slide/text rendition configuration and multitrack learner preview across device/bandwidth/offline/locale modes. Evidence: rendition preview tests. - [x] M3.19.f Present media/consent/rights/source/correctness/accessibility/ sync/technical/target gates and prevent package acceptance on stale/ unavailable blockers. Evidence: gate tests. - [x] M3.19.g Assemble/version/validate deterministic playback package and read it through the real learner renderer. Evidence: package E2E. - [x] M3.20 Build interactive simulation/widget authoring with typed parameters, initial state, learning objective, expected observations, hints, assessment hooks, reset, deterministic seed, sandbox, telemetry, and non-interactive equivalent. Evidence: security and accessible-equivalence tests. - [x] M3.20.a Define registered simulation/widget/runtime version, objective, typed parameters/units/ranges/dependencies, initial state, deterministic seed, expected states/observations, and lifecycle. Evidence: schema tests. - [x] M3.20.b Build parameter/state/scenario/control/layout/instructions authoring with validation, presets, reset, and exact versioning. Evidence: authoring tests. - [x] M3.20.c Define hints/scaffolds and assessment hooks for events/state/ observations/responses/scoring evidence without embedding answer keys in public config. Evidence: learning interaction tests. - [x] M3.20.d Execute preview/delivery in a versioned sandbox with resource/ network/storage/permission/message limits, cancellation, and teardown. Evidence: security tests. - [x] M3.20.e Define privacy-safe typed telemetry events, sampling, learner/ attempt context, offline buffering, consent/retention, and no arbitrary payloads. Evidence: telemetry tests. - [x] M3.20.f Author a noninteractive semantic equivalent with same objective/ information/operation/assessment path and test outcome equivalence with assistive technology. Evidence: accessible-equivalence tests. - [x] M3.21 Build media regeneration and surgical replacement by segment, figure, narration range, caption, translation, or rendition while retaining immutable prior artifacts and dependency invalidation. Evidence: unchanged segments keep stable identities and approvals are recomputed. - [x] M3.21.a Define replacement request with exact project/package/artifact revision, typed segment/figure/audio range/caption/translation/rendition target, requested change, reason, and expected version. Evidence: schema. - [x] M3.21.b Resolve minimal affected source/spec/code/data/render stages and downstream dependency/invalidation graph before execution. Evidence: impact preview tests. - [x] M3.21.c Regenerate/edit only the authorized target with compatible boundaries/timing/layout/style/voice/locale/format and new artifact identity. Evidence: surgical replacement tests. - [x] M3.21.d Retain unchanged component identities/hashes/revisions and all prior artifacts; never splice over immutable package history. Evidence: stability tests. - [x] M3.21.e Recompute affected source/correctness/consent/rights/ accessibility/technical/critic gates and mark dependent approvals/builds stale precisely. Evidence: invalidation tests. - [x] M3.21.f Assemble a new package revision, compare old/new components, require educator/reviewer acceptance, and verify learner playback. Evidence: replacement E2E. ### M4 — Assessment and item-bank authoring - [x] M4.1 Build item-bank search by kind, objective, standard, difficulty, discrimination, exposure, locale, status, author, gate, and usage. Evidence: permission-aware query tests. - [x] M4.1.a Define searchable exact item-revision projection and allowlisted filters/sorts/facets for every named dimension. Evidence: search schema. - [x] M4.1.b Index answer-safe metadata with tenant/course/role/exposure field controls and explicit stale/unknown psychometric state. Evidence: index tests. - [x] M4.1.c Implement deterministic cursor pagination, query limits, stable ranking, and permission-safe counts/suggestions. Evidence: query tests. - [x] M4.1.d Present result/version/use/gate/rights/locale/accessibility state and authorized preview without key/rationale leakage. Evidence: UI tests. - [x] M4.1.e Test direct foreign IDs, hidden filters, facets/counts/timing, protected fields, and two tenants. Evidence: authorization suite. - [x] M4.2 Build zero-form item capture plus structured completion. Evidence: drafts retain provenance and validation state. - [x] M4.2.a Define minimal capture for prompt/idea/source/objective/item-kind hint/author/context with offline/local draft identity. Evidence: capture schema. - [x] M4.2.b Create a canonical draft revision with author/source/import/AI provenance and explicit incomplete/unvalidated status. Evidence: creation tests. - [x] M4.2.c Infer no protected answer or item semantics automatically; route the draft into kind-specific structured fields and requirements. Evidence: boundary tests. - [x] M4.2.d Show completion checklist for stem/response/key/scoring/rationale/ objective/accessibility/source/review/gates. Evidence: completion tests. - [x] M4.2.e Preserve original capture and every structured edit/validation result through revision history. Evidence: provenance tests. - [x] M4.3 Build item-variant generation behind the fenced provider seam. Evidence: `not_configured`, malformed, refusal, and budget states. - [x] M4.3.a Define variant request/set/proposal with exact source item, permitted transformations, invariants, count/diversity, provider provenance, estimate, and budget. Evidence: schemas. - [x] M4.3.b Fence source/stem/objectives/rubric/allowed key context and exclude learner/integrity/unrelated bank data from provider input. Evidence: context tests. - [x] M4.3.c Validate generated kind/schema/key/rationale/objective/difficulty/ locale/accessibility/source and similarity constraints. Evidence: proposal validation tests. - [x] M4.3.d Preserve `not_configured`, refusal, malformed, timeout, partial, moderation, and budget outcomes without fallback content. Evidence: seam tests. - [x] M4.3.e Require per-variant human accept/edit/reject and create new attributed item revisions; no automatic bank admission. Evidence: review tests. - [x] M4.4 Build selected-response editor with keyed answer and distractor rationales. Evidence: answer uniqueness and protected-field tests. - [x] M4.4.a Author stem/instructions/options with stable option IDs, rich accessible content, locale variants, ordering/randomization, and source refs. Evidence: editor tests. - [x] M4.4.b Configure single/multiple/ordered/matching response rules and exact key/partial-credit scoring with uniqueness/cardinality validation. Evidence: answer tests. - [x] M4.4.c Author correct rationale and each distractor’s misconception/ rationale separately from learner feedback. Evidence: rationale tests. - [x] M4.4.d Preview author/key/learner modes with randomized order preserving stable key identity and accessibility. Evidence: preview tests. - [x] M4.4.e Enforce key/rationale property authorization across API/UI/search/ export/log/tutor and direct crafted payloads. Evidence: protected-field tests. - [x] M4.5 Build constructed-response and essay editor with scoring guide, exemplar, acceptable variants, and moderation requirements. Evidence: contract tests. - [x] M4.5.a Author prompt/context/response format, length/language/media/ citation constraints, instructions, sources, and accessibility. Evidence: prompt tests. - [x] M4.5.b Define acceptable answer variants/elements/tolerances and unacceptable/missing evidence without reducing essays to hidden exact strings. Evidence: response model tests. - [x] M4.5.c Attach rubric/scoring guide revision, criterion mappings, partial/ holistic method, and human/model-assisted scoring bounds. Evidence: scoring tests. - [x] M4.5.d Attach authorized annotated exemplars at performance levels with rights/redaction and protected learner identity. Evidence: exemplar tests. - [x] M4.5.e Define first/second marking, blind review, discrepancy thresholds, moderation/reconciliation, and audit. Evidence: moderation tests. - [x] M4.6 Build math and code item editors with executable/renderer sandboxes. Evidence: resource, network, and escape tests. - [x] M4.6.a Author semantic MathML/symbolic/numeric/unit/graph/proof response models with equivalence/tolerance/assumptions and accessible rendering. Evidence: math item tests. - [x] M4.6.b Author code language/runtime/dependencies/starter files/API, stdin/arguments/output, visible/hidden tests, scoring, and limits. Evidence: code item tests. - [x] M4.6.c Pin renderer/compiler/interpreter/CAS/test harness/container/ dependency versions and deterministic seeds. Evidence: runtime contracts. - [x] M4.6.d Execute author preview in isolated CPU/memory/time/process/file/ network/syscall-limited sandbox with teardown. Evidence: sandbox tests. - [x] M4.6.e Protect hidden tests/answers/runtime secrets and test infinite loops, fork/memory bombs, filesystem/network/escape, and malicious output. Evidence: adversarial suite. - [x] M4.7 Build media and interactive item editor with accessible alternatives. Evidence: QTI export/import and accommodation preview. - [x] M4.7.a Author governed image/audio/video/3D/stimulus media revisions, interactions, response regions/timing/state, scoring hooks, and sources. Evidence: media item tests. - [x] M4.7.b Author captions/transcripts/descriptions/sign alternatives/ keyboard paths/noninteractive equivalents and support requirements. Evidence: accessibility tests. - [x] M4.7.c Configure sandbox runtime, typed events/state/reset/seed/resource/ network limits, and secure response capture. Evidence: interactive tests. - [x] M4.7.d Preview permitted accommodation/locale/device/input modes with the real delivery renderer. Evidence: accommodation preview matrix. - [x] M4.7.e Map/import/export through the QTI profile or return exact extension/ loss/incompatibility with round-trip tests. Evidence: QTI suite. - [x] M4.8 Build stimulus-set authoring. Evidence: shared-stimulus edits mark every dependent item stale. - [x] M4.8.a Build immutable stimulus create/edit/version/localize/source/ accessibility/rights workflow separately from items. Evidence: authoring tests. - [x] M4.8.b Build set identity, ordered stimulus revisions, shared directions/ context, item membership/order, and presentation rules. Evidence: set schema tests. - [x] M4.8.c Attach items by exact revision/role/locator and prevent cross- tenant, unauthorized, circular, or answer-exposing links. Evidence: link tests. - [x] M4.8.d Preview item/set combinations and detect conflicting directions, locale, accessibility, exposure, layout, and target constraints. Evidence: preview tests. - [x] M4.8.e On stimulus/set revision, compute dependent item/assessment/build blast radius and mark review/gates stale without rewriting them. Evidence: invalidation tests. - [x] M4.9 Build item-level objective, standard, concept, and prerequisite linking. Evidence: invalid and cross-tenant refs fail. - [x] M4.9.a Define typed link roles/strength/coverage/cognitive level/rationale/ evidence with exact item and target revisions. Evidence: link schemas. - [x] M4.9.b Search/select only authorized course/tenant objective, standard, concept, and prerequisite registry entries. Evidence: selector tests. - [x] M4.9.c Validate target existence/lifecycle/version, discipline/kind/ grade/locale compatibility, cycles, and conflicting links. Evidence: validation tests. - [x] M4.9.d Present links in item, coverage matrix, concept graph, search, and standards export with consistent meaning. Evidence: projection tests. - [x] M4.9.e Reject crafted foreign/stale/deprecated/unknown refs and preserve link revision/audit. Evidence: negative tests. - [x] M4.10 Build difficulty, cognitive level, time, and confidence estimates with source provenance. Evidence: estimates are never labeled calibrated before empirical data. - [x] M4.10.a Define separate author, rule/model-predicted, expert-reviewed, pilot, and empirically calibrated estimate sources with versions. Evidence: estimate schema. - [x] M4.10.b Estimate difficulty, taxonomy+level, response time/range, and per-estimate confidence/uncertainty from exact item/context revision. Evidence: known-value tests. - [x] M4.10.c Record method/model/config/corpus/features/assumptions/applicability and human changes; keep different source estimates visible. Evidence: provenance tests. - [x] M4.10.d Reserve “calibrated” for ratified empirical sample/method/ uncertainty evidence and reject predicted-to-calibrated promotion. Evidence: status invariant tests. - [x] M4.10.e Recompute/preserve history on item/model/data change and surface disagreement/manual review. Evidence: lifecycle tests. - [x] M4.11 Build distractor plausibility and misconception mapping. Evidence: known-value rules and human review. - [x] M4.11.a Define versioned misconception concepts, evidence/source, objective/learner band, locale, lifecycle, and option mapping contract. Evidence: schema tests. - [x] M4.11.b Check option uniqueness, grammatical/semantic parallelism, length/ cue imbalance, implausibility, overlap, absolute wording, and correct- answer leakage using known-value rules. Evidence: lint fixtures. - [x] M4.11.c Evaluate distractor-to-misconception relevance separately from plausibility and never infer an individual learner misconception solely from a response. Evidence: boundary tests. - [x] M4.11.d Present attributed rule/model suggestions with uncertainty and require human accept/edit/reject mappings. Evidence: review tests. - [x] M4.11.e Preserve empirical option statistics separately and trigger re- review when distractors/items/misconception vocabularies change. Evidence: lifecycle tests. - [x] M4.12 Build single-correct-answer and ambiguity verification. Evidence: adversarial crafted-item corpus. - [x] M4.12.a Define applicability by item/response/scoring kind and explicit uniqueness/ambiguity verdicts, evidence, uncertainty, and reviewer state. Evidence: verifier schema. - [x] M4.12.b Verify keyed response satisfies prompt and every nonkey fails under stated assumptions, tolerances, sources, and response rules. Evidence: known-value tests. - [x] M4.12.c Detect multiple defensible interpretations/answers, missing context, contradictory sources, locale/cultural ambiguity, option overlap, and rubric underdetermination. Evidence: adversarial corpus. - [x] M4.12.d Use symbolic/executable/source/model-assisted checks only as attributed evidence with timeout/error/N/A and human review bands. Evidence: checker tests. - [x] M4.12.e Block single-correct publication on unresolved ambiguity while preserving raw findings and exception limits. Evidence: gate tests. - [x] M4.13 Build answer-key leakage scan across learner-visible fields, assets, alt text, hints, exports, logs, and URLs. Evidence: negative suite. - [x] M4.13.a Enumerate learner-visible UI/API/renderer/search/cache/event/ analytics/export/package/log/error/URL channels and protected key/ rationale/test fields. Evidence: coverage manifest. - [x] M4.13.b Scan stem/options/feedback/hints/metadata/filenames/IDs and accessibility text/tracks for exact, normalized, encoded, indirect, and positional key leakage. Evidence: text leakage tests. - [x] M4.13.c Scan media pixels/audio/transcripts/captions/descriptions/ documents/code/runtime output/interactive state and hidden metadata. Evidence: asset leakage tests. - [x] M4.13.d Inspect QTI/LTI/SCORM/xAPI/course packages, previews, deep links, URLs, client bundles/state, errors/logs/traces, and support exports. Evidence: channel tests. - [x] M4.13.e Test answer variations/multiple locales/randomized order/ encryption/role changes and fail release for any unresolved exposure. Evidence: adversarial negative suite. - [x] M4.14 Build item accessibility checklist and automated lint. Evidence: QTI Elevated Accessibility-relevant support matrix. - [x] M4.14.a Define versioned checklist by item/media/interaction kind, applicable WCAG/QTI requirements, PNP supports, severity, evidence, and manual-only criteria. Evidence: checklist registry. - [x] M4.14.b Lint structure/semantics/names/instructions/order/focus/keyboard/ timing/drag/motion/color/contrast/zoom/reflow/error behavior. Evidence: interaction lint tests. - [x] M4.14.c Lint images/math/code/tables/charts/audio/video/3D/interactions for required equivalents, captions/transcripts/descriptions, and sync. Evidence: content lint tests. - [x] M4.14.d Test locale/bidi, screen reader, keyboard, zoom, theme, viewport, reduced motion, and configured accommodation previews. Evidence: automation matrix. - [x] M4.14.e Map each support to QTI accessibility metadata/content with supported/degraded/unsupported status and block unresolved mandatory checks. Evidence: support matrix. - [x] M4.15 Build item compare and decision records. Evidence: stem, response, rationale, accessibility, and gate differences are visible. - [x] M4.15.a Resolve two authorized exact item/stimulus/rubric revisions and define typed semantic diff model. Evidence: comparison schema. - [x] M4.15.b Diff stem/instructions/sources/objectives/standards and response/ options/interaction/scoring/key separately. Evidence: content diffs. - [x] M4.15.c Diff rationales/feedback/hints/exposure, accessibility/locales/ media, estimates/psychometrics, gates/reviews/use impacts. Evidence: protected/status diffs. - [x] M4.15.d Render role-redacted accessible comparison and exact revision/ provenance/impact without leaking answer data. Evidence: UI tests. - [x] M4.15.e Record select/reject/request-changes/merge/supersede with actor, rationale, evidence, immutable source refs, and new revision if merged. Evidence: decision tests. - [x] M4.16 Build test/section assembly with blueprint constraints and exposure controls. Evidence: deterministic solver fixtures. - [x] M4.16.a Define assessment/section blueprint for objective/standard/ content/cognitive level/item kind/difficulty/time/points/locale/ accessibility/security/exposure constraints. Evidence: schema tests. - [x] M4.16.b Build authorized candidate pool from exact eligible item/ stimulus/rubric revisions and current gates/rights/calibration state. Evidence: eligibility tests. - [x] M4.16.c Solve required/optional/min/max/balance/enemy/group/stimulus/ ordering/randomization constraints deterministically with seed/version. Evidence: solver goldens. - [x] M4.16.d Enforce prior/current exposure, overlap, reuse windows, secure pools/forms, and institution policy without leaking bank membership. Evidence: exposure tests. - [x] M4.16.e Return complete solution, infeasible diagnostics, alternatives, blueprint coverage, estimate, and human decision; never silently relax constraints. Evidence: assembly tests. - [x] M4.17 Build secure preview that cannot record a learner attempt or contaminate calibration. Evidence: event and gradebook assertions. - [x] M4.17.a Use the real delivery renderer with exact draft build and synthetic preview identity/session marked nonlearner/nonoperational. Evidence: preview contracts. - [x] M4.17.b Isolate preview responses/events/files/timers/cookies/storage from learner attempt, gradebook, integrity, analytics, calibration, LTI, and credential systems. Evidence: side-effect tests. - [x] M4.17.c Render learner-visible content only; expose protected answer/ scoring overlays through a separately authorized author mode. Evidence: property tests. - [x] M4.17.d Simulate scoring/feedback/navigation/accommodations/offline with disposable state and explicit preview labels. Evidence: behavior tests. - [x] M4.17.e Assert no real attempt/grade/event/calibration/exposure count is written across completion, refresh, crash, and malicious requests. Evidence: integration assertions. - [x] M4.18 Build bulk import with per-item diagnostics and no silent drops. Evidence: imported plus rejected equals input count. - [x] M4.18.a Define supported source formats/profiles, import batch/item IDs, limits, options, duplicate policy, and per-item outcome contracts. Evidence: import schema. - [x] M4.18.b Parse archives/files/rows with type/size/depth/count/path/macro/ formula/external-ref protections and retain immutable source. Evidence: hostile import tests. - [x] M4.18.c Validate/migrate each item/stimulus/rubric/media/source/answer/ accessibility/standard field independently with exact locator diagnostics. Evidence: validation fixtures. - [x] M4.18.d Preview create/update/skip/reject/conflict/loss/substitution and require authorization before committing successful items. Evidence: preview tests. - [x] M4.18.e Commit each accepted item idempotently with provenance and keep rejected inputs/diagnostics without partial silent fields. Evidence: persistence tests. - [x] M4.18.f Assert imported+updated+skipped+rejected equals discovered input items and reconcile nested assets/stimuli. Evidence: count invariant. ### M5 — Pedagogical, quality, psychometric, and fairness gates - [x] M5.1 Implement objective coverage and construct-alignment gates. Evidence: crafted aligned and misaligned curricula. - [x] M5.1.a Compute direct/indirect introduced/practiced/assessed coverage, depth/weight/cognitive-level distribution, and stale/missing links from exact revisions. Evidence: coverage fixtures. - [x] M5.1.b Compare content/activity/item/rubric demands to objective criteria and intended construct; detect underrepresentation and construct- irrelevant variance. Evidence: alignment corpus. - [x] M5.1.c Apply versioned required/advisory thresholds by course/assessment/ risk and persist raw coverage separately. Evidence: verdict tests. - [x] M5.1.d Surface conflicting/unknown/N/A/manual-review state and remediation; block required misalignment. Evidence: gate UI/API tests. - [x] M5.2 Implement reading-level and sentence-complexity measurements. Evidence: independently derived known values. - [x] M5.2.a Pin supported language/content applicability and formula/feature/ tokenizer/normalization versions. Evidence: measurement schema. - [x] M5.2.b Compute reading indices and sentence/word/syntactic distributions server-side with exact units and excluded-content rules. Evidence: independent known-value fixtures. - [x] M5.2.c Report raw values/ranges/assumptions/uncertainty/N/A separately from learner-band policy. Evidence: result tests. - [x] M5.2.d Verify technical terms, math/code, quotations, multilingual, short, and malformed text behavior. Evidence: edge-case corpus. - [x] M5.3 Implement item clarity and ambiguity rules. Evidence: curated adversarial corpus. - [x] M5.3.a Define versioned rules for incomplete context, unclear referent/ instruction/response format, negatives, absolutes, double-barreled prompts, cues, language, and construct-irrelevant complexity. Evidence: rule registry. - [x] M5.3.b Run deterministic rules with exact text/field anchors and locale/item-kind applicability. Evidence: known-value tests. - [x] M5.3.c Run attributed model/human-assist checks only for semantic ambiguity with uncertainty and counterinterpretations. Evidence: calibrated assist tests. - [x] M5.3.d Require human resolution for blocking ambiguity and retain dismissed findings/reasons. Evidence: adversarial corpus gate. - [x] M5.4 Implement distractor plausibility and non-overlap rules. Evidence: known item fixtures. - [x] M5.4.a Check duplicates/normalization/subsumption/intersection and mutually compatible options under stated response rules. Evidence: non-overlap fixtures. - [x] M5.4.b Check implausibility, grammatical mismatch, length/style/cue imbalance, absolutes, joke options, and source/rationale inconsistency. Evidence: plausibility fixtures. - [x] M5.4.c Apply kind/locale/discipline-specific rules and expose exact option pairs/findings without guessing learner ability. Evidence: applicability tests. - [x] M5.4.d Bind verdict to item revision/rules and require review of semantic findings. Evidence: gate lifecycle tests. - [x] M5.5 Implement answer uniqueness and rationale-consistency gates. Evidence: mutation tests. - [x] M5.5.a Verify key cardinality/uniqueness/equivalence/tolerance against item-kind response/scoring contract. Evidence: key tests. - [x] M5.5.b Verify keyed answers satisfy the stem/sources/assumptions and nonkeys do not, with explicit unsupported/manual state. Evidence: correctness tests. - [x] M5.5.c Verify correct and distractor rationales refer to stable response IDs and agree with key, scoring, feedback, and hints. Evidence: consistency tests. - [x] M5.5.d Mutation-test option/key/order/scoring/rationale/source changes and require invalidation/review. Evidence: mutation suite. - [x] M5.6 Implement rubric weight, criterion coverage, level ordering, and descriptor-distinctness gates. Evidence: exact fixtures. - [x] M5.6.a Validate weights/points/totals/ranges/rounding/caps/floors and missing/N/A scoring for the selected rubric method. Evidence: arithmetic fixtures. - [x] M5.6.b Verify required objectives/evidence/performance dimensions are covered without duplicate or orphan criteria. Evidence: coverage tests. - [x] M5.6.c Verify level codes/scores/ranges are strictly ordered/nonoverlap/ complete and descriptor direction matches scale. Evidence: ordering fixtures. - [x] M5.6.d Detect identical/subsumed/contradictory/nonobservable descriptors with human review for semantic distinctness. Evidence: descriptor corpus. - [x] M5.6.e Bind raw checks/verdicts to rubric revision and invalidate dependent item/assessment approval on change. Evidence: lifecycle tests. - [x] M5.7 Implement accessibility completeness gates per item modality. Evidence: missing alternative assets block publication. - [x] M5.7.a Resolve applicable checklist/support requirements from item kind, media/interaction, target, locale, and PNP profile. Evidence: applicability matrix. - [x] M5.7.b Verify structure/keyboard/focus/timing/drag/color/motion/zoom/ reflow/instruction/error requirements. Evidence: interaction gate tests. - [x] M5.7.c Verify modality-specific alt/long descriptions, table/math/code semantics, captions/transcripts/descriptions/sign, and noninteractive equivalents. Evidence: asset gate tests. - [x] M5.7.d Validate referenced alternative asset revision/locale/sync/rights/ availability and outcome equivalence. Evidence: alternative tests. - [x] M5.7.e Block publication on missing/stale/failed mandatory requirements; preserve N/A/manual review with evidence. Evidence: publication gate. - [x] M5.8 Implement media technical and caption/transcript gates through Isis. Evidence: live contract integration. - [x] M5.8.a Map Metis media kind/target/profile/accessibility needs to canonical Isis asset/gate/profile identities and versions. Evidence: integration mapping. - [x] M5.8.b Request/read exact asset revision technical measurements and captions/transcript/sync gates through audience-authorized contracts. Evidence: live contract tests. - [x] M5.8.c Revalidate gate freshness against media/profile/evaluator/policy versions and represent unavailable/not-configured/partial honestly. Evidence: freshness tests. - [x] M5.8.d Translate results to Metis lesson/item/build eligibility without copying or overriding Isis raw evidence. Evidence: authority tests. - [x] M5.8.e Propagate media replacement/quarantine/recall/gate change and block affected publication. Evidence: lifecycle integration test. - [x] M5.9 Implement declared-versus-empirical difficulty checks. Evidence: calibrated fixture. - [x] M5.9.a Resolve declared target/band/source and empirical item revision, population/sample, method, statistic, uncertainty, and calibration status. Evidence: input schema. - [x] M5.9.b Compare on a ratified common scale or explicit mapping with tolerance/uncertainty; prohibit raw incomparable subtraction. Evidence: comparison fixtures. - [x] M5.9.c Return aligned, material mismatch, insufficient, stale, N/A, or conflicting state with direction/magnitude. Evidence: verdict tests. - [x] M5.9.d Route mismatch to item/blueprint review and never overwrite empirical or author-declared values. Evidence: calibrated lifecycle test. - [x] M5.10 Implement IRT parameter bounds and fit diagnostics. Evidence: 1PL/2PL/3PL known-value fixtures. - [x] M5.10.a Validate model-specific difficulty/discrimination/guessing/ scaling/linking parameter presence, numeric bounds, standard errors, and covariance. Evidence: parameter fixtures. - [x] M5.10.b Validate convergence, identifiability, sample/item sufficiency, information, residual/global/item fit, and local dependence. Evidence: diagnostic fixtures. - [x] M5.10.c Distinguish 1PL/2PL/3PL applicability and prohibit unsupported parameter interpretation across models. Evidence: model matrix. - [x] M5.10.d Persist raw diagnostics/tool/config/version separately from calibrated/flagged/ineligible verdict. Evidence: result tests. - [x] M5.11 Implement sample-size and standard-error eligibility for calibration promotion. Evidence: low-evidence items cannot become calibrated. - [x] M5.11.a Define minimum effective sample, response distribution, administration diversity, data quality, missingness, and standard-error/ confidence criteria by model/use. Evidence: eligibility policy. - [x] M5.11.b Calculate included/excluded/weighted counts and privacy-safe cohort coverage from exact attempt/item revisions. Evidence: sample tests. - [x] M5.11.c Verify parameter/statistic standard errors and convergence against all required thresholds without treating missing as zero. Evidence: boundary tests. - [x] M5.11.d Block promotion to calibrated when any required evidence is low/ stale/conflicting and route field-test/manual review. Evidence: state transition tests. - [x] M5.12 Implement DIF analysis across ratified cohorts with minimum sample and privacy rules. Evidence: synthetic fairness corpus. - [x] M5.12.a Define ratified privacy-reviewed cohort dimensions/reference/ focal groups, method/model, matching variable, thresholds, correction, minimum samples, and authorized purpose. Evidence: DIF policy. - [x] M5.12.b Build deidentified analysis inputs with exact item revisions, valid responses/weights, missingness, group privacy thresholds, and no small-cell outputs. Evidence: data tests. - [x] M5.12.c Compute uniform/nonuniform DIF effect/significance/uncertainty/ model fit with pinned tools and multiple-testing handling. Evidence: synthetic corpus. - [x] M5.12.d Return insufficient/N/A/error/conflict and subgroup-safe results separately from fairness decision. Evidence: result tests. - [x] M5.12.e Require psychometric/fairness human review before restrict/ revise/retire; prohibit individual inference. Evidence: decision tests. - [x] M5.13 Implement exposure and compromise-risk gates. Evidence: overexposed items are automatically restricted or retired. - [x] M5.13.a Define exposure metrics/windows/populations/channels, secure-item classification, thresholds, known breach signals, and lifecycle policy. Evidence: exposure schema. - [x] M5.13.b Count delivered/seen/responded/reused/exported/shared occurrences by exact item revision with preview/test exclusion and privacy-safe aggregation. Evidence: counting tests. - [x] M5.13.c Ingest verified compromise/leak/reconstruction reports with evidence, scope, confidence, and incident status. Evidence: report tests. - [x] M5.13.d Calculate normal/warning/restricted/quarantined/retired state and enforce pool/assembly/delivery/export changes server-side. Evidence: threshold tests. - [x] M5.13.e Propagate replacement/notification/blast radius while retaining historical attempts/grades and allowing authorized appeal. Evidence: incident journey. - [x] M5.14 Implement content and answer freshness gates. Evidence: source or standard updates mark dependencies stale. - [x] M5.14.a Bind lesson/item/answer/rationale/feedback/hint to exact source/ claim/citation/standard/objective/tool/policy revisions and review dates. Evidence: dependency tests. - [x] M5.14.b Detect source update/retraction, standard supersession, factual/ temporal review expiry, dependency change, and conflicting current evidence. Evidence: freshness fixtures. - [x] M5.14.c Classify current/due/stale/blocked/unknown/N/A by content risk and use, preserving prior review evidence. Evidence: verdict tests. - [x] M5.14.d Propagate stale state to tutor prompts, assessments, builds, and publication/delivery according to policy. Evidence: propagation test. - [x] M5.15 Implement cultural, regional, and language review assignments. Evidence: required locale reviewers block publication. - [x] M5.15.a Define required reviewer qualifications/locale/region/community/ discipline/independence by content/item/audience/risk/target. Evidence: assignment policy. - [x] M5.15.b Match eligible reviewers without exposing protected attributes, apply workload/conflict rules, deadlines, substitutes, and escalation. Evidence: assignment tests. - [x] M5.15.c Provide exact locale variant/source/context/comparison/evidence and structured cultural/regional/language review decisions. Evidence: review tests. - [x] M5.15.d Require fresh decision/quorum for each applicable locale/region and block publication on missing/expired/conflicted assignment. Evidence: gate tests. - [x] M5.16 Persist raw measures independently from policy verdicts. Evidence: threshold changes recompute without data loss. - [x] M5.16.a Define immutable measurement records with subject, evaluator/ model/code/config/corpus versions, inputs, values/units/regions, uncertainty/applicability, and hash. Evidence: schema tests. - [x] M5.16.b Define verdict records referencing exact measurements plus gate/ policy/threshold/profile versions and rationale. Evidence: verdict schema. - [x] M5.16.c Recompute new verdict identities on threshold/policy change without modifying/reprocessing valid raw measures. Evidence: recompute tests. - [x] M5.16.d Require new measurement when subject/evaluator/input changes and retain all historical projections. Evidence: lifecycle invariants. - [x] M5.17 Expose uncertainty, non-applicability, and insufficient-data states. Evidence: no unknown state renders as pass. - [x] M5.17.a Define pass/fail/advisory/manual-review/N/A/insufficient/ unavailable/error/stale/unknown states and permitted transitions. Evidence: state vocabulary. - [x] M5.17.b Require reason/evidence/uncertainty/sample/applicability/ remediation fields appropriate to each state. Evidence: schema tests. - [x] M5.17.c Aggregate mandatory gates without converting missing/unknown/N/A/ unavailable/insufficient into numeric zero or pass. Evidence: aggregation property tests. - [x] M5.17.d Render/export every state with text/semantics, freshness, and no color-only or false green representation. Evidence: UI/API tests. - [x] M5.18 Version every evaluator, policy, corpus, and threshold. Evidence: gate result provenance. - [x] M5.18.a Register evaluator code/model/config/runtime/dependency version/ hash/source/license/lifecycle and supported inputs. Evidence: registry. - [x] M5.18.b Register corpus manifest/labels/splits/hashes/provenance/rights/ coverage/privacy and calibration status. Evidence: corpus registry. - [x] M5.18.c Register policy/rubric/threshold/band/aggregation/profile versions with approval/effective dates and code floors. Evidence: policy registry. - [x] M5.18.d Bind every measurement/verdict to exact versions/environment and reproduce or explicitly label nonreproducibility. Evidence: provenance tests. - [x] M5.19 Implement atomic-claim decomposition and claim-to-source-span linking for lesson, feedback, hint, worked-solution, and lecture content. Evidence: labeled corpus measures missed and incorrectly split claims. - [x] M5.19.a Define atomic claim identity/revision, subject/predicate/object or normalized proposition, qualifiers/scope/modality/time, content kind/ locator, source-span links, and status. Evidence: claim schema. - [x] M5.19.b Segment each named content kind into factual, procedural, normative, interpretive, mathematical, attribution, and nonclaim text with content-specific rules. Evidence: segmentation fixtures. - [x] M5.19.c Preserve compound relationships, coreference/context, equations/ conditions, negation, examples, quotations, and pedagogical scaffolding without losing meaning. Evidence: adversarial corpus. - [x] M5.19.d Link each claim to exact source/extraction revision and one or more typed spans/locators with support role and human confirmation. Evidence: linking tests. - [x] M5.19.e Evaluate missed/spurious/over-split/under-split/boundary/link precision/recall by content/discipline/locale and uncertainty. Evidence: labeled corpus report. - [x] M5.20 Implement retrieval-grounded support, citation sufficiency, faithfulness, contradiction, and cross-source conflict gates separately. Evidence: entailment, partial support, irrelevant citation, conflict, inaccessible source, and abstention fixtures. - [x] M5.20.a Resolve exact claim, cited/retrieved source spans, authority/ rights/currency/accessibility, retrieval version/rank, and evaluation context. Evidence: gate input tests. - [x] M5.20.b Measure support/entailment per source span with full/partial/ unsupported/contradicted/unclear/N/A and qualifiers. Evidence: support fixtures. - [x] M5.20.c Evaluate citation sufficiency for claim coverage, source authority/diversity/recency/directness and detect irrelevant/overbroad/ inaccessible citations. Evidence: sufficiency fixtures. - [x] M5.20.d Compare content wording to supported claim for added certainty, omitted qualifiers, scope/number/time/causal/attribution changes. Evidence: faithfulness fixtures. - [x] M5.20.e Detect within-source and cross-source contradiction/conflict/ version/jurisdiction/perspective differences without forcing consensus. Evidence: conflict fixtures. - [x] M5.20.f Keep each raw result/verifier/version/uncertainty separate and abstain/manual-review on inaccessible/insufficient/ambiguous evidence. Evidence: state tests. - [x] M5.20.g Apply risk-specific policy verdicts without averaging one failed dimension into pass. Evidence: aggregate gate tests. - [x] M5.21 Implement executable mathematics verification using ratified symbolic/numeric tooling and assumption/domain tracking. Evidence: proofs, equations, units, edge cases, and unsupported constructs do not reduce to an LLM opinion. - [x] M5.21.a Define supported math languages/constructs, parser/CAS/numeric/ unit/proof tool versions, assumptions/domains, tolerances, resource limits, and explicit unsupported behavior. Evidence: verifier contract. - [x] M5.21.b Parse semantic math, bind variables/units/definitions/assumptions/ domains, reject ambiguous notation, and retain source spans. Evidence: parsing fixtures. - [x] M5.21.c Verify symbolic equivalence/identity/equation/inequality/solution sets under stated domains and detect extraneous/missing cases. Evidence: symbolic goldens. - [x] M5.21.d Verify numeric computations/approximations/rounding/error bounds/ edge and randomized property cases with deterministic seeds. Evidence: numeric goldens. - [x] M5.21.e Verify dimensional/unit consistency/conversion/significant figures and physical-domain constraints. Evidence: unit fixtures. - [x] M5.21.f Verify supported proof steps/rules separately; return localized error/unknown/timeout/unsupported rather than provider opinion. Evidence: proof fixtures. - [x] M5.21.g Sandbox tooling and persist inputs/outputs/tool versions/traces separately from policy/human verdict. Evidence: security/provenance tests. - [x] M5.22 Implement sandboxed code correctness using compilation/execution, tests, resource limits, language/runtime versions, and deterministic or explicitly stochastic expectations. Evidence: correct, wrong, unsafe, flaky, timeout, and unsupported fixtures. - [x] M5.22.a Define supported language/runtime/compiler/dependency/test harness versions, input/output/files/API, deterministic seed/repetition, scoring, and unsupported policy. Evidence: verifier contract. - [x] M5.22.b Build immutable source/dependency/test artifacts and compile/ static-check with exact diagnostics in an isolated environment. Evidence: compile fixtures. - [x] M5.22.c Execute visible/hidden/example/property/metamorphic/performance tests with independent cases and exact expected/tolerant/stochastic assertions. Evidence: correctness suite. - [x] M5.22.d Enforce CPU/memory/wall/process/file/output/network/syscall/ secret limits and terminate entire sandbox on breach/timeout. Evidence: unsafe/timeout tests. - [x] M5.22.e Detect nondeterminism/flakiness through repeated seeded runs and report distribution/unstable state rather than lucky pass. Evidence: flaky fixtures. - [x] M5.22.f Persist per-test outputs/resources/tool versions and separate raw execution from score/verdict/manual review. Evidence: result tests. - [x] M5.23 Implement step/process verification for worked solutions, not just final-answer matching. Evidence: localized error, invalid shortcut, circular reasoning, and correct-alternative-path fixtures. - [x] M5.23.a Define solution step identity/order/dependencies, expression/ claim, transformation/rule/justification, assumptions/domain, evidence, and intermediate result. Evidence: process schema. - [x] M5.23.b Verify each step follows from permitted prior steps/premises via ratified symbolic/numeric/rule/source tools and localize first/all errors. Evidence: localized error fixtures. - [x] M5.23.c Detect hidden assumption/domain loss, division by zero, extraneous solution, unit error, invalid shortcut, circular reasoning, and unproved lemma. Evidence: adversarial fixtures. - [x] M5.23.d Accept correct alternative paths/orderings/equivalent forms when independently verified, without exact-template matching. Evidence: alternative-path fixtures. - [x] M5.23.e Distinguish correct/incorrect/partially supported/unknown/ unsupported/timeout per step and aggregate without final-answer override. Evidence: aggregation tests. - [x] M5.23.f Present verifier trace and human-review corrections; keep final answer verification as a separate dimension. Evidence: review tests. - [x] M5.24 Implement calibrated multi-evaluator panels only where deterministic verification is unavailable, with independence analysis, correlated-error controls, confidence calibration, abstention, and human-review bands. Evidence: gold-set and champion/challenger reports. - [x] M5.24.a Define applicability gate proving deterministic/rule/source/ executable verification is unavailable or incomplete before panel use. Evidence: routing tests. - [x] M5.24.b Register evaluator identity/model/prompt/config/provider/training/ data/tool dependencies, rubric scope, calibration, and lifecycle. Evidence: panel registry. - [x] M5.24.c Record shared dependencies/prompts/data/providers as correlation groups and minimum independence/quorum/weight rules. Evidence: independence analysis. - [x] M5.24.d Collect blinded per-evaluator label/score/reason/evidence/ confidence/abstention/error against exact subject/rubric revisions. Evidence: collection tests. - [x] M5.24.e Calibrate confidence/thresholds/manual bands on versioned gold sets and report overall/subgroup/content errors with uncertainty. Evidence: calibration report. - [x] M5.24.f Aggregate with correlated-error controls, preserve disagreement/ minority/timeout/abstention, and never manufacture gate authority. Evidence: consensus fixtures. - [x] M5.24.g Run champion/challenger drift comparison before replacement and require human review for configured bands. Evidence: lifecycle report. - [x] M5.25 Implement verifier-guided best-of-N generation without hiding rejected candidates or selection bias. Evidence: candidate, score, verifier version, selection rationale, and educator decision remain inspectable. - [x] M5.25.a Define request/candidate-set/count/diversity/seed/budget, generator versions, verifier plan/rubric/versions, and stop conditions. Evidence: workflow schema. - [x] M5.25.b Generate bounded unique candidate identities with complete prompt/source/model/config/cost lineage and preserve malformed/refused/ failed candidates. Evidence: generation tests. - [x] M5.25.c Run applicable deterministic and calibrated verifiers on every eligible candidate with raw results, unavailable/error/abstention, and no selective rerun. Evidence: evaluation tests. - [x] M5.25.d Rank/filter only by the declared versioned rule, expose scores/ uncertainty/rejections/tie/selection bias, and prohibit hidden candidate removal. Evidence: selection fixtures. - [x] M5.25.e Present all authorized candidates/evidence/cost and require an educator select/reject/edit/regenerate decision. Evidence: review tests. - [x] M5.25.f Create the accepted artifact as a new revision with candidate/ verifier/human decision lineage and normal gates. Evidence: end-to-end trace. ### M6 — Adaptive sequencing, tutor linkage, and learning analytics - [x] M6.1 Build pathway/program authoring with entry criteria, objective DAG, cadence, pacing, and completion rules. Evidence: cycle and reachability tests. - [x] M6.1.a Define versioned program/pathway, cohort/audience, course/module/ objective membership, owner, locale, lifecycle, and credential links. Evidence: pathway schema. - [x] M6.1.b Author typed entry prerequisites, prior evidence/credentials/ assessment/mastery conditions, alternatives, expiry, and review. Evidence: entry-criteria tests. - [x] M6.1.c Author objective/course dependency DAG with required/optional/ choice/remedial/parallel edges and cycle/orphan/reachability checks. Evidence: graph tests. - [x] M6.1.d Author calendar/cadence/start windows/deadlines/pacing/minimum/ maximum/seat-time/break/load rules with timezone and accommodation. Evidence: schedule tests. - [x] M6.1.e Author deterministic completion rules over exact objectives/ evidence/assessments/grades/mastery/approvals without credential issuance authority. Evidence: completion tests. - [x] M6.2 Build adaptive sequencing overlays that can tighten but not loosen platform safeguards. Evidence: property tests. - [x] M6.2.a Define overlay scope/version/applicability, eligible content/items, sequencing objectives, mastery/pacing/difficulty rules, constraints, owner, and lifecycle. Evidence: overlay schema. - [x] M6.2.b Merge platform/region/institution/program/course/learner-support constraints only by narrower eligibility, stricter limits, or additional requirements. Evidence: merge property tests. - [x] M6.2.c Prohibit overlays from weakening safety, privacy, accessibility, integrity, exposure, rights, prerequisite, assessment, or human-authority floors. Evidence: monotonicity tests. - [x] M6.2.d Preview affected paths/items/learners using privacy-safe aggregates and require review/versioning before activation. Evidence: impact tests. - [x] M6.2.e Revalidate effective overlay at each decision and preserve exact version/rationale in sequence history. Evidence: runtime tests. - [x] M6.3 Build item-pool eligibility rules by objective, mastery band, exposure, accommodation, locale, and integrity mode. Evidence: known-value selector tests. - [x] M6.3.a Define typed rule inputs/outputs and exact item revision prerequisites for objective/coverage, difficulty/mastery band, exposure/ compromise, locale, PNP support, delivery, and integrity state. Evidence: eligibility schema. - [x] M6.3.b Filter stale/unapproved/unavailable/incompatible/quarantined/ overexposed items and unresolved mandatory gates with exact reasons. Evidence: exclusion tests. - [x] M6.3.c Apply current minimized learner-context projection without exposing diagnosis/grade/integrity detail to the item bank. Evidence: context boundary tests. - [x] M6.3.d Select deterministically from eligible items by declared strategy/ seed with tie-break and no hidden constraint relaxation. Evidence: selector goldens. - [x] M6.3.e Persist candidate/rejection/selection/rule/version rationale and test every dimension/boundary combination. Evidence: known-value suite. - [x] M6.4 Surface BKT, FSRS-5, graph-tracing, and IRT rationale separately. Evidence: UI does not collapse distinct models into one opaque score. - [x] M6.4.a Define separate model-result contracts with model/version/config/ input projection/time/item-objective refs, outputs, uncertainty, and applicability. Evidence: model schemas. - [x] M6.4.b Present BKT knowledge-state/prior/learn/guess/slip/update evidence and assumptions. Evidence: BKT view tests. - [x] M6.4.c Present FSRS-5 memory stability/difficulty/retrievability/review history/desired retention/scheduling evidence. Evidence: FSRS view tests. - [x] M6.4.d Present graph-tracing matched/missing/extra/path/state/step evidence and concept dependencies. Evidence: graph view tests. - [x] M6.4.e Present IRT ability/item parameters/information/standard error/ calibration/linking evidence. Evidence: IRT view tests. - [x] M6.4.f Show model disagreements/N/A/stale/insufficient data and combined sequencing rule explicitly; prohibit a generic mastery score. Evidence: UI contract tests. - [x] M6.5 Build author-facing simulation with synthetic learners only. Evidence: no real learner PII enters preview. - [x] M6.5.a Define versioned synthetic learner persona/profile distributions for prerequisites/mastery/history/preferences/PNP/locale/pacing/ integrity states with no real source identity. Evidence: fixture schema. - [x] M6.5.b Generate deterministic seeded individuals/cohorts and label every record/event/result as synthetic. Evidence: generation tests. - [x] M6.5.c Run exact pathway/adaptive/tutor/item rules in isolated simulation with bounded steps/time/budget and no delivery/grade side effects. Evidence: simulation tests. - [x] M6.5.d Present paths/decisions/model rationales/outcomes/failures/ distributions and allow scenario comparison. Evidence: UI tests. - [x] M6.5.e Scan source queries, stores, logs, exports, and analytics to prove no real learner ID/PII/profile/attempt enters simulation. Evidence: isolation suite. - [x] M6.6 Enforce and measure the adaptive next-item latency budget. Evidence: runtime gate, not a documentation assertion. - [x] M6.6.a Define latency SLI boundaries from response commit/context receipt through eligibility/model/selection to next-item usable response, with target percentiles and device/network tiers. Evidence: budget spec. - [x] M6.6.b Instrument each server/client/cache/model/store stage with bounded trace/metric attributes and exact timeout/deadline propagation. Evidence: instrumentation tests. - [x] M6.6.c Implement bounded candidate pools/model work, caching/fallback/ degraded paths, cancellation, and honest unavailable state. Evidence: runtime tests. - [x] M6.6.d Load-test realistic concurrent learners/pools/models/failures/ cold caches and measure p50/p95/p99/end-to-end error. Evidence: profile. - [x] M6.6.e Fail release/runtime health when the ratified budget or missing- measurement rule is breached; never assert compliance from design docs. Evidence: performance gate. - [x] M6.7 Link tutor personas, prompts, tools, sources, and course versions. Evidence: tutor cannot use unapproved or stale course material. - [x] M6.7.a Bind each tutor-config revision to exact persona/pedagogy/hint, system prompt/template, allowlisted tools, source set, and course/item revisions. Evidence: binding schema. - [x] M6.7.b Resolve only approved/current/published material and track source/ course update/retraction/rights blast radius. Evidence: resolver tests. - [x] M6.7.c Validate prompt/tool/source/course compatibility, safety/integrity/ PNP/locale policies, and grants before activation/session. Evidence: configuration tests. - [x] M6.7.d Persist effective versions in each session/response and reject stale/retired/direct substituted IDs. Evidence: stale-material tests. - [x] M6.7.e Present authorized version/diff/status and migrate/deactivate explicitly without rewriting historical sessions. Evidence: lifecycle tests. - [x] M6.8 Build tutor-response grounding and pedagogical policy evaluation. Evidence: generated guidance cites current approved sources. - [x] M6.8.a Decompose tutor output into factual/procedural/hint/pedagogical/ motivational/safety claims and attach exact course/source citations. Evidence: response schema. - [x] M6.8.b Verify support/sufficiency/faithfulness/contradiction/currency for claims and required current approved source use. Evidence: grounding fixtures. - [x] M6.8.c Evaluate hint-ladder stage, scaffolding, direct-answer exposure, learner agency, cognitive demand, tone, accessibility, and assessment mode against exact policy. Evidence: pedagogy fixtures. - [x] M6.8.d Preserve raw evaluator/rule/model outputs, uncertainty/N/A/error, policy verdict, and human review separately. Evidence: result tests. - [x] M6.8.e Block/redact/regenerate/escalate according to policy and verify no ungrounded response is presented as supported. Evidence: end-to-end gate. - [x] M6.9 Build assessment-mode integrity interlocks for tutor and visualization tools. Evidence: active assessed/exam contexts block forbidden assistance. - [x] M6.9.a Define assessment context assertion with exact assessment/item/ attempt, mode, allowed aids/tools/hints/content, time window, institution policy, actor/session, and signature/freshness. Evidence: context schema. - [x] M6.9.b Map practice/homework/quiz/graded/exam/proctored/accommodation/ review modes to allowed tutor/visualization/execution/source/answer operations. Evidence: policy matrix. - [x] M6.9.c Revalidate mode on every tool request/stream turn/deep link and fail closed on missing/stale/conflicting context. Evidence: runtime tests. - [x] M6.9.d Prevent direct routes, alternate modality, cached session, prompt injection, tool alias, graph/media, and accessibility-channel bypass. Evidence: adversarial tests. - [x] M6.9.e Provide safe refusal/permitted scaffolding/escalation and log privacy-minimized interlock events without auto-accusation. Evidence: journey tests. - [x] M6.10 Build author analytics for completion, misconception, item performance, objective mastery, fairness, and content drop-off. Evidence: aggregation privacy and minimum cohort rules. - [x] M6.10.a Define each metric’s population/denominator/window/source/ revision/unit/missingness/owner and valid descriptive use. Evidence: metric catalog. - [x] M6.10.b Compute completion/progression/drop-off by course/module/lesson/ activity/content step and item performance/option/rubric/time/exposure. Evidence: known-value tests. - [x] M6.10.c Compute objective mastery/model-specific summaries and aggregate misconception evidence without individual diagnosis. Evidence: learning analytics tests. - [x] M6.10.d Compute approved fairness/DIF/accessibility/outcome slices with minimum cohorts, uncertainty, privacy suppression, and no hidden trait inference. Evidence: privacy tests. - [x] M6.10.e Present revision-aware trends/comparisons/filters and explicit unknown/suppressed/stale/causal-limit state. Evidence: analytics UI tests. - [x] M6.11 Build feedback-to-revision queues. Evidence: learner data is aggregated/redacted and does not auto-edit content. - [x] M6.11.a Define feedback signal/source/aggregation/version/severity/ evidence/privacy, queue item, target content revision, owner, status, and decision contract. Evidence: queue schema. - [x] M6.11.b Ingest approved surveys/comments/support/corrections/analytics/ performance/accessibility/integrity-safe signals with PII redaction and cohort thresholds. Evidence: intake tests. - [x] M6.11.c Deduplicate/cluster/priority-rank with attributed rule/model versions, uncertainty, counterexamples, and no unreviewed learner quote exposure. Evidence: triage tests. - [x] M6.11.d Let authors inspect/accept/reject/defer/request research and create a new draft revision linked to signals; never auto-edit published content. Evidence: authority tests. - [x] M6.11.e Track revision/gate/review/publication outcome and close the loop with privacy-safe evaluation. Evidence: lineage tests. - [x] M6.12 Build experiment governance for content or sequencing A/B tests. Evidence: hypothesis, metric, guardrail, allocation, stop, and analysis records. - [x] M6.12.a Define experiment identity/version, hypothesis, exact variants/ content/algorithm revisions, eligible population, owner, duration, and institutional/legal/ethics approval. Evidence: schema. - [x] M6.12.b Pre-register primary/secondary metrics, guardrails, estimand, power/sample assumptions, analysis method, subgroup/privacy rules, and multiple-testing policy. Evidence: analysis plan. - [x] M6.12.c Define deterministic privacy-safe assignment, allocation, exclusion, ramp, consistency, contamination, consent/opt-out, and logging. Evidence: allocation tests. - [x] M6.12.d Define start/pause/stop/harm/quality/SLO/integrity thresholds, monitoring, authority, and immutable commands. Evidence: guardrail tests. - [x] M6.12.e Analyze per preregistration with attrition/missingness/uncertainty/ limitations, human decision, and no automatic rollout. Evidence: analysis records. - [x] M6.13 Build curriculum, item-writing, verification, accessibility, and tutoring agent plans with least-privilege tool grants. Evidence: sources, course revision, policy, budget, stop conditions, and approval points are locked before dispatch. - [x] M6.13.a Define versioned agent-plan/step contracts and distinct plan templates/output schemas for curriculum, item, verification, accessibility, and tutoring work. Evidence: plan schemas. - [x] M6.13.b Bind exact source/extraction/claim/course/item/rubric/standard/ policy/config revisions and purpose-minimized learner context where permitted. Evidence: input binding tests. - [x] M6.13.c Resolve each tool/model/provider grant by version, typed operation, data scope, tenant/course, resource/network limit, answer-key visibility, and expiry. Evidence: grant matrix. - [x] M6.13.d Define dependencies/preconditions/outputs/evidence, budget per step/total, deadlines/retries, hard stop/refusal, and no silent fallback. Evidence: execution plan tests. - [x] M6.13.e Insert required human review/approval points with role separation and unchanged-plan/evidence binding; agents receive no approval/publish/ grade/integrity/credential authority. Evidence: authority tests. - [x] M6.13.f Validate graph/grants/inputs/policy/budget/stops/approvals/ destinations before dispatch and reject direct plan injection. Evidence: zero-dispatch tests. - [x] M6.14 Build Metis-scoped agent run, queue, plan, tool-call, budget, evidence, output, and provenance views. Evidence: live traced journey and tenant isolation. - [x] M6.14.a Define audience-safe projections and queries for request/plan/ step/queue/run/attempt/tool/budget/evidence/output/decision/lineage. Evidence: view contracts. - [x] M6.14.b Build run list/detail and plan DAG with state, dependencies, approvals/stops, queue/reservations, live cursor events, reconnect, and immutable versions. Evidence: run journey. - [x] M6.14.c Present tool/version/purpose/status/timing/budget and redacted typed inputs/outputs/errors without prompts/keys/learner data. Evidence: tool-call view tests. - [x] M6.14.d Present allocated/consumed/remaining token/tool/compute/cost/time plus evidence/source/citation/gate and proposed output lineage. Evidence: budget/evidence tests. - [x] M6.14.e Enforce tenant/course/actor/audience/object/property/function authorization across URLs/search/streams/exports/actions. Evidence: isolation tests. - [x] M6.14.f Verify live traced failure/review/accept journey, semantic accessibility, responsive modes, and long-history performance. Evidence: Playwright E2E. - [x] M6.15 Intake agent output as proposals requiring attributed human acceptance. Evidence: agents cannot expose answer keys, change grades, decide integrity appeals, waive gates, or publish. - [x] M6.15.a Define signed/hashed result envelope with agent/run/step/tool/ model/config versions, exact inputs, output kind/schema, evidence/ citations, confidence, cost, and status. Evidence: result schema. - [x] M6.15.b Validate signature/hash/schema/size/type/expected step/source/ tenant/course and scan content/files before storage. Evidence: hostile result tests. - [x] M6.15.c Detect/redact/reject forbidden learner/answer/integrity/grade/ credential/private-source/tool-secret fields and unsupported claims. Evidence: protected-field tests. - [x] M6.15.d Store curriculum/item/content/review/accessibility/tutor outputs only as attributed proposals linked to exact authoring revisions. Evidence: proposal persistence tests. - [x] M6.15.e Require an authorized human accept/edit/reject/defer decision; acceptance creates a new revision and reruns relevant gates. Evidence: review tests. - [x] M6.15.f Prove no result field/action can mutate grades, decide appeals, waive gates, approve/publish content, or issue credentials. Evidence: mass-assignment/authority suite. - [x] M6.16 Implement agent pause, redirect, cancel, budget kill, and replay. Evidence: failure and race tests preserve immutable run/evidence history. - [x] M6.16.a Define separate command eligibility/role/scope/reason/ idempotency/expected version/outcome contracts. Evidence: command schemas. - [x] M6.16.b Pause at safe tool/step boundary, checkpoint resumable state, stop new calls, and resume only after full revalidation. Evidence: pause tests. - [x] M6.16.c Redirect through a new plan revision with changed objective/ inputs/tools/budget and preserved completed history. Evidence: redirect lineage tests. - [x] M6.16.d Cancel queued/running/downstream work with provider/tool propagation, late-result fencing, cleanup, and partial evidence retained. Evidence: cancellation race tests. - [x] M6.16.e Kill before next spend at hard budget ceiling and reconcile nonrefundable in-flight usage without overrun success. Evidence: budget kill tests. - [x] M6.16.f Replay as new run identity after current source/course/policy/ grant/budget/rights validation; never mutate source run. Evidence: replay tests. - [x] M6.17 Build tutor-configuration and preview workspaces for text, live voice, pronunciation, pacing, hint ladders, Socratic guidance, demonstrations, accessibility, human escalation, and session summaries. Evidence: simulated and real learner contexts are visibly distinct and integrity interlocks remain active in every modality. - [x] M6.17.a Build versioned persona/pedagogy/language/tone/disclosure and exact course/source/objective/config applicability editor. Evidence: tutor config tests. - [x] M6.17.b Build hint-ladder/Socratic/scaffolding/demonstration/direct- answer bounds, triggers, penalties, and assessment-mode rules. Evidence: pedagogy editor tests. - [x] M6.17.c Build allowlisted tool/source/citation/model/provider/budget/ retention/safety/escalation editor with effective grant preview. Evidence: configuration guard tests. - [x] M6.17.d Build text preview with synthetic learner states, transcript, grounding/pedagogy/integrity findings, and no real side effects. Evidence: text preview tests. - [x] M6.17.e Build live voice preview with approved voice/consent, language/ pronunciation/pacing/interruption/captions/transcript/latency and degraded states. Evidence: voice preview tests. - [x] M6.17.f Build accessibility modes for keyboard/screen reader/visual/ hearing/cognitive supports and equivalent source/hint/tool behavior. Evidence: accessibility tests. - [x] M6.17.g Build human escalation simulation with reason/context summary/ privacy limits/routing/acknowledgement and no fake handoff. Evidence: escalation tests. - [x] M6.17.h Build session summary/retention/delete/export settings and show exact context sources, redactions, model/config versions, and costs. Evidence: session tests. - [x] M6.17.i Visually and contractually distinguish synthetic preview from authorized real learner context; rerun integrity interlock tests for text, voice, tool, demo, accessibility, and cached/offline paths. Evidence: modality boundary suite. - [x] M6.18 Build credential pathway authoring that links objectives, assessments, evidence, mastery/grade rules, human approvals, issuer policy, expiry, and revocation. Evidence: course completion alone cannot mint a credential unless the locked criteria and authority are satisfied. - [x] M6.18.a Build versioned credential pathway/template selection, issuer/ authority, audience, achievement/standards, lifecycle, locale, and validity editor. Evidence: pathway schema/UI tests. - [x] M6.18.b Author nested objective/course/assessment/evidence/mastery/grade/ experience/time requirements with exact revisions and deterministic evaluation semantics. Evidence: criteria tests. - [x] M6.18.c Configure acceptable evidence types/sources/verification/ freshness/privacy and required human review/approval/quorum. Evidence: evidence policy tests. - [x] M6.18.d Preview current/synthetic subject eligibility per criterion with missing/stale/conflicting/N/A state and no exposed private detail. Evidence: evaluation tests. - [x] M6.18.e Lock criteria/issuer/policy/evidence/subject projection on issuance request and require authorized issuer decision/signing. Evidence: issuance guard tests. - [x] M6.18.f Prove course completion or author action alone cannot mint, backdate, replace, revoke, or verify credentials. Evidence: authority bypass suite. - [x] M6.18.g Define expiry/renewal/revoke/replacement and propagate status without altering underlying learning evidence. Evidence: lifecycle tests. - [x] M6.19 Build governed training-data/evaluation feedback intake from educator decisions, aggregated learner outcomes, verifier disagreements, and media critiques. Evidence: consent, minimization, purpose, retention, contamination, licensing, deletion, lineage, and opt-out controls precede any training or fine-tuning use. - [x] M6.19.a Define feedback-source registry and intake record for educator decisions, cohort-level outcomes, verifier disagreements, and media critiques with exact originating versions. Evidence: schemas. - [x] M6.19.b Verify collection notice/consent or approved basis, creator/ learner/institution rights/license, purpose scope, tenant policy, and opt-out before admission. Evidence: eligibility tests. - [x] M6.19.c Minimize/redact/deidentify protected answer, learner, grade, integrity, biometric/voice, source, tenant, and free-text PII with privacy thresholds. Evidence: minimization tests. - [x] M6.19.d Filter quality/label validity, duplication, leakage, benchmark/ evaluation contamination, malicious/poisoned content, and subgroup representation. Evidence: quality/contamination tests. - [x] M6.19.e Store immutable dataset candidate/record lineage, license/ purpose/retention/delete/opt-out state and prohibit direct training use. Evidence: dataset ledger tests. - [x] M6.19.f Require separate dataset curation, governance approval, versioned manifest/splits, security/privacy/fairness review before evaluation or training. Evidence: promotion gate. - [x] M6.19.g Propagate deletion/withdrawal/revocation through datasets, experiments, derived models/evaluations and record irrecoverable constraints. Evidence: lineage/withdrawal tests. ### M7 — Integrity, review, and institutional governance - [x] M7.1 Integrate Themis adjudication through its canonical contract only. Evidence: no private Themis imports. - [x] M7.1.a Inventory Themis public contracts/versions/operations/events/ auth/failure modes and all current Metis integration/private imports. Evidence: integration inventory. - [x] M7.1.b Map Metis case/evidence/subject/policy/decision/appeal fields to the public contract with protected-field and authority boundaries. Evidence: mapping tests. - [x] M7.1.c Implement an injected adapter/client with version negotiation, idempotency, timeouts, redaction, audit, and unavailable/degraded state. Evidence: contract tests. - [x] M7.1.d Remove/forbid private package/schema/store imports and duplicate adjudication mutation paths. Evidence: dependency-boundary gate. - [x] M7.1.e Verify case submit/status/decision/appeal/revocation journey and cross-tenant/role failures. Evidence: integration E2E. - [x] M7.2 Reconcile assessment and tutor integrity-mode vocabularies through an explicit lossless mapping. Evidence: round-trip tests. - [x] M7.2.a Inventory every assessment/tutor/delivery/institution integrity mode code, definition, version, owner, behavior, and consumer. Evidence: vocabulary inventory. - [x] M7.2.b Define canonical mode identities separately from context-specific projections and map exact/broader/narrower/composite/unmapped semantics. Evidence: mapping table. - [x] M7.2.c Represent untranslatable fields/constraints explicitly and reject lossy defaults or “closest mode” execution. Evidence: loss tests. - [x] M7.2.d Round-trip each supported mode/version through assessment context, tutor config/session, API/events, and UI labels. Evidence: goldens. - [x] M7.2.e Version/deprecate mappings with compatibility windows and preserve historical session meaning. Evidence: lifecycle tests. - [x] M7.3 Build integrity signal review with model version, evidence, confidence, uncertainty, and protected-data controls. Evidence: reviewer journey. - [x] M7.3.a Define signal/case projection with exact learner/attempt/item refs, source/collector/model/rule/config versions, raw outputs, evidence/chain, confidence/uncertainty, and state. Evidence: schema. - [x] M7.3.b Build permission-filtered queue/detail with priority, deadlines, duplicate/correlation, evidence freshness, and explicit classifier-not- conclusion language. Evidence: review UI tests. - [x] M7.3.c Render timeline/media/session/device/similarity/authorship evidence through field-level redaction, secure viewer, and access audit. Evidence: protected-data tests. - [x] M7.3.d Support request-evidence/dismiss/escalate/open-case actions with reason/expected version and no automatic grade/consequence. Evidence: action tests. - [x] M7.3.e Verify reviewer journey for positive/false-positive/conflicting/ insufficient/appealed/cross-tenant cases accessibly. Evidence: E2E. - [x] M7.4 Build decision and appeal workflows with separation of duties. Evidence: original reviewer cannot decide a restricted appeal. - [x] M7.4.a Define decision/appeal state machines, roles, evidence rights, standards/policies, deadlines, stays, outcomes, remedies, and audit. Evidence: workflow schemas. - [x] M7.4.b Require eligible independent decision maker, conflict check, evidence completeness, learner explanation, and expected case version. Evidence: decision guards. - [x] M7.4.c Let learner/authorized representative file appeal, grounds, new evidence, accessibility support, and receive status safely. Evidence: appeal intake tests. - [x] M7.4.d Enforce restricted appeal independence/quorum so original detector/reviewer/decider cannot decide where prohibited. Evidence: separation tests. - [x] M7.4.e Record appeal affirm/modify/overturn/remand/withdraw/expire and trigger grade/consequence correction separately. Evidence: outcome tests. - [x] M7.5 Build immutable integrity audit and learner-visible explanation projection. Evidence: role-based redaction tests. - [x] M7.5.a Record append-only collection/access/change/signal/case/evidence/ decision/appeal/notification/correction events with actor/authority/ versions/hash chain. Evidence: audit schema tests. - [x] M7.5.b Protect raw evidence/classifier features/other learners/reviewer identity/security methods while retaining authorized forensic access. Evidence: field policy. - [x] M7.5.c Define learner-visible explanation for allegation/category, applicable policy, evidence summary/limitations, decision/reason, consequence, appeal rights/deadlines, and support. Evidence: projection schema. - [x] M7.5.d Generate explanations from canonical decisions, not model output, with locale/accessibility and no accusation before decision. Evidence: projection tests. - [x] M7.5.e Verify tamper detection, retention/legal hold, role/tenant redaction, export, and correction history. Evidence: audit tests. - [x] M7.6 Build content review templates for SME, pedagogy, accessibility, fairness, legal/rights, and publisher signoff. Evidence: required-role matrix. - [x] M7.6.a Define versioned review template applicability by content/item/ course/risk/locale/target with dimension, checklist, evidence, role, quorum, sequence, expiry, and code floors. Evidence: schema. - [x] M7.6.b Define SME correctness/source, pedagogy/alignment, accessibility, fairness/cultural, legal/rights, and publisher/target criteria as separate decisions. Evidence: dimension matrices. - [x] M7.6.c Resolve required roles/qualifications/locale/independence and prohibit one signoff from satisfying another dimension. Evidence: role tests. - [x] M7.6.d Bind signoffs to exact revisions/evidence/gates/template and invalidate only affected approvals on change. Evidence: freshness tests. - [x] M7.6.e Test institution overlays can add reviewers/criteria but not remove platform requirements. Evidence: template property tests. - [x] M7.7 Build anchored comments on course, lesson, block, objective, rubric, item, response, stimulus, and media. Evidence: anchor survival tests. - [x] M7.7.a Define comment/thread/reply, exact subject revision, typed entity/ field/text/region/timecode/item-option/rubric anchor, visibility, mentions, attachments, and status. Evidence: schema. - [x] M7.7.b Implement accessible create/reply/edit/resolve/reopen/navigate with object/property permissions and notification controls. Evidence: UI/API tests. - [x] M7.7.c Map stable entity anchors across revisions and text/media anchors as exact/shifted/ambiguous/orphaned while preserving originals. Evidence: survival tests. - [x] M7.7.d Prevent comments from changing content/answer/grade/approval and protect learner/assessment/private-source anchors. Evidence: boundary tests. - [x] M7.8 Build reviewer conflict-of-interest declarations. Evidence: incompatible conflicts block signoff. - [x] M7.8.a Define conflict types/scope/subject/reviewer relationship, self-declaration, detected signal, confidentiality, evidence, dates, and status. Evidence: declaration schema. - [x] M7.8.b Require declaration/update before assignment/decision and provide safe “unsure/request review” path. Evidence: workflow tests. - [x] M7.8.c Evaluate conflict policy by review dimension/risk/institution as disqualifying, manageable with mitigation, or permitted. Evidence: policy matrix. - [x] M7.8.d Block assignment/signoff/quorum for incompatible conflicts and record reassignment/recusal/mitigation approval. Evidence: enforcement tests. - [x] M7.8.e Protect conflict details from unauthorized parties while auditing access and preserving appeal/retention needs. Evidence: privacy tests. - [x] M7.9 Build institution-specific policy overlays with platform floors. Evidence: tenants can tighten but never loosen. - [x] M7.9.a Define typed versioned institution overlay for content/source/ review/accessibility/integrity/provider/retention/export/assessment/ grade/credential/tutor settings. Evidence: schema. - [x] M7.9.b Resolve platform/region/institution/program/course precedence with exact inheritance/merge/conflict semantics. Evidence: resolution tests. - [x] M7.9.c Prove field-level monotonic tightening of safety/privacy/rights/ accessibility/integrity/security/authority floors. Evidence: property tests. - [x] M7.9.d Preview affected users/content/builds/attempts/integrations/ schedules and require authorized review before activation. Evidence: impact tests. - [x] M7.9.e Version/effective-date/rollback overlays and revalidate dependent state without rewriting history. Evidence: lifecycle tests. - [x] M7.10 Build gradebook visibility and correction review. Evidence: correction events are append-only and authorized. - [x] M7.10.a Build role/field/time-window filtered grade/current/history/ evidence projection for learner/guardian/teacher/assessor/admin. Evidence: visibility tests. - [x] M7.10.b Build correction request/detail queue with target grade revision, proposed value/status, reason/evidence, downstream impact, and requester. Evidence: review schema/UI. - [x] M7.10.c Enforce scorer/reviewer/approver separation, scale/range/policy/ attempt/item freshness, expected version, and learner notice. Evidence: guard tests. - [x] M7.10.d Record approve/reject/request-changes as immutable decision and approved correction as append-only grade event. Evidence: history tests. - [x] M7.10.e Recompute aggregates/LTI/OneRoster/credentials idempotently and preserve prior views/appeals. Evidence: propagation tests. - [x] M7.11 Build BYOM quarantine, evaluation, approval, kill switch, and abuse monitoring into operator review. Evidence: fail-closed end-to-end journey. - [x] M7.11.a Intake provider/model/endpoint/config credentials by secret ref, ownership/license/security/data-use/residency/cost/capabilities and quarantined state. Evidence: intake tests. - [x] M7.11.b Probe/scan/benchmark with synthetic approved fixtures for contract, safety, grounding, answer leakage, privacy, latency/cost, availability, and model/version drift. Evidence: evaluation suite. - [x] M7.11.c Require named security/privacy/safety/education/operator approval and scope admission by tenant/course/use/data/region before enablement. Evidence: approval tests. - [x] M7.11.d Implement scoped disable/kill with session/job behavior, credential revoke, fallback/not-configured state, blast radius, and restore gates. Evidence: kill-switch tests. - [x] M7.11.e Monitor prompt injection/exfiltration, harmful/answer-leaking output, anomalous spend/rate/data, endpoint drift, and complaints with explainable human triage. Evidence: abuse monitoring tests. - [x] M7.11.f Run direct endpoint/secret/model substitution, stale approval, cross-tenant, outage, abuse, kill, and recovery journey. Evidence: fail-closed E2E. - [x] M7.12 Build review SLA, escalation, workload, and notification views. Evidence: quiet hours never suppress urgent integrity events. - [x] M7.12.a Define review-type/risk/priority SLA clocks, business calendars, pauses, deadlines, breach thresholds, owners, and escalation paths. Evidence: SLA schema. - [x] M7.12.b Compute queue age/due/breach/workload/capacity by qualified role/ locale/institution with privacy-safe counts and fair assignment. Evidence: fake-clock/load tests. - [x] M7.12.c Build accessible queue/calendar/workload views with filters, current/stale/blocked states, reassignment, and no sensitive titles in unauthorized summaries. Evidence: UI tests. - [x] M7.12.d Route reminders/escalations over configured channels/quiet hours/ substitutes/on-call with idempotency and acknowledgement. Evidence: notification tests. - [x] M7.12.e Override quiet hours only for ratified urgent integrity/safety events, record reason, and test timezones/DST/failures. Evidence: escalation tests. - [x] M7.13 Build human signoff gates that automation cannot complete. Evidence: system actor refusal. - [x] M7.13.a Define human-only gate kinds, eligible named roles/qualifications/ independence/quorum, exact subject/evidence, decision fields, expiry, and nondelegability. Evidence: gate schema. - [x] M7.13.b Require interactive authenticated human action with step-up where needed, conflict declaration, rationale, and unchanged subject/evidence. Evidence: signoff tests. - [x] M7.13.c Reject system/service/agent/model/provider/import/migration actor types and impersonated/delegated tokens at API/domain/store layers. Evidence: system actor refusal tests. - [x] M7.13.d Prevent mass assignment, event replay, direct state mutation, copied signoff, stale approval, and flag/policy bypass. Evidence: adversarial tests. - [x] M7.13.e Invalidate on material change and preserve original human decision/audit. Evidence: lifecycle tests. - [x] M7.14 Build review evidence export suitable for institutional audit. Evidence: stable schema, access control, and tamper hash. - [x] M7.14.a Define versioned export manifest for subjects/revisions, templates/gates, measurements/evidence, comments, assignments/conflicts, decisions/appeals/signoffs, actors/roles, audit, and redactions. Evidence: schema. - [x] M7.14.b Authorize export purpose/scope/institution/course/time/subjects/ fields and apply learner/answer/integrity/source/privacy minimization. Evidence: access tests. - [x] M7.14.c Produce deterministic JSON/CSV/PDF or ratified formats with stable IDs/times/locales, checksums, schema/version metadata, and no spreadsheet/formula/archive injection. Evidence: export tests. - [x] M7.14.d Sign/hash manifest/files and include verification instructions, missing/redacted/external refs, generation actor/time/commit, and audit. Evidence: tamper tests. - [x] M7.14.e Round-trip through independent validator and test two-tenant/ role/large export/retention/expiry behavior. Evidence: audit export suite. ### M8 — Persistence, APIs, jobs, and tenancy - [x] M8.1 Implement missing workbench models using the ratified database. Evidence: migration review and real-DB apply. - [x] M8.1.a Diff ratified contracts/ownership against existing schema and list exact reusable models/fields/indexes and genuine gaps. Evidence: gap map. - [x] M8.1.b Design tenant-scoped keys, logical/revision IDs, FKs/checks/ uniqueness/classification/retention for each missing aggregate. Evidence: schema review. - [x] M8.1.c Add expand/backfill/verify/cutover/contract migrations with compatibility, idempotency, batching, rollback, and no shadow store. Evidence: migration tests. - [x] M8.1.d Apply to an isolated real database from clean and production-like prior versions; verify constraints/data/query plans. Evidence: real-DB report. - [x] M8.2 Separate operational columns from versioned content payloads. Evidence: critical filters use indexed columns. - [x] M8.2.a Classify identity/tenant/owner/state/maturity/timestamps/locks/ queue/freshness/risk/visibility fields as operational versus immutable authored content/revision payload. Evidence: field map. - [x] M8.2.b Normalize query-critical operational fields into typed columns with constraints and one authoritative derivation. Evidence: schema tests. - [x] M8.2.c Store versioned typed content by immutable revision with schema version/hash and prohibit operational mutation from rewriting payload. Evidence: immutability tests. - [x] M8.2.d Add tenant-leading composite/partial indexes for ratified filters/ sorts and verify production-scale query plans/no JSON scans. Evidence: index benchmark. - [x] M8.2.e Reconcile operational projection after revision/events and detect divergence instead of dual authority. Evidence: consistency tests. - [x] M8.3 Implement course, lesson, item, rubric, source, objective, standard, review, and release stores. Evidence: durable-before-ack tests. - [x] M8.3.a Define repository interfaces and transaction ownership for each aggregate with typed create-revision/read/list/transition operations. Evidence: store contracts. - [x] M8.3.b Implement tenant/project/course-scoped persistence, exact revision reads, constraints, optimistic concurrency, and authorization context. Evidence: repository tests. - [x] M8.3.c Implement cross-aggregate refs through validated IDs/versions and outbox events, avoiding application-enforced dangling links. Evidence: integration tests. - [x] M8.3.d Commit aggregate/revision/audit/outbox atomically before success acknowledgement and roll back on any failure. Evidence: durable-before- ack tests. - [x] M8.3.e Test restart/duplicate/retry/deadlock/serialization/two-tenant and production-size access paths. Evidence: real-DB suite. - [x] M8.4 Implement immutable revision and semantic-diff queries. Evidence: history integrity integration test. - [x] M8.4.a Implement revision list/detail/ancestry/branch/consumer queries with stable pagination and protected-field projection. Evidence: query tests. - [x] M8.4.b Verify stored payload/hash/parent/author/reason/time cannot be changed/deleted outside approved retention/legal workflows. Evidence: immutability tests. - [x] M8.4.c Compute typed semantic field/entity/list/relationship/source/ accessibility/key-safe diffs using stable identities. Evidence: diff goldens. - [x] M8.4.d Represent added/removed/changed/moved/unchanged/redacted/unknown and bound diff to schema/version pair. Evidence: result schema. - [x] M8.4.e Rebuild current/history from revisions/events after corruption fixture and verify integrity across restore/supersede. Evidence: integration test. - [x] M8.5 Implement source/claim/citation and blast-radius APIs. Evidence: high-risk grounding known-value route test. - [x] M8.5.a Define source/extraction/claim/citation list/detail/create-review/ link/verify contracts with exact revisions and property authorization. Evidence: API schemas. - [x] M8.5.b Validate typed locators/source rights/authority/currency and provider proposals; canonical claims require human decision. Evidence: mutation tests. - [x] M8.5.c Implement forward/reverse dependency and impact preview queries with stable paths/pagination/reasons/current state. Evidence: graph tests. - [x] M8.5.d Implement update/retraction command triggering stale/block state, owner queue, outbox/audit, and no history rewrite. Evidence: propagation tests. - [x] M8.5.e Run high-risk source-to-lesson/item/tutor/published-build route fixture with cross-tenant/protected-source failures. Evidence: known- value route E2E. - [x] M8.6 Implement course/lesson/item/rubric CRUD with property-level authorization and optimistic concurrency. Evidence: contract suite. - [x] M8.6.a Define versioned create/read/list/edit/new-revision/transition/ archive/restore contracts and disallow in-place published mutation. Evidence: schemas. - [x] M8.6.b Enforce route/function/object/tenant/course authorization and per-property answer/source/learner/review visibility on inputs/outputs/ errors. Evidence: auth matrix. - [x] M8.6.c Accept expected revision/ETag and return typed conflict with safe current/base diff; never last-write-wins. Evidence: concurrency tests. - [x] M8.6.d Validate relationships/registries/standards/floors and write revision/audit/outbox atomically with idempotency. Evidence: mutation tests. - [x] M8.6.e Publish consumer contracts for success/validation/conflict/stale/ forbidden/not-found/redacted states. Evidence: contract suite. - [x] M8.7 Implement provider-backed generation/assist APIs. Evidence: 503, 502, cancellation, malformed output, budget, and success cases. - [x] M8.7.a Define operation-specific typed request/estimate/confirmation/job/ proposal/progress/error contracts and injected provider seam. Evidence: API schemas. - [x] M8.7.b Resolve canonical source/course/item/context/policy/tool grants server-side and reserve quota/budget before dispatch. Evidence: guard tests. - [x] M8.7.c Map not-configured/unavailable to 503, malformed/upstream failure to stable 502 class, plus refusal/timeout/rate/budget/cancel states without fallback. Evidence: failure contracts. - [x] M8.7.d Implement idempotent durable jobs, progress stream, cancellation/ late-result fencing, and attributed proposal intake. Evidence: job tests. - [x] M8.7.e Prove success cannot auto-edit/approve/publish/expose answers and errors leak no prompts/credentials/learner data. Evidence: boundary suite. - [x] M8.8 Implement quality and psychometric gate jobs. Evidence: stale-policy recomputation tests. - [x] M8.8.a Resolve exact subject revisions and required deterministic/model/ psychometric/accessibility gates plus evaluator/policy/corpus versions. Evidence: job plan tests. - [x] M8.8.b Execute bounded dependency-aware gate items with leases, idempotency, progress, retries, cancellation, and partial preservation. Evidence: worker tests. - [x] M8.8.c Persist immutable raw measurements and separate verdicts/ applicability/uncertainty/freshness. Evidence: result tests. - [x] M8.8.d Recompute verdict-only on policy/threshold change and require new measurement on subject/evaluator/input change. Evidence: stale-policy tests. - [x] M8.8.e Prevent partial/stale/unknown jobs from authorizing publication or calibration promotion. Evidence: authority tests. - [x] M8.9 Implement QTI/LTI/OneRoster/SCORM/xAPI/Caliper/Open Badges import and export jobs. Evidence: per-standard golden fixtures. - [x] M8.9.a Define per-standard operation/direction/profile/version/credential/ input/output/diagnostic/progress/result contracts and capability probes. Evidence: job schemas. - [x] M8.9.b Parse/fetch/upload safely, validate conformance/identity/version/ rights, preview mappings/loss/conflicts, and require authorization. Evidence: hostile import tests. - [x] M8.9.c Export exact revisions deterministically with standards metadata, privacy/property filtering, manifests/hashes, and declared loss. Evidence: export tests. - [x] M8.9.d Run durable idempotent per-item/resource jobs with partial results, retry/cancel/resume, receipts, and no silent drops. Evidence: lifecycle tests. - [x] M8.9.e Validate/import/read-back minimal/full/edge golden for every supported profile and explicit incompatible cells. Evidence: conformance suite. - [x] M8.10 Implement publication and LMS synchronization as idempotent sagas. Evidence: partial-failure recovery. - [x] M8.10.a Define immutable publication/sync plan with exact build/ assessment revisions, target/course/context/resource IDs, prerequisite snapshot, steps, compensation, and idempotency. Evidence: saga schema. - [x] M8.10.b Revalidate gates/reviews/rights/standards/target/config/ authorization immediately before each external write. Evidence: TOCTOU tests. - [x] M8.10.c Execute create/update/link/content/grade/config/visibility steps with durable checkpoints and destination-native idempotency/versioning. Evidence: integration tests. - [x] M8.10.d Read back external state/bytes/metadata/permissions/links and mark success only after verification. Evidence: read-back tests. - [x] M8.10.e Recover by reconcile/retry/compensate/manual action without duplicating resources or hiding partial state. Evidence: partial-failure tests. - [x] M8.11 Implement gradebook corrections and late-event replay. Evidence: duplicate and out-of-order tests. - [x] M8.11.a Persist immutable grade/source event/correction IDs, exact learner/attempt/item/scale revisions, ordering keys, timestamps, source, and integrity. Evidence: event schema. - [x] M8.11.b Apply authorized corrections as append-only events with expected grade version, audit/outbox, and deterministic current projection. Evidence: correction tests. - [x] M8.11.c Deduplicate by source/idempotency and order/reconcile late, reordered, retried, corrected, voided, and replayed events. Evidence: event ordering tests. - [x] M8.11.d Rebuild projection/aggregates/LTI/OneRoster/credentials from event history without duplicating external writes. Evidence: replay tests. - [x] M8.11.e Preserve visibility/release windows/appeals/notifications and reject stale unauthorized mutation. Evidence: boundary tests. - [x] M8.12 Implement integrity/appeal API integration without shadow records. Evidence: authoritative ID linkage. - [x] M8.12.a Store only Themis authoritative case/evidence/decision/appeal IDs/ versions plus minimal Metis subject linkage and delivery state. Evidence: linkage schema. - [x] M8.12.b Create/query/update through public Themis contracts with current actor/tenant/purpose/property authorization and idempotency. Evidence: contract tests. - [x] M8.12.c Project audience-safe status/explanation into Metis without copying raw evidence/decision authority. Evidence: projection tests. - [x] M8.12.d Consume versioned events idempotently and handle missing/ forbidden/deleted/merged/corrected authoritative records. Evidence: event tests. - [x] M8.12.e Add schema/import guards proving no shadow integrity decision/ appeal tables or private imports are introduced. Evidence: boundary gate. - [x] M8.13 Implement permission-aware search and item-bank indexing. Evidence: hidden answer and protected integrity metadata do not leak. - [x] M8.13.a Define index documents per source/course/lesson/item/stimulus/ rubric/objective/review with classified searchable/display-only/ forbidden fields. Evidence: index schema. - [x] M8.13.b Build tenant/course/role/exposure-aware indexing events, version/freshness, deletion/quarantine, and rebuild reconciliation. Evidence: index lifecycle tests. - [x] M8.13.c Query with allowlisted filters/sorts/facets/autocomplete/ pagination and server-side object/property authorization after hits. Evidence: search tests. - [x] M8.13.d Exclude answer/rationale/hidden tests/integrity evidence/learner data/protected sources from index, snippets, counts, spellcheck, and logs. Evidence: leak tests. - [x] M8.13.e Test guessed IDs/terms/timing/counts/stale docs and two-tenant collisions. Evidence: adversarial suite. - [x] M8.14 Implement tenant-isolation tests for authoring, learner preview, search, export, gradebook, integrity, and analytics. Evidence: two-tenant suite. - [x] M8.14.a Seed two tenants with colliding names/IDs-slugs/terms/times/ sources/items/learners/roles plus distinct keys/policies/integrations. Evidence: isolation fixture. - [x] M8.14.b Exercise every authoring CRUD/revision/comment/review/build/ provider/agent path with foreign IDs/cursors/links. Evidence: authoring tests. - [x] M8.14.c Exercise learner preview/session/cache/offline/renderer/media/ tutor synthetic and real-context boundaries. Evidence: preview tests. - [x] M8.14.d Exercise search/facets/counts/autocomplete/index lag and all standards/audit/content/evidence exports. Evidence: search/export tests. - [x] M8.14.e Exercise grade/event/correction/LTI, Themis case/appeal, and analytics/cohort/privacy projections. Evidence: protected data tests. - [x] M8.14.f Inspect API/UI/events/queue/blob/cache/log/trace/notification/ timing channels for identifiers, content, existence, or counts. Evidence: two-tenant suite. - [ ] M8.15 Generate OpenAPI and consumer contracts for Studio, learner, operator, and institutional clients. Evidence: drift gate. - [x] M8.15.a Inventory every route/operation/audience/consumer and canonical request/response/error/event/stream schema and owner. Evidence: API inventory. - [ ] M8.15.b Generate OpenAPI with auth/scopes, discriminators, property redaction/absence, versions/units, pagination/idempotency/concurrency, examples, and stable errors. Evidence: schema validation. - [x] M8.15.c Publish distinct Studio/learner/operator/institution consumer contracts for success/empty/partial/stale/degraded/not-configured/ forbidden/failure cases. Evidence: contract fixtures. - [ ] M8.15.d Verify real provider implementation against every consumer and deployed compatibility window. Evidence: provider verification. - [x] M8.15.e Fail CI on unclassified operations, breaking schema/semantic/ auth changes, or protected property exposure. Evidence: drift gate. ### M9 — Workbench UI, calendar, localization, catalog, and publication - [x] M9.1 Build the Metis authoring hub around assigned work, recent courses, gate failures, review queue, and scheduled releases. Evidence: utility-first design review. - [x] M9.1.a Define audience-safe live view models, priority/ownership/ freshness, actions, and navigation for every named hub region. Evidence: hub contract. - [x] M9.1.b Compose a restrained task-first workspace with assigned blockers primary, recent context/reviews/schedule secondary, and no decorative hero or repeated card grid. Evidence: responsive design review. - [x] M9.1.c Implement deterministic filters/sorts/counts/deep links/live updates and loading/empty/stale/degraded/offline states. Evidence: interaction tests. - [x] M9.1.d Gate inline claim/reassign/review/remediate actions by current role/state/version with reason/confirmation/audit. Evidence: action tests. - [x] M9.1.e Verify keyboard/screen-reader/zoom/responsive and production-scale task/course/review volumes. Evidence: utility-first Playwright journey. - [x] M9.2 Build inbox capture for sources, curriculum briefs, lesson ideas, item ideas, and feedback. Evidence: keyboard-first journey. - [x] M9.2.a Define one inbox item contract with typed capture kind, raw input, source/provenance, context, owner, status, validation, and conversion linkage. Evidence: inbox schema. - [x] M9.2.b Implement keyboard-first quick capture for each named kind with paste/upload/link, minimal required fields, shortcuts, autosave, and accessible feedback. Evidence: capture tests. - [x] M9.2.c Quarantine/scan/fence external content, protect learner feedback, label AI/imported sources, and prevent raw capture from publishing. Evidence: intake boundary tests. - [x] M9.2.d Triage/search/filter/assign/defer/archive/deduplicate and convert into canonical source/brief/lesson/item/feedback records as explicit new revisions. Evidence: conversion tests. - [x] M9.2.e Verify offline/reconnect/duplicate/conflict/permission/large-paste keyboard-only journey. Evidence: Playwright E2E. - [x] M9.3 Build course and item workspaces using shared shell primitives. Evidence: route/selection/deep-link restoration. - [x] M9.3.a Define canonical routes and shared shell layout for navigator/ primary editor/inspector/status/command palette across course and item workspaces. Evidence: IA contract. - [x] M9.3.b Reuse shared selection/revision/dirty/save/conflict/capability/ permission state and avoid a second app shell or duplicated owner UI. Evidence: shell integration tests. - [x] M9.3.c Compose course hierarchy/dossier/content/coverage/review/build routes and item stem/response/key/rationale/accessibility/gate/use routes. Evidence: workspace tests. - [x] M9.3.d Persist/restore tenant/course/item/revision/selected entity/panel/ filter/focus through authorized URLs and back/forward/reload. Evidence: restoration tests. - [x] M9.3.e Verify direct link, deleted/stale/forbidden target, unsaved navigation, responsive modes, accessibility, and route ownership. Evidence: Playwright suite. - [x] M9.4 Build source registry and grounding workspace. Evidence: unsourced high-risk claim block-to-clear journey. - [x] M9.4.a Build permission-aware source/extraction/claim/citation search and detail with authority/rights/currency/jurisdiction/audience/retraction state. Evidence: registry tests. - [x] M9.4.b Build extraction/original comparison, typed locator viewer, claim-span linking, source conflict, update/retraction, and version history. Evidence: grounding interaction tests. - [x] M9.4.c Build high-risk claim queue showing risk/source requirements, support/sufficiency/faithfulness/conflict gates, uncertainty, and reviewer role. Evidence: gate view tests. - [x] M9.4.d Implement attach/replace/corroborate/edit/abstain/request-review actions with exact revisions and blast-radius preview. Evidence: remediation tests. - [x] M9.4.e Run unsourced high-risk claim through authoritative citation, human review, cleared gate, rebuild, and stale-on-retraction journey. Evidence: Playwright E2E. - [x] M9.5 Build objective, standard, concept, and prerequisite graph workspace with semantic list parity. Evidence: accessible graph journey. - [x] M9.5.a Build typed graph projection with stable objective/concept/ standard nodes, prerequisite/coverage/alignment edges, revisions, provenance, validation, and permissions. Evidence: graph contract. - [x] M9.5.b Implement visual create/link/unlink/select/filter/layout/compare with no screen-position-as-data and explicit validation. Evidence: graph interaction tests. - [x] M9.5.c Provide synchronized tree/list/table/forms for every inspect/add/ link/edit/delete/reorder/navigation operation. Evidence: semantic parity tests. - [x] M9.5.d Surface cycles/orphans/unreachable/missing prerequisites/ standards drift/coverage impacts and non-destructive remediation. Evidence: validation tests. - [x] M9.5.e Verify keyboard/screen reader/non-drag/zoom/responsive/large graph and direct authorization journey. Evidence: accessible E2E. - [x] M9.6 Build psychometric and DIF review workspace. Evidence: raw sample, uncertainty, policy, and cohort privacy are visible. - [x] M9.6.a Build permission-filtered item/calibration/run queue/detail with exact sample/method/model/tool/item versions and eligibility status. Evidence: projection tests. - [x] M9.6.b Present raw CTT/IRT parameters, standard errors, fit/information, sample/data quality, exposure, and declared-versus-empirical comparison. Evidence: measurement view tests. - [x] M9.6.c Present DIF method/reference-focal cohorts/effect/significance/ uncertainty/sample counts with privacy suppression and no individual inference. Evidence: DIF view tests. - [x] M9.6.d Show thresholds/policy/verdicts/manual bands/disagreement/ unavailable state separately from raw results. Evidence: state tests. - [x] M9.6.e Implement request-rerun/promote/restrict/revise/retire/review decisions with role separation and immutable evidence. Evidence: review journey. - [x] M9.7 Build integrity and appeals deep links without duplicating `/operator/metis`. Evidence: role-directed navigation. - [x] M9.7.a Define allowed link intents from course/item/attempt/grade/support contexts to authoritative Themis/operator case/appeal views and safe return paths. Evidence: route map. - [x] M9.7.b Issue/validate signed tenant/subject/context/intent/expiry/nonce links and reauthorize current actor/object/function at destination. Evidence: deep-link tests. - [x] M9.7.c Show only audience-safe status/explanation/next action in Metis; keep raw evidence/adjudication/appeal decisions in owner surface. Evidence: property boundary tests. - [x] M9.7.d Route learner/teacher/integrity reviewer/operator actors to their permitted views and handle logged-out/expired/deleted/forbidden cases. Evidence: role navigation tests. - [x] M9.7.e Scan Metis routes/components/APIs for duplicated integrity mutation UI/private contracts. Evidence: ownership gate. - [x] M9.8 Build editorial calendar for course launches, assessment windows, standard updates, item refresh, and review capacity. Evidence: time-zone and committed-slot tests. - [x] M9.8.a Define versioned calendar event/resource/reservation/dependency contracts for each named event type with owner/state/timezone/window/ recurrence/visibility. Evidence: calendar schema. - [x] M9.8.b Build month/week/list/timeline views, filters, accessible non-drag create/move/resize, conflict indicators, and role-filtered details. Evidence: calendar UI tests. - [x] M9.8.c Model launch/assessment embargo/deadline, standards effective dates, source/item freshness, and dependency DAG/backward planning. Evidence: scheduling tests. - [x] M9.8.d Reserve named reviewer/approver/localizer/publisher and system build/provider/LMS capacity; reject overbooked committed slots. Evidence: capacity tests. - [x] M9.8.e Test IANA time zones/DST/all-day/locale/recurrence/quiet hours/ missed dependency/committed slot concurrency. Evidence: calendar suite. - [x] M9.9 Build taxonomy registry for subject, discipline, objective, standard, credential, modality, level, and audience. Evidence: impact preview. - [x] M9.9.a Define versioned typed entries/relations/aliases/locales/ ownership/lifecycle and code-owned floors per named taxonomy. Evidence: registry schemas. - [x] M9.9.b Build permissioned author/edit/diff/review/publish/deprecate/ supersede UI with uniqueness/cycle/collision validation. Evidence: lifecycle tests. - [x] M9.9.c Show exact use across courses/items/objectives/standards/builds/ credentials/search/integrations before change. Evidence: impact query. - [x] M9.9.d Preview alias/deprecation/migration effects, conflicts/loss and require versioned approval; preserve historical codes. Evidence: impact preview tests. - [x] M9.9.e Verify consumer fallback/unknown behavior and cross-registry drift without collapsing distinct taxonomies. Evidence: registry E2E. - [x] M9.10 Build localization workflow with translation memory, glossary, MathML, media, accessibility, and parity gates. Evidence: RTL and long locale journey. - [x] M9.10.a Define locale-variant job/unit/source/target/status/translator/ reviewer/version contracts and immutable source-revision binding. Evidence: localization schema. - [x] M9.10.b Integrate permissioned translation memory and course glossary suggestions with source/version/match/rights and human acceptance. Evidence: TM/glossary tests. - [x] M9.10.c Localize structured text, bidi, MathML, SSML, media text/tracks/ voice, descriptions, interaction labels, answers/rubrics, and metadata without breaking stable IDs. Evidence: content tests. - [x] M9.10.d Run source/citation/meaning/key/scoring/terminology/layout/ accessibility/media-sync/standards-export parity gates per locale. Evidence: parity suite. - [x] M9.10.e Manage source-change invalidation, translation diff/review/ approval/build and prohibit silent fallback in assessed content. Evidence: lifecycle tests. - [x] M9.10.f Run RTL/long/CJK/plural/date-number/unit/voice/caption/offline learner-render journey. Evidence: locale E2E. - [x] M9.11 Build course/item catalog curation via reviewed bundles. Evidence: no direct production writes. - [x] M9.11.a Define versioned catalog bundle with exact course/item/build revisions, audience/locale/metadata/order/collections/schedule/targets, owner, and manifest hash. Evidence: bundle schema. - [x] M9.11.b Build draft add/remove/reorder/group/feature metadata editor with eligibility, rights/gates/reviews/credential/integration checks. Evidence: curation tests. - [x] M9.11.c Preview deterministic catalog/search/learner-facing diffs, removals, dependencies, visibility, and affected links. Evidence: preview tests. - [x] M9.11.d Require separate review/approval and publish through idempotent release API; prohibit catalog database/direct target mutation. Evidence: boundary tests. - [x] M9.11.e Preserve released versions and propagate supersession/unpublish/ source withdrawal/recall explicitly. Evidence: lifecycle E2E. - [x] M9.12 Build publication candidate, approval, schedule, execute, and verified-in-target views. Evidence: failed LMS sync cannot appear published. - [x] M9.12.a Build candidate manifest view with exact content/build/standards/ locale/accessibility/gates/reviews/rights/integration versions and hash. Evidence: candidate tests. - [x] M9.12.b Build separate dimension approvals bound to candidate digest, reviewer roles/quorum/conflicts/conditions/freshness. Evidence: approval tests. - [x] M9.12.c Build schedule/dependency/capacity/embargo/timezone/target preview and confirmation against the unchanged candidate. Evidence: schedule tests. - [x] M9.12.d Build live per-target saga progress/receipts/partial/failure/ retry/compensation with immutable attempts. Evidence: execution tests. - [x] M9.12.e Show published only after authoritative LMS/catalog/store read- back verifies bytes/metadata/visibility/links; expose failed/unknown honestly. Evidence: verified-target E2E. - [x] M9.13 Build QTI/LMS export diagnostics with per-item incompatibilities. Evidence: no silent downgrade. - [x] M9.13.a Define diagnostic model per package/assessment/section/item/ stimulus/rubric/media field with standard/profile/version, severity, support/loss/extension, locator, and remediation. Evidence: schema. - [x] M9.13.b Run preflight mappings/validators/target capability probe on exact revisions before export. Evidence: preflight tests. - [x] M9.13.c Present per-item unsupported interaction/scoring/accessibility/ media/locale/metadata and aggregate counts without hiding failures. Evidence: diagnostics UI tests. - [x] M9.13.d Allow explicit supported substitution/exclusion only through reviewed new build revision; never silently downgrade. Evidence: substitution tests. - [x] M9.13.e Link output manifest/loss report/import/read-back evidence to diagnostics and block incompatible targets. Evidence: export E2E. - [x] M9.14 Build command palette and Studio IA registration. Evidence: route integrity and permission filtering. - [x] M9.14.a Register Metis routes/actions/entities/keywords/shortcuts through canonical Studio IA with stable IDs/audiences/capabilities. Evidence: registration tests. - [x] M9.14.b Build permission/capability/context-filtered navigation and typed non-destructive commands with current selection/revision. Evidence: palette tests. - [x] M9.14.c Exclude unauthorized/disabled/operator/learner/protected-answer commands from discovery and execution server-side. Evidence: auth tests. - [x] M9.14.d Implement keyboard search/grouping/help/focus return and localized accessible labels without shortcut conflicts. Evidence: accessibility tests. - [x] M9.14.e Verify every entry resolves to an owned canonical route/action and stale/deprecated registrations fail CI. Evidence: route integrity gate. - [x] M9.15 Build responsive reviewer mode for tablet/mobile without exposing answer keys to unauthorized contexts. Evidence: viewport and auth tests. - [x] M9.15.a Define mobile review scope/layout for subject identity, preview, sources/gates/diffs/comments, decision, and escalation; exclude complex authoring. Evidence: responsive spec. - [x] M9.15.b Build media/content/item/rubric semantic inspection and anchored comment flows with stable revision context. Evidence: mobile tests. - [x] M9.15.c Project answer/key/rationale/integrity/learner fields by current role/purpose and remove them from payloads/DOM/cache, not CSS alone. Evidence: property tests. - [x] M9.15.d Implement approve/reject/request-changes/abstain only for eligible roles/states with evidence, reason, confirmation, and stale conflicts. Evidence: decision tests. - [x] M9.15.e Verify touch/keyboard/screen reader/zoom/orientation/slow-offline/ direct URL/tier-change viewports. Evidence: responsive auth E2E. - [x] M9.16 Build all loading, empty, unauthorized, stale, offline, conflict, not-configured, degraded, and failed states. Evidence: UI state matrix. - [x] M9.16.a Define canonical state discriminators, safe messages, available/ forbidden actions, timestamps, recovery, announcements, and telemetry for each named state. Evidence: state contract. - [x] M9.16.b Implement route/list/detail/editor/preview/media/job/review/ publication/integration variants without fabricated data or false green. Evidence: component matrix. - [x] M9.16.c Distinguish unauthorized from authenticated-empty safely, stale from current, offline cache from live, conflict from failure, and degraded from not-configured. Evidence: semantic tests. - [x] M9.16.d Preserve user input/focus/context where safe through retry, reconnect, reauth, refresh, conflict resolution, and service recovery. Evidence: recovery tests. - [x] M9.16.e Exercise every critical route/state/theme/viewport/locale with accessible announcements and permission assertions. Evidence: UI state Playwright matrix. - [x] M9.17 Build lecture/media production, render, critic, accessibility, and rendition workspaces with per-segment status and replacement. Evidence: authoring-to-real-learner-renderer journey. - [x] M9.17.a Build lecture/media project list/detail with script/segment/ artifact/rendition versions, source/objective links, owner, cost, gates, review, and package status. Evidence: workspace contract. - [x] M9.17.b Build per-segment plan/spec/code/data/media/presenter/consent/ render job timeline with progress/logs/outputs/failures/cancel/retry. Evidence: production tests. Cancel and retry are version-fenced tickets naming the exact request against the service that owns the production; this surface reads productions and does not write them. - [x] M9.17.c Build synchronized media preview and visual/layout/correctness/ source/accessibility/technical critic findings with attributed versions and educator decisions. Evidence: critic workflow tests. - [x] M9.17.d Build captions/transcript/audio description/sign/translation/ pronunciation and rendition status/diff/review across locales/targets. Evidence: accessibility/rendition tests. - [x] M9.17.e Build surgical replacement impact preview, regenerate/edit, unchanged identity proof, invalidated gates/approvals, and new package comparison. Evidence: replacement tests. - [x] M9.17.f Run lesson-to-media-to-reviewed-package-to-real learner renderer with failure/cancel/consent/source withdrawal/accessibility cases. Evidence: Playwright E2E — 18 admin walks plus a member-web walk of the same package through `LecturePackageRenderer`, served from a playback fixture the service generates from the production the workspace judged. - [x] M9.18 Build credential template, pathway, candidate evidence, review, issue, verify, expire, revoke, replace, and audit views with issuer-role boundaries. Evidence: Open Badges verification and learner-privacy tests. - [x] M9.18.a Build template/pathway authoring with criteria/evidence/ achievement/alignment/issuer/validity/locale/version/diff/lifecycle and floor validation. Evidence: authoring tests. - [x] M9.18.b Build candidate queue/detail with privacy-minimized subject, per-criterion exact evidence/current/missing/stale/conflict state, eligibility calculation, and requester. Evidence: candidate tests. - [x] M9.18.c Build independent reviewer/issuer approve/reject/request-evidence decisions with authority/conflict/quorum/step-up and locked subject. Evidence: review tests. - [x] M9.18.d Build issue/sign/deliver/receipt and public/private verifier views for signature/issuer/recipient/evidence/status with privacy-safe results. Evidence: Open Badges verification tests. The signed document itself is the estate's existing OB 3.0 assertion builder; what this cell adds is the durable status a verifier reads and the audience projection around it. - [x] M9.18.e Build expiry/renew/revoke/replace/supersede status/impact/ notification and immutable lineage/audit. Evidence: lifecycle tests. - [x] M9.18.f Prove authors/course completion/agents cannot issue or revoke, and verify learner/guardian/public/institution field boundaries. Evidence: authority/privacy E2E. - [x] M9.19 Build institutional integration operations for roster sync, deep links, grade services, exports, webhooks, credentials, failures, replay, and reconciliation without duplicating operator incident tooling. Evidence: role-directed, live-status journey. - [x] M9.19.a Build institution-scoped connection/status/capability/config/ credential-ref/version/owner views for LTI, OneRoster, LMS, LRS, webhook, and credential integrations. Evidence: connection tests. Capabilities are probed with a shelf life; an unprobed one is unknown, never supported, and the status is derived from the runs rather than from the connection's own summary columns. - [x] M9.19.b Build roster sync and deep-link/launch operation views with per-run/resource progress, mappings, changes, conflicts, diagnostics, and receipts. Evidence: roster/link tests. - [x] M9.19.c Build grade service/current-correction/outbound status and exports/webhooks/credential event delivery views with privacy/redaction/ idempotency. Evidence: data-operation tests. - [x] M9.19.d Build failure/partial/unknown/retry/replay/reconcile controls with authoritative read-back, impact, expected version, role, and audit. Evidence: recovery tests. This surface plans and enqueues; the delivery itself is the integration worker's, and a recovery answers 202 with a queued operation and no receipt rather than claiming a far side it has not reached. - [x] M9.19.e Route platform security/outage/incident/drain/kill operations to operator tools through governed links; do not duplicate them here. Evidence: ownership tests. - [x] M9.19.f Run institution admin/teacher/operator journeys across live success, version skew, duplicate/late event, outage, recovery, and tenant isolation. Evidence: role-directed E2E. ### M10 — Metis verification, operations, and launch - [x] M10.1 Run contract tests for every canonical and workbench schema. Evidence: no unreviewed snapshot updates. - [x] M10.1.a Generate the complete canonical/workbench entity/API/event/job/ bundle/standard schema inventory with owner/version/consumer/test. Evidence: coverage manifest — `openapi/schema-inventory.json`, 3,907 models across 258 modules, generated by importing every schema, route and service module rather than declared by hand. - [x] M10.1.b Test public parse/validation/serialization/round-trip for minimal, full, locale/accessibility, protected-field, unknown/invalid fixtures. Evidence: contract suites. The estate-wide suite covers minimal, round-trip and unknown-field for the 2,560 models a minimal instance can be synthesized for, with the declines and refusals counted; full, locale, accessibility and protected-field fixtures are the per-cell contract modules', and the manifest records which models have one. - [x] M10.1.c Test cross-package/API/database/standards adapters for semantic field/version/unit/optional/discriminator compatibility. Evidence: adapter tests. Database: every mapped model's table is created by a migration, read from the migration's syntax tree. Units: 310 unit-bearing fields hold quantities. Optional: required-field sets are recorded per model so a diff shows a breaking addition. Discriminator: Pydantic refuses a union with an untagged member at class-definition time, so the guarantee is recorded rather than duplicated. Cross-package is `pnpm --filter @oshun/codegen run openapi:types:check`. - [x] M10.1.d Fail missing/duplicate/unowned/unmapped schemas and require reviewed rationale/diff for every snapshot/golden update. Evidence: contract gate. Hard failures: a published name declared twice, a component FastAPI had to qualify, a component with no model, a model with no migration. Measured ratchets that may not grow: unowned, permissive, untested, unconsumed, unmapped tables. The manifest drift gate is what forces the reviewed diff. - [x] M10.2 Run known-value tests for rubric, readability, coverage, item quality, IRT, BKT, FSRS-5, DIF, exposure, and selection logic. Evidence: function-to-test coverage index. - [x] M10.2.a Inventory exact functions/versions/units/applicability and create independent positive/negative/boundary/N/A/error fixtures per named algorithm. Evidence: function-to-test index — `metis/algorithm_registry.py`, eleven algorithms each with its reference, units and applicability. Eight are checked by a scalar table with all five categories; three read a domain object too large for one and name the tests that carry their exact answers, which the index verifies exist. - [x] M10.2.b Verify rubric arithmetic, readability/complexity, objective/ construct coverage, item clarity/distractor/key/rationale rules, and exposure thresholds. Evidence: deterministic suites. Flesch and the exposure thresholds are point cases derived from the published coefficients; the rubric's weighted score, its N/A reweighting and its half-up rounding are indexed to the four tests that already prove them. - [x] M10.2.c Verify 1PL/2PL/3PL parameters/fit/SE, BKT updates, FSRS-5 scheduling, DIF methods/privacy floors, and calibration eligibility. Evidence: psychometric goldens. BKT, FSRS-5 and the 3PL information function are point cases with the arithmetic written beside each expectation. DIF is an iterative maximum-likelihood fit with no closed form to compare against, so it is registered as property-checked and indexed to the recovery, Holm-family, privacy-floor and revision-conflict tests rather than given a second implementation of its own iteration to agree with. - [x] M10.2.d Verify pool/blueprint/adaptive selection constraints, tie-breaks, seeds, eligibility reasons, and no silent relaxation. Evidence: selector goldens — indexed to the six assembly tests that cover the order-independent golden, the blueprint coverage, the seeded tie-break, the unrelaxed enemy and stimulus constraints, the infeasible blueprint and the fail-closed pool eligibility. - [x] M10.2.e Fail coverage for any active algorithm/version without current fixture/tolerance/source derivation. Evidence: coverage gate. Every algorithm pins a digest of its own logic, taken from the syntax tree with docstrings stripped, so a reformat changes nothing and an altered branch or constant fails the gate until the values are re-derived. A tolerance without a reason, a case with no derivation, a category with no case and an algorithm with nothing checking it each fail on their own. Both halves were verified by mutation: changing `FSRS_FACTOR` from 19/81 to 19/80 fails five known values, and wrapping a return in a `min` that changes nothing for valid inputs fails only the pin. - [ ] M10.3 Run calibrated evaluation for AI item writing, bias assist, tutor, and integrity classifiers. Evidence: threshold and subgroup report. - [ ] M10.3.a Define versioned licensed/consented representative held-out corpora, labels/rubrics, annotator/adjudication process, slices, privacy, and contamination controls for each evaluator. Evidence: corpus manifests. - [x] M10.3.b Run exact model/prompt/config/tool versions and retain per-item proposals/scores/labels/reasons/uncertainty/abstention/errors. Evidence: reproducible runs. Evidence: four runs kept whole in `evidence/v1-workbenches/metis-evaluation/-run.json`. They come from `scripts/run_m10_3_evaluations.py`, `services/evaluation_runs.py` and the synthetic manifests `data/m10_3_*_corpus.json`. RE-MEASURED 2026-09-11: only the item-variant provider calls a model. - `cultural_review*` is human quorum logic, so the bias assist measured is `lesson_inclusivity_helpers`. - The tutor preview is canned text. - Integrity is keyword rules. What each run records: - The model run: the dated slug, `price` sort, reasoning `disabled`, and the prompt and config digests. Per item it keeps the served `model@provider`, cost, latency and the whole proposal. - Deterministic runs are versioned by the digest of their deciding code. Reproducibility, all tested: - deterministic runs re-run byte-for-byte; - every item-writing judgement re-derives from its retained proposal; - all four round-trip through the M10.3.e store on a real database. The first real run is kept (`item_writing-run-20260911T163341Z-prompt-v1-all-malformed.json`): all 24 answers came back malformed. The prompt named an internal class instead of its fields, and the reasoning model spent all 1,500 output tokens thinking. Both are fixed (prompt v2, `METIS_ITEM_VARIANT_MODEL_REASONING`), and a `length` finish is now reported as a truncation. Every manifest states it is synthetic. - [x] M10.3.c Report task-appropriate correctness/validity/harm/precision/ recall/FPR/FNR/calibration plus subgroup/language/discipline/item-kind slices with confidence intervals. Evidence: reports. Evidence: `-report.json` and `REPORT.md`, computed by `services/evaluation_reports.py` from the committed runs and manifests only. - Item writing: validity 21/24 = 0.88 [0.69, 0.96], with one key changed and one given away. An earlier run on the same route scored 18/23. - Bias assist: recall 12/30, FPR 6/12, ECE 0.31 over its 18 flags. It missed every paraphrase and flagged every refuting quotation. - Tutor preview: 46/46. - Integrity: recall 4/22 = 0.18 [0.07, 0.39]. All six verbatim copies of the product's own tutor lines passed, as did all eight model-written answers. Slices: - item writing: discipline, locale (en/es), item kind, pressure, transformation; - bias: category, phrasing; - integrity: action, length, URL; - tutor: dimension. Every slice has its size and a Wilson interval, and all are under 20 items, so each is marked as unable to carry a conclusion. Calibration is reported only where a confidence is stated. The gate refuses all four. - [ ] M10.3.d Select fail/review/pass thresholds against ratified criteria, validate held-out performance, and document limitations/manual bands. Evidence: threshold decisions. - [x] M10.3.e Define drift/champion-challenger/recalibration triggers and block launch on unresolved material subgroup or safety failure. Evidence: evaluation gate. Evidence: `services/evaluation_gate.py`, with 72 tests in `tests/test_evaluation_gate.py`. The gate is given a corpus and a run and measures them itself. It takes no report, so a caller cannot hand it figures. What it refuses: - a missing or late ratification, or a decision made under other criteria or against another run; - a serving version different from the one measured; - a convenience or synthetic sample, or more than 10% single-annotated labels; - contamination, or skipped, foreign or errored items; - a floor missed on the interval's lower bound; - any safety finding (there is no way to accept one); - any material subgroup gap nobody answered for in this run. Slices too small, or holding too few positives to compare a miss rate, are marked unchecked. So are runs that mostly abstain. A pass carrying any of these cannot be constructed. `drift()` calls for recalibration on movement past the trigger or age past the limit. It refuses comparisons across corpora or against the wrong champion, and flags a challenger that is better on average but worse for one slice. `promotion_refusals` blocks on any regression. `assert_evaluators_may_launch` raises unless all four evaluators pass, and one fully passing launch is tested. The evidence is durable (migration 069, `services/evaluation_store.py`, 13 real-database tests). Foreign keys carry the id and the digest, so a run of changed labels, or a decision on a run that never happened, cannot be written. M8.4's trigger refuses UPDATE and DELETE, every read re-checks the digest, and `evidence_for_decision` feeds the gate from stored records. Today it refuses all four: no corpus or run exists (see .a). NOT WIRED INTO SERVING: nothing in the product calls the gate. The tutor answers learners through its OpenRouter model with no verdict behind it, and Metis has no launch switch to put the gate in. Whether the tutor should stop serving until it passes is a product decision. - [ ] M10.4 Run real-database and object-store integration tests. Evidence: source-to-course durable round-trip. OPEN 2026-09-11, with all five children closed. The durable round-trip runs through `services/source_pipeline.py`, and no HTTP route calls it. The product's source ingestion routes, and about 20 other services, still write `source_ingestion_storage_dir` on local disk (M8.1's gap map's file store). So the path a user's source takes is not the one proven durable. Closing this needs those routes cut over to the pipeline. `services/durable_reconciler.py` also has no scheduled caller. Cells: claim, citation and release have no index, and the relay reports them `not_indexed`. RE-VERIFIED 2026-09-12 AND THE BLOCKER HOLDS: no module under `src/metis/api/` mentions `source_pipeline`, and nothing outside `durable_reconciler.py` mentions the reconciler, so neither has gained a caller. THE CUTOVER IS LARGER THAN "ABOUT 20". 68 modules under `src/metis/services/` reference `source_ingestion_storage_dir` and 65 of those also contain a filesystem write. That count is by grep and is an upper bound — it does not prove every write targets that directory — but it is far enough above twenty to change the size of the job, so it is recorded with its method rather than swapped in as a corrected figure. 2026-09-18: TWO OF THE THREE BLOCKERS ARE CLOSED; THE PARENT STAYS OPEN. What moved: - The source's own leg is cut over. `POST /api/source-ingestion` now promotes every item whose admitted bytes the service holds onto the durable path BEFORE the manifest is written (`services/source_durable_intake.py`, `services/durable_runtime.py`): the plaintext the quarantine service scanned becomes a content-addressed blob in the new `s3_bucket_sources` bucket, the source record an aggregate revision naming it, and the extracted text a second blob and revision. The item's `durable_source` says where it landed, and its absence means it did not land - it is never filled in from the intake record. The scan is CARRIED, not repeated: `ingest_scanned` takes the admission's verdict with its receipt, policy and scanner-set digests, because re-scanning here would let a host with no ClamAV overrule a real clean verdict with `unavailable`. A missing or unreachable bucket is a 503 that registers nothing, never a fall back to the local directory; the pipeline is built lazily, so an intake the service itself refuses still answers 409 for that reason. Evidence: `tests/test_source_ingestion_durable_real_stack.py`, 3 tests passing on a real stack (0 skipped), reading back through a second engine and a second S3 client. 2 of the 3 were re-run against the route with the promotion removed and failed, so they are not vacuous. The doubles are a stub `clamscan` at the ClamAV boundary and FastAPI's own dependency override for the caller; the quarantine service, the ingestion service, the pipeline, PostgreSQL and MinIO are real. - The reconciler has a caller: `metis.tasks.durable.reconcile_estate`, on beat hourly, over every tenant the store holds a record for and every publication run each has. It repairs nothing, by construction. Evidence: `tests/test_durable_reconcile_task_real_stack.py`, 3 tests passing on a real stack - it reports the owed outbox events and the unindexed source, says the same thing twice (so it repaired nothing), goes clean after a drain, and names a blob deleted out from under an acknowledged revision. WHAT IS STILL OPEN, and why the parent is not checked: - The journey stops at the source. `ground` and `build_course` still have no product caller, so claims, citations and the course are reachable only from a test. The parent's evidence sentence is a source-to-COURSE round trip, and half of it is not on the product path. - The ingestion package manifest is still a JSON file on local disk, so `GET /api/source-ingestion` still reads the file store. - The 68/65 file-store figures above are unchanged, re-measured 2026-09-18 by the same method. - [x] M10.4.a Provision isolated real migrated database/object storage/search/ queue/outbox with two tenants and deterministic fixture/cleanup. Evidence: harness. Evidence: `apps/metis/service/tests/real_stack.py`, with 12 tests across `tests/test_real_stack.py` and `tests/test_search_store_real_database.py`, all passing and none skipped. Run with `METIS_TEST_DATABASE_URL`, `METIS_TEST_S3_ENDPOINT` and `METIS_TEST_REDIS_URL` set; without them the tests skip and name what is missing. Each stack is: - its own PostgreSQL database, migrated to head by the service's alembic. The test checks `alembic_version` against the script head. The outbox (`store_outbox`) lives there, and so does search: this estate has no engine, so the M8.13 index is now durable in `search_index_document` (migration 070, `services/search_store.py`). M8.1's gap map moved the search_index contract from absent to payload_backed; - two MinIO buckets. The server itself refuses bytes that do not match the digest sent with them; - a Redis key prefix for the queue; - two tenants whose ids derive from a seed. The fixture is deterministic: two stacks provisioned at once share nothing, yet produce identical fixture digests. Provisioning is all-or-nothing: a stack failing at its second bucket is watched undoing the database and the first bucket. Teardown is checked: it reports what it could not remove, shown by making removal fail. The search store keeps revision order over arrival, keeps tombstones, stops serving quarantined documents, survives a new engine, serialises two appliers on the row lock, and scopes by tenant. Its product writer, the outbox relay, belongs to M10.4.b/.c. - [x] M10.4.b Ingest/quarantine/store/hash/extract/version a source and persist claims/citations/objectives/course/lesson/item/rubric/reviews/build. Evidence: source-to-course test. Evidence: `tests/test_source_to_course_real_stack.py`, 3 tests passing on a real stack (0 skipped). RE-MEASURED 2026-09-11: every stage of the existing source pipeline wrote JSON files under /tmp. None of it was durable, so the durable journey was built: - `services/blob_store.py`: content-addressed per tenant, the server verifies each `ChecksumSHA256`, a HEAD read-back precedes every receipt, and reads re-hash. - `services/source_pipeline.py`: two scans (the structural scanner plus a malware scanner), then bytes before the record that names them, a source revision, then extraction to a derivative blob and a second source revision. - Claims come from the deterministic M5.19 decomposer, linked to sentence spans of the stored text. - A citation binds each claim to its span, and outside works (URL/DOI) are cited separately. - Then objective, course, lesson, item, rubric, review, and a release whose manifest is itself a verified blob. Claims and citations are now stored aggregates (migration 071). `AuthorableKind` keeps the authoring API and generation jobs at the original nine, since a claim becomes canonical only by a human decision. Everything is read back through a second engine: - both revisions; the bytes and derivative by digest; each span's quote by digest; - the manifest equals the release; - the source retraction walk reaches every record built; - one audit and one outbox row per write, with nothing in the other tenant. With the scanner unavailable or reporting infection, the source is stored quarantined and extraction refuses it. The HTTP ingestion routes still write the file store. Moving them onto this pipeline is a cutover. - [x] M10.4.c Verify transactions/audit/outbox/restart/idempotency/concurrency, exact revisions, blobs/derivatives, search index, and tenant isolation. Evidence: durability tests. Evidence: `tests/test_durability_real_stack.py`, 13 tests passing on a real stack (0 skipped), plus the M10.4.a/.b suites; 428 pass across the store-dependent suites. RE-MEASURED: nothing ever drained the outbox (`published_at` was never set), so `services/outbox_relay.py` was built. Each event's index change and its delivery mark commit in one savepoint; claims use SKIP LOCKED; the relay reads the exact revision an event names and indexes only its `index` map. Proven: - A relay killed after applying leaves the event undelivered and the index unchanged, then redelivers. - Two relays at once deliver disjoint sets that together cover every event. - A poison event fails loudly and does not starve the events behind it. - A withdrawal tombstones the document. A learner's search finds the lesson, and the item's `answer_key` never reaches the index. - A write referencing a missing revision leaves no row in any of four tables. - A re-run step writes nothing, and the same bytes stay one object. - Every old revision reads back exactly; each audit entry names its actor; a changed or missing object is refused. - The derivative equals a fresh extraction of the stored original. - Two tenants with identical ids share nothing across revisions, outbox, audit, index or blob prefixes. FIXED a live M8.3 defect: the loser of a race for one revision was told `unknown_aggregate` instead of `revision_conflict`. The cause was `FOR UPDATE OF a` on a join, which Postgres re-checked against the old revision row after the lock wait. The race test caught it before the fix. - [x] M10.4.d Publish/write/read-back then source retract/quarantine/restore and reconcile every owner/store/index. Evidence: lifecycle round-trip. Evidence: `tests/test_lifecycle_real_stack.py`, 5 tests passing on a real stack (0 skipped), plus 3 restore tests in `tests/test_source_graph_real_database.py` and 2 in `tests/test_search_index.py`. One course is published through the M8.10 saga to the exports bucket by `services/object_store_publication.py` (S3 destination; prerequisites read from the stores) and read back from the bucket. Then: - its source's rights lapse (M8.5 retraction): the export becomes a reconciler finding, compensation hides it without deleting it, and prerequisites report `rights` as the only move; - the source is quarantined: extraction refuses and the index stops serving it; - the source is restored (`source_graph.restore`, a `restore` index action, migration 072): owners' queues empty and search serves the lesson again; - the course is published again. After each step, `services/durable_reconciler.py` must find nothing across blobs, index, outbox, exports and owner queues. It is shown to name each kind of disagreement it looks for when one is injected. FIXED (latent until something resolves a propagation): `owner_queue` and `impact_preview` read resolved rows as open. The relay, reconciler and destination have no product caller yet: the HTTP ingestion cutover is open (M10.4.b), and Celery wiring is .e's queue. - [x] M10.4.e Inject commit/blob/outbox/queue/search/process failures and prove no acknowledged orphan/false success. Evidence: fault suite. Evidence: `tests/test_faults_real_stack.py`, 10 tests passing on a real stack (0 skipped, 0 failed). With the lifecycle, durability, harness, search and saga suites, 229 pass. The faults are real: - PostgreSQL triggers raise at the revision (deferred to COMMIT), outbox and audit rows. No row lands in any of the four tables. The bytes, written first, are reported as an unacknowledged orphan, and a retry adopts them. - An unreachable object store: no record names the bytes. - A trigger on the index. Only that event stays undelivered. - A deferred trigger on the relay's delivery mark: nothing is marked delivered and nothing is indexed. - A dead broker: no event is lost, and the reconciler reports every one still owed. - The service's own Celery worker is SIGKILLed while blocked mid-drain, with the course's event already applied and uncommitted (its row is locked). Nothing is marked, the write rolls back, and a fresh worker delivers all 3 exactly once. - A publisher is SIGKILLed after MinIO stored its PUT; a relay withholds the answer. The step stays `pending`. Resuming adopts the object with 0 writes, leaving one object. - A down destination never reports success; it recovers with one write. The relay now runs as `metis.tasks.durable.drain_outbox`, scheduled by beat on queue `metis.durable`. Before, nothing in the service drained the outbox. FIXED: - One index error rolled back the relay's whole batch on every pass, so delivery stopped for everyone (the test failed before the fix). - Same-instant revisions were delivered in random-UUID order (`ignored_older`; the .c test failed 4 of 4 alone). - Via e884e9ff9fa: every authoring-API edit nulled the aggregate's course, and a course-scoped caller could revise another course's aggregate. - [ ] M10.5 Run QTI 3 import/export goldens, including accessibility features. Evidence: external validator or pinned conformance tool results. - [x] M10.5.a Enumerate supported QTI profile/item-kind/scoring/feedback/ stimulus/media/locale/accessibility cells and explicit unsupported ones. Evidence: coverage manifest. Evidence: `evidence/v1-workbenches/metis-qti/coverage-manifest.json`. It is generated by `scripts/export_qti_coverage.py` from the registry in `services/qti3_profile.py`, which export consults. - 63 cells. Every supported cell names the function that implements it (tested to exist), and every refused cell names its code. - The `contract` column is tested against M1.11's generated evidence. 19 cells fall short of it, and all are listed: - Metis has no canonical hotspot item. The router sends hotspot to the selected-response family, which has no hotspot kind. - Written scoring is a loss, not the contract's extension. - Per-option feedback on ordering and matching is lossy. - No draft carries a hint. - Stimulus, media, captions, transcripts and PNP are unmapped. The runtime is `schemas/qti3.py` and `services/qti3_{content,render,map,parse,profile}.py`, with 33 tests in `tests/test_qti3_runtime.py`. It maps single-choice, multiple-choice, ordering, matching, constructed-response and essay drafts into QTI 3.0.1, one item per locale, and reads them back. It refuses by code what it does not model. Measured outside the repo; the receipts are .d's: - 12 files in four packages pass the official QTI 3.0.1 XSDs. - The Longsight consumer validates the packages, and its scores agree with Metis's scorer on all 42 valid responses. No product route calls the runtime yet; that is .c's work. - [x] M10.5.b Build minimal/full/edge/multilingual/RTL/MathML/caption/ transcript/PNP/interactive goldens with exact expected mappings/loss. Evidence: golden corpus. Evidence: `apps/metis/service/tests/fixtures/qti3/goldens/`, seven packages written by `scripts/export_qti_goldens.py` from the canonical inputs in `tests/qti3_golden_fixtures.py`, and compared byte for byte by `tests/test_qti3_goldens.py` (30 tests). Each golden's descriptor and its exact set of loss codes are committed with it, so a change in what leaves Metis fails a test. - minimal, full (partial credit with a penalty, feedback, cards), edge (escaped characters, a share that does not divide), multilingual (en/fr/ja), RTL (ar, dir=rtl), MathML (islands carried through the lesson canonicaliser). - caption, transcript, PNP and interactive are one package, as they are in practice: a stimulus set whose video carries WebVTT captions, an HTML transcript and a long description in both locales, each declared as a content-package variant with an Access for All resource description, with manifest dependencies and items that reference the stimulus in their own language. - The media is real: a 32x32 one-second H.264/AAC clip, a PNG, WebVTT and HTML, all on the profile's MIME allowlist. Media is content-addressed, so the goldens hold no duplicate bytes. Measured outside the repo (receipts are .d's): all 19 XML files pass the official QTI 3.0.1 XSDs; all seven packages pass the Longsight consumer's strict package validation; and its scores equal Metis's own scorer on all 36 valid responses to the goldens' items. New runtime: `services/qti3_stimulus.py` (an asset resolver, digest and MIME checks, adaptations per media kind) plus stimulus rendering, parsing and manifest dependencies/variants. The coverage manifest's disagreements with M1.11 fall from 19 to 14: media, captions, transcripts, PNP and dependencies now match it. Hotspot stays unmapped, because Metis has no canonical hotspot item. - [x] M10.5.c Import safely, validate canonical semantics/protected keys, then export deterministically with version metadata/manifests. Evidence: round-trip tests. Evidence: `apps/metis/service/tests/test_qti3_packages.py` (40 tests) over `services/qti3_package.py`, plus the parse and render changes it exercises. Every golden package is exported, read back, and the items, stimuli, media and canonical refs that come out are compared with the ones that went in; then the same package is broken one way at a time and each break is refused by its own code. - Import safely: the archive is bounded before anything is parsed (entries, entry size, total expansion, compression ratio, nested archive by MAGIC not extension, encrypted entry, symlink, duplicate normalized path) and every path is a plain relative path inside the package. The manifest is reconciled with the archive BOTH ways: a file a resource declares must exist, a file no resource declares is refused, and every dependency, variant, stimulus reference and media reference must name something present. - Canonical semantics: a key that names a choice the item does not have, a single-response item with two correct values, an order key that is not a permutation of the choices, a match key that is not a choice/target pair, a mapping that scores something nobody can respond with, or a mapping whose bounds can exceed the item's maximum are each refused by name rather than imported as an item no learner can answer. - Protected keys: `contains_protected_answer_material` was the literal `True` for every item file. It is now computed, because an externally scored item renders with neither a key nor response processing — the descriptor was declaring protected material in documents that held none. A test proves the declaration matches what the document contains, and that the key appears in no other file. - Deterministic export with version metadata: every resource now carries `qmd:qtiMetadata` (interaction type, feedback type, scoring mode, tool name/version/vendor), so a consumer can tell what wrote a package. Two builds of the same inputs are byte-identical, and the M1.11 archive policy is now read back OFF THE BYTES — lexicographic order, 1980 timestamps, mode 0644, no extras or comment, and a compressed size equal to level-9 raw deflate (9 of 14 entries distinguish level 9 from level 1, so the check can fail). Re-measured after the manifest change: all 19 committed golden XML files validate against the official QTI 3.0.1 XSDs with 0 errors, and all 7 packages still pass the Longsight consumer — 11 items checked, 0 failed, 0 package errors. Those are .d's receipts to retain. CORRECTION (.d, same day): this line first read "exit 0", which was not a measurement. Run through `node_modules/.bin/qti3`, the consumer's entry guard declines to run and it exits 0 in silence; the numbers above are from re-running its resolved `dist/index.js`, which prints a JSON verdict. .d's runner refuses to write a receipt for a report with no verdict in it. The coverage manifest grows to 65 cells (`qti-metadata`, `bounded-package-import`). STILL NO PRODUCT ROUTE CALLS THE RUNTIME, and .a said this was .c's work. Measured why a cutover today would be a regression, not a migration: `services/item_import_helpers.py` resolves item-level media out of an imported package (`ItemImportRaw.media`, alt text required) and the runtime's `Qti3Item` carries no media — media lives on stimuli. Its archive reader is also not weaker than the runtime's; it checks magic bytes per entry, an extension allowlist, depth, ratio and encryption already. The runtime parser is deliberately narrow — it refuses response processing it cannot regenerate — so pointing the import route at it would refuse foreign QTI the product accepts today. The product path that assembles and reimports a package belongs to M10.10.d, and the parent M10.5 stays open behind it and .d/.e. 2026-09-18: .d and .e are closed, so THE PARENT'S ONE REMAINING BLOCKER IS THIS PARAGRAPH — no module under `src/metis/api/` mentions `qti3_profile`, `qti3_package` or `export_package` (re-measured by grep on 2026-09-18; `api/qti.py` calls the older `qti_service`, not this runtime). A profile nothing serves is a profile, not an export. - [x] M10.5.d Validate through pinned independent QTI schema/conformance tool and at least one supported consumer where required. Evidence: reports. CLOSED 2026-09-18 AT 14 OF 14, WITH M1.11.g. The two receipts that could not be taken were hotspot's, and the reason was not the validators: Metis had no canonical spatial item to hand them. It has one now. - The canonical item: `schemas/selected_response.py` gains the fifth mode M1.5.b ratified — regions with shapes and coordinates, the image they are measured on held by digest with its pixel size, and a region key. A coordinate count that does not fit its shape, a region that runs off the picture, a key naming a region the item does not have, a label or an alt text missing a locale, and a maximum above the region count are each refused at authoring time. Scoring, preview and the safe projection carry regions the way they carried options; the projection shows every label and the image's text equivalent and never the key. - The three option-shaped scanners (answer consistency, leakage, ambiguity) now REFUSE a spatial item by code. Each is keyed by `OptionId`, so a source built from a region-based item would have held no responses at all and every rule would have passed over nothing. - The export: `qti3_map._hotspot_item` writes a `qti-hotspot-interaction` with the image, each region's shape, `coords` and `hotspot-label`, and the region key; `qti3_parse` reads it back; `qti3_profile` moves the cell from `unsupported` to `normalized` with its handler, and the coverage manifest's contract disagreements lose hotspot. - A LIVE INTEROP DEFECT, FOUND BY THE CONSUMER AND FIXED: the image was first written as `img`, which the pinned XSD admits inside a hotspot interaction. The Longsight consumer rejects it — `interaction.child.unsupported`, "qti-hotspot-interaction does not allow img as a direct child" — so the package was schema-valid and unreadable by a real consumer, which is the silent downgrade this gate exists to catch. It is `object` now, with the text equivalent as its content, and both tools pass. Evidence: `evidence/v1-workbenches/metis-conformance/`, 14 receipts, all `passed`, all `synthetic: false`, regenerated whole by `scripts/export_qti_conformance.py` over the two pinned tools. The six pre-existing kinds' `inputHash` values are UNCHANGED, so nothing about the other exports moved. `tests/test_qti3_conformance.py` now asserts `held == needed` rather than `held < needed`. `tests/test_selected_response_hotspot.py` (27 tests) covers the item itself, and `tests/test_qti3_*` (137) the package and the gate. The fixture image is real and committed (`tests/fixtures/qti3/media/animal-cell.png`, 240x160): every coordinate is measured on it, so the picture and the regions cannot drift apart. - [x] M10.5.e Fail silent extension/drop/default/downgrade and any supported cell lacking current proof. Evidence: conformance gate. Evidence: `services/qti3_gate.py`, run by `scripts/export_qti_gate.py` into `evidence/v1-workbenches/metis-qti/conformance-gate.json`, with 15 tests in `tests/test_qti3_gate.py`. The gate is computed over real exported bytes — seven per-kind packages and all seven goldens, 40 documents — never over a description of them. IT PASSES SINCE 2026-09-18: it failed on exactly the two receipts that could not be taken (`missing-passing-receipt:assessment-kind:hotspot:*`) until M10.5.d gave Metis a canonical spatial item. `test_qti3_gate.py` now asserts the pass, with 7 supported kinds and 14 receipts, rather than the two blockers, so the verdict is still checked and not merely produced. The five checks, and what each one is shown catching in a test: - silent extension: a namespace that neither the pinned schema closure defines nor the profile declares. The allowlist is the 11 `targetNamespace`s of the 21 pinned schemas — verified against the files themselves by `fetch_xsd.py`, not maintained by hand — plus the profile's own. Caught: an invented `xmlns:x`. - silent drop: a loss code the registry does not declare, or a document that does not come back byte-identical through the parser. Caught: an invented code, a re-indented document, and a document the parser refuses (reported as a blocker, never raised — the gate stays total over a hostile package). - silent default: a score maximum, mapping default or mapping bound left implicit. Caught: `normal-maximum` and `upper-bound` removed. - silent downgrade: the interaction in the document, the `qmd:interactionType` in the manifest and the contract's mapping for that kind must be one thing. Caught: an ordering item rewritten as a choice list, and a manifest that declares a different interaction than its document carries — which is the shape of the live defect M10.5.a found on the product's import path. - unproven cell: a supported kind with no current passing receipt from each pinned validator. Caught: no receipts at all (14 blockers), and a receipt whose `inputHash` is bytes this repository no longer builds (stale proof proves nothing). NEW, because the gate needed it: the runtime's loss vocabulary is now declared once, in `qti3_profile.LOSS_CODES` (26 codes, published in the coverage manifest). Before this, a refused cell named its code but a LOST thing did not: the 15 codes the corpus emitted were nowhere in the registry, so a drop could be recorded under any name at all and nothing would notice. A test scans the runtime's own source for every `Qti3Loss` code and requires the declared set and the emitted set to be equal, so the list cannot drift in either direction. The committed decision is re-computed by a test and must equal what the gate says today, so a package that starts extending, dropping, defaulting or downgrading in silence fails the suite rather than the next reader. - [ ] M10.6 Run LTI 1.3/LTI Advantage security and flow tests. Evidence: OIDC, JWKS rotation, nonce, state, roles, deep link, and grade service. - [x] M10.6.a Test registration/issuer/client/deployment/JWKS discovery/cache/ rotation/revocation and algorithm/key/confusion failures. Evidence: trust tests. Evidence: `apps/metis/service/tests/test_lti_trust.py` (33 tests) over the new `services/lti_trust.py`. Every test signs a real RS256 token with a real 2048-bit key, because the questions are about keys. THE CELL COULD NOT BE EARNED BY WRITING TESTS: there was nothing to test. `lti_service.py` verified a platform's `id_token` with HS256 against a `platform_secret` taken at registration, and never fetched the `jwks_url` it stored. A LIVE DEFECT, not a gap: any holder of that secret — both sides, and anyone either leaked it to — could mint a launch for any learner in any role, and LTI 1.3's whole trust model is that no such secret exists. Fixed here; `platform_secret` is gone from the API. What the trust layer now refuses, each with the contract's own error code (`libs/contracts/src/metis/lti-advantage.ts`) and a test: - `algorithm-denied`: anything but RS256, refused on the header before a key is fetched — including `alg: none`, and HS256 signed with the platform's own public key, which is the classic confusion. - `key-id-missing`: no `kid`. Without one, verification becomes "does any published key match", which keeps honouring a withdrawn key. - `registration-inactive`, `issuer-mismatch`, `audience-mismatch` (exactly one registered client in `aud`), `authorized-party-mismatch` (`azp` rules for multiple audiences), `deployment-mismatch`, `issued-in-future`, `launch-expired`, `launch-lifetime-exceeded` (600 s), with a minute of clock skew. JWKS discovery, cache, rotation and revocation, all measured by counting fetches at the boundary: - discovery fetches the registration's URL and no other; a key published at another platform's URL does not verify here. - three launches, one fetch: a launch is not a network call. - after the TTL the next launch fetches again. - ROTATION: an unfamiliar `kid` triggers exactly one refresh and then verifies, and the old key keeps working while it is still published. - REVOCATION: a refresh REPLACES the key set. Merging is how a withdrawn key outlives its revocation, so a withdrawn key stops verifying at the next refresh, and `invalidate()` drops it at once. - a stream of invented `kid`s costs one refresh, not one per token: otherwise a tool is an amplifier pointed at its platform's JWKS. The tool's own service calls now use `private_key_jwt` against the tool's published keys (`tool_jwks_url`), so neither side stores a secret that could mint the other's traffic. `HttpsJwksFetcher` is the only thing that reaches a network: https only, no redirects, bounded body, and the protocol is the seam the tests replace. Registration gained `platform_jwks_url`, `tool_jwks_url` and `status` (re-registering as `suspended` stops every launch), and re-registering with a new JWKS URL drops what was cached for the old one. OpenAPI, the generated client and the schema inventory are regenerated. SIDE FINDING, left for M1.1: `evidence/v1-workbenches/ metis-contract-ownership.json` is stale. Regenerating it today gives 198 multi-variant OpenAPI groups and 58 competing definitions against the committed 40 and 0, and `scripts/v1-workbenches/generate-metis-contract-ownership.test.mjs` already fails 7 of 11 at HEAD — measured by running it against HEAD's own OpenAPI, so it is not this change. It was left as it is rather than half-regenerated here. - [x] M10.6.b Test OIDC login/launch issuer/audience/message/version/target/ nonce/state/time/replay/session and malicious claim cases. Evidence: launch suite. Evidence: `apps/metis/service/tests/test_lti_launch.py` (27 tests) over the new `services/lti_login.py` and the rewired `POST /api/lti/launch`. As in .a, the suite could not be written against what was there: THERE WAS NO LOGIN. `/lti/launch` took `state` and `nonce` as request fields and checked the token's nonce against the one the caller had just supplied — a check that passes for anyone who sends both halves. There was nothing a replay could fail. A launch is now the second half of a conversation this tool starts. `POST /api/lti/login` is the OIDC third-party login: it validates the issuer, client and target against the registration, mints a 256-bit `state` and `nonce` from the system CSPRNG, remembers what it asked for, and returns the authorization URL (scope, response_type, response_mode, prompt, redirect_uri, login_hint, state, nonce). `/launch` then consumes the state and judges the token against that login. `nonce` is gone from the launch request: a nonce the caller supplies is a value the caller chose to match. What each case now costs, with the contract's error codes: - `state-replayed` for a state nobody asked for, for the same launch posted twice, and — deliberately — after a REFUSED launch, because a state that survives a wrong answer is a retry oracle. - `state-mismatch` for an expired login (10 minutes) and for a state belonging to another platform. - `nonce-mismatch` for a token carrying any other nonce, and `nonce-replayed` for a nonce already answered, which is the case a fresh login would otherwise launder. - `target-link-mismatch` when the token's target is not the one the login named or is not a registered redirect (registration now carries `tool_redirect_urls`, a set, as the contract's `toolRedirectUris` does, and exact membership is required). - `login-deployment-mismatch` when the deployment drifts between the two halves; `anonymous-resource-launch-denied` for a resource-link launch with no subject, while deep linking rightly needs none. - `lti.version-unsupported` and `lti.message-type-unsupported` are Metis codes, said to be Metis codes: the contract's vocabulary has no code for either, and filing them under one that means something else would be worse than naming them. Malicious-claim cases covered: a launch signed by a key the platform does not publish, a target pointing at another origin, an invented state, a stolen nonce, a version downgrade, an unsupported message type, and an anonymous attempt. KNOWN AND RECORDED, not hidden: the state and nonce stores are in process, so a restart forgets which were spent. It fails closed — an unknown state is refused — but a restart mid-attack reopens the replay window for tokens still inside their lifetime. The stores are a seam (`LoginStore`, `SpentNonces`) so a durable one can replace them; that is the same class of defect already recorded against `credential_service` in M9.18. - [x] M10.6.c Test role/context/resource/user/privacy mappings for learner/ instructor/admin and unknown/custom/cross-tenant claims. Evidence: role tests. Evidence: `apps/metis/service/tests/test_lti_roles.py` (20 tests) over the new `services/lti_roles.py`. Before this, `launch_tool` copied the `roles` claim into its response verbatim: eleven role URIs, seven canonical roles and ten operations were pinned in the contract and none of them existed in the service, so every launch had the same authority as every other — none, or whatever a caller chose to infer. The mapping is not written here twice: the first test reads `evidence/v1-workbenches/metis-lti-advantage.json`'s own role matrix and requires all 11 rows to match this module's — scope, canonical role, operation list, context binding, authoritative identity and `displayClaimsTrusted: false` — so the code cannot drift from the contract without failing. The three rules, each with the case that motivates it: - ONLY RECOGNISED ROLES COUNT. A launch carrying only roles this profile does not map is refused with `unknown-role-denied`; a custom vendor role beside a known one is carried for display and grants nothing. An unrecognised default would make "unknown" the widest privilege instead of the narrowest. - A CONTEXT ROLE WITHOUT A CONTEXT GRANTS NOTHING. An instructor role sent with no context claim is an instructor of nothing: the canonical role is still reported, and the operation set is empty. Operations are the union of what each recognised role grants, so no single role wins by sounding senior. - IDENTITY IS SIGNED, DISPLAY IS NOT. The principal is `issuer#subject`; `name` and `email` became `display_name` and `display_email`, are never matched on, and a launch that carries neither still identifies its user. The roster stores them as display beside the signed subject it actually matches on. The matrix's own headline claims are asserted: a learner can neither author nor grade, a mentor reads neither roster nor grades. Cross-tenant: the same context id arriving from two platforms is two rosters, and an access token minted for one platform reads only that platform's roster — tested with two registered platforms, each with its own keys. - [x] M10.6.d Test deep-link request/response/signature/content/resource/ placement/return/stale/deleted/forbidden cases. Evidence: deep-link suite. Evidence: `apps/metis/service/tests/test_lti_deep_link.py` (14 tests) over the new `services/lti_deep_link.py`, plus the API's new `GET /api/lti/jwks`. TWO DEFECTS FIXED, both of which made the response unusable or unsafe: - THE RESPONSE WAS SIGNED WITH METIS'S OWN SESSION SECRET (HS256, and `iss: "metis"`). No platform holds that secret, so no platform could ever verify a deep-linking response this service produced. It is now signed with the tool's own RSA key, names its `kid`, and the tests verify it exactly as a platform would — through the public half served at `/api/lti/jwks`. A deployment with no key configured signs nothing and says so (`lti.tool-key-not-configured`, 503), instead of signing with the session secret; the pattern and the wording follow the integrity-deep-link key already in `config.py`. - THE PLATFORM'S OPAQUE `data` CAME FROM THE CALLER. It is how the platform recognises its own request, and the request body had a `data` field anyone could fill. The field is gone; the value travels in the launch's `deep_linking_settings` and is echoed from there. `LTI_DEEP_LINKING_SETTINGS_CLAIM` was defined in the service and read by nothing, so everything the platform said it would accept was ignored. The settings are now captured at launch and honoured: `lti.deep-linking-type-denied` for an item type it does not accept, `lti.deep-linking-target-denied` for a presentation target it does not accept, `lti.deep-linking-multiple-denied` for a second item where one was asked for (and several where it allows them), `lti.deep-linking-return-url-invalid` for a return URL that is not https, and `lti.deep-linking-settings-missing` for a deep-linking launch that carries none. The response carries the platform's own `return_url`, which is where the browser must post it. Forbidden and stale: selecting content now requires the launch to hold the `select-content` operation from .c's mapping, so a learner's launch is refused (`lti.deep-linking-forbidden`); an expired launch token is refused, as is one signed by anything but this service. While fixing the stale case: `_decode_metis_token` checked expiry against the library's idea of now rather than the clock the call was given, so a caller passing a time got an expiry judged against a different one. It now uses the call's clock, which is also what makes the AGS and NRPS token checks testable in time. - [x] M10.6.e Test NRPS and AGS line items/scores/results/pagination/scopes/ idempotency/corrections/late events/visibility. Evidence: service suite. Evidence: `apps/metis/service/tests/test_lti_services.py` (17 tests). Four of the named behaviours did not exist and were built: - RESULTS. There was no way to read what a line item holds; scores went in and nothing came out. `GET /api/lti/assignments/line-items/ {id}/results` reads them, gated on the AGS result scope, which is also new (`.../lti-ags/scope/result.readonly`). - IDEMPOTENCY. A score carries a `timestamp` — when it was true, not when it arrived — and re-posting the same timestamp returns the same `score_id` marked `duplicate`, without applying it again. A retry after a timeout used to create a second score; a retried correction would have read as two corrections. - CORRECTIONS AND LATE EVENTS. A newer timestamp replaces the result and increments its `revision`, so a reader can see it was corrected. An older one is refused: arrival order is not event order, which is the lesson M8.11's grade ledger already paid for. - PAGINATION. A roster and a result set are both unbounded — a lecture course is thousands of people — and both were returned whole. Both are now paged in subject order, with a `next_page` token that is ours: a token this service did not issue is refused rather than parsed. Visibility, per scope, each tested both ways: posting a score takes the score scope and no other; reading results takes the result scope and no other (a score-scoped token cannot read back what it wrote); the roster takes the NRPS scope; a token minted for one platform cannot touch another's line item; an expired access token buys nothing. M0.15.d's PRECONDITION FOR THIS CELL, measured over the served app rather than assumed: `POST /lti/assignments/scores` is unreachable without a bearer token (422), refuses an empty, non-bearer or unparseable one, refuses a token that bought a different scope (403 `missing required scope`), and accepts only a score-scoped one; the grades it writes are readable only with the result scope. That is the vector M0.15.d left unmeasured; M0.15.d itself stays open on its other three (the learner-readable answer keys, `/create/*`, and the submission shapes). While writing it: the AGS scope checks ignored the clock they were given, so an expired access token still bought a score write in any caller that passes a time. Fixed with `_decode_metis_token`'s clock from .d. - [x] M10.7 Run OneRoster, SCORM, xAPI, Caliper, Open Badges, and gradebook interoperability fixtures. Evidence: compatibility report. CLOSED 2026-09-18, with all six children closed AND the parent's own sentence measured rather than inherited. The compatibility report is computed from the code today: 49 cells across all six profiles — 38 over HTTP, 8 library, 3 unsupported — with every implemented cell naming a handler that exists, every unsupported one naming the symbol whose absence makes it true, 0 silent losses, and every declared loss demonstrated by calling the code and watching the field not arrive. WHAT IS STILL UNSUPPORTED, AND SAYS SO: three OneRoster record types — academic session, term and category. They are not among the seven entities M10.7.b names, they are reported as gaps rather than omitted, and the ratchet fails the day one of their symbols exists. WHAT THIS PARENT DOES NOT CLAIM: no certification by any of the six bodies. What is held is fixtures, a generated matrix nothing can edit into agreeing with itself, and — for QTI, which is M10.5's — two pinned external tools' own output. - [x] M10.7.a Enumerate supported version/profile/operation/direction/entity cells and source-of-truth ownership per standard. Evidence: matrix. Evidence: `evidence/v1-workbenches/metis-interop/coverage-matrix.json`, generated by `scripts/export_interop_matrix.py` from the registry in `services/interop_coverage.py`, with 16 tests in `tests/test_interop_coverage.py`. 47 cells over the six profiles M1.13 pins when this was written: 21 served over HTTP, 4 library-only, 22 unsupported. The registry is generated, so the counts move as later items build things — .c and .d record the moves, and the committed matrix is the current number. Every cell names its profile, entity, operation, direction and the owner of the record, and a cell cannot describe itself incoherently — an unsupported cell that names a handler, an HTTP cell with no route, or an implemented cell owned by nobody all fail to construct, and the test proves each refusal. Every claim is checked against something outside the registry: each handler against the import system (a method on a class included), each route against the OpenAPI document the service really publishes, and the profile set against the contract's own decision matrix. FOURTEEN DISAGREEMENTS WITH M1.13, computed from its evidence rather than restated, and the last one is a defect: - Five profiles the contract records as `runtimeAdopted: false` are served over HTTP today (OneRoster, Caliper, both SCORM editions, xAPI). Only Open Badges is genuinely library-only. - Two declared directions nothing implements: OneRoster `metis-to-external` (M1.13 makes Metis the gradebook provider and nothing publishes a line item or result) and xAPI `bidirectional-explicit-owner` (no state or profile documents). - Six of OneRoster's ten record types are unmodelled: organization, academic-session, term, category, line-item, result. `OneRosterEntityType` carries user, course, class and enrollment. - IDENTITY: M1.13 pins `tenant+connector+sourcedId` for every entity and `emailAsJoinKey: false`. The runtime matches users by normalized email and classes by course slug, AND NO METIS MODEL PERSISTS A sourcedId at all. A re-sync cannot recognise what it created: change an email in the SIS and the next sync makes a second user. That last row is why .b is not a test-writing task — a round trip needs a stable identity to round-trip through. Also recorded as cells, because an absent row reads as "no such cell" rather than "not built": no OneRoster delta watermark or tombstone, no SCORM sequencing, interactions or objectives, no xAPI voiding, no Open Badges revocation or endorsements, and a badge's `proof` is detected but deliberately never treated as verified. - [x] M10.7.b Run OneRoster org/course/class/user/enrollment/line-item/result snapshot/delta/conflict/delete round-trips. Evidence: OneRoster suite. CLOSED 2026-09-18 ON ALL SEVEN. It was open on three. `organization`, `line-item` and `result` are not modelled at all (M10.7.a's matrix), so there is nothing to round-trip them through; `line-item` and `result` are the gradebook direction M1.13 makes Metis the provider for, and nothing publishes one. Closing this needs those built, not tested. AND THE GRADEBOOK HALF IS BLOCKED ON SOMETHING SHARPER THAN "UNBUILT", found 2026-09-13 by starting to build it. `line-item` and `result` are `gradebook-publish` / `metis-to-external`: Metis SERVES them and a SIS reads them. A published `result` names a STUDENT — OneRoster wants the student's `sourcedId` — and the grade ledger records whose grade a grade is ONLY as `learner_digest`, an irreversible sha256. Nothing in the estate maps a digest back to anybody: every use compares it to one the caller already computed ("a learner may only see signals whose learner_digest is their own"), which is right for privacy and is exactly why it cannot be published. THE JOIN THAT WOULD RESCUE IT DOES NOT EXIST EITHER. A digest can be RECOMPUTED for a student you can already name, so a roster cohort could in principle be matched. But the only grades the ledger holds are the LTI AGS ones M10.7.e's road now carries, and their digest is over the PLATFORM's user id, while `roster_external_reference` maps a `sourcedId` to a METIS user. Nothing connects a platform user id to either. So the chain runs sourcedId → Metis user → nothing. THIS IS A TENSION AND NOT AN OVERSIGHT, worth stating as one: M10.7.d found this estate serialising a learner's NAME to a Caliper consumer, and the answer was to identify people by digest. The same decision is what stops Metis being a gradebook provider. Closing the cell means deciding which of the two wins for this direction — a published gradebook needs a nameable student — and that is a design decision with a privacy consequence, not a missing model. THE DECISION WAS TAKEN 2026-09-18 (user): a scoped, auditable join. `line-item` AND `result` ARE SERVED NOW. Two of the three unmodelled entities are built; `organization` is what keeps this cell open. - The join: `roster_grade_identity` (migration 079) maps a learner digest to a SIS `sourcedId`, per tenant and per connector, unique in BOTH directions — two sourcedIds sharing a digest would put one learner's grades under two names, and two digests sharing a sourcedId would put two learners' grades under one. - THE SCOPE IS THE DESIGN, and a test holds it. `record_identity_async` has exactly one caller (`oneroster_service`), `resolve_for_publication` exactly one (`oneroster_gradebook`), and that one exactly one route. There is deliberately NO `resolve_one(digest)` helper: a general-purpose reverser is what a later caller reaches for, and it would end the digest's usefulness for every other surface at once. Every read takes an actor, a purpose from a fixed vocabulary and a detail, none of them defaulted, and writes its audit row in the SAME transaction as the read — so a publication that happened and an audit that did not cannot both be true. - A SECOND GAP FOUND BY BUILDING IT: the ledger could not say what a grade is ABOUT. `grade_id` is a digest over platform, line item and user, and a `LedgerEvent` carries neither the line item nor the learner, so nothing in the database could enumerate one line item's results. `grade_subject` (migration 079) is that record, written by the ingress when it appends and never rewritten; it is pseudonymous — the same digest `project()` already takes — so it adds a lookup and never an identity. - AN UNRESOLVED LEARNER IS REPORTED. A grade whose learner the roster has never named comes back in `unpublishable_line_items`, because a SIS receiving a short gradebook with no way to tell would record those learners as having done no work. - `GET /api/oneroster/gradebook` publishes both, tenant DERIVED from the caller. A result is derived from the ledger at read time and never cached here: a correction appended a second ago is in the next read, and this surface does not become a second record of a grade. Evidence: `tests/test_oneroster_gradebook_postgres_integration.py`, 13 tests on a live PostgreSQL — publication, the unresolved learner, the orphan line item, a correction landing in the next read, the audit row per read, a refused purpose, a digest already published as somebody else, an identity change as an update, two tenants, two connectors, write-once subjects, and the two scope ratchets over the source. The matrix moves with the code: `oneroster-1.2:metis-to-external` is no longer an unserved direction, and the coverage test that asserted it was now asserts that it is served. AND `organization` IS BUILT TOO (migration 080, `roster_organization`). Metis has no organisation of its own — a tenant is not a school — so an org is kept as what it is: the source's record under the source's id, per tenant and per connector. That is enough for the thing the entity was needed for. A LIVE DEFECT IT CLOSES: `OneRosterUserRecord.org_sourced_ids` existed and NOTHING READ IT, so a user could claim membership of an organization nobody had ever declared and the sync took it. The claim is checked now — against this payload's orgs and against the ones this connector sent before — and an unknown one is a WARNING rather than a block, because the org may be in the next page and losing a real person over a record that is merely late would be worse. An org takes the same three round trips every other entity does: snapshot (create/update), delta (`date_last_modified` against the caller's watermark), conflict (two orgs with one sourcedId) and delete (`tobedeleted` deactivates and KEEPS the row, so the same sourcedId arriving again is not adopted as a new organization). Evidence: 9 more tests in `tests/test_oneroster_identity.py` (21 in the file), and 257 across the coverage, compatibility, contract, route-matrix, gap-map, migration and grade-interop gates. WHAT "SNAPSHOT/DELTA/CONFLICT/DELETE" MEANS FOR THE TWO PUBLISHED ENTITIES, said rather than implied: `line-item` and `result` are the direction where a SIS READS Metis. There is no delta, conflict or delete round trip to run on them, because this estate is not the party that changes them — it answers with what the ledger currently says, and a correction appended a second ago is in the next read. THREE OF THE TEN CONTRACT RECORD TYPES REMAIN UNMODELLED — academic session, term and category — and each still names the symbol whose absence makes its row true. They are not among the seven this cell names. WHAT WAS BUILT, because .a measured that a round trip had no identity to travel on: a sync could not recognise what it had created. `sourcedId` was never persisted; users were matched by email and classes by course slug, so an address change in the SIS made a SECOND PERSON, and a renamed class made a second course. - `roster_external_reference` (migration 073, applied to a live PostgreSQL) stores one row per external identity — tenant + connector + entity + sourcedId — against the Metis record it resolved to, with the source's own `date_last_modified` and a status. Two connectors numbering independently are two identities. - Identity now resolves through the reference, and email or slug only ADOPTS a record the first time a connector sees it. An email change is an update to that person; the planner compares emails now, which it never had to when the email was the identity. - Two sourcedIds claiming one Metis record is a blocking `identity_owned_by_another_source_record` conflict, not a merge. - DELTA: records carry `date_last_modified`, the request takes `modified_since`, and the response returns the `watermark` to ask with next time. It is the source's clock, so a re-run here cannot move it, and a record the source dated nothing is never skipped — silence is not a statement that nothing happened. - DELETE: `tobedeleted` deactivates the record and TOMBSTONES the reference rather than dropping it, so the same sourcedId arriving again is not adopted as somebody new. Evidence: `tests/test_oneroster_identity.py` (16 tests) for the rules and `tests/test_oneroster_postgres_integration.py` against a live database for the round trip: sync, change the email, sync again — one user, one reference, the new address — then withdraw and find the tombstone. A LIVE DEFECT FOUND BY RUNNING THAT, unrelated to rostering and worse: `AuthService.hash_password` RAISED ON EVERY INPUT. passlib 1.7.4 reads `bcrypt.__about__` to pick its backend and bcrypt removed it in 4.1 (this venv has 5.0), so the error came back as a misleading "password cannot be longer than 72 bytes" for a 57-byte string. Registration could not work at all, and the suite was green because the only test that reaches this service patches it out. Now called through `bcrypt` directly, with over-long passwords refused rather than silently truncated to something a shorter password would also open, and hashes written by passlib still verify. `tests/test_auth_passwords.py` (10 tests) hashes and verifies real passwords with nothing mocked. - [x] M10.7.c Run SCORM package/runtime/sequencing/bookmark/score/status/ interaction/error and xAPI statement/state/profile/voiding fixtures. Evidence: SCORM/xAPI suites. WAS OPEN ON SCORM SEQUENCING AND THE xAPI DOCUMENT RESOURCES. Sequencing and navigation are not written or honoured — a package is one launchable activity — and there are no state or profile documents, so an activity cannot keep a learner's place here. Both are cells in M10.7.a's matrix with their reasons; closing this means building them. DONE, and both were defects rather than gaps: - xAPI VOIDING. A voiding statement (verb `voided`, object a `StatementRef`) was stored as an ordinary statement and the statement it withdrew KEPT READING AS CURRENT — the one thing voiding exists to prevent. Now the target is marked voided and carries the id of the statement that withdrew it; a query stops answering with it, and a replay still carries it, because a consumer catching up has to learn that it was voided. The verb alone voids nothing (it must be a StatementRef), a void names something this LRS holds, and a voiding statement cannot itself be voided — otherwise a retraction could be retracted and nothing would settle. `tests/test_xapi_voiding.py`, 11 tests. - SCORM INTERACTIONS. A commit carried `runtime_data`, a free-form dict, so a player's per-question detail arrived in whatever shape it liked and nothing checked it. An interaction is a typed record now: a response that fits its type (a true-false answer is true or false, a numeric answer is a number), a result from SCORM's vocabulary or a number, no question reported twice in one commit, and NO TYPE THE PACKAGE'S OWN EDITION LACKS — a 1.2 package reporting `long-fill-in` is reporting something no 1.2 player wrote. `tests/test_scorm_interactions.py`, 24 tests. Already covered by the existing suites and re-checked here: package and manifest, runtime commit, bookmark (`location` and `suspend_data`), score (raw/min/max scaled) and status (lesson and success), and a replayed commit staying one commit. The matrix moves with the code: `scorm-*/interaction` and `xapi-2.0/statement/void` are now served cells rather than reasons, so the coverage matrix is 24 HTTP cells and 19 unsupported. THE xAPI DOCUMENT RESOURCES ARE BUILT. Half of what kept this open is closed: `state-document/put-get-delete` and `profile-document/put-get-delete` are served cells now rather than witnesses named by their own absence, and an activity can keep a learner's place. Migration 075 (`xapi_documents`), `services/xapi_document_service.py`, thirteen operations under `/api/xapi/activities/{state,profile}` and `/api/xapi/agents/profile`, and `tests/test_xapi_documents.py` — 45 tests against a freshly migrated Postgres, service and HTTP both. The matrix is 30 HTTP, 7 library and 12 unsupported. DURABLE FROM THE FIRST LINE, deliberately. This estate keeps losing the same argument with itself — LTI line items, LTI scores until M10.7.e, credential revocations (M9.18) — and a document store a restart empties would tell a learner they had never begun, which is the one thing a state document exists to prevent. THE CONCURRENCY IS THE RESOURCE. A learner with two tabs open is two writers. PUT replaces and POST merges, which are different verbs and not a preference; a merge is defined over two JSON OBJECTS, so a POST onto text or an array is refused rather than quietly made a replace that loses everything the client did not send; and a write over an existing document that names no expected version is refused 409 WITH the ETag to re-read, while one that names a version that has since moved is 412. A client cannot retry correctly unless it is told which of those two happened. A delete obeys the same preconditions, because deleting what somebody has just written loses their work exactly as overwriting it would. THE IDENTITY IS A TYPE AND AN INDEX, NOT A CONVENTION. A state belongs to one learner on one activity, an activity profile to the activity and every learner shares it, an agent profile to the learner across activities — so an activity profile that names an agent WILL NOT CONSTRUCT, because that mistake is how one learner's place gets served as everybody's. A registration makes a different document, so a second attempt does not resume the first. The whole identity is folded into one `storage_key` with a unique index over it, so two writers racing lose in the database rather than in an `if`. A CROSS-TENANT HOLE THIS ITEM OPENED AND M8.14's RATCHET CAUGHT. The first draft's table had no `tenant_id`, and every other part of a document's name — the activity, the agent, the document id — arrives from the caller. Any authenticated caller could therefore have read any tenant's state by naming its activity and its learner. Nothing in this item's own tests would have found it; the tenancy ratchet failed the full suite with `newly_untenanted=('xapi_documents',)` and that is the only reason it was found. The tenant is part of the identity now, derived from who is asking and never from a parameter, and folded into `storage_key` so the unique index enforces it rather than a query remembering to. Three tests assert the boundary directly: a read, a scoped delete and a listing all stop at it. A LIMIT FOUND BY WRITING THE TEST, AND KEPT AS A LIMIT. `XapiActor` requires a non-empty `account_name`, so an agent identified by a MAILBOX alone — legal xAPI, and what a platform that issues no accounts sends — cannot be constructed here at all, and no document can be keyed by one. The first draft carried an mbox fallback; it was unreachable code. It is gone, the constraint is asserted by a test, and the key still carries its `account:` namespace so that adding an mbox branch later cannot silently merge an account `x@y` with a mailbox `x@y`. The cells are `compatible` rather than `lossy` because such an agent is REFUSED 400 rather than stored with its mailbox dropped — a refusal is not a silent mapping. AND THE OBJECTIVES ARE TYPED NOW TOO. `cmi.objectives.n` was the other free-form casualty beside the interactions: a package reported what a learner had ACHIEVED and it arrived inside `runtime_data`, a dict nothing checked, so an objective scored twelve out of ten and carrying a status its own edition does not define was stored exactly like a good one. `ScormObjective` — the symbol M10.7.a named as the witness — is real, and a score that does not hold together against its own range will not construct. AN OBJECTIVE IS NOT AN INTERACTION, and the two are kept apart on purpose: an interaction is one question, an objective is a thing the course says the learner can now do, and several interactions bear on one. That is why an interaction NAMES objectives by id rather than repeating them — if it carried the objective's own score, two questions could disagree about what a learner had achieved and nothing would say which was the record. AND NOTHING AN EDITION COULD NOT HAVE WRITTEN. SCORM 1.2 has ONE objective status word and no scaled score, so a 1.2 package reporting a completion apart from its success, or a scaled score, is refused — the same rule the interactions got. `tests/test_scorm_objectives.py`, 13 tests. The matrix is 32 HTTP, 7 library and 10 unsupported. SCORM SEQUENCING IS BUILT, 2026-09-18, and this cell closes with it. A package was one launchable activity; it is an activity tree now, and the manifest carries `imsss:sequencing` for a 2004 package. A DOCUMENTED SUBSET, WITH THE REST REFUSED BY NAME. `schemas/scorm_sequencing.py` lists 30 constructs honoured and 7 refused, each with the section of the book that defines it, and `services/scorm_manifest.py` RAISES on a manifest asking for randomisation, constrained choice, rollup considerations, delivery controls, auxiliary resources, an exit-condition rule or `retryAll`. Dropping one silently would deliver a different course from the one the author sequenced, and the learner would have no way to tell. The rulebook is `services/scorm_sequencing.py`, with the book's own process identifiers on its functions (`OP.1`, `NB.2.1`, `SB.2.3`, `RB.1.5`) and the book's own exception codes on its refusals, so it can be read against the specification rather than against its author. Honoured: the four control modes; flow forward and back including descent into a cluster; choice, with `hiddenFromChoice`, `disabled` and `choiceExit` each refused by their own code; `skip` and `stopForwardTraversal`; attempt limits; post-conditions (`continue`/`previous`/`retry`/`exitParent`/`exitAll`); measure, objective and completion rollup with `all`/`any`/`none`/`atLeastCount`/ `atLeastPercent` child sets and objective measure weights; and start, resume, suspend, exit and abandon. TWO RULES THAT ARE EASY TO GET WRONG AND ARE TESTED FOR: - An unknown is not a false. SN 4.5 evaluates a rule combining an unknown condition to unknown, and an unknown rule does not fire; a "not satisfied" retry that read silence as failure would send a learner round again on a judgement nothing had made. - A cluster with no rollup rule keeps what it held. SCORM gives no cluster a default, and inventing one would satisfy a section nobody said was satisfied. DURABLE FROM THE FIRST LINE (migration 078, `services/scorm_sequencing_store.py`). A sequencing session is a learner's place in a course; in process memory — where the rest of the SCORM service still is, which is M8.1's separately recorded gap — it would be lost on every deploy, sending the learner back to the first activity and handing back the attempts an author limited. Two tabs are two writers: every write names the version it read and the loser is told rather than silently overwriting. Over HTTP: `POST /api/scorm/sequencing/{launch,navigate,tracking}` and `GET /api/scorm/packages/{id}/activity-tree`, launch-token authenticated like the runtime commit and declared as such in `DECLARED_POSTURES`. A player may only report on the activity it is RUNNING — otherwise one SCO could set another's objectives, which is how a course marks itself complete. Evidence: `tests/test_scorm_sequencing.py` (29, the rulebook), `tests/test_scorm_sequencing_manifest.py` (16, write and read back, including a whole-tree round trip and every refusal) and `tests/test_scorm_sequencing_postgres_integration.py` (10, over HTTP against a live PostgreSQL, read back through a second engine). 173 more across the contract, route-matrix, gap-map and migration gates. THE MATRIX MOVES WITH THE CODE: `sequencing/sequencing-and-navigation` is a served cell for both profiles — `compatible` for 2004 and `version-skew` for 1.2, because SCORM 1.2 has no `imsss:sequencing` and writing 2004 elements into a 1.2 manifest would send a player rules its own edition does not define. - [x] M10.7.d Run Caliper entity/event/profile/privacy/order and Open Badges achievement/assertion/evidence/signature/status/revocation fixtures. Evidence: Caliper/badge suites. CLOSED 2026-09-18. The two things that kept it open were built in the body below and the checkbox was never flipped; re-verified today rather than taken on the note's word: - `verify_proof` and `read_credential_status` exist in `services/open_badges_proof.py` and are exposed through `open_badges_service` — the two symbols M10.7.a's matrix named as the witnesses whose ABSENCE made those rows true. - The registry, read from the code today, holds NO unsupported cell and NO remaining witness for either profile: open-badges is 2 compatible and 6 lossy, caliper 2 compatible and 3 lossy. - 138 tests pass across `test_open_badges_service.py`, `test_open_badges_proof.py`, `test_caliper_profiles.py`, `test_caliper_service.py` and `test_outbound_ssrf.py`, and the adversarial grep over both badge modules returns nothing. The honest limits below are unchanged and are limits, not gaps: no third-party-issued badge has been verified here, and the Caliper acknowledgement position is as volatile as the event log it points into. WAS OPEN ON BADGE SIGNATURE AND STATUS/REVOCATION. Neither is a fixture that failed; both are things this estate does not do for somebody else's badge, and they are the two that decide whether an inbound badge means anything. Closing this means verifying a foreign issuer's proof and reading a credential status list. Both are cells in M10.7.a's matrix with their reasons. CALIPER DONE — and all three of entity/privacy/order were defects the contract already forbade: - THE GRADING PROFILE COULD NOT BE RECORDED. `metis-interoperability-profiles.json` pins `GradeEvent`/`Graded` → `GradingProfile`, and the request schema's literals listed neither, so the one profile the contract names for grades was rejected at the door. The contract row and the code now agree, and the first test reads the rows out of the contract so they cannot drift apart again. - EVENTS CAME BACK IN ARRIVAL ORDER. The contract pins `eventTime-ascending-then-sequence`; `_filter_events` returned insertion order, so an event that HAPPENED an hour earlier and arrived five minutes later sorted last — the exact case ordering exists for. Now sorted by when it happened, with arrival only breaking ties, in queries and in the exported envelope alike. - THE LEARNER'S NAME LEFT THE ESTATE. The contract pins `directPiiSerialized: false` and every payload carried `actor.name` — including the sensor envelope, which goes to somebody else. What leaves now identifies the actor without naming them; Metis's own record still has the name, and an OBJECT may still be named, because a lesson is not a person. `tests/test_caliper_profiles.py`, 11 tests, covering entity identity, per-event profile, dedup, privacy and order. OPEN BADGES: the module had NO tests, which for an importer is the worst place to have none — everything it does is decide whether somebody else's document is trustworthy enough to read. `tests/test_open_badges_service.py`, 27 tests: the round trip, the deterministic write (sorted keys, no whitespace drift, so a badge can be hashed), the required contexts and types, and fourteen documents that are badge-shaped and are not badges (a credential of another type, an achievement with no criteria, a subject that names nothing, a `validFrom` reading "one tuesday"), plus an alignment with no target, which is dropped rather than half-read. A REAL GAP CLOSED: EVIDENCE. An achievement says what was required; evidence says what was actually SHOWN, and it was dropped on read and had nowhere to go on write, so an imported badge was a claim with nothing behind it. It round-trips now, and an entry with no narrative is a link rather than a record and is not read as one. A NON-GAP CONFIRMED: `proof_present` is recorded as CLAIMED and never as verified. The suite proves the distinction with a forged document — an impostor issuer and the string `obviously-not-a-signature` — which parses as present and unverified, because treating a proof's presence as proof is how badge systems are fooled. The matrix moves with the code: `caliper-1.2/event/ordered-read` and `open-badges-3.0/evidence/read-and-write` are served cells now, and what remains unsupported says so more precisely — `verify-proof` because `credential_service.verify_credential` checks a proof against METIS'S OWN verification method, so a foreign issuer's badge comes back `not_found` rather than verified. 25 HTTP, 5 library, 19 unsupported. BOTH ARE BUILT NOW, AND THE ITEM STAYS OPEN ON ONE STEP OF TRANSPORT. `services/open_badges_proof.py` verifies a foreign issuer's `eddsa-jcs-2022` proof and reads a BitstringStatusList entry, exposed as `open_badges_service.verify_proof` and `.read_credential_status` — the exact two symbols M10.7.a's matrix named as the witnesses whose ABSENCE made those rows true, so the rows flipped by being made real. `tests/test_open_badges_proof.py`, 29 tests. The matrix is 28 HTTP, 7 library and 14 unsupported (the sentence above was written when it was 25/5/19 and later items moved cells without updating it). WHY THAT SUITE AND THAT KEY FORM. `eddsa-jcs-2022` over a `did:key` is the combination checkable with NO NETWORK — the public key is INSIDE the identifier — so the first badge verification this estate performs adds no fetch, no resolver and no registry to trust. A VERDICT WITH TWO VALUES WOULD BE A LIE. A badge signed with a suite this estate does not implement is UNCHECKED, and a verifier that answers only valid/invalid has to call it a forgery. `no_proof`, `unsupported_cryptosuite`, `unresolvable_verification_method` and `uncanonicalizable` all mean "nobody here looked"; `signature_invalid` is the only outcome that accuses the issuer, and `NOT_CHECKED` names the difference so a caller cannot read one as the other. AND A VERIFIED PROOF NAMES THE KEY, NOT THE ISSUER. It says the bytes were signed by that key. Whether that key belongs to the institution on the badge is a trust decision, and there is no issuer registry to make it against — the same absence M10.13.f, M10.14.e and M10.20.a each record. The verdict says so in its own detail string. A CANONICALIZATION THAT IS NEARLY RIGHT REPORTS A GOOD BADGE AS A FORGERY, so JCS is implemented properly rather than borrowed. MEASURED: this estate's existing `canonical_json_bytes` sorts by code point and RFC 8785 sorts by UTF-16 code unit — `😀` and `＀` come out in opposite orders — and Python writes `1.0`, `1e-07` and `1e-06` where ECMAScript writes `1`, `1e-7` and `0.000001`. A number this canonicalizer cannot reproduce EXACTLY is refused as `uncanonicalizable` rather than hashed differently from the way its issuer hashed it. STATUS: a revoked badge no longer reads as valid. A supplied list is decoded (multibase, gunzip, bounded at 16 MiB against a compression bomb) and the bit read most-significant-first, which a test checks at all eight positions in a byte — read the other way round and every badge in the first byte gets somebody else's status. A suspension list is refused as an answer to a revocation question. AND THE LIST IS FETCHED NOW, THROUGH THAT GUARD. `fetch_status_list` is the THIRD fetch somebody outside aims, and the most attacker-chosen of the three: an LTI fetch needs a registration an administrator made or a launch a platform signed, and this one needs only somebody handing over a badge. It goes through `refuse_unless_public` and the same pin the LTI paths got in M10.8.e — dial the address that was approved, keep the hostname for `Host` and the TLS SNI — with a bounded read and a bounded decompression behind it. FETCHING IS OPT-IN, because it makes this service issue a request somebody else chose; without `fetch=True` the badge's URL is never dialled. And a list that cannot be fetched reads `unreadable_list`, never `unset` — the failure that would matter most is a badge whose status could not be read coming back looking like a badge that is fine, and a test asserts it does not. `test_outbound_ssrf`'s "the two fetches somebody else aims" became "named one by one", which is the assertion that was always meant. AND A CALIPER CONSUMER CAN TELL A GAP FROM AN EMPTY PAGE. Export was a query by cursor with no acknowledgement, so a consumer that asked for the next page and received an empty one could not tell whether there was nothing new or whether something had gone missing: both look identical from outside. `POST /api/caliper/deliveries` records how far a consumer has processed and answers with `outstanding` — so an empty page beside a non-zero count is a problem it can SEE. TWO REFUSALS, BOTH ABOUT NOT HIDING A GAP. An acknowledgement that goes BACKWARDS is refused: a consumer that has processed through 40 and then claims 20 would make work already done report as work still to do, which reads exactly like a gap that is not there. And one PAST the highest sequence recorded is refused: nobody can have processed an event this estate never sent, and taking the claim would mark real events as delivered. A repeat of the SAME position is not a refusal, because a retry after a timeout is the ordinary case. A consumer that has never acknowledged reads zero rather than absent — nothing processed is a position, not a missing record — and two consumers keep their own, because one being behind is not the other's problem. RECORDED AS A LOSS: the position is held beside the event log and is as volatile as it is. An acknowledgement of events a restart forgets cannot outlive them, so making this durable means making the log durable first, and doing only half would let a consumer's position outlive the events it points into. AND ENDORSEMENTS ARE READ NOW. `parse_endorsement` — the last symbol M10.7.a named for this profile — reads an `EndorsementCredential` into who vouched, what they vouched for, and what they said, so who else stands behind an achievement is no longer lost on the way in. THE SUBJECT IS THE WHOLE POINT. An endorsement whose subject names NOTHING is refused rather than parsed, because an endorsement of nothing reads as vouching for whichever credential happened to be beside it — which is exactly how an endorsement gets borrowed. And a document claiming to be an `OpenBadgeCredential` AND an `EndorsementCredential` at once is refused, because that would let an issuer award a badge and endorse it in one document and have the endorsement counted as somebody else's word. An endorsement with no comment still endorses: weaker, and still somebody's word, and refusing it would drop a real one for saying little. Its proof is CLAIMED, like a badge's — but unlike when that rule was written there is a verifier now, and a caller that wants an endorsement checked passes it to `verify_proof` rather than reading `proof_present` as an answer. The matrix is 32 HTTP, 8 library and 9 unsupported. HONEST LIMIT OF THE EVIDENCE: the suite signs with the same canonicalizer the verifier uses, so it proves the chain agrees with ITSELF. No badge issued by a third-party implementation has been verified here — none exists offline and inventing one proves nothing. What IS independently checked is the serializer, against canonical strings written out by hand. The residual risk is a canonicalization difference on a shape no test covers, and its symptom would be `signature_invalid` on a genuine badge. - [x] M10.7.e Run internal gradebook import/correction/visibility/LTI- OneRoster reconciliation with duplicate/out-of-order events. Evidence: grade interoperability suite. CLOSED 2026-09-18. It was open on the prerequisite below, and M10.7.b closed it: `result` is modelled and published, so reconciliation across the two roads is a JOURNEY a grade takes rather than a capability of the ledger. A score arrives on the LTI AGS road, a retry of it is one event, a rescore that was true earlier and arrived last never becomes the grade in force, and what the SIS reads is what the ledger DERIVES — asserted from the other side, against `project()`, rather than restated from the publisher. AND THE DEFECT THIS CELL RECORDED AND DID NOT FIX IS FIXED: THE GRADE WAS DURABLE AND THE LINE ITEM IT HANGS ON WAS NOT. Line items lived in a class-level dictionary and `sync_score` refuses one it cannot find, so after a restart a platform posting to a line item METIS ITSELF created was answered `line item is not registered`, 403, forever, with nothing it could do about it. `lti_line_item` (migration 081) is that table, written where `create_line_item` writes. It is NOT the binding table, deliberately: `grade_ingress_binding` says what a line item SCORES and somebody has to assert that; this says the line item EXISTS, which is a thing this tool did. Conflating them would let a registration nobody made be inferred from a binding somebody did. THE STORE IS CHOSEN BY NAME AND NEVER FALLEN BACK TO. `LtiService.use_line_item_store(InProcessLineItems())` is how a suite with no database asks for an in-process one, the way `use_jwks_cache` already worked; a store that silently became in-process when the database was unreachable would put the defect straight back. `reset()` now forgets WHICH store is in use rather than emptying one — a reset that cleared the table would be one import away from clearing a real tenant's line items. Evidence: `tests/test_grade_ingress_journey.py` 28 tests (the new one creates a line item, clears exactly what a restart clears, and posts a score to it successfully), `tests/test_oneroster_gradebook_postgres_integration.py` 14, `tests/test_grade_interoperability.py` 16, and 115 across every suite that constructs an `LtiService`. WHAT WAS OPEN, AND WHY IT IS NOT NOW: the OneRoster road could not be built because `result` was not modelled at all (M10.7.b). It is. WHAT WAS OPEN, AND IS NOW CLOSED FOR LTI AGS. The durable ledger M8.11 built HAD NO WRITER: nothing under `src/` imported `services/grade_ledger.py` except the model registry, and a score posted over LTI AGS landed in `LtiService`'s class-level dicts, which `reset()` clears and a restart forgets. `POST /lti/assignments/scores` now carries the accepted score into the ledger, and `tests/test_grade_ingress_journey.py` proves it the only way worth proving: post a real score with a real AGS token, clear exactly what a restart clears, and read the grade back out of Postgres. 26 tests against a freshly migrated database. THE HARD PART WAS A FIELD NOTHING CARRIES. A `LedgerEvent` names the attempt and the `item_revision_sha256` the value was arrived at against — that is the point of M7.10's chain — and an AGS post carries a number, a user and an opaque line-item id. There is no honest derivation from an identifier to a content digest, so the digest is NOT derived: `grade_ingress_binding` (migration 074) is where somebody says what a line item scores, and a score against an unbound line item is refused rather than recorded with an invented revision. A ledger holding a confident digest of nothing is worse than an empty one, because the empty one is visibly empty. AND THE TENANT COMES FROM THE SAME PLACE, for the same reason. An AGS post says nothing about whose records it belongs in — the platform registration does not record who registered it — so binding a line item is a tenant CLAIMING it, and a line item two tenants claimed is refused naming both rather than assigned to whichever sorted first. WHAT IS DERIVED, IS DERIVED AND NOT GUESSED. The grade and the attempt are the `(platform, line item, user)` triple, which is the platform's own notion of one person's work on one assignment; the learner and the actor are digests, not names, which is M10.7.d's Caliper finding applied before it could recur; and the source sequence is the count of posts applied to that result, because `lti_ags` is a bursting source and the protocol supplies no counter — two posts bearing one instant are an `ambiguous_order` refusal without it, which a test asserts. THREE REFUSALS THAT ARE NOT GAPS, each with its own test: a line item nobody bound; a score the platform reports as `Pending`, `PendingManual` or `Failed`, because a provisional number recorded as `scored` is the grade in force until something else arrives; and a line item whose maximum disagrees with the bound scale, because rescaling 40/50 into 80/100 on the way in is exactly the silent mapping M10.7.f blocks. A REFUSED SCORE DOES NOT FAIL THE POST. AGS is the platform's protocol and its rules were met; failing a well-formed post because nobody on this side bound the line item would make a Metis omission look like a platform error. The post stands and `LtiScoreResponse.ledger` carries the receipt, so the platform is told exactly what became of the number instead of being told nothing. The read path is `GET /api/gradebook-ingress/projection`, derived from the entries on every read rather than served from the stored row — a projection that has fallen behind its own ledger is the failure a read path can hide — and scoped to the caller's own claim, so a line item somebody else bound answers the same 404 as one nobody bound. RECORDED, NOT FIXED, AND FOUND BY BUILDING THIS: THE GRADE IS DURABLE AND THE LINE ITEM IT HANGS ON IS NOT. `_line_items` is the same kind of class-level dict the scores were in, and `sync_score` refuses a line item it cannot find — so after a restart a platform posting to a line item Metis itself created is told `line item is not registered` and answered 403, forever. The grade road is durable from the post onward and the thing being posted about evaporates. The fix has the shape this item just built: a table, written where `create_line_item` writes today. The binding table is NOT that table — it says what a line item scores, not that it exists — and conflating them would let a registration nobody made be inferred from a binding somebody did. The absence is held as its inverse now: `test_the_grade_ledger_has_a_writer_under_src` fails the day the ingress is deleted, because every ledger test would still pass without it and the store would quietly go back to being one no road reaches. `tests/test_grade_interoperability.py`, 16 tests against a freshly migrated Postgres, driving import, correction, visibility, duplicates and out-of-order arrival across all five sources at once. THE DEFECT IT WAS WRITTEN TO FIND: THE ALPHABET WAS DECIDING WHICH GRADE STOOD. `SourceRef.ordering_key` ended in the system's NAME, and the ambiguity check compared that same key — so a tie between two systems was invisible to the check that exists to catch ties, and was broken by `lti_ags` < `oneroster`. A platform post and a roster record landing on the same second ordered by spelling, and the one that sorted last became the grade in force. The module's own docstring says a tie is an ambiguity and not a coin flip; across sources it was a coin flip with the alphabet as the coin. A SEQUENCE IS A COUNTER INSIDE ONE SOURCE — an import's first event is not before a platform's seventh — so `separates_from` now asks what the sources actually said: a different instant separates them, the same instant from two systems does not, and a source's own counter separates only its own events. Such a pair is refused as `ambiguous_order` naming BOTH systems, and `as_history` refuses to derive over one too, so a ledger that somehow holds one cannot quietly project a winner. A SECOND, SMALLER ONE: a projection over entries that do not yet make a history — a rescore whose opening score has not arrived, which is ordinary while an import catches up — reached the caller as a pydantic validation dump from two layers down. It is a `LedgerError` naming the grade and how many entries are waiting; the entries stay, and the projection works the moment the score lands. What the fixtures confirmed already worked: a retry is one event, and a retry carrying the version its first attempt carried is still accepted because a delivery guarantee is not a stale-version error; one identifier from two systems is two events; a term replayed BACKWARDS into a second tenant produces a byte-identical history; one system corrects another's event by the id that system used; and M7.10's visibility matrix over a ledger-derived history withholds the value from a learner before release and shows them the correction after it. - [x] M10.7.f Publish per-cell compatible/lossy/extension/unsupported/version- skew results and block silent mapping. Evidence: compatibility report. Evidence: `evidence/v1-workbenches/metis-interop/compatibility-report.json`, generated by `scripts/export_compatibility_report.py` from the same registry M10.7.a's matrix comes from, with 21 tests in `tests/test_interop_compatibility.py` and 15 in `tests/test_interop_loss.py`. All 49 cells classified: 15 compatible, 13 lossy, 4 extension, 1 version-skew, 16 unsupported. `fidelity` is a REQUIRED field, so a new cell cannot arrive unclassified, and a label its own fields contradict will not construct — a compatible cell that names a loss, a lossy one that names none, an extension that says nothing it adds. BLOCKING SILENT MAPPING, and it was not blocked: EVERY INBOUND STANDARDS PAYLOAD WAS SILENTLY DISCARDING WHATEVER IT DID NOT MODEL. Pydantic's default is to drop an undeclared field without a word, so a SIS sending `middleName`, `grades` and `agents`, a platform sending an xAPI `authority`, a sensor sending a Caliper `session`, or a player committing `cmi.exit` got back a success over a record quietly smaller than the one it sent. Refusing the whole sync over `middleName` is not interoperability either — so the payload is now walked against the model that parsed it and every unread path comes back in `fields_not_carried` on the response. `services/interop_loss.py`, wired into all four ingresses (OneRoster sync, xAPI statements, Caliper events, SCORM commit), bounded in depth, breadth and list length because the payload is somebody else's. The rule is then enforced in the type: a cell that RECEIVES over HTTP and declares a loss nothing announces WILL NOT CONSTRUCT, and the report publishes `silent_losses` (empty) so a reader can check it without running the suite. The rule binds where a sender exists to be told — an HTTP request with a response. A library call (the badge parser) has no sender to answer, so its losses are published in the report instead, which is the other way of not being silent; the three cells it applies to say so in their own rows. THE SECOND RATCHET, WHICH IS WHY THIS ITEM FOUND ITS OWN CHECKLIST STALE: an implemented cell proved itself by naming a handler that exists, and an UNSUPPORTED cell proved nothing at all. M10.7.b built `roster_reference`, the delta watermark and `tobedeleted` tombstones, and three cells went on reporting all three as unbuilt for an entire item — the matrix over-reported gaps and nothing could contradict it. Every unsupported cell now names the symbol whose ABSENCE makes it true (`OneRosterLineItemRecord`, `ScormSequencing`, `XapiStateDocument`, `open_badges_service.verify_proof`), and the test fails the day one of them exists. The three stale rows are corrected: sourcedId persistence and tombstones are compatible, the delta is an extension (a payload-level watermark, not OneRoster's REST filter), and the identity join's own row now says what it does — sourcedId first, a normalized email fallback ONLY on a first sync, which M1.13's `emailAsJoinKey: false` does not sanction and without which a first sync copies every user the estate already has. 17 losses named as field paths, each demonstrated by calling the code: SCORM 1.2 refusing `long-fill-in` (the one version-skew cell), the Caliper envelope leaving `actor.name` behind, `fields_not_carried` naming what a badge cannot hold — and A BADGE'S `validUntil` IS NEVER READ, so an expired badge parses exactly like a live one, which the report now says out loud. The matrix moves with it: 28 HTTP, 5 library, 16 unsupported. - [ ] M10.8 Run BFF authorization, idempotency, concurrency, pagination, rate, SSRF, and tenant negative suites. Evidence: route matrix complete. - [x] M10.8.a Generate full route-method-operation/role/audience/object/ property/function inventory from runtime/OpenAPI and map tests. Evidence: route matrix. Evidence: `evidence/v1-workbenches/metis-bff/route-matrix.json`, generated by `scripts/export_route_matrix.py` from `services/route_matrix.py`, with 17 tests in `tests/test_route_matrix.py`. 882 operations — the SPEC's 767 was 2026-09-06 and the surface has grown — each joined to the function that serves it, the roles that reach it, its audience, its object, the protected properties its responses can reach, and the test modules that name its path. Nothing is hand-written: the operations and statuses come from the published document, the handler and its dependencies from the AST of `metis/api/*.py` and `metis/main.py`, the posture from M8.15's register, and the test mapping from path literals in `tests/*.py`. 653 operations are named by a test and 229 ARE NAMED BY NONE. The mapping is deliberately literal — a test reaching a route through a helper is not seen — so 229 is an upper bound on what is untested and the right direction for a coverage gate to be wrong in. Worst by object: admin 57 of 198, item-bank 28 of 137, and measurement-ledger 12 of 12 — a whole surface no test names. That list is M10.8.f's. THREE DEFECTS IN THE INVENTORY ITSELF, each found by a check written to fail: 4 operations matched no handler (a trailing slash normalised away, a `{asset_path:path}` converter published without its converter, and `/health` and `/ready` hanging off the app rather than a router); an f-string's trailing piece was being read as a path of its own; and, the one that mattered, NINE ROUTES WERE READ AS ANONYMOUS BECAUSE THEIR AUTHENTICATION WAS ONE DEPENDENCY DEEPER — `export_diagnostics` routes depend on `export_tenant`, which depends on `get_current_user`. A scan that reads a route as open when it is not is wrong in the worst direction, so the dependency graph is walked, `metis/deps.py` included. Roles now: 537 instructor, 179 any-authenticated, 125 admin, 41 anonymous — and every anonymous one has a posture M8.15 declared open, checked against the register rather than restated. The protected-property column reads 0, and 0 is only worth reading because the report names what was looked for: one published schema carries one (`AssessmentContext.answer_key`) and only a REQUEST body reaches it, so it is accepted and never returned. The walk that found nothing is proven able to find something — a synthetic schema three deep through a list and a union — and to survive a reference cycle. - [x] M10.8.b Test anonymous/learner/guardian/author/reviewer/teacher/admin/ operator and cross-tenant IDs/fields/search/counts/exports. Evidence: authorization suite. CLOSED 2026-09-18. Both halves are done: the cross-tenant read sweep below (2026-09-12) and the persona vocabulary the last paragraph was open on. THE EIGHT ARE EXPRESSIBLE NOW (`schemas/personas.py`). A capability table says what each persona may do, and `CurrentUser` asks it rather than asking which of two words a token carried — which is why five personas could not be added before without rewriting every route. A NEW PERSONA WIDENS NOTHING. `student` still means learner and `instructor` still means teacher, asserted by a test over all three legacy words, so no token that exists reaches anything it did not reach yesterday. `is_instructor()` asks for `teach_class` rather than `author_content` deliberately: that seam gates 537 operations, and granting all of them to the new `author` and `reviewer` would be the one thing adding a vocabulary must not do. A ROLE NOBODY DEFINES RESOLVES TO NOTHING, not to the narrowest persona: a token carrying `role: "superuser"` must not quietly become a learner and work, because then nobody finds out that the issuer and this service disagree. THE SWEEP RUNS ALL EIGHT: `tests/test_route_authorization.py` offers every published operation to anonymous, a token with no role claim, a learner, a guardian, an author, a reviewer, an operator and a teacher, each below its bar — 18 tests, every offer refused 401 or 403 and never 422, because a validation error means the request reached the body. WHAT WAS DELIBERATELY NOT DONE, and is now asserted so a later item re-takes the decision rather than drifting past it (user decision 2026-09-18): the 537 operations behind the instructor seam KEEP it. Which of them are authoring, which reviewing and which teaching is a per-route judgement the checklist does not supply, so an author, a reviewer, a guardian and an operator reach what a learner reaches and no more — which the sweep proves rather than assumes. WAS OPEN ON FIVE OF THE EIGHT PERSONAS AND ON THE CROSS-TENANT READ SWEEP. `CurrentUser.role` holds one of THREE values — student, instructor, admin — so guardian, author, reviewer, teacher and operator are distinctions this item asks the surface to make and it cannot make them: every route that should tell a guardian from a learner, or a reviewer from an author, sees the same caller. And the two-tenant read sweep (create in A, read as B, over ids/fields/search/counts/exports) exists for the eight authoring routes M8.14.b built it for, not for the other 874. Closing this means a role vocabulary that can express the eight and a generated two-tenant sweep. THE CROSS-TENANT SWEEP IS NOW GENERATED AND RUN, 2026-09-12. `tests/test_cross_tenant_read_sweep.py` takes every GET operation in the published document that needs no path parameter — 197 collection reads — and offers each to a second instructor who has created nothing. 138 of them answered 200, 46 refused with 403, and NOT ONE returned any of the 8 identifiers belonging to the first tenant. The assertion is over BYTES, not counts: a count passes whenever two tenants happen to hold the same number of rows, and a field check misses an id echoed inside a nested payload or an error message. The sweep refuses to pass vacuously — it asserts it had identifiers to look for and that it reached more than twenty permitted reads. AND IT FOUND A LIVE 500. `/api/admin/authoring-hub/workspace` answered `internal_server_error` for the second instructor and 200 for the first. `AuthoringHub.viewer_id` was typed `Identifier`, whose pattern is `^[a-z][a-z0-9._:-]{2,159}$` and so requires a leading lowercase LETTER — but a viewer id is a USER id, which is a UUID. Ten of the sixteen possible leading hex characters are digits, so the authoring hub was unopenable for most real callers and fine for the rest, which is why it looked like it worked. The unit tests never caught it because they passed `viewer_id="actor:one"`, a slug shape the route never produces. The field is a `uuid.UUID` now, the tests pass a real user id, and both a digit-leading and a letter-leading account answer 200 against the running service. One schema moved in the published document. WAS STILL OPEN ON: the five personas. `CurrentUser.role` held three values and the item names eight. Closed 2026-09-18, above. DONE, and it found a cross-tenant hole. `tests/test_route_authorization.py` drives the REAL application with REAL bearer tokens — nothing overridden, because the dependency you would override is the thing under test — and offers all 882 operations to every caller below their bar: anonymous, a token with NO ROLE CLAIM (which defaults to `student`, so it is a learner's token), a student and an instructor. 1,628 offers, every one refused 401 or 403 and NEVER 422, because a validation error means the request reached the body, which means it passed the gate. Four bad tokens — signed by somebody else, expired, carrying no subject, and not a token at all — are each 401. THE DEFECT: A CALLER COULD NAME ITS OWN TENANT. `oneroster_service` opened with `tenant_id = body.tenant_id or actor_user_id`, so an authenticated administrator could put any tenant's id in the request body and read, write and re-point THAT tenant's `roster_reference` rows — the mapping that decides which Metis user a SIS sourcedId becomes on every later sync, so re-pointing it lands the next sync's name, email and withdrawal on an account of the attacker's choosing. M8.14 established the property this breaks: a caller cannot name its own tenant. The tenant is now derived from the authenticated user, by a `deps.tenant_of` shared with the twenty modules that had each written the same `uuid5` inline — which is how a twenty-first came to take it out of a request body — and a body that names a different one is REFUSED 403 rather than quietly ignored, because ignoring it would leave a caller believing it had written somewhere it had not. A SECOND FINDING, IN THIS SESSION'S OWN GATES: three drift gates (M10.7.a's coverage matrix, M10.7.f's compatibility report, M10.8.a's route matrix) compared the committed artifact to the generator BYTE FOR BYTE. The commit hook reformats generated JSON after the generator writes it, so all three were green in the working tree and RED at HEAD. They compare documents now, and the fix is verified by running prettier over the artifacts and re-running the gates. - [x] M10.8.c Test idempotency key replay/conflict/scope, ETag/expected-version races, simultaneous edits/decisions, and event dedup/order. Evidence: mutation suite. CLOSED 2026-09-18 ON WHAT THE DOCUMENT SAYS — the last open half. ALL 177 KEYED OPERATIONS PUBLISH THE CONFLICT NOW; it was 0, then 95, and the remaining 82 were held as a ceiling with the note that shrinking it meant "reading those mappings rather than running a script over them". They were read, one at a time, and every one of the 82 could answer 409: - twenty-six modules map a domain error whose status is a runtime attribute — five of those classes DEFAULT to 409, so any bare raise is one, and the rest pass 409 explicitly at the raise; - `agent_runtime` maps any code its table does not list to 409 by default; - `generation`'s `cancelled` failure class is 409 in `FAILURE_STATUS`. Each is documented against that evidence and not one was documented for tidiness — documenting a status an operation cannot return is the same error pointing the other way. THE CEILING IS GONE RATHER THAN SET TO ZERO, which is the rule M8.15's own status ratchet was retired under: a baseline over nothing is a gate that cannot fail. The test asserts the thing itself, so an operation that gains a key without its conflict fails immediately. THE EXPECTED-VERSION HALF: 25 of 26 publish 409 or 412; it was 2 of 14. THE ONE THAT DOES NOT IS CORRECT AND IS NAMED RATHER THAN COUNTED — `POST /api/gradebook-corrections/decisions` answers 200 with a typed `CorrectionRefusal` in the body, because a stale version there is a DECISION about a correction and not a transport failure: the reviewer is told what the store holds and why their decision was not taken, and a 409 would lose the reason. Evidence: `tests/test_mutation_concurrency.py`, 11 tests, and 142 across the contract, openapi and route-matrix gates. WAS OPEN ON WHAT THE DOCUMENT SAYS. 177 of the 463 mutating operations take an idempotency key and NOT ONE publishes the status a replay or a reused key answers with; 12 of the 14 taking an `expected_version` publish neither 409 nor 412. The behaviour is right now — the last test in the suite measures the silence and fails the day any operation starts documenting it — but a client generated from this document has no branch for the conflict, so it reads a 409 as an unknown error. Closing this means the statuses reaching the published contract. THE STATUSES HAVE REACHED IT, AND THE RATCHET THAT HELD THEM IS GONE. M8.15 recorded FIFTY-SIX modules that raise a status none of their operations document — 404 forty-five times, 409 forty, 403 twenty-one — and held the number as a ratchet because documenting them was "a change to ninety route modules' decorators". That change is made. The gap is ZERO modules, and the ratchet's own rule said what to do next: delete it rather than empty it, because a baseline over nothing is a gate that cannot fail. So `STATUS_GAP_BASELINE` and `status_gap_ratchet` are deleted and `test_no_module_raises_a_status_it_never_documents` asserts the thing itself — a module that starts raising something it does not publish fails immediately instead of being written down and lived with. DOCUMENTED PER HANDLER, NOT PER MODULE, which is the part that needed judgement rather than a script. A function's statuses are what it can actually raise: the `HTTPException`s in its own body plus those its module's error mapper can produce for it. A read that catches nothing gets nothing — `/evaluation` on six of these modules promises no 404, because it cannot answer one. Documenting a status an operation cannot return is the same error pointing the other way. AND THE MODULE-LEVEL GATE WAS COARSER THAN IT LOOKED. `admin` was not in the baseline at all — it raises 409 and some one of its eighty-nine operations documented it, which satisfied a gate that asks about modules. Fifty-one of its handlers still published nothing. The operation-level measurement in `test_mutation_concurrency` is the finer instrument and it is the one this item is written against. KEYED OPERATIONS PUBLISHING THE CONFLICT: 0 OF 177 BEFORE, 95 NOW. The remaining 82 are held as a ceiling that may shrink and must never grow, and they are not one kind of thing. Some handlers genuinely cannot conflict. The others raise a domain error whose status arrives as a RUNTIME ATTRIBUTE — `ContentFreshnessError` defaults to 409 and never writes it as a literal — so the operation answers 409 and no static pass can see that it does. Shrinking the ceiling means reading those mappings one at a time, which is what keeps this open. The refusals-unpublished debt fell with it: 121 operations required a role and documented no failure at all; 102 do now. DONE, AND THE FIRST CLAUSE WAS A DEFECT. AN IDEMPOTENCY KEY IS A RETRY TOKEN AND THIS ONE WAS A UNIQUENESS TOKEN. `aggregate_store` consulted the key LAST, through a unique constraint on the outbox, so a caller that did not hear the answer and sent the same request again was refused `stale` — indistinguishable from somebody else having got there first, which is the ONE distinction the key exists to make. The key is now asked before the revision checks: the same intent is answered with the first attempt's acknowledgement (same revision, same ETag, same audit line, same outbox event, `replayed: true`), and a key pointed at a different intent is refused, because answering it with the first attempt's result would confirm a write that never happened. The store's own outbox row carries the audit id now, so a replay answers with the acknowledgement that was issued rather than a fresh one that merely looks like it. A SECOND, SMALLER ONE: that refusal reached the caller as 422 `validation_failed` — the authoring layer's fallthrough for every refusal it had no case for. A well-formed request that names an intent the caller has already named differently is a conflict, so the published outcome vocabulary gains `duplicate_key` (409). M8.6's own rule then did the rest: a state in the contract that nothing produces is a promise nobody keeps, so its reachability test obliged a case that produces it. `tests/test_mutation_concurrency.py`, 10 tests against a freshly migrated Postgres: a retry written once and answered twice, an edit retried against its own first attempt, a key pointed elsewhere, a key with a changed payload, two tenants using ONE key and getting two writes, a transition replayed under its own key, a stale revision told what the store holds, two threads at one revision producing one winner and one refusal with nothing written by the loser, and the same retry run twice at once still writing once. Event dedup and order were done in M10.7 and M8.11 and are not re-measured here: xAPI statement conflict, Caliper event dedup and ordering, SCORM commit replay, and the grade ledger's `(tenant, system, source_event_id)` with its advisory lock. - [ ] M10.8.d Test cursor signing/scope/stability/expiry, filter/sort limits, rate/quota/budget/concurrency bypass, and privacy-safe errors. Evidence: protocol suite. THE RATE LIMITER EXISTS NOW; QUOTA AND CURSOR EXPIRY STILL DO NOT. `services/request_throttle.py` joins the three pieces that were lying about separately, and `main.py` applies it as middleware — a middleware and not a dependency, because the finding was about every authenticated route and a dependency would have had to be added to eight hundred and ninety-odd operations to answer it. `tests/test_backpressure.py` — renamed from `test_backpressure_absence.py`, because it is not about an absence any more — drives the REAL application against the REAL Redis and watches the fourth request of a three-request window come back 429 with a `Retry-After`. Its old assertions are the same claims pointing the other way: the limiter HAS a caller, the configured number IS read, a route CAN answer 429. IT IS A FIXED WINDOW AND THE CODE USED TO CALL IT SLIDING. Measured: `check_rate_limit` sets a counter with a TTL on the first request and increments until the TTL expires, so the window is anchored to that request rather than moving with the clock. The docstring said sliding and the implementation never was. The consequence is the ordinary one and it is now written down: a caller can spend the whole allowance at the end of one window and the whole allowance at the start of the next, so the real short-term ceiling is twice the configured number. `rate_limit_burst` IS STILL READ BY NOBODY, and a test asserts that on purpose. A fixed-window counter has no burst parameter to read; spending it would mean a token bucket, where a burst allowance is a real thing with a refill rate. Folding it into the window maximum would be inventing a meaning the name does not have. (That test had to stop grepping for the name to find this out — every mention of `rate_limit_burst` is now in prose EXPLAINING that nothing reads it, so it asks the AST for an attribute access instead.) IT FAILS OPEN WHEN REDIS CANNOT ANSWER, deliberately and with a test. A limiter keeps load off a service; one that refuses everything when its own dependency is down converts a Redis outage into a total outage. Every other way of not running names itself too — `disabled`, `no_limiter`, `unthrottled_path`, `nonpositive_maximum` — because a throttle that quietly does nothing is the state this cell was opened on, and "it did not run" should be a value a test can read rather than a silence it has to infer. IT IS ON IN PRODUCTION AND OPT-IN ANYWHERE ELSE, and that policy was WRONG THE FIRST TIME. Enabling it everywhere but the testing environment looked obviously right and failed TWENTY-SEVEN suites, because they build the real application with default settings — `environment` defaults to `development` — and drive hundreds of routes at one address in one process. `test_route_authorization` alone offers every operation to every caller. Those suites measure the service, and a throttle firing inside them measures the suite. The finding was about a DEPLOYED service accepting requests without limit, so that is where it runs by default; `rate_limit_enabled` turns it on anywhere. The policy is a named function rather than an expression inline in the middleware, because it is a decision somebody should be able to read and test on its own — and because the first version of it was wrong. `test_protocol_limits`'s "nothing here limits a rate" flipped with it, and the new sentence is the precise one: the limiter is INSTALLED here and not ARMED here, so sixty requests still pass and the reason has changed from "nothing limits anything" to "this configuration asked for no limit". AND THE CURSOR EXPIRES NOW. The item-bank cursor — the one opaque cursor in the estate, the rest being positions — carries an `iat` and is refused past thirty minutes. IN BOTH DIRECTIONS: a cursor issued in the FUTURE is refused too, because otherwise a forged issued-at would be the way to make one last for ever and the expiry would check only honest cursors. Version 1 cursors are refused rather than honoured — one with no issued-at cannot be expired, so accepting it would leave the hole open for as long as anybody held one, and for a page token the cost of that is asking for the first page again. NOTHING ABOUT IT IS IN THE PUBLISHED DOCUMENT, deliberately: a lifetime is the server's business and a `cursor_ttl` field would be a promise a client could rely on. A TEST HAD TO STOP ASSERTING DETERMINISM TO ALLOW IT. An issued-at makes two otherwise identical searches produce different cursor strings, and `test_signed_cursor_is_deterministic_…` compared the bytes. It passed only while both calls landed inside the same second — a test that fails on a slow morning. It asserts what actually mattered now: the same question asked twice continues at the same place, checked by decoding rather than by comparing strings. STILL OPEN ON QUOTA. A quota is a budget over a longer period than a window — a month's generation spend, a term's exports — and nothing keeps one. The rate limiter is a window and cannot be read as one. WHAT THE ORIGINAL MEASUREMENT SAID. Sixty requests in a row to an authenticated route are all served; the only middleware this application installs is a response timer and CORS; no route answers 429. There is no limiter to bypass because there is no limiter, and the test that says so is written to fail the day one appears. No cursor carries an issued-at or a lifetime either: the signed one binds a SNAPSHOT, so it stops working when the data moves, which is stability and not expiry. DONE, AND ONE PARAMETER WAS BOTH UNFLOORED AND UNCAPPED. `GET /api/authoring/{kind}?limit` was a bare `limit: int = 100` that reached `LIMIT :limit` unchecked: `?limit=-1` came back a 500 — the database's complaint, rendered as "an unexpected error occurred", for what is plainly a bad request — and `?limit=100000000` was simply served. It is `Query(default=100, ge=1, le=500)` now, so the bound is ENFORCED and PUBLISHED, and `?revision` is floored at 1 because revisions start there. The rest of the limits hold and are now checked against the document rather than believed: every page size a caller can name, in a query parameter or a request body, declares a maximum AND a minimum; every `sort`/`order_by` is a closed vocabulary rather than a column name; and the only integer parameter left without a floor is a stream position, recorded by name so a new one has to be looked at. CURSORS. One opaque cursor exists — `ItemBankSearchRequest.cursor` — and it is signed and bound to the query digest, the snapshot digest, the tenant and the role. Every other paginated surface hands back a POSITION, which is forgeable into nothing a caller could not already ask for, because the query is re-scoped server-side on the next call. The test pins that there is exactly one opaque cursor, so a second one arrives with a signer or fails here. BUDGET is built and CONCURRENCY was proven in M10.8.c: `reserve_budget` takes a reservation inside a transaction, so a job that does not fit never reaches a provider — but `reserved_cents` appears in NO published schema, so a caller cannot see the reservation that binds it. PRIVACY-SAFE ERRORS. Another tenant's aggregate answers `not_found` rather than `forbidden` — a 403 on a record you cannot see confirms that it is there — and carries none of its payload; a validation failure is a fixed sentence with a field list and no traceback. `tests/test_protocol_limits.py`, 11 tests. - [ ] M10.8.e Test URL/feed/LMS/repository/webhook/media fetch SSRF, redirects, DNS rebinding, internal metadata, schemes/ports, size/time bombs. Evidence: SSRF suite. OPEN ON DNS REBINDING FOR EIGHT OF THE NINE FETCHES. Source intake resolves, checks, and then PINS the peer address it validated, so a name that answers differently on the second look is caught. The LTI paths resolve and check and then hand the URL to `httpx`, which resolves again — the window between the two lookups is exactly what a rebinding attack aims at. Closing this means a transport that dials the address that was validated, which is what `source_intake_network` already has and nothing else does. THE REBINDING WINDOW IS CLOSED. `outbound_targets.pin_to_validated_address` returns a request aimed at the LITERAL the policy approved, and both LTI fetches use it, so neither hands a NAME to a client that would resolve it a second time. The hostname rides in `Host` so the server still routes, and in the TLS SNI so the CERTIFICATE is still verified against the name — drop that and pinning would have bought safety by giving up authentication. `httpx.stream` cannot carry `extensions`, so both fetches now go through an `httpx.Client`; the SNI hostname travels there. AND THE PIN IS ASSERTED BY WATCHING WHERE A REQUEST IS AIMED, which is the part the existing cases could not do. Every test here already passed whether the address was pinned or not: they drive a fetch at a 0.2-second timeout and assert it FAILS to connect, which proves the policy let it through and says nothing about where it went. The nine new cases capture the outgoing request instead — the fetcher, the policy and the pin are all real, and only DNS and the HTTP client are substituted at their boundaries. One of them answers public on the first lookup and private on every one after, and the request still goes to the public literal, because there is no second lookup to move it. A SEAM THAT WAS MISSING ON ONE SIDE. `HttpxTransport` took a resolver and `HttpsJwksFetcher` did not, so the JWKS path could only have been tested by the internet agreeing with the test. It takes one now, the same way, and the two fetchers are symmetric. WHAT KEEPS THIS OPEN, AND A CORRECTION TO WHAT THAT MEANS. Every fetch somebody OUTSIDE aims is pinned now — the two LTI ones here and the badge status list M10.7.d added, which is the third and the most attacker-chosen. The seven model providers read their base URL from settings and are not. THE FIRST VERSION OF THIS SENTENCE SAID THEY SHOULD GO THROUGH "THE SAME POLICY AND THE SAME PIN", AND THAT IS WRONG. Reading the call sites to do it showed why: `refuse_unless_public` would REFUSE an operator who points a model provider at an internal gateway on `10.0.0.5`, which is an ordinary and deliberate deployment. The policy that is right for a URL a platform chose is the wrong policy for a URL an operator chose, and applying it uniformly would have broken working estates in the name of closing a checkbox. So what remains is smaller and different: pinning without the globality check buys little on its own — each request re-resolves, so an operator whose DNS is hostile is compromised from the first answer either way — and the useful control for these would be an operator-declared allowlist of model hosts, which is a new mechanism rather than a reuse of this one. That is what this stays open on. DONE, AND TWO OF THE NINE FETCHES POINTED WHEREVER SOMEBODY ELSE SAID. The spec's first instruction was to enumerate every `httpx` call site under `src/metis/services` before writing a case, and enumerating found nine: seven read their base URL from settings, and two do not. `lti_trust` fetches the JWKS an ADMINISTRATOR registered, and `lti_services_client` calls the AGS and NRPS endpoints that arrive in CLAIMS INSIDE A LAUNCH TOKEN — a platform that signs its own launch chooses those. Neither checked where it was going, so `https://169.254.169.254/latest/meta-data/iam/security-credentials/` was a URL this service would have called WITH A BEARER TOKEN ATTACHED, and `https://10.0.0.5/lineitems` was another. `services/outbound_targets.py` makes the check `source_intake_network` already made, written once so the two agree: resolve the name and refuse unless EVERY address it answers with is public. One public answer beside a private one is refused, which is the shape of a rebinding attempt. A TEST WRITTEN TO ASK FOUND A HOLE IN THE CHECK ITSELF: Python reports `224.0.0.1` as `is_global`, because multicast is not in the special-purpose registry it consults, so multicast, reserved and unspecified addresses are now refused by name. LOOPBACK IS A DECISION EACH CALLER MAKES rather than a global rule. M10.6 allowed it for JWKS deliberately — RFC 8252's exception, and the only reason a platform on this machine is testable — and this item does not undecide it. The AGS client refuses it: a key document is read and discarded, while those calls carry a token and write. SIZE BOMBS. Both LTI fetches capped the body with `response.content[:limit]`, which caps what is KEPT and not what arrives — the whole body is in memory by the time it is sliced. Both read with a budget now and stop mid-stream, proven against a response that never ends. Already held and re-checked rather than rebuilt: no fetch anywhere follows a redirect (asserted across all nine), and source intake's own SSRF suite covers private DNS, redirect revalidation, peer mismatch, oversize, deadlines, credentials, fragments, ports and the host allowlist. `tests/test_outbound_ssrf.py`, 32 tests, including an inventory that FAILS WHEN A NEW `httpx` CALL SITE APPEARS until somebody says who aims it. - [x] M10.8.f Fail CI for any untested route/role/failure row or protected field leak. Evidence: coverage gate. Evidence: `evidence/v1-workbenches/metis-bff/coverage-gate.json`, computed by `services/coverage_gate.py` from M10.8.a's inventory, runnable as `pnpm run metis:coverage:gate` (exit 1 on any failing row), with 11 tests in `tests/test_coverage_gate.py`. Three rows, each failing in BOTH DIRECTIONS — a new bad row fails it, and a recorded row that got fixed and was left on the list fails it too, because a list that can only grow is an excuse with a file name (M8.14 settled that for tenancy): - AN UNTESTED ROUTE. 229 of 882 operations are named by no test. That is today's debt, recorded operation by operation in `src/metis/data/coverage_gate_baseline.json`, and the gate is what stops the 230th. - A REFUSAL NOBODY PUBLISHED. 121 operations require a role and document no 4xx at all, so a client generated from the document has no branch for the 403 it WILL get — M10.8.b proved every one of them refuses. An anonymous route is not asked for one, and a test proves the gate makes that distinction. - A PROTECTED FIELD IN A RESPONSE. No baseline for this one and no way to record an exception: `answer_key` and the eleven properties beside it may not become reachable, and the gate fails with nowhere to write it down. Zero today. Every check is paired with a doctored surface that fails it: an invented untested route, a baseline entry that gained a test, an operation that stopped documenting its refusal, and a response that reaches `answer_key`. The baseline lives beside the code rather than in `evidence/`, because evidence is written by a generator and a baseline is edited by a person. - [ ] M10.9 Run full-journey Playwright: source ingest to grounded course publish. Evidence: live backing and verified target. THE ROOT BLOCKER IS CLOSED 2026-09-13. It held for two days and it was real: source intake had no page in either application — `apps/metis/web/src/app/create` had no source or intake route, and the admin app's `source-impact` and `training-intake` are different surfaces (impact analysis over a source already held, and training-data intake). The admin app now serves `/source-intake`, and the stage map it is measured by reports ELEVEN stages walkable out of eleven, where it reported ten yesterday. WHAT THAT DOES AND DOES NOT UNBLOCK. The first stage can now be walked through a page by a person, which is what .a–.e each waited on. It does not settle the rest of any of them: .a still owes the standard and LMS seeds and the extraction assertion, .b still needs content seeded and the gateway — a third process — stood up, .c still owes three of its four gates, and .d/.e still have no authoritative target to read back from. This parent stays unchecked on those, not on the page. - [ ] M10.9.a Seed roles/tenant/standard/LMS and upload one valid plus malicious source through real backing; assert quarantine/extraction/provenance. Evidence: intake journey. OPEN ON TWO THINGS, DOWN FROM THREE. The standard and LMS seeds are not done (the roles and the tenant are), and EXTRACTION is not asserted: this stage proves quarantine, scanning and provenance, and the extraction step is the next endpoint along. THE PAGE BLOCKER IS CLOSED 2026-09-13, AND IT WAS THE BIG ONE. It read: the source-ingestion API publishes 41 operations — 52 when re-counted from `app.openapi()` on 2026-09-13; the API grew, the finding did not change — and NEITHER `apps/metis/web` NOR `apps/metis/admin` references one of them, so there is nothing to walk in a browser — recorded, never mocked, as this item's spec requires, and measured by a test that fails the day a page appears. That test has now flipped, on purpose and in both places it was taken: `test_a_page_reaches_the_source_intake_api` in `tests/test_source_intake_journey.py`, and `test_every_stage_of_the_journey_now_has_a_page` in `tests/test_journey_stage_map.py`. Both assert the opposite of what they asserted yesterday and are worth more that way round: a deleted route, or a page that stops naming the intake API, puts the first stage back out of reach and fails there. - THE PAGE. `apps/metis/admin/src/app/source-intake/page.tsx`, routed at `/source-intake` and reached from the sidebar, over a proxy at `src/app/api/source-ingestion/[[...path]]/route.ts` and a client of its own — `admin-client` is pinned to `/api/admin` and this API is not under it. The proxy forwards `await request.arrayBuffer()` and not `.text()`, because a multipart body does not survive being decoded to a string and re-encoded. - WALKED IN CHROMIUM, 4 tests in `apps/metis/admin/e2e/source-intake-workspace.spec.ts`, against the real page and a stubbed intake API — the routing, the upload control, the digests and the findings are the application's own. The stub returns the receipt the service really produces, INCLUDING `malware_scanner_unavailable`, so a page that quietly dropped the finding an estate with no scanner gets would fail there. Each test also carries the suite's axe pass: zero serious or critical WCAG 2.1 AA violations. - THE TWO DIGESTS ARE SHOWN SIDE BY SIDE, because their difference is the evidence that what is stored is the envelope and not the plaintext, and the page says which of the two things it is looking at rather than leaving a reader to compare hex by eye. - A REFUSAL IS CARRIED, NOT SWALLOWED. The service refuses an upload outright until an intake key is configured; the page renders that detail in an alert and shows no receipt. That is the fail-loud seam .a already proved at the service, now visible to the person holding the file. DONE, AGAINST A RUNNING SERVICE AND A REAL DATABASE. `tests/test_source_intake_journey.py`, 7 tests, driven over HTTP at `METIS_JOURNEY_BASE_URL`; receipts in `evidence/v1-workbenches/metis-journey/intake-receipts.json`. - QUARANTINE. An upload never lands as plaintext: the artifact is an AES-256-GCM envelope under a named key, and the receipt carries the content digest AND the envelope digest, which are different numbers. The service REFUSED to accept an upload at all until a key was configured — a fail-loud seam, met before any of this could run. - PROVENANCE. The source version records `intake_kind`, the original locator, the retrieval time, the quarantine and evidence URIs, the version number and a tenant DERIVED from the uploader. - THE SCAN DISCRIMINATES. An XML declaring an external entity pointed at `file:///etc/passwd` is `xml_external_entity`, CRITICAL; the same pipeline over a Markdown file raises it not at all, which is the check that proves the finding is about the file. - AND IT SAYS WHEN IT CANNOT SEE. With no malware scanner configured every receipt carries `malware_scanner_unavailable` as a CRITICAL finding rather than a clean bill. An instrument that is not there does not get to agree. - The receipt is bound to the bytes: quarantine id, content digest, envelope digest and size all match the upload it describes, and it names the policy, the policy digest and the scanner-set digest. - [ ] M10.9.b Review source authority/rights/currency, confirm claims/citations, author objectives/outline/lesson/item/media and clear high-risk grounding. Evidence: authoring journey. OPEN ON THE WALK ITSELF. Every stage page now RENDERS against a live service — which it could not this morning — but the journey database holds no content yet, so the pages render empty. Walking .b means seeding an objective, an outline, a lesson, an item and a media asset through the live APIs first, and the authoring half of that lives in the WEB app, which calls `/api/metis/v1/*` — the gateway, a third process this journey has not yet stood up. DONE: THE MAP, AND THE FIX THAT MADE ANY OF IT POSSIBLE. `evidence/v1-workbenches/metis-journey/stage-map.json`, generated by `scripts/export_journey_stage_map.py` from the two applications' own source, with 4 tests in `tests/test_journey_stage_map.py`. Eleven stages, and as of 2026-09-13 ELEVEN of them walkable. It said ten until then, and the eleventh — source intake — had NO PAGE IN EITHER APPLICATION, which was M10.9.a's finding arrived at from the other direction: .a searched for references to the API, this asks which stages have a route, and the two agreed. They agree still, in the other direction: the admin app serves `/source-intake` and this map now reports no unwalkable stage at all. THE JOURNEY CROSSES TWO HOSTS, and the map says which: authoring (objectives, outline, lesson) is the web app against the gateway, and reviewing (grounding, claims, publication) is the admin app against the service. Neither application serves both halves. The five admin stage pages — grounding-gates, rights, claims, media, publications — were driven in chromium against the live service and every one rendered its own heading with no authentication alert. That is only true because of the defect this stage found and fixed: React runs a CHILD's effects before its PARENT's, so every admin page fetched before `AdminAuthProvider` installed the API client's token accessor, every first request went out unauthenticated, and nothing re-fetched. Against mocks — which is all any existing admin spec has ever run against — it never showed. Against a live service the whole admin application read "Authentication required". - [ ] M10.9.c Run correctness/accessibility/quality/review gates, resolve a blocker through a new revision, and bind approvals. Evidence: review journey. OPEN ON THREE OF THE FOUR GATES AND ON THE BROWSER. This walks the REVIEW gate — human signoff — end to end over HTTP; the correctness, accessibility and quality gates have their own routes and are not walked here, and none of it is driven through a page, because the review stage's pages need content the journey database does not hold (M10.9.b's blocker). DONE: THE SIGNOFF GATE, AND FOUR ROUTES NOTHING HAD EVER CALLED. M7.13 built the gate and tested the ENGINE; `/signoffs`, `/attempt-checks`, `/outcomes` and `/invalidations` were four of the 229 operations M10.8.a found that no test names. `tests/test_review_gate_journey.py`, 11 tests against a running service. Every refusal was produced by the service while the test was being written, and each is a door somebody could otherwise walk through: no interactive session (`not_interactive`), no tenant header ("nothing to scope it to"), no conflict declaration (`conflict_not_declared`), an evidence digest that is not the one the attempt was prepared against (`evidence_changed`), a second factor older than fifteen minutes (`step_up_required`), and a gate opened under a policy digest that is not the rules in force (`gate_policy_changed`). A PASSWORD IS REFUSED AT THE DOOR rather than counted and found wanting: a stale passkey reaches the engine and comes back `step_up_required`, while a password never becomes an actor at all. AND THE TWO PROPERTIES THAT MATTER. A quorum of two counts PEOPLE: the same person signing twice leaves one signatory and an uncleared gate, and two people in two roles clear it. A signoff binds the revision it was given, so a NEW REVISION starts unsigned — otherwise "approved" would mean "approved once, for something else", which is the blocker this item asks to be resolved by revising. - [ ] M10.9.d Build/schedule/publish/sync and verify authoritative target read-back before published state. Evidence: publication journey. OPEN ON THE AUTHORITATIVE TARGET, WHICH IS NOT AN LMS. This item's spec names the LMS the M9.12 saga reads back from; the saga's `Destination` protocol has exactly ONE implementation in this estate and it is an OBJECT STORE. There is no LMS destination to read back from, so the read-back property is proven against reported facets rather than against a live platform, and the sync half is unwalked. And nothing here is driven through a page: M10.9.b's blocker. DONE: PUBLISHED IS COMPUTED, NOT DECLARED. `tests/test_publication_journey.py`, 11 tests over HTTP against a running service, including `schedules/{id}/preview` and `schedules/{id}/confirm` — two of the 229 operations M10.8.a found that no test names. - A candidate pins nine dimensions into one digest, and the same nine readings of the same revision produce the same digest. - MATCHING BYTES ALONE IS NOT PUBLISHED. Four facets are required — bytes, metadata, visibility, links — and the saga verifies only the first, so a target with bytes matched and nothing else read is `unknown`: not published, and not failed either. All four matched is `published`; a facet that came back different is `failed`; a facet nobody checked keeps it `unknown`; and a failed attempt cannot read as published however the facets look. - A facet that was NOT CHECKED may not carry a time it was checked. The model refuses that contradiction, which is how the record stays true rather than merely complete. - A schedule is planned against THIS candidate's digest and says so; confirming answers with the REFUSALS, so an empty list is the confirmation and there is no second place for the same fact to disagree with itself. NOBODY CAN APPROVE ANYTHING TODAY, measured over HTTP. The approval route refuses the assembler BY IDENTITY, and `publication_tenant` makes every user their own tenant — so the second person does not get a refusal about roles, they get `not_found`. The two rules together mean no candidate can be approved by anyone at all. The derivation documents this limitation in its own docstring; this stage is the first thing to measure it from outside. - [ ] M10.9.e Retract the source and assert stale/blast-radius/unpublish/ notification/history plus accessibility/tenant/tier boundaries. Evidence: full E2E trace. NOT ATTEMPTED, and recorded as such rather than part-done. This is the one stage that cannot be walked in isolation: retracting a source and watching the blast radius requires a source, content derived from it, and a publication — .a, .b and .d in ONE database, which is exactly what M10.9.b is blocked on. What it will need, from the routes that exist: `POST /api/admin/catalog/source-withdrawals`, `POST /api/admin/source-impact/{package_id}/changes` — which takes an `expected_graph_sha256`, so the source graph has to be there to be named — then `GET /api/source-ingestion/{package_id}/source-changes/{change_event_id}/blast-radius`, `POST /api/admin/catalog/bundles/{bundle_id}/unpublish` and the remediation route. The accessibility, tenant and tier boundaries are assertions over that trace rather than separate calls. - [ ] M10.10 Run full-journey Playwright: item authoring to accessible QTI export. Evidence: validation report. OPEN, AND NOT BECAUSE NOTHING WAS WALKED. Five children are recorded: .a captured and completed an item, .b proved a preview writes no learner record, .c broke and mended it through three of four gates, .e found and fixed a learner reading the answer key. What the PARENT claims is the end-to-end sentence — authoring THROUGH TO accessible QTI export — and both halves of the ending are missing: .d's export validation is M10.5.d's receipt and M10.5.d is open, and NONE of this is driven through a page. Every stage here is HTTP against a running service; the item-bank pages exist and no journey opens one. The "Playwright" in this item's own title is the part not done. - [ ] M10.10.a Capture/complete a representative stimulus-linked item with objective/standard/key/rationales/rubric/source and protected fields. Evidence: item journey. OPEN ON THE STANDARD, THE RUBRIC AND THE STIMULUS. The capture carries an OBJECTIVE and a SOURCE; a standard alignment, a rubric and a linked stimulus set are separate surfaces this stage does not reach, and none of it is driven through a page. DONE, OVER HTTP AGAINST A RUNNING SERVICE. `tests/test_item_authoring_journey.py`, 11 tests: capture a draft, author a complete selected-response revision against that exact draft revision, then read the item back on all four of its surfaces as an author and as a learner. - A capture keeps the objective, the source reference and WHO wrote it, with the tenant derived from the caller. A kind outside the vocabulary is refused by name. - A revision is bound to the draft revision AND its digest; a stale digest is refused, and content naming a source the draft does not have is refused as `selected_response_source_reference_drift`. The item's sources are the draft's sources, not a second list. - THE PROJECTION IS A LEARNER SURFACE AND SAYS SO: `surface: "learner"`, `protected_properties_visible: false`, and an `excluded_properties` list that NAMES the five it removed — `response_rule`, `answer_key`, `correct_rationale`, `distractor_rationales`, `misconceptions`. None of them is in the bytes. The protected export names the authority it answered to. - A learner reaches NONE of the four surfaces, including the projection built for a learner: the item bank is an authoring surface and a learner meets items through an assessment. WHICH IS THE POINT OF READING THIS BESIDE M10.10.e. The mechanism to withhold a key — a named learner projection with an explicit excluded list — already existed one module away from the assessment read that handed the key over. - [ ] M10.10.b Add modality-specific accessibility/locale/PNP content and verify real learner preview creates no attempt/grade/calibration event. Evidence: preview assertions. OPEN ON ADDING THE CONTENT. The accessibility and locale surfaces the authored revision carries come from this suite's own fixture rather than from a caller adding them modality by modality, and PNP (personal needs and preferences) is not touched at all. What IS proven is the second half of the clause, which is the one with a property in it. A PREVIEW IS A LOOK, NOT AN ATTEMPT. `tests/test_item_preview_journey.py`, 4 tests against a running service with the journey's database read directly — because the thing under test is A WRITE THAT MUST NOT HAPPEN, and the only witness to that is the table. Rendering a preview and scoring a response against EVERY option, including the right one, leaves `submissions`, `grade_ledger_entry` and `item_calibration_promotion_inputs` exactly as they were. The scoring is real while it happens: one option comes back `correct: true` and another `false`, so the preview is scoring rather than declining, and it reports `stable_option_identity_used`, meaning it scored the option's identity and not its position. AND THE COUNTER MOVES FOR A REAL ATTEMPT — a learner submitting through `/api/assessments/{id}/submit` takes `submissions` from n to n+1. Without that half, "nothing was written" could just as well have meant "nothing can be written here". - [ ] M10.10.c Trigger ambiguity/key/accessibility/QTI incompatibility, fix via revisions, and complete independent review/gates. Evidence: remediation journey. THREE OF THE FOUR WALKED; OPEN ON QTI INCOMPATIBILITY, which is M10.5.d's receipt and M10.5.d is open — the same blocker M10.10.d carries. `tests/test_item_remediation_journey.py`, 10 tests over HTTP against a running service, plus `evidence/v1-workbenches/metis-journey/remediation-journey.json`. Each class is walked the same way, and the second half is the half that can fail: make the gate say NO, fix it, make the SAME gate say YES. A gate that only ever says NO proves nothing. - Ambiguity: a distractor assessed as also satisfying the stem. The service derives `nonkey_correctness_not_rejected` from the key partition itself — nothing in the request names a category or a severity — and the gate refuses to publish. - Answer key: the keyed option's own text planted on a learner-visible `ui/stem`, found across a complete 22-channel, 144-artifact sweep as an `exact` match. - Accessibility: one automated check failing on the live item; `a11y-check:structure-semantics`, severity error, gate blocked. A CLEARANCE IS ABOUT ONE REVISION OF ONE ITEM. After the remediation revision the gate computed over the previous text stopped applying by itself: `mutation_reasons: ['responses_changed']`, and prepare turned `review_required` on. Nothing had to tell it. FOUND AND FIXED: THE AUTHOR COULD WAVE AWAY THEIR OWN ANSWER-KEY LEAK. The leakage gate answered `pass` / `release_allowed: true` over a scan that said `leak_detected`, carrying in its own `raw_findings` an `exact` exposure marked `exception_eligible: false`. The review counted only `confirm` as unresolved and never asked WHO decided, so the one instructor who wrote the item and submitted the artifacts could type "false positive" and ship the key. Every layer declares this is not exceptable — the finding, the review content and the gate content all carry a `Literal[False]` — and the one path around them was relabelling. `review_answer_leakage` now refuses a `resolve` or `false_positive` from the scan's own submitter; `confirm`, the safe direction, stays open to everybody. WHO THE SECOND PERSON CAN BE, measured rather than assumed: an instructor IS their own item-bank tenant, so a second instructor gets 404 in their own scope and 403 naming the author's — peer review is not a thing this service can express. An admin naming the tenant it acts into is the only shape independence has here, and the journey drives the release through one. - [ ] M10.10.d Assemble QTI package, inspect per-item diagnostics/loss report, validate externally, reimport, and compare semantics. Evidence: validation report. NOT ATTEMPTED, AND BLOCKED ON M10.5.d. This item's external validation IS M10.5.d's receipt, and M10.5.d is open: there is no canonical hotspot item to validate, so the conformance cell cannot close. The assemble-and-diagnose half is built — M10.5's `qti3_*` runtime publishes 26 loss codes behind a conformance gate — and the reimport-and-compare half needs the package this stage would assemble. - [ ] M10.10.e Assert answer-key absence from learner/UI/package-unprotected/ logs/URLs and role/tenant/accessibility behavior. Evidence: E2E suite. A LEARNER COULD READ THE ANSWER KEY. FIXED. `GET /api/assessments/{id}` and `GET /api/assessments` returned `correct_answer` and `explanation` to EVERY AUTHENTICATED CALLER, and both docstrings said so as though it settled the matter — "so this read requires an authenticated caller". The learner sitting the assessment is authenticated. A student calling either route was handed the answers to the quiz they were about to take. Proven live: a student's GET came back with `correct_answer: "Chlorophyll"` and the explanation, then the same request after the fix came back with neither. The fix is a projection, not a filter on one field. A caller who is not an instructor gets the questions with `correct_answer`, `explanation` AND the evidence bundle removed — the bundle's claims are extracted from the explanation's own text, so redacting the field and leaving the bundle would MOVE the answer rather than withhold it. Measured M9.15's way: a word planted in the explanation and nowhere else, looked for in the RESPONSE BYTES. The correct option's text is one of the options a learner must see, so its presence proves nothing. TWO WRITES ANSWERED 500 FOR EVERY CALLER, found on the way in. `POST /api/courses` serialises `modules` and `POST /api/assessments` serialises `questions`; both are lazy relationships, and reading one during serialisation happens outside the async session's greenlet. Every create raised `MissingGreenlet` and returned "an unexpected error occurred". Both load the relationship before the response is built now. Nothing caught it because no test creates either over HTTP. `tests/test_answer_key_absence_journey.py`, 6 tests against a running service, including the one that makes the others mean something: an instructor STILL sees the key, so a fix that redacted for everybody would fail here. OPEN ON THE REST OF THE CLAUSE: the UI, the unprotected part of a QTI package, logs and URLs are not covered, and neither are the tenant and accessibility behaviours. M10.10.c reached the machinery that WOULD cover them and found the limit. `answer-leakage` enumerates 22 learner-visible channels — `log`, `url`, `deep_link`, `qti` package payloads, `export`, `error`, `trace` among them — and a scan of a complete 144-artifact set across all of them returns `coverage.complete: true`. But A COVERAGE RESULT ATTESTS TO THE SUBMISSION, NOT TO THE SYSTEM: every artifact is supplied by the caller. `LearnerVisibleLeakageArtifact` has NO producer in this estate — it is defined in the schema, consumed by the helpers, typed in the generated client, and constructed only by test fixtures. The workbench page at `apps/metis/web/src/app/create/item-bank/answer-leakage` is a textarea a human pastes a capture into, and it fails closed on an empty one, which is the right posture and not a harvest. So the honest reading is: the SCANNER is proven across 22 channels and the gate that judges it is now sound (M10.10.c), and nothing walks the running system's logs, URLs or packages to feed it. That harvest is what this clause still needs. - [ ] M10.11 Run full-journey Playwright: psychometric review to item revision. Evidence: calibrated data fixture remains isolated. OPEN ON TWO THINGS, WITH .a, .c AND .d DONE. The word in this item's own title is Playwright and nothing here is driven through a page: the review pages named above exist and no journey opens one, which is also what leaves .e's accessibility clause unwalked. And .b is open on parameters, fit and standard errors, because the review contract REFUSES an estimate without uncertainty and nothing in this estate fits a model to responses — the IRT surface attests an external tool's output and no tool is wired to it. What the stage did establish is that the fairness analysis is sound under both questions: it invents nothing on a null sample carrying real sampling noise (.b), and it finds a planted shift on the one item it was planted on (.c). Those are only worth anything together. - [x] M10.11.a Seed isolated synthetic calibrated response sample with exact item/model/method versions, privacy-safe cohorts, and known CTT/IRT/DIF/ exposure outputs. Evidence: fixture manifest. THE M6.5 SIMULATION COULD NOT PRODUCE ONE, and that had to be fixed first. Its response rule drew against the learner's prerequisite satisfaction alone, so the delivered item could not move accuracy — while the pool engine beside it bands eligibility by a mastery DIFFICULTY window and offers a `nearest_target_difficulty` strategy. A simulation whose selection layer targets difficulty and whose response layer cannot feel it measures nothing it varies. Measured on the baseline corpus: the correlation between an item's observed p-value and its declared difficulty was +0.575, the WRONG SIGN, on two to nine responses an item. The model is now Rasch — ability is the logit of the persona's declared satisfaction, difficulty is the item's declared centilogits, and at the average difficulty of zero the probability is the persona's satisfaction exactly, so that field keeps its meaning. `response_method` and its schema literal are v2. DONE: THE TRUTH CAME FIRST. `src/metis/schemas/calibration_fixture.py`, `src/metis/services/calibration_fixture.py`, `scripts/export_calibration_fixture.py` (`pnpm run metis:calibration:fixture`, `--check` compares documents not bytes), `tests/test_calibration_fixture.py` (13 tests), and `evidence/v1-workbenches/metis-calibration-fixture.json`. 400 synthetic learners give 4,100 responses over 16 items, generated by the M6.5 engine through the same item-pool eligibility engine a real delivery calls. Item difficulties and persona abilities are DECLARED and the responses are drawn from them, which is what makes the outputs known rather than asserted: the observed proportions correct recover the declared difficulty ordering at a Spearman correlation of −0.9794. - Exact versions: engine id, engine version, `response_method`, eligibility engine id, the cohort seed, a digest of the whole request, and each item pinned to its revision sha256. - Privacy-safe cohorts: a cohort here is a PERSONA, an authored distribution, so it names no attribute of a person. All 16 items clear the 30-per-cell floor in both cohorts — the same floor `dif_analysis` will judge the sample by, because a sample built to feed an analysis may not be assembled under a laxer rule than the one that will judge it. The model refuses a released cell below the floor, and refuses a suppressed cell that still carries the counts it suppressed. - CTT: proportion correct and the item-REST correlation, so an item is never correlated with a total containing itself. - Exposure: per-item count and rate in basis points. - DIF: BOTH GROUPS ARE ONE POPULATION WEARING TWO LABELS, drawn from a single declared ability range, so the ground truth is `none_injected`. A fixture whose groups genuinely differ only tests that a detector finds a planted difference; this one tests the direction that matters, that a detector does not INVENT one. And it publishes the size of its own noise: with no DIF present at all, sampling alone still produced a largest group gap of 0.2036. A detector whose threshold sits under that reports unfairness against an innocent item on every null sample it is ever shown. - Isolation: the M6.5 import-closure and output-identity scan over this exact run — isolated, 0 unlabelled records, 0 real-identity matches — and the manifest refuses to validate if it is not. - [ ] M10.11.b Review raw parameters/fit/SE/sample/uncertainty/DIF/privacy/ declared difficulty without exposing learner records. Evidence: review journey. DIF, PRIVACY AND AUTHORITY WALKED; OPEN ON PARAMETERS, FIT AND SE, and the reason is the honest one: the review contract REFUSES what an unfitted sample can offer. `Estimate` will not accept a difficulty, a discrimination, a guessing parameter or a point-biserial as a bare number — "a point estimate on its own reads as precise and a reviewer compares two spurious digits" — and the standard error it wants means fitting a model to responses. NOTHING IN THIS ESTATE FITS ONE. The IRT surface is an attestation of an external tool's output and no tool is wired to it, so M10.11.a's sample can put a proportion correct, a sample size and an exposure rate in front of a reviewer, and must report difficulty and discrimination as `unavailable` with the reason. `tests/test_psychometric_review_journey.py`, 14 tests. THE MULTIPLICITY CORRECTION IS LOAD-BEARING, MEASURED. DIF is the one analysis here that really computes — weighted logistic regression, Newton-Raphson, inverse observed information, two-sided Wald, Holm — so M10.11.a's sample was run through it for real. In a sample with NO differential item functioning in it, 11 of 16 items produced a uniform effect at or beyond the policy's materiality threshold of 0.5, the largest reaching 1.45, and the largest |z| was 2.05 — whose UNADJUSTED p-value clears alpha. Holm over the family of 32 hypotheses takes the smallest adjusted p to 1.0 and all 16 come back `no_statistical_signal`, `direction: none`, no human review required. Without the correction this run publishes a fairness finding against an innocent item. THE EXISTING DIF SUITE COULD NOT HAVE SHOWN THAT. Its null fixture gives reference and focal the identical correct-count in every stratum — (4, 7, 10, 13, 16) against (4, 7, 10, 13, 16) — a null with no sampling variation in it at all. Nothing in it ever asks what the correction is for. M10.11.a's sample wobbles as much as chance makes it wobble, which is why it can. Privacy: no result carries a learner reference or a per-response row; every released cohort sample is at or above the floor it declares; and M9.6's complementary suppression holds — one suppressed cell beside a published total gives the cell back, so a second is withheld and `recoverable_by_subtraction` comes back empty. Authority: promoting is a psychometrician's alone, restricting and retiring need a psychometrician AND a fairness reviewer, and an analyst may only ask for a re-run or record what they saw. A statistical signal is not a cause and never an individual: every result carries `bias_cause_established: false` and `individual_inference_supported: false`. - [x] M10.11.c Trigger insufficient/misfit/DIF or exposure blocker and record psychometric/fairness decision. Evidence: gate journey. DONE, WITH A MATCHED PAIR. `tests/dif_control_fixtures.py` and `tests/test_dif_gate_journey.py`, 10 tests over the real analysis. Both samples come from ONE generator, one seed and one set of declared item difficulties; the only difference is a shift of 120 centilogits planted on one item for the focal group. So a detector that answers differently is answering to the plant, and one that answers the same is not detecting anything. M10.11.b asked the negative question — does it invent a finding where there is none — and this asks the positive one. A gate that never fires and a gate that always fires each pass half of these tests and neither is a gate. - DIF BLOCKER: exactly one item flagged, the planted one. Uniform effect −1.065, Holm-adjusted p 0.0019, `material_signal`, `human_review_required: true`, and `direction: reference_favored` — the right way round, since the focal group met that item harder. The same item in the null answers `no_statistical_signal`, and the other seven are unmoved in both. - INSUFFICIENT BLOCKER at 40 learners a group against the `locale_family` floor of 50: `status: insufficient`, `finding: inconclusive`, effect and significance both `suppressed`, and the `sample`, `model_fit` and `multiplicity` checks fail. AN INSUFFICIENT RUN HIDES ITS OWN CELL SIZES — both cohort samples come back suppressed with `source_n: null`, because reporting "too few to analyse: 40 and 40" would publish the very counts the floor exists to protect. - THE DECISION NEEDS TWO DISCIPLINES AND TWO PEOPLE. Recording one requires a psychometrician AND a fairness reviewer, two distinct reviewer ids, both recommending the action actually recorded. One person signing twice is refused, one discipline signing twice is refused, and a second signature on an action only the first recommended is refused. No decision may set `establishes_bias_cause` or `individual_inference_supported`: a statistical signal says an item behaved differently, not why, and never anything about one person. - [x] M10.11.d Create a new item revision/remediation, retain old calibration/ use/decision, and set new revision uncalibrated until evidence exists. Evidence: lifecycle assertions. DONE. `tests/test_calibration_lifecycle_journey.py`, 7 tests. A CALIBRATION BELONGS TO A REVISION, NOT TO AN ITEM. Three things have to hold at once and they pull in different directions: the new revision is not calibrated because nobody measured it, the old calibration is not deleted because it was true of the item it was about, and the old evidence does not quietly carry over. - The revision that has its own evidence is `eligible_for_ratification` with every check passing — the half that can fail, so the refusals below mean something. - Present the same 640 well-formed attempts against a revision they were not gathered on and `exact_revisions` reads `stale`, the status drops to `manual_review`, and the route is never `calibration_ratification`. It reads `stale` rather than `fail` because nothing is wrong with the evidence — it is about something else. - THE OLD ATTEMPTS STOP COUNTING RATHER THAN MERELY BEING FLAGGED. `effective_sample`, `response_distribution` and `administration_diversity` all go from `pass` to `insufficient`. This is the distinction that decides whether the guard holds: a system that flagged the mismatch and still counted 640 attempts would report a well-powered calibration with a warning attached, and a warning beside a green number is read as a green number. - SUPERSEDING IS NOT ERASING. The old receipt still names the revision it was measured on, its sample and its attempt count, and it is sealed over its own content — repointing it at the new revision breaks the seal detectably. It also never claims `promotion_applied`, and it expires, so an old calibration cannot be leaned on forever. The failure this guards against is one of omission: keeping a calibration keyed to the item rather than the item REVISION means a one-word fix to a stem silently inherits a difficulty estimate measured on different words, and nothing anywhere reports an error. - [ ] M10.11.e Prove synthetic fixture cannot enter real analytics/grade/ training data and verify role/tenant/accessibility boundaries. Evidence: isolation E2E. ISOLATION, ROLE AND TENANT PROVEN; OPEN ON ACCESSIBILITY, which needs a browser against the psychometrics pages and is the same unwalked UI half M10.10's parent carries. `tests/test_calibration_isolation_journey.py`, 10 tests. THE STRUCTURAL PROOF IS THE STRONGER ONE. The transitive import closure of everything this stage runs — the M6.5 simulation, the fixture generator and the DIF analysis — contains no database, ORM, learner store, gradebook, analytics or export module. That says the sample CANNOT reach a learner record, which is a better claim than "it did not this time"; counting rows can only ever show the second. The scan is proved able to fail by walking outward from `aggregate_store`, which is built on SQLAlchemy and is duly caught. NO SANDBOX IS CLAIMED. The closure does pull in socket and TLS transitively through the standard library, and the test asserts that it does, so the claim cannot quietly grow into one about confinement. Dynamically: the sample's isolation report is `isolated` over a non-empty scan with every record synthetic-labelled, 0 unlabelled and 0 real-identity matches; no learner reference survives into a DIF result; and generating the fixture and running both analyses moves no row in any of the nine tables a person's work lands in — submissions, the four grade-ledger tables, the two gradebook-correction tables, training intake and calibration promotion inputs. FOUND AND FIXED: A STUDENT REACHED AN `/api/admin/` ROUTE. `psychometric_review` took plain `get_current_user` while all four sibling psychometric surfaces — `dif_analysis`, `irt_diagnostics`, `calibration_promotion`, `exposure_control` — already required instructor or admin. `AUTHORITY_FOR_USER` maps `"student"` to `analyst`, an authority that may request a re-run and record a review. Measured over HTTP: a student got 200 and `authority: analyst` from `/api/admin/psychometrics/queue`. Nothing had leaked, because the tenant is derived from the caller and a student's queue is their own and empty — but the exposure was one scoping parameter away and the route is mounted under `/api/admin/`. It requires instructor authority now and the same request answers 403, measured against the running service. OPEN, AND THE SAME SHAPE AS M10.9.d: NOBODY CAN BE A FAIRNESS REVIEWER. `restrict` and `retire` are the two dual-control actions and they are permitted to a psychometrician and a fairness reviewer. `fairness_reviewer` is reached only by a user whose platform role is `"reviewer"`, and this service issues `student`, `instructor` and `admin`. So the discipline that exists to check a psychometrician cannot be occupied by anybody, and the second signature on a high-impact fairness action is unobtainable. That is a gap in the role vocabulary rather than in the mapping, and closing it needs a platform role this service does not have. - [ ] M10.12 Run full-journey Playwright: integrity decision, appeal, and gradebook correction. Evidence: role separation. OPEN. .a and .b are done; .c has no surface to walk, .d has no store, and .e's answer is a defect rather than an assertion. Nothing here is driven through a page, which is this item's own title again. - [x] M10.12.a Seed a synthetic learner attempt, attributed uncertain integrity signal/evidence, separate reviewer/decider/appeal/grade roles, and policy. Evidence: fixture. DONE over HTTP against a running service. `tests/test_integrity_decision_journey.py` records a signal carrying its model id, its model version, its collector version, a confidence INTERVAL with a stated basis and sample size, and the raw classifier output beside the threshold it was judged against — so a reviewer can see how close to the line it fell rather than only which side. A SIGNAL IS AN INDICATION AND THE TYPE WILL NOT LET IT BE A FINDING. The projection carries `is_conclusion: false` and `language: classifier_indicates` as literals, so no payload, however constructed, can present a detection as a conclusion. The evidence is a chain in which each link names the digest of the one before it, so nothing can be inserted into a settled chain without breaking every link after it. The four roles are separate in the engines rather than in one fixture: the reviewer and integrity-lead audiences come from the caller's role, the decider independence is by actor digest in the appeal engine, and the grade roles are the scorer, requester, reviewer and approver of the correction engine. - [x] M10.12.b Review signal/evidence/model/version/uncertainty, request evidence, and record initial human decision/explanation. Evidence: decision journey. DONE. `tests/test_integrity_decision_journey.py`, 11 tests over HTTP. The queue shows the signal, a view names the audience that saw it and leaves an access-audit trace with a digest and a time, asking for evidence moves the signal `new` to `evidence_requested` and records who asked, the history reads back, and an action naming a version that has moved is refused `stale_expected_version`. NO REVIEW VERB CAN CARRY A GRADE OR A CONSEQUENCE, and not because a check forbids it: the four verbs are `request_evidence`, `dismiss`, `escalate` and `open_case`, and `ReviewAction` has no field for one. FOUND: THE ESCALATION THIS AUDIENCE MODEL EXISTS FOR CANNOT HAPPEN. `escalate` is one of the four verbs and there is nobody to escalate to. `_authority` sets `tenant_id` to the caller's own user id for every audience, and this router — unlike the item-bank surfaces, which take `?tenant_id=` for exactly this reason — offers no parameter to act into another tenant. Measured: an integrity lead gets 404 on both the history and the view of a signal a reviewer recorded. AND THE ACCOUNTABILITY RECORD IS THE CASUALTY. The access audit exists so somebody can see which reviewer opened which signal. A reviewer is correctly refused it, 403. The integrity lead who may read it gets 200 and an empty list, because it is scoped to their own tenant and the reviewer's views sit unreadable in another. The views it exists to record are the exact views nobody can read. - [ ] M10.12.c File learner appeal, enforce independent restricted reviewer, add evidence, and overturn/modify/remand with immutable history. Evidence: appeal journey. NOT WALKABLE: THE APPEAL WORKFLOW HAS NO SURFACE AND NO STORE. `apps/metis/service/src/metis/api/appeal_workflow.py` is 27 lines and mounts exactly ONE route, `GET /api/appeal-workflows/evaluation`, which returns the engine's own labelled-corpus report. There is no route to file an appeal, add evidence, decide, overturn, modify or remand, and no table holds an appeal case — the only appeal table in the schema is `item_exposure_appeals`, which belongs to M6 exposure control and is a different thing. The engine itself is real and well made: `appeal_workflow_engine` is a state machine whose `decide` refuses a decider who owned the detector or reviewed the signal (`not_independent`), who declared a conflict with this learner, who names a stale version, or who acts before the evidence and the learner's explanation are settled — all BY ACTOR DIGEST rather than by JWT role, which is what this stage's spec asks for. It is imported by its own evaluation corpus and by `integrity_audit_engine`, and by nothing that a person can reach. So the independence rule this item exists to walk is implemented and unreachable. Closing this needs the routes and the persistence, not a test. - [ ] M10.12.d Request/approve append-only grade correction and reconcile aggregates/integration/learner visibility. Evidence: correction journey. APPEND-ONLY AND LEARNER VISIBILITY WALKED; OPEN ON RECONCILIATION, because there is nothing durable to reconcile. `tests/test_grade_correction_journey.py`, 7 tests over HTTP. A grade is a sequence of events and an approval appends one — the disputed event stays in the history beside the value that replaced it, and the sequence numbers stay ordered and unique. A correction cannot be approved without a notice to the learner (`learner_not_noticed`), and a decision naming a version that has moved is refused. THE TABLES HAVE A READER AND A WRITER AS OF 2026-09-13. They did not before: `POST /decisions` read the request, the history and the prior decisions out of the request body, computed, and returned, loading nothing and saving nothing. Migration 044 created `gradebook_correction_grade_events` and `gradebook_correction_correction_decisions` and NOTHING IN THIS REPOSITORY READ OR WROTE EITHER — no ORM model, no repository, no statement naming them, checked repo-wide — and a test asserted that absence so the day a writer appeared it would say so. That test has now flipped to `test_the_store_the_server_consults_is_real`, and it asserts the property that was actually missing: not that a row exists, but that a decision recorded by one HTTP call CONSTRAINS THE NEXT ONE. `models/gradebook_correction_store.py`, `services/gradebook_correction_ store.py`, and migration 076, which indexes the `content_json::jsonb ->> 'request_id'` expression the lookup filters on so the separation check does not become a scan of every decision a tenant ever made. Measured against a live service: 20 decisions and 4 grade events durable in the two tables after the journey suite ran twice, and the suite passes on the second run because the rules read state rather than reset with the process. A DEFECT IN THE ABOVE, FOUND AND FIXED THE SAME DAY. The first version of the route resolved its tenant with `resolve_item_bank_tenant`, which returns the actor's RAW UUID, while the grade ledger these corrections correct is written by `api/gradebook_ingress.py` under `uuid5(NAMESPACE_URL, "metis-tenant:" + user.id)` — the derivation `deps.tenant_of` documents as "derived and never accepted". For the SAME signed-in instructor those are two different UUIDs, so a correction and the grade it corrects were landing in different partitions. 23 API modules use the uuid5 derivation; this route was the only one using the item bank's, which is that family's convention for its own services. Nothing misbehaved — no code joins the two stores yet, and no exploit is claimed — but a reconciliation across two partitions is impossible BY CONSTRUCTION rather than merely unbuilt, which is the thing this very clause asks for. Now `tenant_of(current_user.id)`; instructor authority was already required by the route's dependency, so the resolver's role check was redundant. Re-measured against a live service on a fresh database: the 9 journey tests pass over HTTP, all 9 decisions and 2 grade events land under `tenant_of(the instructor)` — the ledger's partition — and the same caller approving their own request is still `REFUSED ['reviewer_cannot_approve']`. RECONCILIATION IS STILL NOT WALKED. Two corrections to one grade now share state, which is what this clause said was impossible, so the blocker as written is gone. But `POST /aggregates` still recomputes over inputs the caller hands it, so nothing yet reconciles an aggregate ACROSS the corrections now on record. That is what remains here, and it is a smaller thing than what it replaced. - [ ] M10.12.e Assert original reviewer/system actor cannot decide appeal/ grade, protected evidence redaction, tenant isolation, and accessibility. Evidence: separation E2E. ASSERTED. THE GRADE HALF NOW HOLDS; THE APPEAL HALF CANNOT BE ASKED. A SEPARATION OF DUTIES ENFORCED AGAINST HISTORY THE ACTOR SUPPLIES IS NOT A SEPARATION OF DUTIES. The three grade rules are right and each has its own refusal — the scorer cannot review, the requester cannot decide, the reviewer who moved a request on cannot approve it — and all three fire when the server is told. But only ONE of their four inputs came from the session. `actor_digest` is derived from the token and no body field can move it, which is the half that was always right. The grade history, the correction request and the prior decisions were all read out of the REQUEST BODY, and `prior_decisions` defaulted to an empty tuple. MEASURED OVER HTTP, ONE CALLER, ONE REQUEST, BEFORE: they ask for changes and the service records their digest as the reviewer; they then APPROVE THE SAME REQUEST and it SUCCEEDS, because the default value of a field is to mention nothing. Only the identical call that disclosed the first decision was refused. The rule was asking the person it is meant to constrain. FIXED 2026-09-13, AND THE FIX WAS PERSISTENCE RATHER THAN A CHECK. The same walk against the same service now answers `reviewer_cannot_approve` on the second call, with NOTHING in that call mentioning the first: `POST /decisions` loads the prior decisions from the store and `prior_decisions` is gone from the published request shape — refused, not ignored, because a silently dropped field would leave a caller believing they had disclosed something. The store is .d's, and the tenant it is scoped by comes from the session through `resolve_item_bank_tenant`, never from a payload; scoping it by a body field would have put the hole back one level down. WHAT IS STILL BODY-SUPPLIED, said plainly: the grade history and the correction request. Those are two of the four inputs and they are unchanged, so this clause's finding is half closed, not closed. The appeal half of this clause cannot be asserted at all — see .c, where the independence rule exists and no route reaches it. Redaction and tenant isolation hold on the signal surface: a view names the fields it showed and withheld, a reviewer is refused the access audit (403), and a learner is placed in the learner audience and sees an empty queue. Accessibility stays open with every other UI clause in §M10. - [ ] M10.13 Run WCAG 2.2 AA automation, keyboard journeys, and screen-reader announcement tests across authoring and preview. Evidence: report matrix. OPEN, with .b done and the rest measured. THE THREE DEFECTS THIS STAGE FOUND WERE ALL INVISIBLE TO THE GATE THAT EXISTED — two because the rule was switched off, and one because no scan can see when a live region is mounted. That is the report matrix's real finding: the coverage was wide (every route visited) and shallow (one state, one rule set, no traversal). A real assistive-technology run belongs to S11.5.f and is not claimable here; this stage's own spec note says so, and .d is DOM assertions by design. - [ ] M10.13.a Maintain critical route/state/role/action inventory for hub, course/item/source/graph/review/calendar/localization/media/credential/ integrations and learner preview. Evidence: coverage matrix. ROUTE COVERAGE IS ESSENTIALLY COMPLETE AND IS NOT THE GAP. Measured across both applications: all 65 admin route groups are visited by at least one spec, and 10 of the 11 web route groups are — only `saved` is never opened. 71 admin specs and 66 web specs. THE GAP IS STATES AND ACTIONS, NOT ROUTES, and M10.13.b/.d proved it twice over. Both contrast defects lived in an EMPTY STATE, so every spec that visited the route with data in it passed; and the 41 unannounced live regions are a mounting pattern no route visit can see. A route-level matrix would have shown green for all three. So the inventory this item asks for is the wrong shape to catch what was actually wrong here. What the stage needed, and what .b and .d now have, is a matrix over STATES — empty, loading, error, populated — and over the mount-time behaviour of announcements. Recording that rather than producing a route table that would have said everything was fine. - [x] M10.13.b Run automated rule scans across themes/viewports/locales/zoom/ reduced motion after key interactions and error states. Evidence: scan reports. THE SIGNOFF WAS GREEN BECAUSE THE RULE WAS OFF. FIXED. `wcag-aa-signoff-v1-p2-3513.spec.ts` is named "Metis admin WCAG 2.1 AA signoff" and ran with `disableRules: ['color-contrast']`, deferring to a design-token migration named with no owner and no date. 1.4.3 Contrast (Minimum) is AA and is the rule a real interface is likeliest to break, so the signoff was silent about exactly the thing it was named for. The carve-out is REMOVED and the spec passes with the rule on. TWO REAL DEFECTS BEHIND IT, both in shared components and both in EMPTY STATES, which is why every scan of a populated page passed: `DataTable`'s "no rows" message was #9ca3af on white, 2.53:1, and `ActivityFeed`'s was #9ca3af on #f9fafb, 2.42:1. Both are #64748b now, 4.76:1 and 4.63:1. The empty state is the only message a reader has when there is nothing else on the card, so it is the worst place to be faint. The failures looked intermittent until the cause was found: they appeared whenever a fetch failed and left a table empty. WCAG 2.2 RAN FOR THE FIRST TIME. Both Metis applications take their gate from `axeAfterEach`, which declares the 2.1 terms, and the one hand-rolled helper in `apps/metis/web` declares the same four. So nothing in Metis had ever asked for the 2.2 terms. Measured against the axe-core installed here (4.11.4), they add EXACTLY ONE RULE: 68 rules to 69, and the addition is `target-size` — 2.5.8 Target Size (Minimum). It also ships `enabled: false` in axe's metadata, so naming the tag is what turns it on; scanning with no tags at all leaves it off. Result: NO `target-size` violations across eight authoring surfaces at desktop width, nor on the hub at 390px, which is where pointer targets are smallest. That is a fact nobody had established. `e2e/support/wcag22.ts`, `e2e/wcag22-target-size.spec.ts` (10 tests) and `e2e/contrast-carve-out-census.spec.ts` (13 surfaces, a ceiling of zero that can only be ratcheted down). 52 of 52 green over two repeats, chromium. OPEN: themes, locales and reduced motion are not varied here — the scans run one theme, one locale and default motion. - [ ] M10.13.c Run keyboard-only focus/order/visibility/shortcut/non-drag/ editor/graph/calendar/media/modal/save/conflict journeys. Evidence: keyboard reports. TRAVERSAL WALKED ON THE LEARNER APP; the widget-by-widget list above is not, and the counts say why that matters. MEASURED FIRST: across the 65 specs in `apps/metis/web`, twelve press a key and NONE PRESS TAB. The keys they press are arrows, Enter, Home and End — widget keys, pressed inside a component that already holds focus. Nothing asked the question a keyboard user asks first, which is whether Tab reaches the controls at all and in what order. The admin app is thin rather than empty: 4 of 69 specs press Tab, and the one named "every control is reachable and operable from the keyboard" presses it once, between two adjacent filters. `apps/metis/web/e2e/keyboard-traversal.spec.ts`, 5 tests, 15 of 15 green over three repeats on chromium. The assertions are properties rather than one page's layout, so they keep meaning when it changes: every visible control is reachable by Tab alone; the order Tab visits them in is document order, with no positive `tabindex` lifting a control out of it; focus is visible on whatever holds it; nothing traps the keyboard; and the sign-in form can be completed and submitted without a pointer at all. The login page passes all five. Two things had to be right in the harness before that meant anything: Next's dev overlay is focusable and Playwright's locators pierce its shadow root, so it had to be stepped over on both the walk and the enumeration or the test measures the harness; and Tab WRAPS to the top after the last control, so an order check spanning the wrap reads a correct cycle as a jump backwards. OPEN: the editor, graph, calendar, media, modal, save and conflict journeys the item names, and shortcuts and drag alternatives. This walks one page thoroughly rather than eleven surfaces shallowly. - [ ] M10.13.d Run screen-reader name/role/value/instruction/status/live update/ validation/selection/decision and semantic alternative journeys. Evidence: announcement reports. FOUND: 41 LIVE REGIONS THAT ARRIVE WITH THEIR MESSAGE AND ARE NEVER ANNOUNCED. `aria-live="polite"` and `role="status"` tell assistive technology to watch an element and read what CHANGES inside it. NVDA and JAWS attach that watch when the region enters the accessibility tree, so a region inserted already containing its text has nothing to change — the text was there when the watch began. The shape across `apps/metis/web` is the silent one: {feedback ?

{feedback.message}

: null} and the shape that works is the region rendered from the start, empty, with the message written into it. The consequence is not subtle: a learner submits a form, a sighted user sees the confirmation, and a screen-reader user is told nothing. 41 of these across 37 files. `role="alert"` is excluded and is NOT a defect — an alert is defined to be announced when it appears, so inserting one with its text is correct; there are 13 of those and they are left alone. Getting that distinction wrong would have condemned a correct pattern. `src/lib/live-region-insertion.spec.ts` is a ceiling rather than a zero, because each site has to be moved by hand with its styling. Three of the most learner-facing are fixed — the standards alignment, objectives and decisions pages — and the ceiling stands at 38 and may only go down. The gate also proves it can fail and refuses to count an alert. WHAT WAS ALREADY GOOD: 24 of the 65 web specs assert on live regions and 62 product files declare one, so the vocabulary is used widely and the defect is in HOW the region is mounted, not in whether anybody thought about announcements. OPEN: name/role/value and the validation, selection and decision journeys are not walked, and a real assistive-technology run is S11.5.f's matrix rather than this one — this stage's own spec note says so, and it is not claimable here. - [ ] M10.13.e Verify real learner preview parity and PNP/MathML/code/table/ media/interaction alternatives. Evidence: content accessibility report. NOT WALKED AS A JOURNEY, but two precise findings came out of reading the delivery renderer, and both are about the same image. FOUND: AN IMAGE NOBODY DESCRIBED IS PRESENTED AS DECORATION. `LessonDeliveryRenderer` renders `{media.alt_text`. An empty `alt` is not "no description" — it is an assertion that the image is decorative and assistive technology should skip it. The model cannot tell the two apart: `alt_text` is nullable and there is NO `decorative` flag anywhere in the web app or the service schemas, so a null can only mean nobody wrote one. A learner using a screen reader is silently given nothing, and is not told that anything is missing — while the same component renders a visible "Reason: …" when media is withheld, so the codebase plainly knows how to say a thing is absent. AND THE FALLBACK THAT WOULD FIX IT EXISTS AND IS UNREAD. `image_fallback_alt` is declared on `lesson_technical.py`, published in the OpenAPI document and typed in the generated client — and no component in `apps/metis/web` reads it. Its only other appearance in the repository is one test fixture, set to `null`. `MediaBlock` is also handed a `fallbackText` it does not use for the image either. No test covers the null case, which is why this survived: the one renderer spec sets `alt_text` to a real sentence. What IS present and good: `role="math"` carries `aria-label` from `speech_text`, code blocks are labelled by language, and audio and video carry titles — so the alternatives vocabulary is real and it is the image path that drops it. OPEN: preview parity between the learner view and the authoring preview, PNP, and table and interaction alternatives are unwalked, and only 3 files in the web app mention PNP at all. - [ ] M10.13.f Triage owners/severity and block release on current unresolved applicable violations. Evidence: zero-blocker report matrix. RELEASE IS BLOCKED ON THEM NOW, WHICH IT WAS NOT BEFORE. The gate that was supposed to do this ran with `color-contrast` disabled, so the one rule most likely to be violated could not block anything. That carve-out is removed (.b) and three gates stand in its place, each of which fails rather than warns: - `wcag-aa-signoff-v1-p2-3513.spec.ts`, 13 surfaces, now with contrast on. - `contrast-carve-out-census.spec.ts`, the same 13 surfaces against a contrast ceiling of ZERO that may only be ratcheted down. - `wcag22-target-size.spec.ts`, 8 surfaces plus a 390px viewport under the WCAG 2.2 terms. - `live-region-insertion.spec.ts`, a ceiling of 38 on regions that arrive with their message, down from the 41 measured. CURRENT UNRESOLVED APPLICABLE VIOLATIONS, all found this stage: - contrast on two shared empty states — FIXED, both components. - 38 live regions that arrive with their message — OPEN, held at a ceiling; each needs moving by hand with its styling. - a null `alt_text` rendered as `alt=""`, and `image_fallback_alt` published by the API and read by nothing — OPEN (.e). - keyboard traversal on ten of the eleven surfaces the item names — OPEN (.c). NO OWNER FIELD EXISTS TO TRIAGE INTO, which is the honest answer to the first half of this item. The estate has no accessibility owner registry and `skipAxe` — the control this would be recorded against — is a bare boolean with no owner, reason or expiry, 247 uses across 241 files estate-wide. Metis is the good citizen there: 1 of its 137 specs uses it, and the one new use in `wcag22-target-size.spec.ts` replaces the scan with a WIDER one rather than giving anything up. A severity ordering is available and used — everything above gates on axe's `serious` and `critical` — but owners and expiries are not expressible, so the triage half of this item stays open. - [ ] M10.14 Run performance budgets for large courses, item banks, graphs, search, save, preview, and export. Evidence: trend reports. OPEN ON A CHAIN THAT STARTS OUTSIDE THIS REPOSITORY. Production volume is unrecorded, so .b cannot build a representative corpus; .c and .d profile against it; .e needs both a baseline and a ratified budget, and the budget type deliberately refuses to exist without a ratifier. Each link is measured rather than assumed, and .a still found and gated a real defect on the way: a script budget that cannot bind. - [ ] M10.14.a Ratify scenario/device/network budgets for load/interaction/ render/save/search/export latency, payload/query, CPU/memory/network, throughput, and error rate. Evidence: budget spec. BLOCKED ON AN AUTHORITY, AND THE TYPE IS RIGHT TO BLOCK IT. `LatencyBudgetSpec` requires `ratified_by` and `ratified_at`, so a budget cannot exist in this estate without naming who ratified it. That is the correct design and it means this item cannot be closed by writing numbers: I can propose them and cannot ratify them. Recording rather than inventing a ratifier. WHAT METIS ALREADY HAS, measured: - A good budget CONTRACT. `LatencyBudgetSpec` carries p50/p95/p99 per tier and per stage, pairs device WITH network because "a p95 for a phone on 3G is not a p95", refuses a higher percentile with a tighter budget, and refuses a stage that times out before its own budget is spent. - Exactly ONE ratified instance: `budget:adaptive-next-item` v1.0.0, ratified by the Performance Working Group on 2026-08-01 — and it lives in `adaptive_latency_evaluation.py`, an evaluation corpus, so it is a budget the engine is scored against rather than one the running system is held to. - Client budgets on 5 routes in `lighthouse-budget.json`: paint and interaction timings, resource sizes and counts. NONE OF THE SEVEN SCENARIOS THIS ITEM NAMES HAS A BUDGET — large courses, item banks, graphs, search, save, preview and export. Nor does any Metis artefact budget query count, memory, CPU, throughput, concurrency or error rate; the estate's own I9.14.a recorded 6 of 12 dimensions budgeted anywhere and Metis is not in that count. FOUND: A BUDGET THAT CANNOT BIND IS NOT A BUDGET. On all five budgeted routes the `script` resource budget EXACTLY EQUALS the `total`, so it is satisfied by every page the total already admits and can never be the constraint that fails. Scripts are the dominant payload in a Next application, so the one resource type most worth constraining was the inert one. `image` and `font` sit below their totals and do bind — checking that stopped this being overstated. `src/lib/performance-budget-coherence.spec.ts`, 5 tests: every routed path is budgeted, every route states a total, paint metrics are ordered, and the inert count is held at a ceiling of 5 that may only go down. It is a ceiling rather than a zero because correcting it means choosing numbers, and this item's own rule is that budgets are ratified BEFORE being measured against — a number picked to fit the bundle that exists is a description. - [ ] M10.14.b Create production-scale course/item/stimulus/media/source/graph/ locale/revision/review fixtures with documented distributions. Evidence: fixture manifest. BLOCKED AT ITS ROOT: NOBODY KNOWS WHAT PRODUCTION SCALE IS. The estate's own persistence inventory records it — `evidence/v1-workbenches/metis-persistence-inventory.json` carries `observedProductionBytes: null`, `observedProductionRows: null` and `productionVolumeEvidence: "not present in the repository; capacity baseline required before migration"`. A fixture built without that is not production-scale, it is a fixture of a size somebody chose, and profiling it would produce numbers that look like measurements and answer no question. The distributions this item asks to be documented are exactly the thing that is missing. The machinery to build one exists and is proven: M10.11.a generates 400 synthetic learners and 4,100 responses into an isolated database with a manifest, which is the shape this item wants. It is the target SIZE that is unknown, not the method. - [ ] M10.14.c Profile course/item workspaces, graph/list, search/facets, autosave/diff/conflict, learner preview/media, and export/diagnostics independently. Evidence: scenario reports. BLOCKED ON .b. Profiling a fixture of an arbitrary size measures the fixture. The per-scenario discipline this item asks for — one at a time, with a memory checkpoint between — is the right method and is already the rule this repository works under; what it has nothing to run against is a corpus anybody can defend as representative. - [ ] M10.14.d Capture client/server traces, query plans, bundle/network/ hydration/virtualization costs and memory leaks over sustained use. Evidence: profiles. BLOCKED ON .b for the query plans and the sustained-use leak hunt, both of which are statements about behaviour AT a volume. The bundle and network half is separable and partly budgeted already — the five-route lighthouse budget in .a covers resource sizes and counts — but .a also found that its script budget cannot bind, so the bundle number it reports is not currently constrained by anything. - [ ] M10.14.e Compare trends to baselines/budgets, assign regressions, rerun, and retain current passing evidence. Evidence: performance gate. BLOCKED ON .a AND .c: a trend needs a baseline to move from and a budget to be judged against, and neither exists for the seven scenarios this stage names. Assigning a regression additionally needs an owner field, and the same gap M10.13.f recorded applies here — the estate has no performance owner registry either. - [ ] M10.15 Run load tests for imports, gate jobs, adaptive selection, LMS sync, grade events, and analytics. Evidence: backpressure and SLO results. OPEN, AND .f ANSWERED ITS OWN QUESTION WITHOUT A LOAD RUN: there is no backpressure in this service to verify. The rest waits on .a, which waits on a production baseline that does not exist, exactly as M10.14 does. Running load anyway would produce numbers about a corpus nobody chose against limits nobody set. - [ ] M10.15.a Define realistic arrival rates/concurrency/payload distributions/ tenant mixes/dependencies/failures/SLOs/resource stop thresholds per workload. Evidence: load plans. OPEN. "Realistic" is the word that blocks it, and for the same reason M10.14.b is blocked: the estate records `observedProductionRows: null` and "capacity baseline required", so an arrival rate written here would be a number somebody chose rather than a rate anybody observed. A target capacity could be DECLARED instead — that is a design decision rather than an observation and would be honest — but it needs the same ratifying authority M10.14.a is blocked on. The resource stop threshold is the one part that is already real and is written down outside this checklist: this repository's own rule is a `free -m` checkpoint before every heavy invocation and a teardown below roughly 3 GB available on this box. - [ ] M10.15.b Load source/QTI/standards imports and extraction/media/ quality/psychometric gate queues with bounded parallelism. Evidence: import/gate report. BLOCKED ON .a's plan and on .f: loading a queue that has no backpressure measures how fast it can be overwhelmed. - [ ] M10.15.c Load adaptive next-item selection/tutor context at learner concurrency with cold/hot caches and degraded models/stores. Evidence: adaptive report. BLOCKED ON .a. This is the one workload with a ratified latency budget — `budget:adaptive-next-item`, p50/p95/p99 per stage — so it is the first that becomes runnable once an arrival rate exists. - [ ] M10.15.d Load LMS/roster/grade/webhook sync, duplicate/out-of-order/ corrected events, replay/reconciliation, and provider limits. Evidence: integration report. BLOCKED ON .a AND ON THE ABSENT DESTINATION M10.9.d recorded: the saga's `Destination` protocol has one implementation in this estate and it is an object store, so there is no LMS to sync against. - [ ] M10.15.e Load privacy-safe analytics ingestion/aggregation/query with high-volume attempts/events and suppression. Evidence: analytics report. BLOCKED ON .a. The suppression half is separately proven: M10.11.e and M10.12 show cohort cells withheld below the floor and complementary suppression enforced, but neither was measured under volume. - [ ] M10.15.f Verify backpressure/fairness/retry/circuit/queue age/lag/ resource/cost/tail SLOs and stop before unsafe host pressure. Evidence: resource-safe SLO results. THERE IS NO BACKPRESSURE TO VERIFY. This service has three pieces of a rate limiter and no rate limiter: - `config.py` declares `rate_limit_requests_per_minute = 60` and `rate_limit_burst = 10`; - `deps.py` implements `check_rate_limit`, a correct sliding-window counter over Redis that sets a key with a TTL, refuses past the maximum and increments otherwise; - `main.py` maps 429 to `rate_limited` and "Too many requests." And nothing joins them up. `check_rate_limit` has ZERO callers in `src/` or `tests/`; the two configured numbers are read NOWHERE outside their own declaration; and no route or middleware can produce the 429 the error mapper knows how to render. The only middleware installed is CORS and a request timer. Somebody reading the configuration would reasonably conclude callers are limited to sixty requests a minute. They are not limited at all, and a load run would discover that the service accepts everything until it falls over — which measures the absence of a control rather than the presence of a limit. `tests/test_backpressure_absence.py`, 6 tests, asserts the three pieces exist AND that nothing connects them, so the day it is wired the suite says so and the tests flip into assertions about the limit. Better than a comment, which is what an unwired control usually gets. THE DAY CAME (M10.8.d, 2026-09-13). The pieces are joined: `services/request_throttle.py` with a middleware in `main.py`, and the file is `tests/test_backpressure.py` now — 27 tests, the last of which drives the real application against the real Redis and watches the fourth request of a three-request window come back 429. Every assertion above flipped as it was written to. Read M10.8.d for the three decisions worth knowing: it is a FIXED window and the code used to call it sliding, `rate_limit_burst` is still read by nobody because a fixed window has no burst parameter, and it fails open when Redis cannot answer. SO BACKPRESSURE EXISTS TO VERIFY NOW, and this item's own clause is still not verified: what a load run would measure is the limit at its configured sixty a minute under real concurrency, which needs the production volume M10.15.a is blocked on. The rest of the clause — fairness, retry, circuit breaking, queue age and lag, cost and tail SLOs — is unverified behind .a–.e. - [ ] M10.16 Run answer-key leakage, prompt injection, BYOM, PII, grade tamper, integrity bypass, and cross-tenant adversarial tests. Evidence: zero release blockers. OPEN, AND IT STILL CANNOT CLAIM ZERO RELEASE BLOCKERS, but for one reason now rather than two. The self-approval hole this section measured is CLOSED (.e, 2026-09-13): a reviewer can no longer approve their own grade correction, because the rule is checked against a store instead of against the caller's account of themselves. What remains is .f — four workflows unreachable because every user is their own tenant — and that is a tenancy model, not a defect a suite can close. The two findings its own spec note starts from are also closed: the answer key no longer reaches a learner, red then green in that order, and SSRF on the fetch sites is refused. - [ ] M10.16.a Scan learner UI/API/search/cache/client state/assets/accessibility/ packages/logs/URLs/tutor/analytics for answer/rationale/hidden-test leaks. Evidence: key leakage suite. THE API CHANNEL IS DONE, RED THEN GREEN, IN THAT ORDER — which is what this item's own spec note asks for. The known live finding it names was real: `GET /api/assessments` and `GET /api/assessments/{id}` returned `correct_answer` and `explanation` to every authenticated caller including a student. Measured over HTTP before the fix, a learner's GET came back with `correct_answer: "Chlorophyll"` and the explanation; after it, neither. `tests/test_answer_key_absence_journey.py`, 6 tests, and the fix removes the evidence bundle too, because its claims are extracted from the explanation's own text — redacting the field and leaving the bundle would move the answer rather than withhold it. THE OTHER TWELVE CHANNELS ARE SCANNED BUT NOT HARVESTED. M4.13's answer-leakage runtime enumerates 22 learner-visible channels — `log`, `url`, `deep_link`, `qti` packages, `export`, `cache`, `search`, `error`, `trace` among them — and M10.10.c drove a complete 144-artifact sweep across all of them that returns `coverage.complete: true`. But every artifact is SUPPLIED BY THE CALLER: `LearnerVisibleLeakageArtifact` has no producer in this estate, and the workbench page is a textarea somebody pastes a capture into. The scanner is proven; nothing walks the running system to feed it. That harvest is what this clause still needs. FOUR OF THE TWELVE READ CLEAN ON INSPECTION, 2026-09-18 — read rather than harvested, so this is a narrower claim than the scanner would make, and it is recorded because the alternative is a reader assuming the worst about channels that are in fact built right: - LOG. `assessment_service` is the only holder of the key that logs at all, and its two calls carry ids and a type — `assessment_created` and `assessment_submitted`. No payload, so no key. - SEARCH (the durable index). Already covered by a suite this record did not credit: `FIELD_CLASSES` is total over the eight kinds and REFUSES an unclassified field rather than indexing or dropping it, and `residue` re-scans each built document for any forbidden value. `tests/test_search_index.py` runs it over all eight kinds — 62 tests. The channel has a producer and a scan already. - SEARCH (the item bank). `correct_answer` appears exactly ONCE in `services/item_bank_search_service.py`, and it is inside the input to `source_witness_sha256` — a digest that moves when the answer moves, holding no answer. The projection the search serves is built separately and does not carry it. - TUTOR. `correct_answer` appears nowhere in `tutoring_service` or in the retrieval and grounding modules that feed its trust zones, so the key never enters the tutor's context to be fenced in the first place — which is M6.13's answer again: the strongest refusal is having nowhere to put it. THE HARVEST IS STILL THE GAP and reading four channels does not replace it. `LearnerVisibleLeakageArtifact` still has no producer: nothing exercises a route as a learner and hands what came back to `scan_answer_leakage`. That producer is the work, and the remaining eight channels — ui, cache, client_state, client_bundle, url, deep_link, export/qti, analytics — need it rather than another reading. - [ ] M10.16.b Inject instructions through sources/uploads/citations/standards/ learner text/provider outputs/media/code/graphs against prompts/tools/ agents/retrieval. Evidence: injection suite. THIN. `prompt_trust_helpers` carries the right idea — trust zones, `fence_untrusted`, `sanitize_prompt_data` and a versioned renderer — and it has 3 tests; `agent_safety_helpers` has 6. Nine tests is not an injection suite against the ten carriers this item names, and none of them drives a source, an upload, a citation or a provider output end to end. M6.13's finding still stands as the estate's strongest answer here: injection is best refused by having nowhere to put it. THE CENSUS ABOVE WAS AN UNDERCOUNT, measured 2026-09-18. Ten test files exercise the fence, not two, and each of the six model boundaries has its own test that inspects the body it would transmit: `test_source_claim_provider.py` (4), `test_course_outline_provider.py` (4), `test_curriculum_alignment_provider.py` (5), `test_item_variant_provider.py` (13), `test_lesson_assist_provider.py` (7), `test_source_lesson_model_provider.py` (4), plus `test_prompt_trust_helpers.py`, `test_agent_safety_helpers.py`, `test_agent_evaluation_helpers.py` and `test_review_evidence_export.py` — 101 tests in those files before today. The existing renderer tests already drive delimiter forgery and two encoded layers. AND THE STRUCTURAL CENSUS IS CLEAN, which this stage rarely gets to record: of the ten modules in the service that make an outbound POST, SIX SEND A PROMPT AND ALL SIX FENCE IT. The other four — `isis_gallery_client`, `lti_services_client`, `lti_trust`, `open_badges_proof` — send no prompt at all. `tutoring_service` renders a trust prompt too and reaches a model through a provider rather than its own client. ONE REAL HOLE, MEASURED AND CLOSED. `sanitize_prompt_data` normalised with NFKC ONCE, BEFORE its two decode passes, so a homoglyph that arrived ENCODED was never normalised: `%EF%BC%9C%EF%BC%9C%EF%BC%9C` decoded to U+FF1C FULLWIDTH LESS-THAN after the only normalisation, and the collapse — which looks for ASCII `<<<` — left `＜＜＜END_UNTRUSTED_DATA＞＞＞` sitting in the data. It could NOT forge the delimiter, because `END_UNTRUSTED_CONTENT` is rewritten independently of the brackets, so this was hardening and not a break — but it left text that reads as a closing marker to anything matching loosely. Fixed by normalising again after the decode loop, which is idempotent for content that was already normal: every digest of ordinary text is unmoved, and 111 tests across the ten fence files stayed green. Three attack shapes now assert it. AND THE END-TO-END DRIVE THIS ITEM ASKED FOR EXISTS NOW: `tests/test_prompt_injection_journey_real_stack.py`, 5 tests. A markdown file carrying three payloads — a plain instruction, a forged closing delimiter and an encoded homoglyph of one — is ingested through the real pipeline into real MinIO, read back out, extracted, and the EXTRACTED text is handed to the claim provider as the passage it would be. The assertions are on the body the provider actually transmits: the payload sits between the markers and nowhere else, the authority half is untouched and carries the immunity clause, the forged and encoded delimiters are both collapsed inside the fence, instructor guidance is fenced as a second zone, and the body offers no tools. Fencing is not redaction and the test says so: the sentence is still there, because a claim extractor that never saw it could not report it. The double is at the HTTP boundary and nowhere else. WHAT IS STILL NOT DRIVEN, of the ten carriers this item names: media, code, graphs and standards. Learner text and provider outputs are fenced by `tutoring_service` and asserted in its own tests but not driven from a stored artefact the way a source now is. - [ ] M10.16.c Test BYOM endpoint/credential/SSRF/model substitution/supply chain/data-use/output/spend/outage/kill-switch paths. Evidence: BYOM suite. SSRF IS DONE AND FOUND TWO LIVE HOLES. M10.8.e built `outbound_targets.refuse_unless_public()` and `tests/test_outbound_ssrf.py`, 18 tests over the fetch-site list this item points at. It closed SSRF on two LTI fetches and size bombs, and the policy refuses multicast, reserved and unspecified addresses as well as non-global ones — `224.0.0.1` reports `is_global=True` in Python, which is how the first version would have let it through. MODEL SUBSTITUTION IS NOW VISIBLE, AND IT WAS NOT. Measured 2026-09-13: the admission engine carries the right rule — `fingerprint_moved`, "the endpoint is answering as a different model than the one that was evaluated and approved" — keyed on `ServeRequest.observed_fingerprint_sha256`. That field appeared in exactly TWO places in `src/`: its own declaration and that comparison. NOTHING COMPUTED IT. Every value it had ever held came from a request body or from the workbench's fixture constant. The same shape as the hole closed in M10.12.d/.e one layer up, and worse, because the input had no producer at all. ONE OF SIX OBSERVED WHAT ANSWERED; NONE OF SIX CHECKED IT. `item_variant_provider` read `model`/`provider` off the response envelope; the other five declared `choices` and `usage` only, so the served model was dropped unparsed and every record named the model that was ASKED FOR. The two readers of `served_model` build a provenance string and compare nothing. Now: `services/served_model_identity.py` is the one derivation (`observe`, `substituted`, and the fingerprint that finally gives `observed_fingerprint_sha256` a producer), all six envelopes read the answer, all six record `served_model`/`served_provider` on EVERY outcome including refusals, and a silent endpoint reads as unobserved rather than as agreement. 14 tests in `test_served_model_identity.py` — including a parametrized ratchet so a seventh provider cannot skip it — plus one driven substitution test in each of the six provider suites. ONE CAVEAT ON THE ABOVE, recorded rather than discovered later. Four of the consumers digest a whole invocation dump and re-derive it on read (`source_claim_service` over `canonical_json_bytes`, `curriculum_alignment`'s re-dump, and the lesson-assist chain). That is symmetric within a run, so a fresh database verifies — but an invocation STORED BEFORE these two fields existed would re-parse with them present as None and fail its own provenance check. The house already solved this once: `item_variants.WITNESS_OPTIONAL_FIELDS` leaves such fields out of the witness when unset. Not a live defect, because nothing in this estate has stored invocations predating today; it becomes one the moment something does. AND IT ALREADY BIT ONCE, in a smaller way: `lesson_assist_provider` sealed its digest over a DICT that omitted the new keys while the model defaulted them, so three lesson-dossier tests failed with an invalid digest chain. A DICT THAT OMITS A KEY DIGESTS DIFFERENTLY FROM A MODEL THAT DEFAULTS IT. Fixed the same day, along with a frozen dataclass whose required new fields turned a model path into its deterministic fallback by raising TypeError at every other construction site. CORRECTION TO THIS RECORD'S OWN EARLIER CLAIM: "Admission and the kill switch are M7.11's, already closed" IS WRONG for these paths. `provider_model_admission_engine`'s docstring says "Every path that could end in 'send this prompt to the tenant's model' runs through `check_serve` … There is no second path." There are six. `check_serve`'s only callers are the admission module and its own route. The kill switch cannot stop any of the six. STILL OPEN, AND WHY NOTHING IS CHECKED HERE: the refusal half. Closing it needs a store of the last observed fingerprint per endpoint, because a pre-flight check cannot have observed the answer to the call it is gating. `test_no_provider_consults_admission_yet` pins that open rather than letting it pass unrecorded. ALSO OPEN: supply chain, data-use, spend and outage. Spend is two of six — `item_variant` and `lesson_assist` price usage and can answer `budget_exceeded`; the other four have no budget or cost at all. The BFF store this item's spec note names (`apps/oshun/bff/src/metis/metis-byom-decision-store.ts`) is bring-your-own-MATERIAL source-review governance, not a model admission path — a different sense of "BYOM". It has its own unit and durability specs; it is not exercised from the service suite, and it would not answer this item if it were. - [ ] M10.16.d Test learner/minor/PNP/grade/integrity/voice/source PII across UI/API/events/logs/exports/analytics/training feedback. Evidence: privacy suite. OPEN, with one narrow suite: `test_sequencing_overlay_privacy.py`, 5 tests. Against the seven subjects and eight surfaces this item names that is a corner of the matrix. What IS proven elsewhere and counts toward it: cohort suppression below a floor of 30 with complementary suppression (M10.11.e, M10.12), learner-audience redaction on the integrity signal surface (M10.12.b), and the synthetic fixture's import-closure proof that it cannot reach a learner record at all (M10.11.e). Minor, voice and training-feedback PII are untouched. - [ ] M10.16.e Test grade/event/correction/LTI/credential tamper/replay/race/ mass assignment and integrity evidence/decision/appeal/interlock bypass. Evidence: authority suite. PARTLY DONE, AND M10.12 FOUND THE BYPASS THIS ITEM IS ABOUT. Replay and race are covered: `test_mutation_concurrency.py`, 10 tests, after M10.8.c fixed an idempotency key that was being read as a uniqueness token rather than a retry token. Mass assignment is structurally refused — every intake model forbids unknown fields — and M10.8.b closed a caller that could name somebody else's tenant. THE CORRECTION BYPASS IS CLOSED 2026-09-13. It was real and measured: a reviewer approved their own grade correction by not mentioning that they had reviewed it, because `prior_decisions` was read from the request body and defaulted to empty. The route now loads prior decisions from the correction store and refuses the field outright; the same walk answers `reviewer_cannot_approve` (M10.12.d/.e). The appeal bypass still cannot be tested at all — M10.12.c, the engine has no route. - [ ] M10.16.f Test two-tenant IDs/search/counts/blobs/cache/queues/deep links/ exports/integrations/timing and close all release blockers. Evidence: adversarial report. OPEN. `test_tenant_isolation_authoring_api.py` has 9 tests and M8.14 built a two-tenant suite and a tenancy ratchet, so IDs and the authoring API are covered. Search, counts, blobs, cache, queues, deep links, exports, integrations and timing are not. AND THE TENANT MODEL ITSELF IS THE FINDING THIS STAGE KEEPS MEETING. Every user is their own tenant, which makes cross-tenant leakage structurally hard and multi-person work impossible: four instances now — no publication candidate can be approved (M10.9.d), no second instructor can review an item (M10.10.c), no fairness reviewer can exist (M10.11.e), and no integrity lead can see a reviewer's signal (M10.12.b). Release blockers cannot be closed while those stand. - [ ] M10.17 Run backup/restore and late-event replay drills. Evidence: gradebook, audit, blobs, and search reconcile. OPEN WITH .b DONE FOR REAL. The restore half was run against the compose Postgres and verified by hashing 163 tables on both sides rather than counting them. The replay half is not a drill yet, blobs are untouched because MinIO is not running, and the gradebook cannot reconcile because its correction tables have no writer (M10.12.d). Two facts the drill established that no document had: there is no point-in-time recovery, and nothing schedules a backup. ALL FOUR LEGS OF THE EVIDENCE SENTENCE NOW RECONCILE ON A RESTORED ESTATE (2026-09-18), and the three gaps the paragraph above names are closed or superseded: the replay half was drilled on 2026-09-13 (.c), the gradebook's correction tables got their writer the same day (M10.12.d), and MinIO is running on this host now. `tests/test_estate_restore_drill_real_stack.py` is the drill, and a test rather than a script so it can be run again instead of described: a real journey through the durable pipeline, `pg_dump -Fc`, the originals bucket mirrored through the S3 API (`mc` is not installed here, so each object is read and written back with its digest recomputed, which is what `BlobStore.put` does), the database restored into a second one and the objects wiped and restored, then `durable_reconciler.reconcile` run against the restored pair. VERIFIED BY HASHING BOTH STORES, never by counting: 172 tables digested with `md5(string_agg(row::text ORDER BY row::text))` on both sides, all 172 equal, 7 of them non-empty; every object compared on length, on the sha256 of its bytes and on its content type. The reconciler then answered clean on all of it — blobs, search index, outbox, exports, grades and M10.17.d's record legs — over 15 restored revisions. THE DRILL'S OWN FINDING, and the reason the blob half was worth running rather than assuming: a restore into a differently-named bucket leaves every receipt pointing at a bucket that does not hold the object, and the reconciler says so. The measurement and what it implies for a restore are in .e. STILL OPEN, WHICH IS WHY THIS STAYS UNCHECKED: .a's DR plan, .d's remaining legs, and .e's scheduled backup, encryption, retention and runbook. The two facts .b established are unchanged — there is no point-in-time recovery and nothing schedules a backup. - [ ] M10.17.a Define backup scope/frequency/encryption/key/retention/RPO/RTO for database/blobs/audit/search config/standards/integration state and document rebuildable stores. Evidence: DR plan. OPEN, AND ONE NUMBER IN IT IS NOW DECIDED BY THE SERVER RATHER THAN BY A PLAN. `archive_mode` is OFF on the compose Postgres and `wal_level` is `replica`, so THERE IS NO POINT-IN-TIME RECOVERY: a restore can only go back to the last dump, never to a chosen moment. Any RPO written here is therefore bounded below by the backup interval, and no interval is configured either — nothing schedules a dump. RTO HAS A MEASURED FLOOR from .b's drill: 204 ms to dump and 1,981 ms to restore, 2.2 seconds total for 1.1 MB. That is a floor for a development-sized database and says nothing about production, whose volume is unrecorded (the same gap M10.14.b is blocked on). Scope, frequency, encryption, key management and retention are undefined, and the blob half is untouched — MinIO is a compose profile that is not running here. THE BLOB HALF IS NO LONGER UNTOUCHED (2026-09-18). MinIO runs on this host now, and the drill named in the parent backs up and restores the originals bucket beside the database, so the scope this plan has to state is two stores and not one. One constraint on it is measured rather than open to choice: the objects must come back under the bucket name the receipts already name, because `BlobStore.verify` reads `receipt.bucket` and the receipts are immutable (see .e, step 3). Scope, frequency, encryption, key management and retention remain undefined, and the RPO any of them implies is still bounded below by a backup interval nothing configures. SCOPE, FREQUENCY AND RETENTION ARE NOW STATED IN CODE rather than owed by this plan (2026-09-18, with .e). `services/estate_backup.py` backs up the database and the source bucket, and its docstring says why the other four buckets are not: `s3_bucket_exports` holds artifacts a release republishes, `s3_bucket_courses` and `s3_bucket_assets` hold derivatives of records in the database, and `s3_bucket_uploads` is swept daily by `tasks.cleanup`. That is this clause's "document rebuildable stores", written where the code that acts on it lives. Frequency is `backup_interval_seconds` (default 86,400) and retention is `backup_retention_count` (default 7) — both DEFAULTS, and the decision this plan still owes is what they should be for a deployment, which needs the production volume M10.14.b is blocked on. ENCRYPTION AND KEY MANAGEMENT ARE STILL UNDEFINED and are the clause's real remainder: the dumps land in object storage unencrypted, and where a key would live is an operator decision, not a default this session can pick. - [x] M10.17.b Take/verify backups and restore into isolated environment at selected point with tenant/permissions/hash integrity. Evidence: restore drill. DRILL RUN FOR REAL, against the compose Postgres, on the database this session's journeys wrote to. `pg_dump -Fc` of `metis_item_journey` (1,123,762 bytes), `createdb` + `pg_restore --no-owner --no-privileges` into an isolated `metis_restore_drill`, exit 0. VERIFIED BY HASHING ROWS, NOT BY COUNTING THEM, which is what this item's spec insists on: for each of the 163 public tables on both sides, `md5(string_agg(row::text ORDER BY row::text))`. ALL 163 DIGESTS MATCH. 18 of the tables are non-empty, so this is not a comparison of nothing — a count would have said two tables agreed whenever they merely had the same number of different rows. Tenant integrity follows from the row digests: `tenant_id` is part of every row hashed. PERMISSION INTEGRITY IS VACUOUS HERE, and measured rather than assumed: the restore dropped owners and privileges, and the source database has ZERO role grants on `public` beyond the owner and PUBLIC, so nothing existed to lose. On a deployment that grants to real roles this drill would have to be re-run without those flags. "AT SELECTED POINT" IS NOT DEMONSTRATED AND CANNOT BE — see .a. The drill databases were dropped afterwards. - [ ] M10.17.c Replay outbox/grade/LMS/integrity/revision/events including duplicate/out-of-order/late/correction/void cases. Evidence: replay drill. THE DRILL IS RUN NOW, FOR REAL, and it is `scripts/replay_drill.py` so it can be run again rather than described. Against the compose Postgres, 2026-09-13: SEVEN OUTBOX EVENTS SURVIVED A RESTORE AND THE SERVICE'S OWN WORKER DRAINED THEM THERE. Six lesson aggregates plus one revision were written through the real `AggregateStore`, leaving 7 undelivered events; `pg_dump -Fc` then `pg_restore` into an isolated database carried all 7 across; `metis.tasks.durable.drain_outbox` — the task beat runs every 10 seconds, executed in its OWN process reading its OWN configuration pointed at the restored database, not a function handed an engine — reported `delivered=7 failed=0`. Undelivered went 7 to 0 and `search_index_document` went 0 to 6 (six lessons; the seventh event is a second revision of one of them and upserts the same document). A SECOND drain delivered nothing and left the index at 6, which is the idempotence a re-run after a crash depends on. THE NAMED GRADE CASES, replayed on the RESTORED database through the ledger's own append path: duplicate (the same source event id retried came back `appended=False` rather than refused for carrying a stale version — a retry is not a new append), out-of-order/late (an event that HAPPENED three hours earlier arriving second was appended), correction (naming the event it corrects), and void (no value). Five appends, four entries held, and a history derived from them. `reconcile` answered `never_projected`, which is correct and is M10.17.d's own point: the projection is built lazily on read, so a restored grade nobody has read has nothing stored to compare. TWO FAIL-LOUD SEAMS PROVED THEMSELVES while building this, both worth recording because each looked like a defect first. A revision whose payload offers no `index` key is indexed not at all — the record decides what search may hold, the relay does not guess from the content. And offering `lesson.summary` was REFUSED outright: "is not classified; indexing it and dropping it are both a decision nobody recorded". That refusal isolated correctly — all 7 events stayed undelivered and nothing was half-applied, which is the relay's "ONE EVENT'S FAILURE IS THAT EVENT'S" claim, measured. A SECOND EVENT TYPE, because everything above is `aggregate.revised`. Withdrawing a lesson on the restored database produced `aggregate.transitioned`, the worker delivered it, and the document went to `state = deleted` while the ROW REMAINED. That is correct and deliberate — a delete leaves a tombstone "so a late upsert for" an older revision cannot resurrect what was withdrawn — and asserting the row COUNT read as a defect until the state column was looked at. Live documents went 6 to 5; rows stayed 6. THE LMS LEG IS DRIVEN TOO, through the INGRESS road rather than the ledger's own API: `ingest_ags_score`, which resolves the binding and derives the grade id from the platform triple. A first post appended; THE SAME POST REDELIVERED came back `accepted=True appended=False`, which is idempotence on the source's own id rather than a refusal; a later score appended; and a post out of 10 against a binding out of 100 was REFUSED with `scale_disagreement` rather than rescaled, which is the silent mapping M10.7.f exists to block. STILL OPEN, WHICH IS WHY THIS STAYS UNCHECKED: the integrity replay this clause names. And the reason is worth more than the gap — THERE IS NO INTEGRITY EVENT STREAM TO REPLAY. Only `aggregate_store` and `source_graph` write to `store_outbox`; no integrity service references an outbox at all. So this leg cannot be driven until integrity emits something durable, and recording it as covered because nothing broke would be closing a clause over an absence. THE RELAY'S OTHER TWO EVENT TYPES ARE DRIVEN NOW TOO, so all four are. A source and a lesson that CITES it were written on the restored database — the citation is what puts a row in `store_references` — and then `source.retracted` moved the citing lesson to `quarantined` and `source.restored` lifted it back to `live`, each delivered by the worker. So a retraction reaches what depended on the source, through a restore, without anybody calling the relay by hand. ONE OBSERVATION RECORDED RATHER THAN ASSERTED: `retract` emits an outbox event per DEPENDENT, so the retracted source's own index document stays `live`. Whether a `factually_wrong` source should also stop being served by that act, or only by a revision marking it unavailable (which is the path the relay's quarantine branch describes), is a design question this drill does not answer and no claim is made about it here. The earlier reading of this item, still true of what it covered: M8.11's grade ledger handles late-event replay over a 24-per-day matrix — AN ARRIVAL ORDER IS NOT AN EVENT ORDER — and M10.8.c's idempotency work made a retry replay the first attempt's acknowledgement rather than answering `stale`. What is missing is the drill this item asks for: replay through the service's OWN worker against a restored database, which is the only way the outbox and the projections are exercised together. - [ ] M10.17.d Rebuild/reconcile current grade/course/build/audit/search/blob/ dependency/integration projections to authoritative histories. Evidence: reconciliation report. STILL BLOCKED ON .c, BUT ITS SECOND BLOCKER IS GONE AND THE REAL GAP IS NOW NAMED. The correction tables have a writer as of 2026-09-13 (M10.12.d), and the partition defect that would have split a grade's history across two tenant ids is fixed, so a grade history is now persisted and reachable under one key. WHAT THE INPUTS ACTUALLY ARE, MEASURED 2026-09-13 BY DRIVING IT. `grade_ledger.project()` takes the entries, a `GradeScale` and a `learner_digest`. Bound a line item, ingested one FullyGraded AGS score through the real `ingest_ags_score`, then asked which of them the projection depends on: - the entries are durable; - THE SCALE MATTERS AND IS RECOVERABLE. Deriving with a wrong scale is REFUSED (`LedgerError`, via `GradeHistory`'s own check that every event is on the bound scale). `grade_ingress_binding` stores `scale_id` beside `scale_minimum/maximum/decimals` and the entry carries `scale_id`, so a join on `(tenant_id, scale_id)` reaches it. Nothing performs that join today, but the data is there; - THE LEARNER DIGEST AFFECTS NOTHING. Deriving the same entries with a completely different digest produced the IDENTICAL `history_sha256` and `current_value`. It is a field of `GradeHistory` that no validator reads and that `substance()` — what the digest is taken over — does not include. It is a required parameter that changes no output. CORRECTION TO THIS RECORD'S FIRST VERSION, which said the rebuild's inputs were not durable and no projection could be rebuilt. That was wrong, and it was written from the function's SIGNATURE rather than from what the function uses. A grade projection CAN be rebuilt from the record — through a join nothing performs, on a `scale_id` that is not guaranteed unique within a tenant. The honest gap is smaller and is the two items below. A SECOND THING THE WALK SHOWED: after a successful ingest, `grade_ledger_projection` HAD NO ROW. The projection is built lazily on read (`projection_for_ags`), so "reconcile the projection against the history" has nothing to compare for any grade nobody has read. What the walk did confirm working: given the inputs, `rebuild()` derives the history and emits nothing — outbox 1 before, 1 after. THE GRADE LEG IS NOW BUILT AND WIRED IN (2026-09-13), and the rest of this clause is not. `grade_ledger.reconcile()` re-derives one grade from its own entries and compares with the stored projection, WRITING NOTHING — which is why it is not `rebuild()`: that calls `project()`, which upserts, so it repairs while reporting, and something that changes what it measures cannot report that the thing was already right. `durable_reconciler.Reconciliation` gains `grades_disagree` (counts against `clean`) and `grades_never_projected` (does not — a lazily-built projection that nobody has read is an absence, not drift), and `reconcile()` now sweeps every grade the tenant holds an entry for. Migration 077 + `grade_ledger_derivation` record the scale per grade, written with the first entry and never rewritten, because the scale was not unambiguously recoverable (see above) and a wrong one is refused. 8 tests against a real database, including TWO tamper cases. The second exists because the first was BELIEVED: `stored_projection` parses `document_json`, so moving only the `history_sha256` COLUMN changed nothing the comparison reads and the reconciliation cheerfully agreed. That is now its own refusal, `projection_row_inconsistent` — a row that disagrees with its own document is corrupt in a way the history comparison cannot see. WHAT IS ACTUALLY MISSING, measured 2026-09-13: `services/durable_reconciler.py` (M10.4.d) reconciles blobs, search index, outbox, publication and owner queues — `grep -n grade` returns ZERO HITS. Grades are not reconciled by the estate's reconciler at all. Meanwhile `services/grade_ledger.py` (M8.11) ALREADY HAS the machinery this clause wants — `project()`, `rebuild()`, `stored_projection()`, `entries()`, and a rebuild that deliberately "announces nothing" so recomputing does not wake the outbox. So the rebuild exists and NOTHING DRIVES IT AS A RECONCILIATION. That is the work, and it is smaller than the blocker it replaced. The aggregate store's five tables DO hold authoritative revisions and an outbox, so the course, audit and dependency projections are rebuildable in principle. THE COURSE, AUDIT AND DEPENDENCY LEGS ARE BUILT NOW (2026-09-18), and the sentence above is what they were built on. `services/record_reconciler.py` sweeps one tenant and reports, writing nothing; `durable_reconciler.reconcile` carries it, so the scheduled `reconcile_estate` task is the caller. Every leg below was missing, and `store_aggregates` — the row every other leg of M10.4.d measures something against — was never compared with the revisions and moves that produced it. The yardstick was unmeasured. - THE HISTORY AGAINST ITS OWN BYTES. `content_sha256` is recomputed from the stored `content_json`, which is `text` (measured in the information schema, so re-hashing the column is hashing the bytes the digest covered, not a normalised jsonb round trip). Nothing did this: `revision_history.ancestry` walks the `previous_sha256` links and never opens the content, so a payload rewritten under the retention workflow left two digest columns agreeing with each other. The test asserts that `ancestry` still reports that chain intact. - THE REVISION SEQUENCE. `ancestry` sets `revision=len(chain)`, so a history with revision 2 deleted answers "an intact chain up to revision 2" for an aggregate standing at revision 3. Measured, not inferred: the test deletes revision 2 under the legal-erasure token and reads `walked.revision == 2` back. - THE HEAD THE AGGREGATE ROW POINTS AT, read-only. `rebuild_from_ revisions` compared this already and REPAIRED as it looked, which is the same reason the grade leg uses `reconcile` and not `rebuild`. - THE OPERATIONAL STATE, REPLAYED FROM TWO WITNESSES. A creation is refused in any state but `draft` (`RevisionRequest`'s own validator), so the walk has a start, and every move since is recorded twice in the transaction that made it. Both must agree with the column and with each other. The walk follows the `from`/`to` linkage rather than the clock, because transitions are serialised under `FOR UPDATE` — two moves cannot leave the same state — while two moves at one pinned instant are ordinary in this repo's fixtures. - THE AUDIT TRAIL'S COMPLETENESS, for every revision and every move. - THE RETRACTION QUEUE AGAINST THE REFERENCE GRAPH. `source_propagation` is derived: `retract` walks the citations backwards and writes a row per dependent. An open entry must name something a recursive walk of `store_references` still reaches from that source, and one that does not is an owner being asked about work that never depended on it. MIGRATION 082, BECAUSE THE STATE HAD ONE WITNESS AND IT WAS THE WRONG ONE. `store_audit` recorded THAT a transition happened and never what it moved to: the `from`/`to` pair lived only in the `store_outbox` event payload. The outbox carries `published_at`, which the relay writes, so 047's immutability trigger cannot be put on it — the operational state of every aggregate in this estate was derivable from a mutable table and from nothing else. 082 adds `from_state`/`to_state` to the trail, nullable and NOT backfilled (a state nobody recorded does not get invented into the one table that cannot be corrected), and the sweep names the aggregates whose trail predates it instead of reading a missing state as `draft`. THREE DEFECTS IN ONE FUNCTION, all in `authoring_api.set_archived`, found by asking what records `archived_at` (049): - IT WROTE NO AUDIT ENTRY AND NO EVENT. An authorised operation — `may(role, "archive")` gates it — whose only record was the column it wrote. Who shelved a lesson, and when, was unanswerable. - IT DISCARDED THE REASON. `ArchiveBody.reason` is required, 8 characters minimum, and no line of the function read it. - ITS STALENESS CHECK READ FROM A PAGE. The expected revision was compared against `store.list_aggregates(context, kind=kind)`, which is `LIMIT 100 ORDER BY updated_at DESC`, so archiving an aggregate outside the hundred most recently touched of its kind was answered `not_found` for a record that exists. The write is now `AggregateStore.set_archived`: the column and an `archived`/`restored` entry in one transaction, under the row's own lock, with the caller's reason as the entry's detail. It returns an `ArchiveAcknowledgement` and deliberately not a `WriteAcknowledgement`, which would have had to name an outbox event id no row answers to — a shelf is not a lifecycle state, nothing is served differently for it, and the relay refuses an event type it does not know. THE REBUILD HALF, which the clause also asks for. `rebuild_from_revisions` carried the stored `op_state` forward — it repaired the revision pointer and trusted the column for the state, including a value somebody had written straight onto the projection — and wrote `draft` when the row was missing altogether. It now derives the state (trail first, moves second) and REFUSES when neither answers, rather than inventing one. An empty move history is not that case and must not be treated as one: nothing having moved does derive `draft`. The two witnesses are cross-checked before the moves are believed, because an empty move list cannot tell "nothing moved" from "the events are gone" — the trail's `transitioned` entries can, and they exist even in a trail written before 082. TWO LEGS OF THE CLAUSE ARE NOT PROJECTIONS, MEASURED RATHER THAN SKIPPED. Dependency: both ends of `store_references` are foreign keys into `store_revisions` (046), so a dangling reference is refused by the database and there is nothing to reconcile; what IS derived from the graph is the retraction queue, and that is the leg above. Integration: `grade_ingress_binding` is registered and not derived (`grade_ingress` says so in its own docstring, and registering it is why M10.7.f can refuse a scale disagreement), `integration_workspace` is an aggregate saved whole, `roster_grade_identity` holds only what the SIS supplied through its single writer, and `lti_line_item` records what this tool created. None is computed from another table, so none has a history to be rebuilt from, and the drill that covers them is .b's restore. STILL OPEN, WHICH IS WHY THIS STAYS UNCHECKED: - THE QUEUE RECONCILES IN ONE DIRECTION ONLY. The other — every dependent of a retracted source is in the queue — needs to know WHICH REVISION of the source was retracted, because the walk is over exact revisions. `source_propagation` records `source_id` and the reason and not the revision, so the set it ought to contain is not recoverable, and a sweep that assumed "any revision" would report every citer of an older revision as missing. - A LIVE DEFECT THIS SWEEP CANNOT SEE, found while building it and not fixed here: `retract` calls `impact_preview(..., limit=1000)` and iterates `preview.rows`, never reading `next_cursor` or `truncated_at_depth`. A blast radius wider than 1,000 dependents or deeper than `MAX_DEPTH = 6` is silently not propagated — no entry, no event, no owner told — and `SourceRetractionResult` carries no truncation flag, so the caller cannot tell either. - `project_id`/`course_id` are still recorded nowhere but the projection. They are write-once (a revision that would move an aggregate between courses is refused), so the projection is its own record; the sweep counts them as an absence it could not check rather than calling them consistent. - .c's integrity replay, unchanged: no integrity service writes to an outbox, so that leg still has nothing to replay. EVIDENCE. `services/record_reconciler.py`, migration 082, `AggregateStore.set_archived`, `authoring_api.set_archived`, `revision_history.rebuild_from_revisions`, `durable_reconciler.Reconciliation.record`, `tasks/durable.py`. 13 tests in `tests/test_record_reconciliation_real_stack.py` (every tamper read back before it is judged — the first one did not land, and the read-back is what said so), 3 added to `tests/test_aggregate_store_real_database.py` and 2 to `tests/test_revision_history_real_database.py`; 112 passing across the six affected suites against a real PostgreSQL, MinIO and Redis stack. `metis:contracts:check` reports no OpenAPI change: nothing here is on a route. - [ ] M10.17.e Measure RPO/RTO, residual/manual steps, update runbooks/tests, and close gaps. Evidence: game-day report. PART MEASURED, THE REST OPEN. RTO has a real floor from .b — 2.2 seconds end to end at development volume — and RPO is unbounded because nothing schedules a backup and WAL archiving is off, so the honest answer is "everything since whenever somebody last ran pg_dump by hand". Every step in .b's drill was manual; none of it is a runbook or a scheduled job yet. RTO NOW HAS A FLOOR FOR BOTH HALVES, measured 2026-09-18 by the drill in `tests/test_estate_restore_drill_real_stack.py` rather than by .b's database-only run: dump 0.181 s, restore 1.790 s, object mirror 0.029 s, object restore 0.045 s — 2.045 s end to end for a 938,995-byte dump of 172 tables (7 non-empty, 15 revisions) and two objects totalling 1,723 bytes. A development volume still, and production volume is still unrecorded (the gap M10.14.b is blocked on), so this is a floor and not a projection. RPO IS UNCHANGED AND STILL UNBOUNDED: nothing schedules a dump and `archive_mode` is off, so the honest answer remains "everything since whenever somebody last ran pg_dump by hand". THE RESIDUAL MANUAL STEPS ARE NOW ENUMERATED BY HAVING PERFORMED THEM, not by imagining the restore: 1. create the target database (`CREATE DATABASE`) — `pg_restore` does not, and the drill fails at this step without it; 2. `pg_restore --no-owner --no-privileges`, which is only vacuously safe here: the source database has no role grants to lose (.b measured that), so a deployment with real roles needs the drill re-run without those flags; 3. RESTORE THE OBJECTS INTO THE BUCKET NAME THE RECEIPTS ALREADY NAME. This is the step no document had, and the drill establishes it by measurement: `BlobReceipt` carries its bucket and `BlobStore.verify` reads `receipt.bucket`, not the bucket the store was handed. With the objects mirrored into a second bucket and the original emptied, the reconciler reported every blob broken — and reported them broken again when pointed AT the backup bucket, because the receipt decides where it looks. The receipts cannot be rewritten to suit: they live in `store_revisions`, which 047 makes immutable outside an approved retention or legal workflow. So a restore either recreates the bucket under its original name or it produces an estate whose every blob is unverifiable; 4. drain the outbox on the restored database (.c's leg), because a restore lands undelivered events that only the worker clears. A DESIGN QUESTION THIS DRILL RAISES AND DOES NOT ANSWER, recorded rather than quietly settled: a bucket in a receipt is payload deciding where the service reads. Making `verify` and `get` look only in their own bucket would remove that and make a renamed restore verifiable, but it would also fail any legitimate cross-bucket receipt (an export read through a store holding the originals), and `durable_reconciler` verifies every receipt it finds in a revision against one store. It is a boundary change with a security reading on both sides and it wants a decision, not a guess. STILL OPEN: the scheduled backup that would bound RPO, encryption and key management for the dumps, retention, and the runbook itself — none of the four steps above is written down anywhere but here and in the drill. THE SCHEDULED BACKUP IS BUILT (2026-09-18), SO RPO IS A NUMBER NOW. `services/estate_backup.py` + migration 083 + the beat entry `back-up-estate`: a `pg_dump -Fc` of the configured database every `backup_interval_seconds` (default 86,400), the source bucket mirrored beside it, and a row in `estate_backup_run` for every attempt. RPO ≤ the interval + the run, and `last_successful()` is what makes the bound READABLE — the question an incident asks is when the last one succeeded, and before this there was nowhere to ask it. A DUMP NOTHING HAS READ IS NOT A BACKUP, so a run is not `succeeded` until `pg_restore --list` has parsed the archive and its table count is recorded; the table's CHECK refuses a succeeded row that does not name its artifact, length and digest. The test goes further and RESTORES the dump into another database, comparing every table digest on both sides: all equal except `estate_backup_run` itself, which differs for a reason worth recording — the run row is written AFTER the dump, so a dump cannot contain its own record. THE TWO FAILURE PATHS ARE DIFFERENT, DELIBERATELY. A missing `pg_dump` or a missing backup bucket writes NO row and raises `BackupUnavailableError`: a precondition nobody met is not an attempt on the database, and recording it as a failed run would say one was made. A dump that ran and failed IS an attempt and is recorded as `failed` before the error is raised, because a gap in the schedule is only visible if the failures are in the table beside the successes. A failed run never becomes `last_successful` — asserted, not assumed. RETENTION IS CONFIGURED AND PRUNES ARCHIVES, NEVER RECORDS: `backup_retention_count` (default 7) dumps are kept, the rest are deleted from the bucket and their rows stay, so the history of what was taken survives the archive it pointed at. Source objects are never pruned — they are content-addressed and a revision names them forever, so an object no longer in the sources bucket is exactly what the backup exists to return. WHAT THE SCHEDULE DOES NOT SETTLE, and .a still owes: the interval is a DEFAULT and not a decision; there is still no point-in-time recovery (`archive_mode` is off, so the floor is the last dump and never a chosen moment); the dumps are not encrypted and key management is undecided; and the runbook is still only this record and the drill. 5 tests in `tests/test_estate_backup_real_stack.py` against a real database and a real bucket. THE RUNBOOK IS UPDATED TOO, which is the other half of this clause. `docs/runbooks/metis-disaster-recovery.md` goes to 2.0.0, and the revision corrected a statement as well as adding the new steps: VERSION 1.0.0 NAMED THE WRONG BUCKETS FOR BLOB RECOVERY. It listed `metis-courses`, `metis-assets`, `metis-exports` and `metis-uploads`, and the durable bytes a receipt points at are in `metis-sources` (`s3_bucket_sources`, M10.4) — the one bucket it did not name. The runbook now opens with how to read the recovery point out of `estate_backup_run`, carries the bucket-name constraint, and ends with drain + reconcile before traffic is switched. AND ONE PROCEDURE IS CODE RATHER THAN A SHELL LINE. "Mirror the bucket back" has no CLI here — `which aws mc` finds neither — and either could be installed, but `estate_backup.restore_sources` is what the service's tests exercise, and a restore step only ever run by hand is a step nobody has verified. The runbook invokes the function. Rehearsed while writing it — `(1, 27)` on the first run and `(0, 0)` on the second, which is the idempotence an interrupted restore depends on. The runbook was also missing from `docs/runbooks/index.md` entirely, which its own version 1.0.0 never added; it has a row now. 6 tests in `tests/test_estate_backup_real_stack.py` against a real database and a real bucket. - [ ] M10.18 Publish educator, psychometrician, accessibility, integrity, institutional, incident, and interoperability runbooks. Evidence: game-day results. OPEN, WITH ONE RUNBOOK PUBLISHED AND EXERCISED. The rest are held up less by writing effort than by the workflows they would describe: an appeal with no route, a reconciliation with no destination, a review with no second reviewer. Writing those procedures now would document steps nobody can take. - [ ] M10.18.a Define runbook template/owners/on-call/prerequisites/roles/ dashboards/commands/evidence/comms/recovery/verification/version review. Evidence: runbook index. PARTLY: the template is now demonstrated rather than specified. `docs/runbooks/metis-disaster-recovery.md` follows the house frontmatter already in `docs/runbooks/` — title, owner, version, last_reviewed, next_review, applies_to — and carries prerequisites, commands, verification, cleanup, a failure path and a gap table. OWNERS AND ON-CALL CANNOT BE DEFINED HERE. There is no owner registry in this estate; M10.13.f and M10.14.e record the same absence for accessibility and performance. Every runbook written now has to name its owner as unassigned, which is honest and is not a template problem. - [ ] M10.18.b Publish educator authoring/review/source/assessment/publication and psychometric calibration/DIF/exposure/item lifecycle procedures. Evidence: role runbooks. NOT WRITTEN. The material exists and is unusually well verified — M10.10 walked authoring and review, M10.11 walked calibration, DIF and the item lifecycle — but several of those procedures would have to document a step nobody can take: no second instructor can review an item, and no fairness reviewer can exist. A role runbook whose first instruction is impossible is worse than none. - [ ] M10.18.c Publish accessibility remediation/alternative/waiver/escalation and integrity signal/case/appeal/grade correction procedures. Evidence: governance runbooks. NOT WRITTEN, and two of the four procedures cannot be: the appeal workflow has no route to describe (M10.12.c), and the grade correction procedure would have to tell a reviewer to disclose their own prior decision, which the endpoint does not require and cannot check (M10.12.e). The accessibility remediation half is writable now that M10.13 has the gates and the ceilings. - [ ] M10.18.d Publish institution integration/roster/LTI/grade/export/ credential/version/reconciliation and standards interoperability procedures. Evidence: integration runbooks. NOT WRITTEN. The reconciliation procedure is blocked on the same absence M10.9.d found: the saga's only `Destination` implementation is an object store, so there is no LMS to reconcile against. - [ ] M10.18.e Publish source withdrawal/answer leak/BYOM/privacy/grade/ integrity/outage/recall/DR incident procedures. Evidence: incident runbooks. THE DR PROCEDURE IS PUBLISHED AND EVERY COMMAND IN IT WAS EXECUTED WHILE WRITING IT, which is what this item's spec asks for. `docs/runbooks/metis-disaster-recovery.md`: take a backup, restore into an isolated database, and verify by hashing 163 tables on both sides rather than counting rows, with the measured numbers from that run — 204 ms to dump, 1,981 ms to restore, all 163 digests identical, 18 tables non-empty. It also carries what could NOT be executed and why: no point-in-time recovery because `archive_mode` is off, no schedule, and no blob procedure because MinIO was not running. A runbook that described those anyway would be the failure this checklist keeps finding. It names its own owner as unassigned, because the estate has no owner registry and a runbook cannot invent an on-call rota. OPEN: source withdrawal, answer leak, BYOM, privacy, grade, integrity, outage and recall. The answer-leak procedure is the next one worth writing — M10.10.c and M10.16.a have the verified material for it, including a fix that is already live. - [ ] M10.18.f Execute cross-role game days, record time/gaps/unsafe ambiguity, update artifacts, and verify closure. Evidence: game-day results. STAYS OPEN BY ITS OWN SPEC: a cross-role game day needs named people. §S10's finding is the one to keep in view here — every game day in that phase reported a result without performing it, and `kill -9` on PID 1 exits 0. - [ ] M10.19 Produce engineering-readiness evidence and reconcile the domain registry. Evidence: no planned/live contradiction. OPEN, AND ITS EVIDENCE LINE IS CURRENTLY FALSE: there IS a planned/live contradiction, measured — three registries answer for Metis and none agree. The readiness evidence this item would produce also already exists in the estate at 1,262 entries and contains zero for this checklist. Both halves are answered by artefacts that point somewhere else. - [ ] M10.19.a Define requirement/capability/host/audience/standard/discipline/ integration evidence index and freshness/owner rules. Evidence: schema. AN EVIDENCE INDEX EXISTS AT SCALE AND IS ABOUT A DIFFERENT CHECKLIST. `oshun-readiness-evidence.json` carries 1,262 ledger entries over 1,573 checklist cells citing 5,490 artifact paths — and `ledgerEntriesForThisChecklist: 0`. Not one entry is for this checklist, and the artefact mentions Metis zero times. Its own properties: 0 of 6 present, 1 of 7 validations performed, and `commitShasThatAreASha: 0` — the commit identifiers it records are not shas. So the schema half of this item is answered by something that already exists; what is missing is an index that points at THIS work. Freshness and owner rules are unwritten, and the owner half runs into the same absent registry as M10.13.f, M10.14.e and M10.18.a. THE INDEX AND BOTH RULES EXIST NOW (2026-09-18), and the freshness rule turned out to be the one with teeth. `scripts/v1-workbenches/generate-metis-evidence-index.mts` → `metis-evidence-index.json` beside its own `metis-evidence-index.schema.json`, wired into both inventory chains. The schema is the deliverable this clause names: one entry per artefact, the seven dimensions required as KEYS, and a dimension the estate does not record carried as `null` rather than omitted — so an absence is counted instead of missing. FRESHNESS IS COMPUTABLE WITHOUT THE ARTEFACTS DATING THEMSELVES, which matters because M10.19.c measured that only 1 of 20 does. These artefacts CITE THEIR OWN SUBJECTS — the threat model names 44 source paths, the contract inventory 83, and every one of them exists — so an artefact is fresh when its last commit is at or after the newest commit touching any source it cites, and stale names the source that moved. MEASURED OVER THE DOMAIN'S WHOLE EVIDENCE TREE, 175 files citing 4,146 sources: **22 fresh, 115 stale, 38 that cite nothing that could date them**. The worst is 22 days — `metis-authoring-maturity.json` against `apps/metis/service/src/metis/schemas/scorm.py`. Two of the 115 are stale because of THIS session: `metis-credential-lifecycle.json` and `metis-package-metadata.json` sit behind `credential_service.py`, which M10.22's correction touched today. That is the rule working, not noise. WHAT STALE MEANS, WRITTEN INTO THE ARTEFACT so nobody reads 115 as 115 wrong: a cited source changing for an unrelated reason flags its artefact too, so stale is "a reviewer has to look again" and the number is an upper bound on freshness — the direction a readiness gate should be wrong in. THE OWNER RULE IS STATED AND UNSATISFIED BY EVERY ROW: 175 of 175 carry `owner: null`, because this estate has no owner registry — the same gap M10.13.f, M10.14.e and M10.18.a record. The schema requires the field so the absence is counted; putting a team name nobody agreed to into 175 rows would have been the alternative. AND THE INDEX POINTS AT THIS WORK, which is what this clause said was missing: each entry lists the §M10 cells that cite it. **23 of 175 are cited by any cell**, which is the same finding .c reports from the other side. Capability, audience and discipline are `null` for all 175 — nothing in the estate records them — and 50 artefacts name an interoperability standard in their own text. 8 tests, including the trap this rule could most easily have fallen into: an artefact that cites nothing answers `null`, never `fresh`. Calling an undatable artefact fresh would have rubber-stamped exactly the 38 nobody can check. STAYS UNCHECKED. The schema, both rules and the index are here, and the three dimensions no registry feeds — capability, audience, discipline — are still empty for every row, as is the owner. This clause asks for the index AND its rules; the rules now measure how far the estate is from satisfying them, which is not the same as satisfying them. - [ ] M10.19.b Collect current contract/migration/test/evaluation/accessibility/ performance/security/DR/runbook/approval artifacts by commit/hash. Evidence: readiness packet. NOT COLLECTED as a packet, though most of the artefacts now exist and are addressable: contracts and migrations in the OpenAPI document and alembic head 073, tests in the service suite, the accessibility gates from M10.13, the DR runbook from M10.18.e, and the 190-odd generated inventories under `evidence/v1-workbenches`. Collecting them BY COMMIT is the part with no mechanism — the existing ledger records commit identifiers that are not shas. THE PACKET EXISTS NOW (2026-09-18) AND THE MECHANISM IS THE POINT. `scripts/v1-workbenches/generate-metis-readiness-packet.mts` → `evidence/v1-workbenches/metis-readiness-packet.json`, wired into both `inventory:v1-workbenches` and `verify:inventory:v1-workbenches`, because a generator nobody runs is not a gate. MEASURED, FIRST RUN: the ten classes this clause names, 39 named paths (0 absent, 0 untracked) and 3 collections over 661 files — and **42 of 42 commit addresses are a 40-character sha**. That number is the whole answer to "the part with no mechanism": the addresses come from `git log -1 --format=%H`, which cannot produce `PENDING_COMMIT`, and the packet counts the shape rather than checking the field is non-empty — which is the check that let the existing ledger's 1,262 placeholder rows through. EVERY ARTEFACT IS ADDRESSED TWICE: the sha256 of its bytes now, and the commit that last touched its path. The file lists come from `git ls-files`, so an uncommitted artefact is ABSENT from the packet rather than present with an invented history. ONE THING THE CLAUSE CANNOT HAVE, and the packet says so rather than pretending: a packet addressed by commit cannot be drift-checked by its commit addresses, because the commit that will carry an artefact does not exist while the packet naming it is written. `--check` therefore compares the CONTENT projection — paths, digests, counts, citations — and reports how many addresses have moved since, as information. A test asserts both halves of that: a changed digest moves the projection and a changed address does not. AND IT ALREADY ANSWERS HALF OF .c: each path is checked against this checklist's text, and **14 of 39 are cited by it**. The other 25 are artefacts no cell's evidence sentence points at — the orphan direction .c asks for, measured here rather than asserted there. 8 tests in `generate-metis-readiness-packet.test.mts`, including the exact trap: the address set must not contain `PENDING_COMMIT`, and the citation count must be neither 0 (the checklist was not read) nor all of them (a count that proves nothing). STAYS UNCHECKED, AND THE DOUBT IS THE REASON RATHER THAN AN ABSENCE OF WORK. The ten classes are the clause's own, but WHICH artefacts belong to each class is a judgement this session made: the estate holds about 140 `metis-*` evidence files and the packet names 39 of them. The mechanism is complete and the enumeration is an opinion, so the box waits on somebody who owns the domain agreeing that these are the artefacts — which is also what .a's freshness and owner rules would settle. - [ ] M10.19.c Validate evidence pass/current/scope/environment/version and bidirectional mapping to every supported matrix/ledger row. Evidence: zero-orphan report. BLOCKED ON .b, and the orphan count is already known to be total rather than zero: with `ledgerEntriesForThisChecklist: 0`, every row of this checklist is an orphan of that ledger and every one of its 1,262 entries is an orphan of this checklist. A bidirectional mapping between two sets that share nothing is empty in both directions. THE REPORT EXISTS NOW (2026-09-18) AND THE ORPHAN COUNT IS NOT TOTAL. .b's packet gave this something to map against, so the mapping is over §M10's own cells rather than over a ledger for another programme: `scripts/v1-workbenches/generate-metis-evidence-orphans.mts` → `evidence/v1-workbenches/metis-evidence-orphans.json`, wired into both inventory chains. MEASURED, BOTH DIRECTIONS, 145 cells (48 checked). The figures below are the run that includes this record, because writing a record CHANGES THE MEASUREMENT — the first run said 61 cells named nothing and this cell was one of them; citing the artefacts here made it 60. An observation that moves what it observes is worth stating rather than hiding behind a timestamp. And every later edit to any §M10 record moves them again, which is why `metis-evidence-orphans.json` is the number and this paragraph is only the reading that prompted it — the counts here are the 2026-09-18 run and the shape of the finding, not a live total: - **60 cells name no artefact at all.** Their evidence lines say "Evidence: schema" or "Evidence: reconciliation report" and point at nothing a reader can open. This is the orphan direction that matters, and it is 41% of the stage; - **20 of the packet's 36 artefacts are named by no cell** — evidence nobody's evidence sentence points at; - 260 citations. 38 are not paths at all (routes, elided paths, build outputs, and identifiers that merely contain a slash), 251 resolve, 7 are a bare filename several files answer to, and 2 do not resolve; - **170 of the 251 resolve only after guessing a root**, and 29 more only by searching the index for a unique basename. The cells cite `tests/test_backpressure.py` and `services/record_reconciler.py`, which are relative to `apps/metis/service` and its `src/metis` — so a tool reading this checklist cannot follow most of its citations without knowing where each record was written from. That is the finding under the finding: the traceability this clause asks for is defeated by the citation convention before any ledger is involved. THE FIVE DIMENSIONS .c NAMES ARE CHECKED AND **0 OF 20 ARTEFACTS CARRY ALL FIVE**: version 19, environment 12, pass 10, scope 10, and **currency 1**. One artefact of twenty records when it was generated (`metis-approval-subject.json`, which carries a commit and a branch), so "is this evidence current?" is unanswerable for the other nineteen. The check is key presence and is labelled as a lower bound — it says the field is there to be read, not that its value is meaningful. TWO CORRECTIONS THIS SESSION MADE TO ITS OWN MEASUREMENTS, both worth keeping because each was wrong in a direction that flattered the report: - the first run reported **30 dead citations**. A citation pattern that matches a slash matches `/api/lti/jwks`, `xapi-2.0/statement/void` and `.../governance` too. Classified now, and the real figure is 2; - and those 2 are not broken links either. Both are deliberate mentions of a file RENAMED to `tests/test_backpressure.py`, and each cell names the current path in the same breath. So the stale-link count in §M10 is ZERO, which a generator cannot tell and a reader can — recorded in the artefact's own `method` so nobody reads the JSON and concludes otherwise. AND A THIRD CORRECTION, ON THIS RECORD ITSELF. The first draft of the paragraph above illustrated the root problem with two invented example paths, in backticks, and the next run counted them: 4 dead citations, two of them written by the sentence explaining the other two. Naming them here in backticks re-created them a second time, so this sentence does not. An illustrative path in a checklist is a citation to anything that reads the checklist; the examples above are real files now. 9 tests in `generate-metis-evidence-orphans.test.mts`, asserting the classifier by value rather than by count. STAYS UNCHECKED: the report is the deliverable this clause asks for and it reports a non-zero orphan count in both directions. "Zero-orphan" is the state, not the artefact — closing this needs the 61 cells to cite their evidence and the 20 unnamed artefacts to be cited or dropped. - [ ] M10.19.d Compare implemented/exposed/deployed state to domain registry planned/internal/preview/live flags by host/audience/region. Evidence: reconciliation report. THE COMPARISON IS DONE AND THE ANSWER IS THAT NOTHING AGREES. `evidence/v1-workbenches/metis-registry-launch-state.json`, which M0.2 generates and this session regenerated: `registriesAnsweringForMetis: 3`, `registriesThatAgree: 0`. Three registries answer for Metis and no two of them say the same thing. `lifecycleStatesRequired: 7` against `lifecycleStatesTheShellCanRepresent: 1` — the shell has one flag where the lifecycle has seven states, so most of the distinctions this item asks to be compared BY cannot be expressed at all. `propertiesMeasured: 5`, `propertiesPresent: 0`. What IS clean is the route half: 11 Oshun-hosted Metis routes, all 11 covered, `routesNotCovered: []`, and the proxy is the middleware, calls the resolver, and refuses before auth. So the reconciliation exists and reports a contradiction. Closing this needs the contradiction resolved, not another comparison. - [ ] M10.19.e Block contradictory shell/routes/capabilities/registry and ratify exact registry change/rollback. Evidence: approved decision. THE CONTRADICTION IS IDENTIFIED AND CANNOT BE RATIFIED HERE. .d shows three registries disagreeing and a shell that can express one of seven lifecycle states; blocking on that is correct and is what this item asks for. The ratification half is human by this stage's own spec, and the same authority gap recurs — M10.14.a's budget type refuses to exist without a ratifier for the same reason. - [ ] M10.20 Obtain named education, accessibility, privacy/security, integrity, engineering, and product approvals. Evidence: human signoff. OPEN BY DESIGN — the evidence line is human signoff and no agent may supply it. The packet half is built: .b freezes and hashes the subject, and names the five fields this repository cannot answer rather than defaulting them. What an approver would be signing is now identifiable; who may sign it is not, because the estate has no approver registry. _2026-09-18: open by design, as its note says: the packet half is built and the evidence is human sign-off (rule 9)._ `blocked:human` - [ ] M10.20.a Define each named approver’s authority/scope/independence, required packet, decision options/conditions/expiry, and invalidation. Evidence: approval matrix. OPEN ON THE SAME MISSING REGISTRY THIS PHASE KEEPS MEETING. Defining "each NAMED approver's authority" needs a register of approvers, and this estate has none — the same absence recorded at M10.13.f for accessibility, M10.14.e for performance and M10.18.a for runbook owners. What the estate does have, and what an approval matrix should reuse rather than reinvent, is M7.13's human-signoff contract and M7.8's conflict-of-interest engine, both closed, plus the independence rule M10.12.c's appeal engine already states by actor digest. The required-packet half is answerable and .b answers it. - [ ] M10.20.b Freeze exact commit/build/config/environment/host/audience/ standards/integration/capability subject manifest. Evidence: subject hash. THE COMPUTABLE HALF IS FROZEN AND HASHED. `scripts/export_approval_subject.py` (`pnpm run metis:approval:subject`) writes `evidence/v1-workbenches/metis-approval-subject.json`: the commit, the branch, whether the working tree was clean, the migration head, the OpenAPI digest, 882 operations, 3,685 published schemas, the three applications, and a `subject_sha256` over all of it. An approval can now name a digest, and a later reader can tell whether what is in front of them is what was approved. FIVE FIELDS THIS ITEM ASKS FOR ARE NAMED AS NOT COMPUTABLE RATHER THAN DEFAULTED, because a defaulted field in a frozen subject is the one that makes the freeze a lie: there is no build identifier, no captured runtime configuration, no addressable deployed environment, no agreed host/audience (three registries disagree — M10.19.d), and no capability manifest scoped to this checklist. The manifest also records `working_tree_clean`, because a subject hash taken over a dirty tree names a state nobody can check out. - [ ] M10.20.c Obtain separate education/pedagogy/psychometrics, accessibility, privacy/security, and integrity approvals with conditions. Evidence: governance decisions. STAYS OPEN BY THIS STAGE'S OWN SPEC: a named person has to act. Recording an approval here would be the exact fabrication this checklist exists to catch. What CAN be said is what each approver would be reading: accessibility has gates and two open ceilings (M10.13), integrity has a measured self-approval hole (M10.12.e), and psychometrics has a fairness analysis proven sound in both directions (M10.11.b and .c). - [ ] M10.20.d Obtain engineering/operations/interoperability and per-host/ audience product launch decisions. Evidence: launch decisions. STAYS OPEN, and per-host/audience decisions are additionally unanswerable while three registries disagree about what Metis is (M10.19.d). - [ ] M10.20.e Record approve/reject/conditional/request-changes immutably and revalidate on material evidence/scope/subject change. Evidence: approval lifecycle. OPEN. The revalidation trigger is now mechanical, which is the part worth having early: .b's `subject_sha256` changes whenever the commit, the migration head or the published contract does, so "material subject change" is a digest comparison rather than a judgement. The immutable record itself needs the store and the approver registry that .a is blocked on. - [ ] M10.21 Run full-journey Playwright for lecture/agentic-media creation, correctness critique, accessible renditions, localization, and learner playback. Evidence: real sandbox/render adapters or explicitly hermetic dependencies and exact provenance assertions. NOT WALKED. This is the same unwalked UI half M10.10 and M10.12 carry, with an added dependency: the render stage needs Isis and Euterpe through their canonical adapters, and this stage's spec is explicit that hermetic never means skipping the render. The lecture delivery path itself is real and was read closely under M10.13.e, which found the image alternative it drops. - [ ] M10.21.a Seed exact lesson/objectives/sources/data/presenter consent/ locales/targets and live or explicitly hermetic render/Isis/Euterpe dependencies. Evidence: fixture manifest. - [ ] M10.21.b Author script/scene plan/spec/code/media, execute sandbox render with progress/cost, and retain all stage/source/tool provenance. Evidence: creation journey. - [ ] M10.21.c Run visual/layout/source/math-code/correctness/accessibility/ technical critics, reject one iteration, revise, and require educator acceptance. Evidence: critique journey. - [ ] M10.21.d Author/review captions/transcript/description/translation/ pronunciation/renditions and surgical replacement with stable unaffected segments. Evidence: localization/replacement journey. - [ ] M10.21.e Assemble package, clear gates, publish, play via real learner renderer across locale/device/bandwidth/accessibility. Evidence: playback journey. - [ ] M10.21.f Assert budget/policy/render/verification stop, no self-publish, source/consent withdrawal, tenant/role boundaries, and exact lineage. Evidence: E2E trace. - [ ] M10.22 Run full-journey credential tests from pathway authoring through evidence review, Open Badges issuance/verification, expiry, revocation, replacement, and audit. Evidence: issuer, privacy, and stale-course boundaries. NOT WALKED. The clause above was spliced in half by the record that followed it — "from pathway authoring through" ran straight into a paragraph and the rest of the sentence appeared after it. Rejoined 2026-09-18. AND THE BLOCKER THAT RECORD NAMED IS NOT WHAT HAPPENS. It said the credential service keeps revocations in process dictionaries "so a restart resurrects a revoked badge". The dictionaries are real — nothing in `services/credential_service.py` survives a restart — but the direction was measured on 2026-09-18 by driving it, and it is the opposite: after the class attributes are cleared, the same credential and the same document verify as **`not_found`, `valid=False`**. `verify_credential` hands anything the registry does not hold to `_verify_unregistered_document`, which returns `valid=False` whatever else passes — and the canonical hash and the HMAC proof DO still pass, because the signing secret is configuration and survives the restart. That is why the claim was plausible and it is still wrong. THE REAL DEFECT IS THE SAFE DIRECTION AND IS STILL A DEFECT: every issued badge becomes unverifiable after a restart, not just the revoked ones, so a learner's legitimate badge stops verifying. A journey that restarts the process would find that, which is what this item should walk. Four tests pin the direction now (`tests/test_credential_service.py::CredentialRestartDirectionTest`), including the one that matters: a revoked badge must not verify as valid when the issuer cannot account for it. A docstring cannot enforce that, and the one that tried had it backwards. - [ ] M10.22.a Seed credential issuer/roles/keys/template/objectives/course/ assessment/evidence policies and synthetic recipient. Evidence: fixture. - [ ] M10.22.b Author/approve pathway and complete locked criteria with exact learning/assessment/human evidence; test missing/stale/conflicting cells. Evidence: eligibility journey. - [ ] M10.22.c Review independently, issue/sign/deliver Open Badge, and verify signature/issuer/recipient/evidence/status through public/private views. Evidence: issuance journey. - [ ] M10.22.d Advance fake clock through warning/expiry/renew and execute revoke/replacement/supersession/status notification. Evidence: lifecycle journey. - [ ] M10.22.e Assert author/agent/course completion cannot issue, protected learner evidence is minimized, stale course invalidates request, and audit remains immutable. Evidence: boundary E2E. - [ ] M10.23 Run known-value and calibrated suites for atomic claims, citation OPEN WITH .f DONE. The coverage gate this stage's evidence line asks for exists and passes, and it found the one asymmetry worth knowing: five of the six enumerated verifiers are scored against a versioned corpus and cultural review is not. Building the corpora .a–.e ask for is the remaining work, and .c's calibrated panel sets additionally need the human judgements no agent can supply. sufficiency, faithfulness, contradiction, math, code, worked solutions, evaluator panels, media critics, and discipline-specific verification. Evidence: no generic "content quality" test substitutes for an enumerated verifier. - [ ] M10.23.a Build versioned labeled corpora and coverage rows for atomic claim segmentation/linking and support/sufficiency/faithfulness/ contradiction/conflict. Evidence: grounding suites. - [ ] M10.23.b Build executable math/code/worked-solution goldens for correct/ wrong/partial/alternative/unsafe/flaky/timeout/unsupported cases. Evidence: deterministic suites. - [ ] M10.23.c Build calibrated panel/critic gold sets with evaluator dependency/correlation, confidence/abstention/manual bands, champion/ challenger, and subgroup reports. Evidence: panel reports. - [ ] M10.23.d Build diagram/chart/lecture/media visual/layout/accessibility/ source/correctness critic fixtures and renderer/version goldens. Evidence: media critic suites. - [ ] M10.23.e Build per-discipline proof/lab/data/source/language/code specialized verification fixtures and standards export survival tests. Evidence: discipline suites. - [x] M10.23.f Publish a verifier-to-fixture/report/threshold/owner matrix and fail any enumerated verifier covered only by generic content quality. Evidence: dedicated coverage gate. THE GATE EXISTS AND ALL SIX CLEAR THE BAR THIS ITEM SETS. `tests/test_verifier_coverage_matrix.py`, 7 tests over the six verifiers this stage enumerates by name. Each has a service of its own, each has at least two dedicated test files, no generic content-quality suite exists to stand in for any of them, and every corpus a verifier names resolves on disk — a corpus path that does not resolve is a verifier scored against nothing, and it would fail only when somebody ran it. THE MATRIX, measured by reading what each verifier's own modules load rather than by matching filenames: - `claim_decomposition` → `m5_19_atomic_claim_corpus.json` - `grounding_gate` → `m5_20_grounding_gate_corpus.json` - `mathematics_verification`→ `m5_21_executable_math_corpus.json` - `code_verification` → `m5_22_sandboxed_code_corpus.json` - `evaluator_panel` → `m5_24_evaluator_panel_corpus.json` - `cultural_review` → NONE FIVE ARE CALIBRATED AND ONE IS MERELY TESTED. The five ship an `*_evaluation.py` that scores the corpus and reports matched against total per dimension. `cultural_review` has six dedicated test files and a fixtures module, so it passes this item's "not generic" bar outright — but it has no corpus and no evaluation module, so nothing says how much of its own space those six suites reach. Held as a ceiling that may shrink and must never grow. THRESHOLDS AND OWNERS ARE NOT EXPRESSIBLE and the matrix says so rather than inventing them: the estate has no owner registry, the same absence recorded at M10.13.f, M10.14.e, M10.18.a and M10.20.a. --- ## Phase Y — Yemaya AAA production, study, and interactive-case authoring Yemaya is an existing AAA production suite, not a greenfield V1 route. This phase adds coherent study-material and interactive-case authoring to `apps/yemaya/studio-web` and its desktop host while completing and governing the existing project, script/storyboard, character/world, asset, production, engine-integration, collaboration, rendering, agent, marketplace, canon, case, and human-override systems. Consumer study experiences remain distinct from authoring, but the existing AAA suite is in scope for explicit feature reconciliation rather than being hidden behind the word "integration." ### Y0 — Boundary, host, inventory, and production decisions - [ ] Y0.1 Inventory the Studio web/desktop route trees and classify live, fixture, documentation, duplicate, and missing surfaces. Evidence: route-to-capability matrix. - [x] Y0.1.a Enumerate every web/Electron route, nested layout, navigation/ deep-link entry, IPC/API call, feature flag, consumer, owner, and test. Evidence: deterministic route inventory. - [ ] Y0.1.b Exercise each surface against backing services and label live, partial/degraded, fixture/demo, documentation/mock, unreachable, or missing with proof. Evidence: runtime classification. - [ ] Y0.1.c Map route operations/fields to atomic capabilities, audience/ role, project type, owner service/package, data store, and desktop/web requirement. Evidence: route-capability matrix. - [ ] Y0.1.d Identify duplicate mutation/read facades, stale aliases, undocumented live routes, orphan APIs, and asserted capabilities with no route. Evidence: divergence report. - [ ] Y0.1.e Assign reuse/refactor/redirect/retire/net-new/exclude dispositions with owner, compatibility window, and test. Evidence: approved ledger. - [ ] Y0.1.f Add route/inventory drift checks and honest-state tests. Evidence: route coverage gate. - [ ] Y0.2 Define the shared renderer boundary between Studio web and Electron desktop. Evidence: no business rule exists only in a renderer component. - [x] Y0.2.a Inventory renderer/shared/domain/service/main-process code, imports, state, validation, permissions, API/IPC handlers, and duplicated business rules. Evidence: dependency map. - [ ] Y0.2.b Define renderer-agnostic domain contracts/use cases/state machines/validation/authorization and shared view-model seams. Evidence: boundary interfaces. - [ ] Y0.2.c Define web transport and Electron preload IPC adapters with typed command/query/events, structured errors, cancellation, and versioning. Evidence: adapter contracts. - [ ] Y0.2.d Keep native filesystem/device/DCC/render capabilities behind main- process service ports; renderer receives no Node/Electron privilege. Evidence: security boundary tests. - [ ] Y0.2.e Move or disposition renderer-only validation/workflow/policy/ canon/release rules into canonical domain owners. Evidence: rule ledger. - [ ] Y0.2.f Run identical domain contract/consumer tests through web and desktop adapters and fail forbidden imports. Evidence: parity gate. - [ ] Y0.3 Define which native capabilities require desktop: local files, DCC bridge, large media, background render, color management, and device capture. Evidence: capability matrix and browser fallback. - [ ] Y0.3.a Define versioned native-capability registry with host/OS/device/ permission/security/resource/offline requirements and audience. Evidence: capability schema. - [ ] Y0.3.b Specify local file/directory/project package operations, path/ symlink/permission/sandbox rules, watchers, and web upload/download/ file-system-access fallback. Evidence: file matrix. - [ ] Y0.3.c Specify DCC/engine bridge discovery/session/command/transfer/ version/auth behavior and governed Bellona handoff; web fallback is inspect/deep-link/export only. Evidence: bridge matrix. - [ ] Y0.3.d Specify large media streaming/proxy/chunk/cache/memory/disk/ hardware decode behavior and browser limits/degraded states. Evidence: media matrix. - [ ] Y0.3.e Specify background render/encode/job resume/notifications/power, color profile/display/OCIO, and capture device permission/calibration/ consent behavior. Evidence: render/color/capture matrices. - [ ] Y0.3.f Define capability negotiation and honest supported/degraded/ unavailable/install-desktop/open-desktop states with no data loss. Evidence: fallback tests. - [ ] Y0.4 Define the authoring/consumer boundary for `study-workspace`. Evidence: authoring never writes consumer read models directly. - [ ] Y0.4.a Inventory authoring/consumer routes, packages, schemas, stores, caches/indexes, mutations, events, and current direct writes. Evidence: boundary inventory. - [ ] Y0.4.b Define canonical study project/content/revision/build/release mutation owner and separate consumer delivery/progress/session read owners. Evidence: ownership matrix. - [ ] Y0.4.c Define versioned compiled study bundle/publication event consumed to build delivery read models and no shared mutable content rows. Evidence: handoff contracts. - [ ] Y0.4.d Define author preview through the real consumer renderer using synthetic identity and nonoperational events. Evidence: preview boundary. - [ ] Y0.4.e Remove/prohibit direct authoring writes to consumer database/ index/cache/progress and direct consumer edits to authoring revisions. Evidence: dependency/schema guards. - [ ] Y0.4.f Test publication/supersession/recall/read-back, two-tenant and failure/replay behavior. Evidence: boundary integration suite. - [ ] Y0.5 Define the study and interactive-case content tracks plus their shared project, source, asset, review, and release spine. Evidence: domain context diagram. - [ ] Y0.5.a Define track-specific goals, authors/audiences, content entities, authoring journeys, validation, outputs, consumers, and explicit exclusions. Evidence: track charters. - [ ] Y0.5.b Define shared project/workspace/member/role/revision/maturity/ schedule/budget/audit contracts without collapsing track semantics. Evidence: shared project map. - [ ] Y0.5.c Define shared governed source/claim/citation/rights and asset/ variant/provenance/continuity/canon relationships. Evidence: source/asset spine. - [ ] Y0.5.d Define shared comment/review/gate/decision/approval/exception/ localization workflows with track-specific templates. Evidence: review spine. - [ ] Y0.5.e Define track-specific compiler/bundle/target/publication/catalog/ consumer handoffs atop shared release candidate/execute/verify/recall. Evidence: release spine. - [ ] Y0.5.f Draw ownership, context, trust, data, event, and cross-domain boundaries plus valid reuse/forbidden coupling. Evidence: ratified context diagram. - [ ] Y0.6 Map all `libs/yemaya/*` packages to the two tracks, shared production systems, other Yemaya products, or out-of-scope. Evidence: complete package ledger. - [x] Y0.6.a Enumerate every package/export/source/test/dependency/consumer/ build target/owner and detect nested/untracked/dead packages. Evidence: package inventory. - [x] Y0.6.b Extract public entities/operations/events/jobs/adapters/UI/ algorithms and link exact source locations. Evidence: capability catalog. - [ ] Y0.6.c Map each capability to study track, interactive-case track, shared production, AAA/organization/marketplace/developer/consumer product, or explicit out-of-scope. Evidence: classification ledger. - [ ] Y0.6.d Assign canonical owner, reuse/refactor/move/merge/retire/exclude/ net-new disposition and identify duplicate/shadow shapes. Evidence: disposition review. - [ ] Y0.6.e Map every retained package feature bidirectionally to route/API/ contract/ledger/evidence and add zero-orphan drift gate. Evidence: complete package ledger. - [ ] Y0.7 Reconcile case contracts, compiler, director, engine, verifier, eval, canon, localization, and pipeline ownership. Evidence: dependency direction ADR. - [x] Y0.7.a Inventory contracts/packages/services/stores/jobs/CLIs/routes/ events/tests for each named subsystem and current dependency graph. Evidence: subsystem inventory. - [ ] Y0.7.b Define canonical aggregates/operations/outputs and mutation/read ownership for case authoring, compilation, direction/runtime, verification evaluation, canon, localization, and pipeline. Evidence: ownership map. - [ ] Y0.7.c Define permitted dependency direction, public ports/contracts/ events, versioning, idempotency, failure, and no private-store imports. Evidence: target graph. - [ ] Y0.7.d Reconcile duplicate case/canon/localization/evaluation shapes and migrate consumers with compatibility/retirement plan. Evidence: contract disposition. - [ ] Y0.7.e Define compiler output as immutable input to engine/director and verifier/eval evidence as nonauthoritative inputs to review. Evidence: authority invariants. - [ ] Y0.7.f Ratify ADR with cycle/forbidden-import/drift tests and rejected alternatives. Evidence: approved dependency-direction ADR. - [ ] Y0.8 Reconcile project, asset-library, dailies, collaboration, rendering, orchestration, budget, safety, and human-override systems. Evidence: no planned shadow implementation. - [ ] Y0.8.a Inventory existing services/packages/routes/stores/jobs/UIs/events/ deployments for each production system with live/partial/fixture status. Evidence: system inventory. - [ ] Y0.8.b Map study/case requirements to exact reusable project/asset/ dailies/collaboration/render/orchestrator/budget/safety/override operations and contracts. Evidence: reuse matrix. - [ ] Y0.8.c Identify gaps, duplicate proposed stores/queues/workflows/ dashboards, conflicting state vocabularies, and authority overlap. Evidence: gap/duplication report. - [ ] Y0.8.d Assign reuse/facade/extend/refactor/migrate/retire/net-new disposition with canonical owner and dependencies. Evidence: disposition ledger. - [ ] Y0.8.e Define governed cross-system identity/version/tenant/project/ lineage/audit/transaction/event/recovery handoffs. Evidence: seam contracts. - [ ] Y0.8.f Add architecture/dependency/schema inventory guards proving no shadow canonical implementation. Evidence: ownership gate. - [ ] Y0.9 Define author, researcher, writer, designer, editor, canon reviewer, solver, localization reviewer, producer, publisher, and administrator roles. Evidence: permission matrix. - [ ] Y0.9.a Define each role’s purpose/qualifications, track/project/ organization scope, eligible actor, delegation, lifecycle, and conflicts. Evidence: role definitions. - [ ] Y0.9.b Map project/source/story/case/canon/solution/asset/script/ production/localization/review/release/admin operations per role. Evidence: operation matrix. - [ ] Y0.9.c Map unpublished story/protected source/spoiler/solution/ participant/biometric/rights/budget/security fields and actions at property level. Evidence: field matrix. - [ ] Y0.9.d Define author/reviewer/solver/canon/publisher separation, quorum, conflict, substitute, embargo, blind-review, and break-glass rules. Evidence: duty policy. - [ ] Y0.9.e Define administrator bounds for membership/configuration versus content/canon/solution/approval/publication authority. Evidence: admin boundary. - [ ] Y0.9.f Test route/object/property/function, combined roles, role change, direct IDs, embargo/spoiler, and two tenants. Evidence: permission suite. - [ ] Y0.10 Define maturity models for study projects and cases separately. Evidence: state vocabularies do not overload project production status. - [x] Y0.10.a Inventory current study/case/content/review/production/render/ release/consumer states, labels, enums, owners, and collisions. Evidence: vocabulary inventory. - [ ] Y0.10.b Define study content maturity states/transitions/prerequisites/ roles/effects independently from project schedule/asset production. Evidence: study state machine. - [ ] Y0.10.c Define interactive-case concept/writing/canon/solvability/ production/review/release maturity independently from runtime play state. Evidence: case state machine. - [ ] Y0.10.d Define shared project production status and relation/projection to each track’s maturity without one mutating the other. Evidence: mapping. - [ ] Y0.10.e Define transition concurrency, revisions, review invalidation, supersession/archive/quarantine/restore, audit, and server enforcement. Evidence: transition matrix tests. - [ ] Y0.10.f Detect API/UI/analytics/export vocabulary collisions and prove no overloaded enum/default mapping. Evidence: collision review. - [ ] Y0.11 Threat-model source injection, malicious project files, spoiler leakage, canon corruption, unfair or harmful case content, unsafe media, agent runaway, desktop IPC, local filesystem, and supply chain. Evidence: mitigations map to tests. - [ ] Y0.11.a Map actors/assets/trust boundaries/data flows/entry points/ providers/tools/hosts/integrations/high-impact actions. Evidence: threat model context. - [ ] Y0.11.b Model prompt/source/retrieval/import injection and poisoned/ retracted/false/protected sources across authoring, agents, compilers, critics, and generated media. Evidence: source threats. - [ ] Y0.11.c Model spoilers/solutions/unpublished story/canon/embargo leakage via UI/API/search/export/logs/caches/collaboration/local files/consumer builds. Evidence: confidentiality threats. - [ ] Y0.11.d Model canon tamper/conflicts, unfair/unsolvable/manipulative/ harmful case content, unsafe media/identity/voice/minor/rights use, and false automated approval. Evidence: content threats. - [ ] Y0.11.e Model agent budget/tool/loop/runaway/injection/approval confusion, hidden side effects, and cross-project/tenant data access. Evidence: agent threats. - [ ] Y0.11.f Model Electron IPC/preload/navigation/deep-link/update/plugin/ local filesystem/path/symlink/credential/device/DCC/renderer compromise. Evidence: desktop threats. - [ ] Y0.11.g Model package/model/node/renderer/DCC/engine/marketplace/ dependency/artifact/build/distribution supply-chain tamper. Evidence: supply-chain threats. - [ ] Y0.11.h Assign prevention/detection/response/recovery, owner, residual risk, test, monitoring, incident runbook, and launch gate per threat. Evidence: mitigation traceability map. - [ ] Y0.12 Define data classification for unpublished story material, protected sources, case solutions, participant data, assets, and local caches. Evidence: privacy/security decision. - [x] Y0.12.a Inventory entities/fields/files/blobs/prompts/logs/events/search/ exports/backups/local caches for each named data category. Evidence: data inventory. - [ ] Y0.12.b Define classification labels and per-category owner, purpose, access roles, tenant/project isolation, encryption/key, residency, retention/deletion/legal hold, export, and audit. Evidence: policy map. - [ ] Y0.12.c Define spoiler/embargo/need-to-know compartments and protected source/solution field-level projections with nonenumerable errors. Evidence: confidentiality matrix. - [ ] Y0.12.d Define participant/performer/voice/likeness/biometric/consent/ minor and review-comment/telemetry privacy handling. Evidence: participant policy. - [ ] Y0.12.e Define asset derivative/proxy/watermark/provenance and desktop local cache encryption/OS storage/offline/eviction/logout/device-loss behavior. Evidence: asset/cache policy. - [ ] Y0.12.f Threat-test UI/API/search/logs/notifications/exports/IPC/local files/backups/support/analytics and obtain privacy/security decision. Evidence: classification tests and approval. - [ ] Y0.13 Define web/desktop parity, version-skew, update, offline, and project-lock policies. Evidence: compatibility ADR. - [ ] Y0.13.a Define versioned web/desktop/shared-contract/native-capability/ server compatibility matrix and support windows. Evidence: matrix. - [ ] Y0.13.b Classify required parity versus desktop-only/web-fallback/ unsupported behaviors, UI states, data semantics, and test proof. Evidence: parity policy. - [ ] Y0.13.c Define startup/runtime version negotiation, min/max/expiring/ unsupported behavior, protocol/schema migration, and no silent skew. Evidence: skew tests. - [ ] Y0.13.d Define signed update discovery/download/staging/migration/ restart/rollback/forced-security-update and interrupted update behavior. Evidence: update policy. - [ ] Y0.13.e Define offline cache/project availability, read/write/queued commands, conflict/reconnect/revalidation, secret expiry, and honest state. Evidence: offline policy. - [ ] Y0.13.f Define project/revision/entity/asset/render locks, lease/ heartbeat/fencing/expiry/takeover/read-only, desktop crash, and split- brain behavior. Evidence: lock policy. - [ ] Y0.13.g Ratify compatibility ADR and matrix-generated web/desktop/skew/ update/offline/lock tests. Evidence: approved ADR. - [ ] Y0.14 Define success measures for authoring throughput, solvability, canon quality, source grounding, collaboration, render reliability, and release correctness. Evidence: metric specification. - [ ] Y0.14.a Define authoring flow measures by track/stage with denominator, wait/rework/block/abandonment and quality/safety countermetrics. Evidence: throughput metrics. - [ ] Y0.14.b Define solvability/fairness measures for clues/evidence/paths/ ambiguity/hints/solver outcomes with calibrated sample/uncertainty and no “difficulty equals quality” incentive. Evidence: solvability metrics. - [ ] Y0.14.c Define canon/source measures for conflicts/drift/coverage/ authority/currency/citation/faithfulness/corrections and review burden. Evidence: trust metrics. - [ ] Y0.14.d Define collaboration measures for review cycle/response/ conflicts/merge/rework/participation with privacy and no worker surveillance incentive. Evidence: collaboration metrics. - [ ] Y0.14.e Define render/job reliability/SLO/resource/cost/quality and release planned-written-verified/partial/rollback/recall metrics. Evidence: production metrics. - [ ] Y0.14.f Specify source/formula/unit/window/dimensions/privacy/freshness/ owner/target/guardrail/limitations and ratify against harmful shortcuts. Evidence: approved metric catalog. - [ ] Y0.15 Author and ratify `V1/YEMAYA_AUTHORING_WORKBENCH_DESIGN_2026-07-23.md` with current-state, web/desktop boundary, study/case tracks, data, APIs, agents, production, trust, migration, rollout, and decision records. Evidence: approved doc and resolved review comments. - [ ] Y0.15.a Establish scope/terminology/requirements traceability/source anchors/owners/reviewers/decision log/evidence format. Evidence: outline. - [ ] Y0.15.b Document current routes/apps/packages/contracts/stores/jobs/ agents/CLIs/integrations/deployments and live/partial/fixture/proposed truth. Evidence: current-state review. - [ ] Y0.15.c Document web/desktop/renderer/native boundaries, audiences/roles/ product tracks/project profiles, data/contracts/APIs/events/jobs, and cross-domain ownership. Evidence: architecture sections. - [ ] Y0.15.d Document study/case authoring/canon/sources/assets/production/ agents/compiler/runtime/UI/responsive/accessibility/localization/offline journeys. Evidence: workflow/experience sections. - [ ] Y0.15.e Document trust/safety/rights/privacy/security/supply chain, verification/evaluation/observability/operations/DR. Evidence: trust sections. - [ ] Y0.15.f Document migration/compatibility/rollout/flags/deprecation/ rollback/readiness and explicit ADRs/options. Evidence: rollout sections. - [ ] Y0.15.g Reconcile code/inventory/deep dives, resolve every comment, and obtain named domain/security/privacy/accessibility/engineering/product ratification. Evidence: approved design. - [ ] Y0.16 Reconcile the domain feature inventory, all web/desktop pages, 44+ API route groups, every `libs/yemaya/*` package, worker, CLI, walkthrough, and external integration at atomic-feature level. Evidence: the inventory explicitly covers projects, assets, scripts/storyboards, characters/ worlds, production management, collaboration, autonomous pipelines, engines/DCCs, gameplay/NPCs, virtual production/XR, marketplaces/search, organizations/enterprise, community, study, and cases. - [x] Y0.16.a Build deterministic atomic inventories from feature docs, every page/route/operation/schema/package/worker/job/CLI/walkthrough/ integration/test with source anchors. Evidence: source inventories. - [ ] Y0.16.b Normalize aliases through reviewed mappings while preserving source identity/version/semantics and live/fixture/asserted state. Evidence: alias map. - [ ] Y0.16.c Map projects/assets/scripts/storyboards/characters/worlds/ production/collaboration/dailies/rendering and autonomous pipelines. Evidence: core production rows. - [ ] Y0.16.d Map engines/DCCs/gameplay/NPCs/virtual production/XR/mocap/ builds/runtime/device operations with Bellona/Aja ownership boundaries. Evidence: specialized production rows. - [ ] Y0.16.e Map marketplace/search/community/organizations/enterprise/admin/ developer APIs/SDK/webhooks/plugins and security/monetization authority. Evidence: platform rows. - [ ] Y0.16.f Map study/case/source/canon/compiler/solver/localization/ publication/consumer delivery features. Evidence: track rows. - [ ] Y0.16.g Assign reuse/refactor/move/merge/retire/net-new/defer/reject, canonical owner, task, dependencies, and evidence per atomic feature. Evidence: disposition ledger. - [ ] Y0.16.h Review collisions/orphans/unsupported assertions and add a bidirectional zero-orphan drift gate. Evidence: approved reconciliation. - [ ] Y0.17 Define the product boundary among AAA creation, production operations, organization administration, marketplace/community, developer tooling, study/case authoring, and consumer delivery. Evidence: each capability has an authorized audience/host and governed handoff or explicit exclusion. - [ ] Y0.17.a Define purpose/actors/hosts/routes/owner services/data/actions for AAA creation, production ops, org admin, marketplace/community, developer, study/case, and consumer delivery. Evidence: surface matrix. - [ ] Y0.17.b Assign every atomic capability to exactly one mutation owner and authorized audiences, with any read-only facade/deep link. Evidence: ownership ledger. - [ ] Y0.17.c Define governed signed/versioned project/asset/run/build/review/ release/entitlement handoffs between products and external domains. Evidence: handoff contracts. - [ ] Y0.17.d Keep organization/billing/security, marketplace/payout, operator fleet/incident, and consumer progress/session authority out of authoring convenience routes. Evidence: boundary tests. - [ ] Y0.17.e Define excluded/deferred/unsupported cells and safe UI/API/ capability behavior without hidden routes or generic fallback. Evidence: exclusion matrix. - [ ] Y0.17.f Test direct URL/API/property/function, role changes, deep links, search/export/logs/cache, and tenant/product boundary leakage. Evidence: adversarial suite. - [ ] Y0.18 Define supported project types and production profiles for film, episodic, animation, game, virtual production, XR, study, interactive case, podcast/AV, and other ratified types. Evidence: every profile maps required entities, pipeline stages, roles, gates, assets, exports, and target hosts without inheriting unsupported defaults. - [ ] Y0.18.a Define versioned project-type/profile registry with owners, audience, lifecycle, inheritance, target platforms, and code floors. Evidence: registry schema. - [ ] Y0.18.b Define film/episodic/animation profiles for script/scene/shot/ sequence/editorial/VFX/audio/color/delivery stages, roles, assets, gates, schedules, and targets. Evidence: screen profile rows. - [ ] Y0.18.c Define game profiles for world/level/character/gameplay/NPC/UI/ audio/cinematics/build/test/performance/engine/platform stages and assets. Evidence: game rows. - [ ] Y0.18.d Define virtual-production/XR profiles for stage/device/tracking/ camera/render/mocap/engine/session/safety/calibration/build/deployment. Evidence: VP/XR rows. - [ ] Y0.18.e Define study/interactive-case profiles for sources/content/ canon/clues/solver/compiler/localization/accessibility/review/bundle/ consumer target. Evidence: track rows. - [ ] Y0.18.f Define podcast/AV and other ratified profiles for script/record/ edit/mix/video/captions/distribution/rights/loudness/target requirements. Evidence: AV rows. - [ ] Y0.18.g Map exact required/optional/unavailable entities/pipeline stages/ roles/gates/assets/exports/host capabilities/dependencies per profile. Evidence: profile matrix. - [ ] Y0.18.h Fail missing/unsupported cells instead of inheriting defaults and test profile resolution/overlays/migrations. Evidence: no-default gate. ### Y1 — Project, content, revision, and source contracts - [ ] Y1.1 Define a canonical authoring project with track, workspace, tenant, ownership, locale, status, production links, and retention policy. Evidence: contract invariants. - [ ] Y1.1.a Define stable project identity/revision, track/project type/ production profile, title/description, tenant/organization/workspace, and lifecycle. Evidence: base schema. - [ ] Y1.1.b Define owner/member/team/role assignments, visibility/ compartment/embargo, created/imported/forked provenance, and audit. Evidence: ownership tests. - [ ] Y1.1.c Define source/default/supported locale, fallback, translation policy, time zone, units/color profile, and accessibility targets. Evidence: locale/config tests. - [ ] Y1.1.d Define authoring maturity separately from project production/ release/consumer state and valid transitions/guards. Evidence: status invariants. - [ ] Y1.1.e Define links to assets/production schedule/budget/runs/builds/ targets/external projects by exact version/owner contract. Evidence: production link tests. - [ ] Y1.1.f Define classification/retention/archive/delete/legal hold/export/ local-cache policy and tenant-scoped key/index invariants. Evidence: lifecycle tests. - [ ] Y1.2 Define study project, collection, module, note, source node, anchor, concept, reading order, activity, and published artifact entities. Evidence: schema fixtures. - [ ] Y1.2.a Define study-project specialization and versioned collection/ membership/order/source-scope entities. Evidence: project/collection fixtures. - [ ] Y1.2.b Define module hierarchy/order/objectives/summary/content/activity/ prerequisite/publication state with cycle/depth rules. Evidence: module fixtures. - [ ] Y1.2.c Define note/block/annotation/tag/author/source/citation/locale/ visibility/revision and protected-source fields. Evidence: note fixtures. - [ ] Y1.2.d Define source node/version/kind/authority/rights/checksum/ extraction plus typed anchor and note/canon links. Evidence: source fixtures. - [ ] Y1.2.e Define concept identity/version/definition/aliases/relationships/ evidence and a separate reading-order/prerequisite graph. Evidence: concept/order fixtures. - [ ] Y1.2.f Define activities with type/instructions/inputs/outputs/resources/ time/accessibility/consumer behavior and no progress authority. Evidence: activity fixtures. - [ ] Y1.2.g Define published study artifact/build/manifest/locale/target/ constituent revisions/hashes/provenance/release state. Evidence: full schema goldens. - [ ] Y1.3 Define case project, premise, mystery model, suspect, relationship, motive, means, opportunity, clue, red herring, scene, timeline event, location, reveal, solution, and ending entities. Evidence: complete case fixture. - [ ] Y1.3.a Define case-project specialization, premise/theme/tone/setting/ audience/format/duration/difficulty/safety/locale and exact source/canon scope. Evidence: case/premise schema. - [ ] Y1.3.b Define mystery model/question/crime-event/truth state/solution constraints/allowed interpretations and solver-visible separation. Evidence: mystery schema. - [ ] Y1.3.c Define character/suspect identity, public/private knowledge, background/traits/goals/arc/alibi plus motive/means/opportunity as typed evidence-backed dimensions. Evidence: suspect fixtures. - [ ] Y1.3.d Define directed typed relationship revisions with source/canon, temporal interval, visibility/spoiler, confidence, and contradictions. Evidence: relationship fixtures. - [ ] Y1.3.e Define clue/red-herring identity/kind/content/source/truth link/ discovery prerequisites/placement/salience/interpretations/fairness/ payoff and player-visible state. Evidence: clue fixtures. - [ ] Y1.3.f Define scene/location/timeline event/order/branch/participants/ actions/dialogue/clue transitions/asset/production/continuity links. Evidence: scene/timeline fixtures. - [ ] Y1.3.g Define reveal sequence, solution reasoning graph/evidence/ alternatives, ending conditions/outcomes/epilogue and embargoed authority. Evidence: solution/ending fixtures. - [ ] Y1.3.h Publish minimal/full/branching/multisuspect/multilocale/ intentionally ambiguous/invalid complete-case goldens. Evidence: fixture suite. - [ ] Y1.4 Define canon assertions with namespace, subject, predicate, object, temporal scope, source, confidence, status, and contradiction links. Evidence: canon contract tests. - [ ] Y1.4.a Define assertion logical/revision identity, tenant/project/ franchise namespace, subject/predicate/object typed refs/literals, author, and lifecycle. Evidence: base schema. - [ ] Y1.4.b Define temporal instant/interval/sequence/era/unknown scope, effective story-world versus publication chronology, and uncertainty. Evidence: temporal tests. - [ ] Y1.4.c Define exact source/citation/creator decision/production artifact evidence, authority, confidence basis, rights, and freshness. Evidence: provenance tests. - [ ] Y1.4.d Define proposed/under-review/canonical/conditional/disputed/ deprecated/retconned/invalid status and role/guard transitions. Evidence: state tests. - [ ] Y1.4.e Define supports/contradicts/refines/supersedes/scoped-exception/ alternate-continuity links with exact revisions and no auto-resolution. Evidence: relation tests. - [ ] Y1.4.f Validate namespace/entity/predicate vocabulary/units/cardinality/ temporal logic/cycles/conflicts and preserve unknown/N/A. Evidence: contract suite. - [ ] Y1.5 Define typed stable anchors for source pages, study notes, case scenes, dialogue, clues, timeline events, assets, frames, and timecodes. Evidence: anchor round-trip tests. - [ ] Y1.5.a Define common anchor identity, exact subject/revision/kind, locator payload, context/hash/fingerprint, author, and resolution status. Evidence: anchor schema. - [ ] Y1.5.b Define page/region/section/paragraph/character source and note block/text-range anchors with extraction/revision context. Evidence: text/source fixtures. - [ ] Y1.5.c Define case scene/entity, dialogue speaker/line/range, clue/ placement, timeline event/interval, and graph entity anchors by stable IDs. Evidence: case fixtures. - [ ] Y1.5.d Define asset/object/component/region, image/video frame/region, audio/video timecode/sample/range, shot/sequence anchors with units/ timebase. Evidence: media fixtures. - [ ] Y1.5.e Validate kind/subject/bounds/permissions and round-trip through API/database/export/localization/build without screen-coordinate-only identity. Evidence: round-trip tests. - [ ] Y1.5.f Map across revisions as exact/shifted/ambiguous/orphaned/invalid with original preserved and human reattachment. Evidence: survival tests. - [ ] Y1.6 Define immutable revisions and semantic diffs for text, tree, graph, timeline, and structured case data. Evidence: golden diff fixtures. - [ ] Y1.6.a Define logical versus revision ID, parent/base/branch, schema version, author/reason/time, payload/manifest hash, state, and immutability. Evidence: revision schema. - [ ] Y1.6.b Define text/block semantic diff for normalized content/format/ source/citation/locale/accessibility without line-only noise. Evidence: text goldens. - [ ] Y1.6.c Define tree diff for stable node add/remove/edit/move/reorder/ reparent and descendant impact. Evidence: tree goldens. - [ ] Y1.6.d Define graph diff for node/edge/type/property/add/remove/change/ merge/split and cycle/reachability/canon impact. Evidence: graph goldens. - [ ] Y1.6.e Define timeline diff for event/duration/interval/order/branch/ participant/location/causality/continuity changes. Evidence: timeline goldens. - [ ] Y1.6.f Define structured case diff for premise/suspect/motive/means/ opportunity/clue/red-herring/reveal/solution/ending with spoiler redaction. Evidence: case goldens. - [ ] Y1.6.g Represent added/removed/changed/moved/unchanged/redacted/unknown and pin schema/comparator versions. Evidence: diff contract tests. - [ ] Y1.7 Define branch, merge, conflict, and restore rules. Evidence: concurrent authoring known-value tests. - [ ] Y1.7.a Define branch identity/base/head/purpose/owner/scope/visibility/ lock/lifecycle and branchable entity granularity. Evidence: branch schema. - [ ] Y1.7.b Define three-way merge by stable IDs for scalar/text/list/tree/ graph/timeline/structured data with exact automatic-safe rules. Evidence: merge fixtures. - [ ] Y1.7.c Define content/order/delete-edit/reparent/graph/canon/solution/ localization/asset conflicts and mine/theirs/base projections. Evidence: conflict fixtures. - [ ] Y1.7.d Require human resolution for semantic/canon/spoiler/solution/ source/rights conflicts; preserve both inputs and resolution rationale. Evidence: resolution tests. - [ ] Y1.7.e Create merged/restored state as a new immutable revision with all parents/provenance; never overwrite branch history. Evidence: lineage tests. - [ ] Y1.7.f Test simultaneous edits/offline/reconnect/locks/rebase/merge/ abandon/restore and downstream gate invalidation. Evidence: concurrency suite. - [ ] Y1.8 Define decision records for outlines, case solutions, clue plans, canon resolutions, and production choices. Evidence: schema and UI projection. - [ ] Y1.8.a Define immutable decision identity/type, actor/authority, exact candidate revisions, chosen/rejected/deferred/superseded outcome, rationale/evidence/conditions/time. Evidence: base schema. - [ ] Y1.8.b Define outline selection/merge/scope/schedule decision fields and source/constraint/coverage comparisons. Evidence: outline fixtures. - [ ] Y1.8.c Define solution and clue-plan decisions with solver/fairness/canon/ spoiler evidence, alternatives, reveal/order/placement consequences. Evidence: case decision fixtures. - [ ] Y1.8.d Define canon resolution with conflicting assertions/sources/ continuity scope, accept/reject/retcon/alternate outcome, and approver. Evidence: canon fixtures. - [ ] Y1.8.e Define production choice with asset/shot/tool/provider/format/ cost/schedule/quality/rights alternatives and impact. Evidence: production fixtures. - [ ] Y1.8.f Define role-redacted UI/API projection and supersession without deleting prior decisions or exposing spoilers. Evidence: projection tests. - [ ] Y1.9 Define source authority, rights, locale, checksum, extraction, and citation metadata. Evidence: source-kind validation. - [ ] Y1.9.a Define source identity/version/kind/title/creator/publisher/ external IDs/locators/edition/status and provenance. Evidence: source schema. - [ ] Y1.9.b Define authority/role/expertise/official/primary-secondary/ reliability/review evidence, jurisdiction, currency, and conflicts. Evidence: authority tests. - [ ] Y1.9.c Define ownership/license/access/use/adapt/train/quote/distribute/ attribution/territory/term/embargo/protected-source evidence. Evidence: rights tests. - [ ] Y1.9.d Define language/script/region/translation/source locale, audience/ sensitivity/spoiler classification, and locale variants. Evidence: locale tests. - [ ] Y1.9.e Define original bytes/content hash/length/type/storage, retrieval/ connector receipt, scans, and extraction run/tool/config/output/anchors. Evidence: integrity/extraction tests. - [ ] Y1.9.f Define citation target/source revision/typed locator/quote/context/ role/verification and validate per source kind. Evidence: source-kind validation. - [ ] Y1.10 Define release bundles for study content and compiled cases. Evidence: schema/version profiles and compatibility policy. - [ ] Y1.10.a Define common bundle identity/version/track/project/release candidate/manifest/entry points/files/dependencies/hashes/provenance/ rights/locale/target/profile. Evidence: base schema. - [ ] Y1.10.b Define study bundle hierarchy/content/notes/concepts/reading order/activities/media/sources/citations/accessibility/search/navigation and consumer configuration. Evidence: study goldens. - [ ] Y1.10.c Define compiled-case world/entities/scenes/dialogue/timeline/ clues/runtime graph/rules/hints/solution partitions/assets/locales/ save-state compatibility. Evidence: case goldens. - [ ] Y1.10.d Separate player-visible, progressive/reveal, solver/reviewer, protected-source, and operator diagnostics with encryption/access. Evidence: spoiler partition tests. - [ ] Y1.10.e Define format/schema/runtime/consumer min-max versions, extensions, migration, degradation/loss, and unsupported behavior. Evidence: compatibility policy. - [ ] Y1.10.f Produce deterministic manifests/packages and validate/import/read- back minimal/full/edge/multilocale fixtures. Evidence: bundle suite. - [ ] Y1.11 Define consumer read-model derivation. Evidence: projections are reproducible from approved authoring revisions. - [ ] Y1.11.a Define each consumer projection’s exact approved bundle/ authoring revision inputs, schema/version, audience/locale/entitlement, owner store/index/cache, and rebuild policy. Evidence: projection map. - [ ] Y1.11.b Define deterministic transforms for study navigation/content/ search/activity and case runtime/entity/clue/dialogue/timeline/save-state models. Evidence: transform goldens. - [ ] Y1.11.c Exclude drafts/comments/decisions/protected sources/solutions/ reviewer fields/production secrets according to consumer audience. Evidence: field boundary tests. - [ ] Y1.11.d Build idempotently from release events/bundles with version/ ordering/checkpoint/retry/dead-letter and no authoring direct writes. Evidence: projection job tests. - [ ] Y1.11.e Rebuild from scratch and compare hashes/semantics to incremental state; reconcile supersession/unpublish/recall. Evidence: reproducibility tests. - [ ] Y1.12 Define backward compatibility with existing case and study contracts. Evidence: old-version fixture migration and unsupported version refusal. - [ ] Y1.12.a Inventory existing schema/protocol/bundle/database/client/ consumer versions, fixtures, deployments, producers, and support windows. Evidence: version inventory. - [ ] Y1.12.b Map old-to-canonical fields/enums/IDs/semantics/defaults/loss/ unsupported states separately for study and case. Evidence: migration mappings. - [ ] Y1.12.c Implement explicit version detection, parse validation, staged pure migrations, provenance, warnings, and immutable original retention. Evidence: migration tests. - [ ] Y1.12.d Define read-old/write-new/dual-read/shim/client-server/runtime negotiation and expiration/telemetry. Evidence: compatibility tests. - [ ] Y1.12.e Migrate minimal/full/edge old fixtures and semantic round-trip them through current consumers. Evidence: golden suite. - [ ] Y1.12.f Reject unknown/future/expired/incompatible versions with typed safe diagnostics and no partial import/runtime fallback. Evidence: refusal tests. ### Y2 — Study source and material authoring - [ ] Y2.1 Build study-source intake from upload, URL, reference, import, and existing Sophia/Yemaya records. Evidence: provenance round-trip. - [ ] Y2.1.a Define source/intake/version/provenance/rights/checksum/connector/ project-link/status contracts common to every path. Evidence: schemas. - [ ] Y2.1.b Implement bounded streamed upload with content sniff/hash/ temporary quarantine/tenant isolation. Evidence: upload tests. - [ ] Y2.1.c Implement allowlisted URL/reference retrieval with SSRF/redirect/ DNS/size/type/time controls and immutable receipt. Evidence: network tests. - [ ] Y2.1.d Implement safe package/reference import with version/profile/ manifest/path/dependency validation and preview. Evidence: import tests. - [ ] Y2.1.e Resolve existing Sophia/Yemaya records through public owner contracts, exact IDs/revisions/authorization, and no data copy by URL. Evidence: integration tests. - [ ] Y2.1.f Normalize paths to one immutable source version and round-trip original locator/bytes/hash/rights/connector/version/audit. Evidence: provenance suite. - [ ] Y2.2 Quarantine and scan documents, archives, media, and project imports. Evidence: malicious corpus. - [ ] Y2.2.a Store new content in nonpublic nonexecutable quarantine with opaque names, encryption, tenant scope, limits, and no downstream use. Evidence: quarantine tests. - [ ] Y2.2.b Scan malware/signature/polyglot/macros/scripts/active content and source/project supply-chain metadata. Evidence: malicious fixtures. - [ ] Y2.2.c Enforce archive traversal/symlink/nesting/bomb/file-count/ compressed-uncompressed size/password rules. Evidence: archive tests. - [ ] Y2.2.d Enforce document/page/object/parser/OCR and media codec/duration/ dimension/sample/decode/resource limits. Evidence: resource tests. - [ ] Y2.2.e Validate project manifest/schema/dependencies/plugins/scripts/ paths/versions/signatures and block executable or unknown constructs. Evidence: project import tests. - [ ] Y2.2.f Persist scanner/version/config/hash/results and admit exact bytes only after required fresh scans; preserve quarantine/manual/unavailable. Evidence: admission tests. - [ ] Y2.3 Extract source hierarchy, text, media, tables, headings, pages, and stable anchors. Evidence: golden source corpus. - [ ] Y2.3.a Define extraction run/tree/node/content/anchor/confidence/error contracts bound to source hash and extractor/config versions. Evidence: schemas. - [ ] Y2.3.b Extract document/book/site/package hierarchy, order, headings/ sections/pages, reading flow, IDs, and cross-references. Evidence: hierarchy goldens. - [ ] Y2.3.c Extract normalized text/paragraph/list/footnote/quote/citation with source offsets/page/region and language/direction. Evidence: text goldens. - [ ] Y2.3.d Extract images/audio/video/files with bytes/hash/caption/alt/ technical metadata/time/page anchors and rights. Evidence: media goldens. - [ ] Y2.3.e Extract tables with cell/header/span/caption/units/footnotes/ region and semantic/text fallback. Evidence: table goldens. - [ ] Y2.3.f Generate stable anchor identities/fingerprints/context and test multilingual/RTL/OCR/complex/malformed/partial fixtures. Evidence: golden source corpus. - [ ] Y2.4 Build source-tree editing with cycle prevention, keyboard reorder, bulk move, and impact preview. Evidence: accessible tree journey. - [ ] Y2.4.a Define editable collection/source/section/node hierarchy operations, stable IDs/order keys, locks, depth/cardinality, and revision semantics. Evidence: tree contract. - [ ] Y2.4.b Build tree and synchronized list/outline with create/rename/ reorder/reparent/group/remove/restore by pointer and keyboard/non-drag. Evidence: interaction tests. - [ ] Y2.4.c Validate self/descendant cycles, duplicates, missing parent, protected roots, cross-project/tenant moves, and stale versions server-side. Evidence: negative tests. - [ ] Y2.4.d Build selected/all/filter-descendant bulk move with count/scope/ destination validation, atomic/partial policy, and confirmation. Evidence: bulk tests. - [ ] Y2.4.e Preview affected anchors/notes/claims/materials/reading order/ cases/translations/builds/permissions before commit. Evidence: impact tests. - [ ] Y2.4.f Verify accessible focus/announcement/zoom/large-tree/concurrent journey and immutable history. Evidence: Playwright E2E. - [ ] Y2.5 Build note and excerpt capture anchored to exact source locations. Evidence: source update/re-extraction preserves or explicitly orphans the anchor. - [ ] Y2.5.a Define note/excerpt logical/revision identity, author/project/ visibility/locale/tags/concepts/claims/status and typed exact source anchor. Evidence: schema. - [ ] Y2.5.b Capture selected text/region/page/time/table slice/URI fragment with exact source/extraction revision, quote/context/hash, and bounds. Evidence: capture tests. - [ ] Y2.5.c Author note blocks/annotations/commentary separately from immutable excerpt and retain source rights/attribution/spoiler classification. Evidence: editing tests. - [ ] Y2.5.d Validate source/anchor/access and render citation trail/side-by- side context accessibly without protected-source leakage. Evidence: viewer tests. - [ ] Y2.5.e On source update/re-extraction map anchor exact/shifted/ambiguous/ orphaned, preserve original, and require reattachment/review. Evidence: survival tests. - [ ] Y2.6 Build concept and claim extraction behind the fenced provider seam. Evidence: human confirmation before persistence. - [ ] Y2.6.a Define concept/claim proposal with exact source/extraction/span, normalized term/proposition, aliases/type/qualifiers/relations, confidence, provider/model/prompt/config, and status. Evidence: schemas. - [ ] Y2.6.b Send only authorized bounded source spans fenced as untrusted data with no tools/project secrets/solution/canon authority. Evidence: injection tests. - [ ] Y2.6.c Validate proposal schema/locators/source support/duplicates/ conflicts/size and preserve not-configured/refusal/malformed/partial. Evidence: seam tests. - [ ] Y2.6.d Present source context, similar concepts/claims, uncertainty, suggested relations, and accept/edit/reject/defer per proposal. Evidence: review tests. - [ ] Y2.6.e Create canonical revisions only from authorized human decisions, retaining original proposal/provider/source lineage. Evidence: authority tests. - [ ] Y2.7 Build citation attachment and source trails. Evidence: unsupported or missing locators fail validation. - [ ] Y2.7.a Define citation/relationship contract linking exact note/claim/ block/case/canon target to source revision, typed locator, quote/context, support role, and verification. Evidence: schema. - [ ] Y2.7.b Implement page/section/paragraph/text range/region/timecode/ dataset/table/URI/entity locators with source-kind compatibility. Evidence: locator fixtures. - [ ] Y2.7.c Validate syntax/bounds/hash/revision/rights/access and reject unsupported/missing/mutable-only locators. Evidence: validation tests. - [ ] Y2.7.d Build forward target-to-source and reverse source-to-target trails with intermediate claims/extractions/translations/decisions and stable pagination. Evidence: trail tests. - [ ] Y2.7.e Render/export accessible citations/trails with authorized excerpts/redactions and update/orphan state. Evidence: UI/export tests. - [ ] Y2.8 Build outline divergence and compare. Evidence: scores and provider provenance are preserved. - [ ] Y2.8.a Define outline/variant-set/module/node/order/source/concept/ objective/constraint contracts with exact brief/source revision and manual/generated discriminator. Evidence: schema. - [ ] Y2.8.b Generate bounded N variants with diversity strategy, seed/ controls, provider/model/prompt/config, estimate/budget, and unique IDs. Evidence: generation tests. - [ ] Y2.8.c Validate hierarchy/reading order/prerequisites/source coverage/ workload/rights/accessibility and retain invalid candidates. Evidence: validation tests. - [ ] Y2.8.d Record rule/provider/evaluator/human scores separately with version/rubric/uncertainty/N/A and no score invention for manual outlines. Evidence: score tests. - [ ] Y2.8.e Build side-by-side semantic structure/content/source/coverage/ cost diff and select/reject/merge/fork decisions preserving all candidates. Evidence: compare journey. - [ ] Y2.9 Build a structured study-material editor for explanation, excerpt, comparison, question, activity, reflection, media, glossary, and case link. Evidence: block registry tests. - [ ] Y2.9.a Define versioned block registry with shared identity/order/locale/ source/concept/accessibility fields and per-kind schema/renderer/ validator/export mappings. Evidence: registry. - [ ] Y2.9.b Implement explanation/excerpt/comparison typed editors with claim/ citation/source-pane and contrasted-dimension semantics. Evidence: content block tests. - [ ] Y2.9.c Implement question/activity/reflection editors with instructions/ expected engagement/resources/time/response/noninteractive alternative and no learner-state mutation. Evidence: activity tests. - [ ] Y2.9.d Implement governed media attachment and glossary term/definition/ locale/source links plus exact interactive-case deep link/context. Evidence: media/glossary/case tests. - [ ] Y2.9.e Implement insert/reorder/nest/convert/duplicate/reference/delete/ restore with stable IDs, depth rules, dependency invalidation, and non-drag controls. Evidence: editing tests. - [ ] Y2.9.f Fail registry coverage for missing editor/consumer renderer/ validation/accessibility/localization/import-export/preview/test. Evidence: block coverage gate. - [ ] Y2.10 Build reading-order and prerequisite editing. Evidence: cycle, unreachable node, and missing prerequisite gates. - [ ] Y2.10.a Define separate ordered sequence/branch and prerequisite DAG edge kinds, optional/required/choice/remedial semantics, conditions, and exact node revisions. Evidence: graph schema. - [ ] Y2.10.b Build accessible visual plus synchronized list/table create/ connect/disconnect/reorder/group/branch operations. Evidence: UI tests. - [ ] Y2.10.c Detect self/cycles/duplicates/conflicting order, missing roots/ ends/prerequisites, orphans/unreachable/dead branches. Evidence: validation fixtures. - [ ] Y2.10.d Validate prerequisite availability before node and reading flow/ locale/accessibility/consumer compatibility. Evidence: sequence tests. - [ ] Y2.10.e Preview impact on notes/materials/activities/cases/builds and recompute stale reviews/gates after revision. Evidence: impact tests. - [ ] Y2.11 Build source-hierarchy completeness, anchor coverage, claim grounding, reading-order coherence, accessibility, and rights gates. Evidence: known-value fixtures. - [ ] Y2.11.a Resolve exact project/material/source/tree/anchor/claim/order/ block/asset/locale/release revisions and applicable gate/profile versions. Evidence: input tests. - [ ] Y2.11.b Measure required source-node hierarchy/metadata/extraction/ authority/currency completeness and note/block anchor coverage/orphan rate. Evidence: hierarchy/anchor fixtures. - [ ] Y2.11.c Evaluate atomic claim support/sufficiency/faithfulness/conflict/ citation locators and high-risk source floors. Evidence: grounding fixtures. - [ ] Y2.11.d Evaluate order/prerequisite cycle/reachability/coherence/ workload and content/asset semantic accessibility/localization parity. Evidence: order/accessibility fixtures. - [ ] Y2.11.e Evaluate source/content/media rights/attribution/embargo/term and downstream target compatibility. Evidence: rights fixtures. - [ ] Y2.11.f Persist raw results separately from policy verdicts/uncertainty/ N/A/manual review and block mandatory failures. Evidence: gate suite. - [ ] Y2.12 Build consumer preview through real `study-workspace` read models. Evidence: preview parity without writing learner state. - [ ] Y2.12.a Compile exact draft/approved authoring revisions into an isolated preview bundle and derive the same versioned read models as consumer. Evidence: preview pipeline tests. - [ ] Y2.12.b Render through real consumer route/components/runtime with synthetic identity, selected locale/device/theme/accessibility/offline profile, and prominent preview state. Evidence: renderer parity tests. - [ ] Y2.12.c Exercise navigation/reading order/concepts/search/media/ activities/case links and compare semantics to published bundle. Evidence: interaction parity. - [ ] Y2.12.d Isolate preview events/cache/progress/bookmarks/analytics/ notifications from real learner/consumer systems. Evidence: side-effect tests. - [ ] Y2.12.e Verify permission/spoiler/protected-source/failed build/stale/ offline and accessibility behavior. Evidence: preview E2E. - [ ] Y2.13 Build localization with citations, glossary, directionality, source-locale trace, media parity, and review. Evidence: locale bundle golden. - [ ] Y2.13.a Define locale job/unit/variant/source revision/translation/ reviewer/status/fallback contracts and stable IDs. Evidence: schema. - [ ] Y2.13.b Translate structured material blocks/concepts/glossary/metadata/ instructions with TM/glossary suggestions and human acceptance. Evidence: content tests. - [ ] Y2.13.c Preserve citation source locale/exact locator, translated quote/ paraphrase relation, source authority, and no false translated source. Evidence: citation tests. - [ ] Y2.13.d Handle RTL/bidi/Unicode/numerals/dates/units/layout plus localized media/captions/transcripts/descriptions/voice/assets with parity. Evidence: locale/media tests. - [ ] Y2.13.e Run meaning/claim/key-term/citation/order/accessibility/media/ target parity gates and required locale/cultural review. Evidence: review tests. - [ ] Y2.13.f Build deterministic locale bundle and consumer round-trip for RTL/long/CJK/missing-fallback cases. Evidence: golden. - [ ] Y2.14 Build source update/retraction blast radius across notes, claims, materials, cases, translations, and published items. Evidence: propagation test. - [ ] Y2.14.a Maintain immutable reverse dependency edges from source/ extraction/anchor/citation/claim into every named consumer and bundle/ read model. Evidence: graph tests. - [ ] Y2.14.b Ingest verified update/supersession/retraction/rights change with authority/scope/effective time/source matching. Evidence: intake tests. - [ ] Y2.14.c Traverse direct/transitive impacts with reason/path/revision/ current state/owner/unknown and tenant/property authorization. Evidence: blast-radius tests. - [ ] Y2.14.d Mark affected draft/review/canon/translation/build/publication/ consumer eligibility stale/blocked without rewriting history. Evidence: propagation tests. - [ ] Y2.14.e Route re-extract/reattach/re-source/rewrite/review/relocalize/ rebuild/unpublish/recall actions and verify downstream read-back. Evidence: end-to-end propagation. ### Y3 — Interactive-case concept, structure, and writing - [ ] Y3.1 Build zero-form case-premise capture with genre, audience, constraints, safety, setting, duration, difficulty, locale, and format. Evidence: keyboard-first capture. - [ ] Y3.1.a Define minimal capture identity/project/author/raw idea/source/ provenance/draft status and typed eventual premise requirements. Evidence: schema. - [ ] Y3.1.b Implement keyboard-first freeform/paste/voice-safe capture with genre/audience/setting/format hints, autosave/offline, and accessible shortcuts. Evidence: capture tests. - [ ] Y3.1.c Collect structured audience/age, genre/tone, setting/time, duration/pacing/difficulty, locale/language, format/target constraints. Evidence: completion tests. - [ ] Y3.1.d Collect safety/sensitivity/identity/rights/source/production/ accessibility/budget/code-floor constraints and explicit unknowns. Evidence: constraint tests. - [ ] Y3.1.e Create immutable premise draft retaining raw capture and validation/provenance; never treat capture as approved framing. Evidence: lineage tests. - [ ] Y3.2 Build case-framing divergence through `case-writers-room` and `case-director`. Evidence: real provider seam and exact returned variants. - [ ] Y3.2.a Define framing request/plan/variant-set with exact premise/source/ canon/constraints, requested count/diversity, budget, provider/tool versions, and output schema. Evidence: contracts. - [ ] Y3.2.b Route writers-room ideation and case-director structural planning through their canonical injected operations, not duplicate prompts or private imports. Evidence: seam tests. - [ ] Y3.2.c Fence untrusted sources/premise, enforce tool grants/budget/stop/ timeout/safety/spoiler boundaries, and preserve not-configured/refusal/ malformed/partial states. Evidence: provider tests. - [ ] Y3.2.d Create exact unique returned premise/solution/suspects/clue/ structure/tone/scope variants with full step/model/prompt/config/cost lineage. Evidence: variant fixtures. - [ ] Y3.2.e Validate schema/canon/safety/fairness/production feasibility without automatically accepting or hiding invalid variants. Evidence: validation tests. - [ ] Y3.3 Build variant compare for premise, solution, suspect set, clue topology, tone, production scope, and gate estimates. Evidence: comparison fixture. - [ ] Y3.3.a Resolve authorized exact manual/generated variant revisions and define comparison session/layout/selection contracts. Evidence: schema. - [ ] Y3.3.b Diff premise/question/theme/setting/audience/format/difficulty and tone/style/safety/source/canon assumptions. Evidence: premise diff. - [ ] Y3.3.c Diff solution/truth/proof chain/ambiguity, suspects/motive/means/ opportunity/alibis/relationships, and alternative hypotheses. Evidence: solution/cast diff. - [ ] Y3.3.d Diff clue/red-herring topology, dependencies/discovery/reveal/ evidentiary coverage/fairness and scene/timeline branch structure. Evidence: topology diff. - [ ] Y3.3.e Diff asset/scene/dialogue/locale/voice/render/engine/target/ schedule/resource/cost production scope. Evidence: scope diff. - [ ] Y3.3.f Present per-gate raw estimate/availability/uncertainty/provider provenance and accessible table/graph alternatives. Evidence: comparison fixture. - [ ] Y3.4 Build decision records for selected and rejected case framings. Evidence: downstream case links to the decision. - [ ] Y3.4.a Define immutable decision with exact variant set/revisions, actor/ authority, select/reject/defer/merge outcome, reasons/evidence/ conditions/time. Evidence: schema. - [ ] Y3.4.b Record one or multiple selected contributions and every rejected variant/reason without deleting or rewriting them. Evidence: decision tests. - [ ] Y3.4.c Create a new case/premise revision from the selected or explicitly merged framing with source contribution lineage. Evidence: creation tests. - [ ] Y3.4.d Link all downstream mystery/cast/clue/scene/production decisions to the framing decision and exact premise revision. Evidence: lineage. - [ ] Y3.4.e Supersede through a new decision after impact review while preserving historical current/old projections. Evidence: lifecycle tests. - [ ] Y3.5 Build the case dossier with premise, solution, cast, clues, scenes, timeline, locations, canon, assets, gates, review, and history. Evidence: live browser journey. - [ ] Y3.5.a Define one permission/spoiler-filtered live projection joining exact case revision and every named relationship/freshness state. Evidence: dossier contract. - [ ] Y3.5.b Present premise/mystery/solution, cast/relationships/knowledge/ motives, clue/red-herring/proof topology, and authorized differences. Evidence: story panels. - [ ] Y3.5.c Present scene/timeline/location/branch/state/dialogue and canon/ source/contradiction/continuity state. Evidence: structure panels. - [ ] Y3.5.d Present assets/production/jobs/budget/schedule/localization/ consumer-build dependencies and failure state. Evidence: production panels. - [ ] Y3.5.e Present solvability/fairness/safety/canon/technical gates, comments/reviews/decisions/approvals/remediation/maturity. Evidence: review panels. - [ ] Y3.5.f Present semantic revision/branch/merge/decision/audit/playtest/ build/release history with stable links. Evidence: history tests. - [ ] Y3.5.g Run live edit-review-playtest-remediate journey with role/spoiler/ tenant/accessibility/responsive/large-case proof. Evidence: Playwright. - [ ] Y3.6 Build suspect editor with identity, role, motive, means, opportunity, alibi, secrets, relationships, knowledge state, and reveal constraints. Evidence: contract validation. - [ ] Y3.6.a Author stable character/suspect identity, names/aliases/pronouns/ locale, role/archetype, background/traits/goals/arc, source/canon, and asset refs. Evidence: identity tests. - [ ] Y3.6.b Author typed motive/means/opportunity with temporal/location/ capability/resource/evidence/strength/contradiction and truth status. Evidence: MMO tests. - [ ] Y3.6.c Author alibi claim/events/witness/source/reliability/timeline/ verification/contradictions and resolved/false/partial status. Evidence: alibi tests. - [ ] Y3.6.d Author secret/knowledge fact, learned-at-event, knows/does-not- know/believes/lies/uncertain, visibility/spoiler, and evolution. Evidence: knowledge tests. - [ ] Y3.6.e Author typed directed relationship history and reveal earliest/ latest/condition/audience/order/forbidden disclosure constraints. Evidence: relationship/reveal tests. - [ ] Y3.6.f Validate stable IDs, required fields, timeline/canon consistency, circular secrets, impossible knowledge, clue/solution links, and protected fields. Evidence: contract suite. - [ ] Y3.7 Build clue editor with type, source, discovery condition, timing, visibility, interpretation, dependencies, evidentiary weight, and truth status. Evidence: invariant tests. - [ ] Y3.7.a Author clue identity/kind/content/representation/source/citation/ asset/locale/rights/canon and intended solver role. Evidence: clue schema. - [ ] Y3.7.b Author discovery actor/location/scene/action/tool/prerequisite/ state/time/window/branch/repeat/miss/fallback conditions as typed logic. Evidence: discovery tests. - [ ] Y3.7.c Author visibility/salience/presentation/spoiler/knowledge and interpretation list with supporting/refuting facts, ambiguity, and hints. Evidence: interpretation tests. - [ ] Y3.7.d Author clue-to-clue/scene/suspect/timeline/claim dependencies, evidentiary dimension/weight/confidence, and proof-chain contribution. Evidence: dependency tests. - [ ] Y3.7.e Author true/false/misleading/ambiguous/fabricated/altered/ incomplete status with truth/canon/source and reveal/payoff resolution. Evidence: truth tests. - [ ] Y3.7.f Validate reachable discovery, dependency cycles, chronology, source/asset rights, sufficient resolution, and no unsupported freeform conditions. Evidence: invariants. - [ ] Y3.8 Build red-herring editor with fairness justification and resolution. Evidence: unresolved or indistinguishable red herrings fail review. - [ ] Y3.8.a Author red-herring clue/suspect/hypothesis linkage, intended inference, source/canon/truth basis, placement/salience, and scope. Evidence: schema. - [ ] Y3.8.b Author fairness justification showing why it is plausible yet distinguishable through available evidence, logic, timing, or source. Evidence: fairness tests. - [ ] Y3.8.c Author required contradiction/correction/disproof/reveal/payoff, discovery dependencies, earliest resolution, and player feedback. Evidence: resolution tests. - [ ] Y3.8.d Compare to true clue/path for unique signals and detect identical/ strictly indistinguishable/unresolvable/misleading-without-payoff cases. Evidence: comparison fixtures. - [ ] Y3.8.e Block review on missing justification/resolution/unreachable disproof or harmful/unfair manipulation; preserve manual evidence. Evidence: gate tests. - [ ] Y3.9 Build scene editor with participants, location, time, objectives, dialogue/actions, clues, state effects, branches, assets, and canon refs. Evidence: structured-block tests. - [ ] Y3.9.a Define scene identity/revision/order/sequence/branch, title/ summary/purpose/pacing/duration/status/owner/locale and source refs. Evidence: scene schema. - [ ] Y3.9.b Author participants/entry-exit/presence/role/knowledge/wardrobe/ prop/continuity and location/set/subarea/time/weather/light. Evidence: context tests. - [ ] Y3.9.c Author objectives/beats/conflicts/outcomes and typed ordered dialogue/action/direction/choice/interaction/transition blocks. Evidence: block tests. - [ ] Y3.9.d Place clues/red herrings/discovery/reveal/knowledge changes and state preconditions/effects with exact entity refs. Evidence: state tests. - [ ] Y3.9.e Author branch choices/conditions/targets/merge/fallback/dead-end semantics and sequence/timeline/causal links. Evidence: branch tests. - [ ] Y3.9.f Link assets/shots/storyboards/audio/locales/production tasks and exact canon assertions/exceptions/continuity profiles. Evidence: production/canon tests. - [ ] Y3.9.g Validate presence/knowledge/timeline/location/state/canon/clue/ branch/asset constraints and structured block registry coverage. Evidence: validation suite. - [ ] Y3.10 Build timeline editor with absolute/relative time, uncertainty, witness perspective, evidence refs, and contradiction detection. Evidence: keyboard and semantic-list parity. - [ ] Y3.10.a Define event/interval identity/revision, absolute instant/range/ time zone/calendar/story era or relative-before/after/during/offset/ sequence constraints. Evidence: temporal schema. - [ ] Y3.10.b Author duration/uncertainty/earliest-latest/confidence and participants/location/actions/state/clue/scene/canon/source links. Evidence: event tests. - [ ] Y3.10.c Author separate witness/source perspectives for observed/reported/ inferred/remembered/believed times with reliability/contradictions. Evidence: perspective tests. - [ ] Y3.10.d Build visual lane/scale/order/zoom/filter editor and synchronized keyboard-operable semantic list/table/forms. Evidence: parity tests. - [ ] Y3.10.e Solve temporal constraints and flag impossible intervals/order/ travel/presence/alibi/knowledge/age/duration, source/canon conflicts with explanation. Evidence: contradiction fixtures. - [ ] Y3.10.f Preserve ambiguous/alternate chronologies and require human resolution rather than autochanging events. Evidence: review tests. - [ ] Y3.11 Build relationship and clue graphs with semantic table parity. Evidence: accessible navigation and graph/list consistency. - [ ] Y3.11.a Define graph view contracts with stable entity/edge IDs, revisions/types/properties/visibility/evidence/validation and role/ spoiler projection. Evidence: schema. - [ ] Y3.11.b Build relationship graph filters/layout/time/point-of-view/ knowledge/canon/strength/status and typed edit actions. Evidence: relationship UI tests. - [ ] Y3.11.c Build clue graph for clues/hypotheses/suspects/scenes/discovery/ dependencies/support/refute/reveal/proof paths/fairness. Evidence: clue UI tests. - [ ] Y3.11.d Provide synchronized table/tree/list/forms for inspect/filter/ select/add/edit/link/unlink/navigate/reorder with non-drag keyboard parity. Evidence: semantic tests. - [ ] Y3.11.e Keep visual/table selection/filter/edit/validation consistent and surface cycles/orphans/unreachable/conflicts/unknown. Evidence: consistency tests. - [ ] Y3.11.f Verify screen reader/keyboard/zoom/reflow/reduced motion/large graph and direct authorization. Evidence: accessible E2E. - [ ] Y3.12 Build solution editor with proof chain, required clue set, alternative-hypothesis disposition, reveal sequence, and confidence. Evidence: schema invariants. - [ ] Y3.12.a Define protected solution identity/revision, truth outcome/ culprit/cause/mechanism/timeline/motive/means/opportunity and source/ canon basis. Evidence: solution schema. - [ ] Y3.12.b Author proof graph steps/claims/inferences/rules/assumptions and support/refute clue/evidence refs with ordering/dependencies. Evidence: proof-chain tests. - [ ] Y3.12.c Define required/sufficient/optional/corroborating/exculpatory/ misleading clue sets and minimum path/coverage/fallback. Evidence: clue-set tests. - [ ] Y3.12.d Enumerate plausible alternative hypotheses/suspects and disposition as refuted/less supported/equivalent/unresolved with exact evidence. Evidence: alternative tests. - [ ] Y3.12.e Author reveal sequence/timing/conditions/presentation/explanation/ payoff and ending linkage without premature spoiler exposure. Evidence: reveal tests. - [ ] Y3.12.f Record author/solver/calibrated confidence/uncertainty separately and validate proof acyclicity/soundness/clue reachability/uniqueness/ canon/timeline. Evidence: invariants. - [ ] Y3.13 Build branch and state-condition editor. Evidence: unreachable, dead-end, cyclic, and impossible-condition analysis. - [ ] Y3.13.a Define typed state variables/domains/defaults/ownership/ visibility, condition expression AST, effects, branch/choice/target/ merge/end contracts. Evidence: schema. - [ ] Y3.13.b Build allowlisted visual/form expression editor for boolean/ comparison/set/count/temporal/knowledge/clue/inventory flags with no arbitrary code. Evidence: condition tests. - [ ] Y3.13.c Build branch create/order/condition/priority/fallback/target/ effect/merge authoring with semantic list and graph views. Evidence: editor tests. - [ ] Y3.13.d Analyze reachability, dead ends, unintended cycles/loops, mutually exclusive/exhaustive conditions, impossible state, shadowed/ nondeterministic branches, and orphan content. Evidence: analysis fixtures. - [ ] Y3.13.e Simulate bounded seeded paths and show counterexample trace/ assumptions without claiming exhaustive proof when limits are reached. Evidence: simulation tests. - [ ] Y3.14 Build character/scene dialogue assist with canon and spoiler fences. Evidence: explicit accept and AI attribution. - [ ] Y3.14.a Define assist request/proposal with exact scene/character/ dialogue/locale/canon/knowledge/spoiler/style revisions, operation, provider provenance, and cost. Evidence: schema. - [ ] Y3.14.b Build only authorized context from character voice/relationship/ current knowledge/scene objective/canon/source, excluding future reveals/ solutions/private sources outside scope. Evidence: context tests. - [ ] Y3.14.c Fence content, enforce no tool/approval authority, provider/budget/ timeout/safety/identity/rights controls, and honest failure states. Evidence: seam tests. - [ ] Y3.14.d Validate speaker/scene/knowledge/canon/timeline/spoiler/style/ locale/safety/accessibility and flag conflicts. Evidence: proposal tests. - [ ] Y3.14.e Present per-line/block diff/context/attribution and require explicit accept/edit/reject; acceptance creates new revision and reruns gates. Evidence: review tests. - [ ] Y3.15 Build script/table-read preview. Evidence: roles, timing, missing lines, and accessibility output. - [ ] Y3.15.a Compile selected case/scenes/branches/dialogue revisions into script format with stable scene/beat/line/speaker IDs and spoiler scope. Evidence: script tests. - [ ] Y3.15.b Validate cast/role assignments, missing/duplicate/unknown speaker, dialogue order, directions, scene coverage, branch variants, and participant access. Evidence: role tests. - [ ] Y3.15.c Estimate/read timed scene/line/pause/action totals and flag missing lines/overlap/pacing with assumptions. Evidence: timing tests. - [ ] Y3.15.d Render text table read and optional consented human/approved TTS voices with pronunciation, playback controls, transcript/captions. Evidence: playback tests. - [ ] Y3.15.e Export accessible script with semantic headings/speaker labels/ directions/alt text, large print/locale/bidi and no unauthorized solutions. Evidence: accessibility tests. - [ ] Y3.16 Build playtest configuration with spoiler-protected participants, build version, consent, telemetry scope, and retention. Evidence: privacy-safe test. - [ ] Y3.16.a Define playtest/session/cohort/participant opaque identity, exact case/build/locale/device/accessibility version, purpose, schedule, owner, and lifecycle. Evidence: schema. - [ ] Y3.16.b Configure participant eligibility/invite/auth/role/embargo/ spoiler compartment, conflict/prior knowledge, guardian/age rules, and compensation. Evidence: participant tests. - [ ] Y3.16.c Capture consent for participation/recording/voice/video/ telemetry/quotes/recontact/use/term/withdrawal and provide accessible information. Evidence: consent tests. - [ ] Y3.16.d Allowlist telemetry events/fields/sampling/purpose, exclude raw secrets/solutions/PII where unnecessary, and define offline upload/ encryption/access. Evidence: telemetry tests. - [ ] Y3.16.e Define session data/comment/replay/media retention/deletion/ legal hold/export and participant withdrawal propagation. Evidence: lifecycle tests. - [ ] Y3.16.f Validate build availability/integrity, no admin/debug/solution data, participant entitlements, and privacy review before launch. Evidence: privacy-safe gate. - [ ] Y3.17 Build playtest feedback and session replay linked to immutable case revision. Evidence: no replay leaks solution to unauthorized users. - [ ] Y3.17.a Define feedback/event/replay artifact with exact case/build/ participant/session/locale/device/config revisions, timestamps, source, consent, visibility, and integrity. Evidence: schema. - [ ] Y3.17.b Capture structured difficulty/fairness/confusion/enjoyment/ accessibility/bug/clue/scene feedback plus optional consented text/media. Evidence: feedback tests. - [ ] Y3.17.c Build deterministic replay from allowlisted ordered events/state checkpoints/input/media refs with versioned runtime and gaps/unknown. Evidence: replay tests. - [ ] Y3.17.d Apply participant/author/solver/reviewer spoiler/solution/ protected-source/property permissions to timelines, events, state, feedback, search, exports, and URLs. Evidence: leak tests. - [ ] Y3.17.e Anchor comments/findings to session time/event/scene/clue/build and route aggregated/redacted proposals to authoring without auto-edit. Evidence: feedback-to-revision tests. - [ ] Y3.17.f Test revoked consent/retention expiry/deleted participant/case supersession/corrupt replay/cross-tenant access. Evidence: lifecycle E2E. - [ ] Y3.18 Build authoring templates for genre and format with code-owned fairness/safety floors. Evidence: template property tests. - [ ] Y3.18.a Define versioned template identity/scope/genre/format/audience/ project profile, typed premise/cast/clue/scene/solution/production defaults/requirements, parent, and lifecycle. Evidence: schema. - [ ] Y3.18.b Define genre-specific conventions/tropes/tone/pacing/clue/fairness/ sensitivity and format-specific duration/branch/interaction/asset/target constraints as guidance or typed requirements. Evidence: fixtures. - [ ] Y3.18.c Resolve inheritance with exact versions/cycle/depth and field/ collection/graph merge/replace/append/remove/lock semantics. Evidence: inheritance tests. - [ ] Y3.18.d Apply code/region/platform fairness/safety/rights/consent/privacy/ accessibility/spoiler/authority floors monotonically. Evidence: property tests. - [ ] Y3.18.e Preview inherited/defaulted/overridden/locked/conflicts and impact, then version/publish/deprecate/migrate consumers explicitly. Evidence: lifecycle tests. ### Y4 — Canon, solvability, fairness, and safety gates - [ ] Y4.1 Implement canon graph validation for missing entities, conflicting assertions, temporal impossibility, and namespace mismatch. Evidence: known-value canon fixtures. - [ ] Y4.1.a Resolve exact canon namespace/entity/predicate/assertion/source/ status/version graph and validation profile. Evidence: input tests. - [ ] Y4.1.b Detect missing/deleted/unresolved/unauthorized entity refs, invalid predicate/cardinality/type/unit/literal, dangling relations, and required assertion gaps. Evidence: entity fixtures. - [ ] Y4.1.c Detect simultaneously applicable contradicting values/relations/ knowledge/identity/location/state with confidence/status/source scope. Evidence: conflict fixtures. - [ ] Y4.1.d Solve temporal interval/order/age/duration/presence/state constraints and report minimal impossible sets/counterexamples. Evidence: temporal fixtures. - [ ] Y4.1.e Detect cross-namespace refs, alias/version ambiguity, continuity/ alternate-universe leakage, and unapproved scoped exceptions. Evidence: namespace fixtures. - [ ] Y4.1.f Persist per-assertion/path raw findings and human resolution state separately from canon gate verdict. Evidence: known-value suite. - [ ] Y4.2 Implement canon update and retraction blast radius. Evidence: affected scenes, dialogue, clues, solutions, assets, and releases become stale. - [ ] Y4.2.a Maintain immutable forward/reverse edges from canon assertions/ entities/sources/decisions to every named consumer, build, and release. Evidence: dependency tests. - [ ] Y4.2.b Ingest authorized new revision/supersession/retcon/deprecation/ retraction/scoped exception with effective continuity/time and evidence. Evidence: update tests. - [ ] Y4.2.c Traverse direct/transitive impact with path/reason/revision/ current state/owner/unknown and spoiler/tenant authorization. Evidence: query tests. - [ ] Y4.2.d Mark affected scenes/dialogue/clues/solutions/assets/locales/ reviews/gates/builds/releases stale or blocked without rewriting history. Evidence: propagation tests. - [ ] Y4.2.e Route reconcile/rewrite/relink/regenerate/review/rebuild/unpublish/ recall and verify downstream read-back. Evidence: blast-radius E2E. - [ ] Y4.3 Implement clue reachability from every supported play path. Evidence: graph fixtures with reachable and hidden required clues. - [ ] Y4.3.a Compile exact case revision into typed state/branch/scene/clue/ discovery graph with supported start states/modes/difficulty/accessibility profiles. Evidence: compiler tests. - [ ] Y4.3.b Enumerate/explore all paths for bounded cases and use sound symbolic/model checking for larger graphs with declared limits. Evidence: traversal tests. - [ ] Y4.3.c Verify every required clue is discoverable before needed on every supported path, including miss/revisit/fallback/branch merge/reset. Evidence: reachable/hidden fixtures. - [ ] Y4.3.d Return unreachable clue/path/state counterexample traces, unsupported/timeout/coverage bounds, and no false exhaustive claim. Evidence: result tests. - [ ] Y4.3.e Separate optional/bonus/alternative-path clues and profile-specific requirements from universal requirements. Evidence: applicability tests. - [ ] Y4.4 Implement solution existence. Evidence: at least one evidence-backed solution is provable. - [ ] Y4.4.a Define solution rule system, hypothesis space, truth/canon facts, required evidence/inference rules, allowed assumptions, and exact case revision. Evidence: solver contract. - [ ] Y4.4.b Compile clue discovery/interpretations/proof steps/alternative paths into solver inputs without consuming protected author assertions as proof automatically. Evidence: input tests. - [ ] Y4.4.c Find at least one satisfying hypothesis/proof chain using only reachable admissible evidence and valid inferences under each supported profile. Evidence: positive fixtures. - [ ] Y4.4.d Return zero-solution unsatisfied core/counterexample, timeout/ unsupported/unknown separately and persist trace. Evidence: negative fixtures. - [ ] Y4.4.e Verify solution matches locked author truth/canon or explicitly declared open outcome without circular/self-revealing clues. Evidence: existence gate. - [ ] Y4.5 Implement solution uniqueness under the declared rules. Evidence: zero-, one-, and multi-solution fixtures. - [ ] Y4.5.a Define what counts as materially distinct solution/hypothesis/ culprit/mechanism/timeline versus equivalent representation. Evidence: equivalence rules. - [ ] Y4.5.b Enumerate or prove bounded count of satisfying solutions from reachable evidence/rules with solver version/limits. Evidence: cardinality tests. - [ ] Y4.5.c Validate exactly one when uniqueness is required, at least one/ bounded alternatives when ambiguity is intentional, and allowed outcome constraints. Evidence: policy tests. - [ ] Y4.5.d Return representative multiple solutions and discriminating/ missing evidence plus zero/unknown/timeout states. Evidence: fixtures. - [ ] Y4.5.e Distinguish true logical uniqueness from only tested path/sample coverage. Evidence: proof-quality tests. - [ ] Y4.6 Implement alternative-hypothesis testing. Evidence: each plausible suspect is eliminated or retained by explicit evidence. - [ ] Y4.6.a Generate/resolve the declared plausible suspect/hypothesis set from exact case entities/rules without hidden arbitrary omissions. Evidence: hypothesis tests. - [ ] Y4.6.b Evaluate motive/means/opportunity/alibi/timeline/clue/canon/ relationship/knowledge evidence for and against each hypothesis. Evidence: evidence matrix. - [ ] Y4.6.c Build explicit proof/refutation/insufficient chain with source/ clue/inference refs, contradictions, assumptions, confidence, and reachable timing. Evidence: chain tests. - [ ] Y4.6.d Classify eliminated/retained/equivalent/unresolved/unsupported and require every plausible hypothesis to have a disposition. Evidence: coverage gate. - [ ] Y4.6.e Detect unjustified elimination, absence-as-proof, circular clues, hidden solution facts, and post-answer evidence. Evidence: adversarial fixtures. - [ ] Y4.7 Implement fair-clue timing. Evidence: required evidence appears before the answer is demanded. - [ ] Y4.7.a Define answer-demand/reveal/commit points and required/sufficient/ disambiguating evidence sets per supported path/profile. Evidence: timing schema. - [ ] Y4.7.b Compute earliest/latest possible discovery and guaranteed availability for each clue under branches, state, miss/revisit, fallback, pacing, and accessibility. Evidence: timing tests. - [ ] Y4.7.c Verify required evidence is reachable/perceivable/interpretable before commitment with adequate review time and no future/hidden source. Evidence: fairness fixtures. - [ ] Y4.7.d Report late/missable/branch-locked/too-early-spoiler/ inaccessible evidence and counterexample path. Evidence: result tests. - [ ] Y4.7.e Apply profile/difficulty policy to raw timing and require human fairness review for contextual salience/pacing. Evidence: gate tests. - [ ] Y4.8 Implement suspect coverage and opportunity coherence. Evidence: crafted omissions and contradictions fail. - [ ] Y4.8.a Resolve all in-scope suspects/hypotheses and required motive/ means/opportunity/alibi/relationship/clue/timeline dimensions. Evidence: coverage schema. - [ ] Y4.8.b Detect missing/placeholder/unsupported dimensions, omitted plausible suspects, overprivileged culprit evidence, and incomplete alternative dispositions. Evidence: omission fixtures. - [ ] Y4.8.c Verify opportunity intervals against presence/location/travel/ capability/resources/access/knowledge and event timing. Evidence: coherence fixtures. - [ ] Y4.8.d Verify alibi/witness/source/canon/scene/clue consistency and surface contradictions/unknowns separately. Evidence: contradiction tests. - [ ] Y4.8.e Preserve intentional unknown/false alibis with evidence and apply fairness policy separately. Evidence: gate tests. - [ ] Y4.9 Implement timeline consistency and travel-time constraints. Evidence: independently derived fixture values. - [ ] Y4.9.a Normalize absolute/relative/uncertain event constraints, duration, time zones/calendars/story era, participant/location and source perspective from exact revision. Evidence: input tests. - [ ] Y4.9.b Solve ordering/overlap/duration/age/state/knowledge/presence/ simultaneous-action constraints and report minimal conflicts. Evidence: timeline fixtures. - [ ] Y4.9.c Resolve versioned location graph/transport/mode/speed/range/ accessibility/transition overhead and compute minimum/expected travel times independently. Evidence: travel goldens. - [ ] Y4.9.d Detect impossible/implausible/unknown travel, teleportation, double presence, missed transition, and alibi inconsistencies with units. Evidence: edge fixtures. - [ ] Y4.9.e Keep author estimates, calculated values, uncertainty, policy thresholds, and intentional canon exceptions separate. Evidence: result tests. - [ ] Y4.10 Implement scene reachability, dead-end, soft-lock, and state reset checks. Evidence: exhaustive small-case traversal. - [ ] Y4.10.a Compile typed start states, scenes/branches/conditions/effects/ choices/inventory/knowledge/clues/checkpoints/resets/endings and supported profiles. Evidence: state model tests. - [ ] Y4.10.b Exhaustively traverse bounded cases and use bounded symbolic/ property exploration for larger cases with declared state/path limits. Evidence: traversal tests. - [ ] Y4.10.c Detect unreachable scenes/choices/endings, terminal dead ends without intended ending, and orphan branches. Evidence: reachability fixtures. - [ ] Y4.10.d Detect soft locks where required progress becomes impossible while runtime remains active, with minimal path/state trace. Evidence: soft-lock fixtures. - [ ] Y4.10.e Verify restart/checkpoint/scene reset/branch merge/replay clears/ preserves exact state and cannot duplicate/lose required clues. Evidence: reset fixtures. - [ ] Y4.10.f Return exhaustive/partial/timeout/unsupported coverage and never label bounded exploration complete. Evidence: result tests. - [ ] Y4.11 Implement spoiler-boundary analysis for UI labels, assets, logs, URLs, notifications, localization, and exports. Evidence: leak corpus. - [ ] Y4.11.a Classify solution/reveal/clue truth/suspect secret/canon/branch/ protected-source fields by spoiler tier, audience, reveal condition, and embargo. Evidence: data map. - [ ] Y4.11.b Inventory author/reviewer/solver/playtester/consumer/operator UI/API/search/client/cache/assets/accessibility/telemetry/output channels. Evidence: channel manifest. - [ ] Y4.11.c Scan labels/tooltips/alt text/transcripts/captions/filenames/ thumbnails/metadata/client state/bundles for direct/encoded/indirect leaks. Evidence: UI/asset corpus. - [ ] Y4.11.d Scan logs/errors/traces/URLs/deep links/notifications/email/ webhooks/localization TM/glossary/export/debug/save files. Evidence: operational leak tests. - [ ] Y4.11.e Test role/reveal progression/back navigation/offline cache/ locale fallback/search/count/timing/cross-tenant behavior. Evidence: adversarial suite. - [ ] Y4.11.f Fail release on unresolved spoiler exposure and preserve authorized evidence with redaction. Evidence: leak gate. - [ ] Y4.12 Implement harmful-content, representation, age-rating, and accessibility gates. Evidence: policy/version and human-review states. - [ ] Y4.12.a Define separate versioned gate taxonomies/applicability/ evaluator/rule/human evidence for harmful content, representation, regional age rating, and accessibility. Evidence: registries. - [ ] Y4.12.b Evaluate text/dialogue/scene/choice/consequence/assets/media/ gameplay for violence/abuse/hate/sexual/self-harm/child/identity/ manipulation and contextual uncertainty. Evidence: safety fixtures. - [ ] Y4.12.c Evaluate stereotype/tokenism/agency/power/cultural/linguistic/ protected-trait portrayal and harmful mechanics as review evidence, not a truth score. Evidence: representation corpus. - [ ] Y4.12.d Map content descriptors/intensity/context/interactivity/user content/region/platform to rating evidence and required qualified review. Evidence: age-rating matrix. - [ ] Y4.12.e Evaluate semantic/keyboard/non-drag/color/motion/cognitive/ captions/descriptions/audio/controls/timing alternatives for every content/runtime path. Evidence: accessibility matrix. - [ ] Y4.12.f Persist raw results/version/uncertainty/N/A separately, route human review/exception, and block mandatory failures. Evidence: gate tests. - [ ] Y4.13 Implement study grounding and case canon gates as distinct registries. Evidence: no false mapping between evidence and fiction canon. - [ ] Y4.13.a Define separate gate identities/contracts/vocabularies/owners/ policies/applicability for real-world source grounding and fictional canon consistency. Evidence: registry schemas. - [ ] Y4.13.b Map study claims/citations/source authority/currency/faithfulness/ conflict only to grounding measurements/verdicts. Evidence: grounding tests. - [ ] Y4.13.c Map case entity/assertion/timeline/knowledge/continuity/ contradiction only to canon measurements/verdicts. Evidence: canon tests. - [ ] Y4.13.d Define explicit “fictional claim informed by source” relation retaining both source evidence and canon assertion without equivalence. Evidence: mixed-content fixtures. - [ ] Y4.13.e Fail cross-registry ID/enum/threshold/result substitution and consumer aggregation that labels canon as factual support or vice versa. Evidence: false-mapping tests. - [ ] Y4.14 Persist raw solver traces and measurements separately from policy verdicts. Evidence: threshold/policy recomputation. - [ ] Y4.14.a Define immutable solver run/trace with subject revision, compiled model, solver/engine/config/environment versions, inputs/assumptions, explored states/paths/proofs/counterexamples/limits, and hash. Evidence: trace schema. - [ ] Y4.14.b Define immutable measurements for reachability/solution count/ timing/coverage/conflicts/resources with units/uncertainty/applicability. Evidence: measurement schema. - [ ] Y4.14.c Define verdict records referencing exact traces/measurements plus gate/profile/policy/threshold versions. Evidence: verdict schema. - [ ] Y4.14.d Recompute new verdict identities on policy/threshold/profile change without rerunning or modifying valid raw traces. Evidence: recompute tests. - [ ] Y4.14.e Require new solver run when case/compiler/solver/input/assumption changes and preserve all history. Evidence: lifecycle tests. - [ ] Y4.15 Add insufficient-data, timeout, unsupported, and evaluator-failure states. Evidence: none renders as pass. - [ ] Y4.15.a Define pass/fail/advisory/manual-review/N/A/insufficient/timeout/ unsupported/evaluator-failure/unavailable/stale/unknown states and transitions. Evidence: vocabulary. - [ ] Y4.15.b Require typed reason/coverage/limit/missing input/dependency/ evaluator/error/correlation/remediation/evidence per nonresult state. Evidence: schema tests. - [ ] Y4.15.c Map exceptions/timeouts/provider errors/partial solver coverage/ invalid input to exact states without generic catch-as-pass/fail. Evidence: mapping tests. - [ ] Y4.15.d Aggregate mandatory gates so none of these states can satisfy review/release, and preserve valid partial measurements. Evidence: property tests. - [ ] Y4.15.e Render/export text/semantic state with no green/color-only/ zero-value assumption. Evidence: UI/API tests. - [ ] Y4.16 Version solver, engine, canon, evaluator, corpus, and policy. Evidence: every gate is reproducible or explicitly not reproducible. - [ ] Y4.16.a Register solver/engine/compiler/code/config/runtime/dependency version/hash/source/build/lifecycle/supported constructs. Evidence: tool registry. - [ ] Y4.16.b Register canon schema/namespace/predicate/entity/mapping/ assertion-source and validation rule versions. Evidence: canon registry. - [ ] Y4.16.c Register evaluator/model/prompt/config/provider/training/ calibration and corpus manifest/labels/splits/rights/coverage versions. Evidence: evaluator/corpus registry. - [ ] Y4.16.d Register gate/policy/threshold/profile/rubric/aggregation/ manual-band versions with approvals/effective dates. Evidence: policy registry. - [ ] Y4.16.e Bind exact versions/environment/hardware/nondeterminism controls to every trace/measurement/verdict and verify goldens. Evidence: reproducibility tests. - [ ] Y4.16.f Label nonreproducible with exact uncontrolled dependency and prohibit retired/quarantined versions from new runs while retaining history. Evidence: lifecycle tests. ### Y5 — Production, assets, rendering, and agent orchestration - [ ] Y5.1 Link authoring projects to existing Yemaya projects and organizations. Evidence: no duplicate project identity. - [ ] Y5.1.a Resolve exact canonical project/organization/workspace/member/ profile IDs/versions through public owner contracts and current actor access. Evidence: resolver tests. - [ ] Y5.1.b Define authoring-track extension/link record with canonical project identity, selected content roots, config, and no copied owner/ membership/status fields. Evidence: linkage schema. - [ ] Y5.1.c Create/open/migrate links idempotently and reject cross-tenant, incompatible profile, archived/deleted, or duplicate identity. Evidence: lifecycle tests. - [ ] Y5.1.d Project organization/project changes and permissions dynamically, preserving authoring revisions without shadow synchronization authority. Evidence: update tests. - [ ] Y5.1.e Add schema/search/import guards and end-to-end proof that one project appears under one stable identity across surfaces. Evidence: duplication gate. - [ ] Y5.2 Link characters, locations, scenes, clues, and study materials to asset-library records. Evidence: stable lineage. - [ ] Y5.2.a Define typed entity-to-asset-revision link roles for portrait/ reference/model/texture/audio/video/scene/proxy/render/evidence and ordering/primary status. Evidence: link schema. - [ ] Y5.2.b Select only authorized exact asset revisions compatible with entity kind/project/profile/locale/target/status. Evidence: selector tests. - [ ] Y5.2.c Persist forward/reverse links with source/generation/import/ transformation provenance, rights/consent/canon/continuity refs and author decision. Evidence: lineage tests. - [ ] Y5.2.d Version link add/remove/reorder/replace without changing asset or entity history and compute downstream scene/build impacts. Evidence: lifecycle tests. - [ ] Y5.2.e Propagate asset supersession/quarantine/recall/rights expiry and entity/canon revision to eligibility/freshness. Evidence: propagation tests. - [ ] Y5.3 Build rights/provenance status into asset selection. Evidence: ineligible assets cannot enter a release candidate. - [ ] Y5.3.a Define asset-selector projection for owner/source/license/use/ adaptation/training/distribution/attribution/territory/term/consent/ provenance/gates/target and exact versions. Evidence: schema. - [ ] Y5.3.b Derive eligible/review/expired/revoked/incompatible/incomplete/ quarantined/unknown per project use/audience/locale/target rather than a generic asset approval. Evidence: policy tests. - [ ] Y5.3.c Present status/reasons/evidence/freshness/required attribution/ restrictions without exposing protected source/identity fields. Evidence: UI tests. - [ ] Y5.3.d Revalidate on attach, candidate lock, build, and release; reject direct foreign/stale asset IDs server-side. Evidence: TOCTOU tests. - [ ] Y5.3.e Scan every release-candidate assembly path and prove ineligible assets/derivatives cannot enter. Evidence: release boundary suite. - [ ] Y5.4 Build brief-to-Isis generation handoff for approved assets. Evidence: project/entity context and return lineage. - [ ] Y5.4.a Define handoff request for exact project/entity/scene/shot/ continuity/canon/source/asset revisions, approved asset kind/operation, audience, return intent, expiry, nonce, and signature. Evidence: schema. - [ ] Y5.4.b Validate project/actor/use/right/consent/canon/source/target and minimize authorized context before signed handoff. Evidence: issuance tests. - [ ] Y5.4.c Reauthorize in Isis, resolve canonical inputs, show plan/cost/ capability/substitution preview, and create governed run. Evidence: acceptance tests. - [ ] Y5.4.d Return generated proposal/output revision with run/model/workflow/ input/rights/provenance/gates and immutable source context linkage. Evidence: return tests. - [ ] Y5.4.e Require Yemaya accept/reject/link decision; no automatic asset/ canon/scene promotion. Evidence: authority tests. - [ ] Y5.4.f Test failure/cancel/multiple output/stale context/expired link/ cross-tenant/back navigation. Evidence: handoff E2E. - [ ] Y5.5 Build dailies review for rendered case scenes and study media. Evidence: timecode/frame annotations survive revisions. - [ ] Y5.5.a Define dailies session/item/render revision/shot-scene-material/ participant/reviewer/status/timebase/color/audio/rights projection. Evidence: schema. - [ ] Y5.5.b Build permission-filtered list/detail/playlist with synchronized image/video/audio/3D playback, color proxy, versions, gates, source/ lineage, and live/partial states. Evidence: viewer tests. - [ ] Y5.5.c Create typed frame/timecode/range/region/object/track anchored comments, drawings/notes, replies, mentions, resolve/reopen, and accessible anchor list. Evidence: annotation tests. - [ ] Y5.5.d Map anchors across rerender/trim/rate/crop/replacement as exact/ shifted/ambiguous/orphaned and retain original evidence. Evidence: survival tests. - [ ] Y5.5.e Record approve/reject/changes/hold/compare/promote decisions against exact render revision with stale/concurrency/role checks. Evidence: review tests. - [ ] Y5.5.f Run case scene and study media render-to-notes-to-rerender journey with accessibility/responsive/tenant proof. Evidence: E2E. - [ ] Y5.6 Build render and compilation job views with dependency, capacity, cost, progress, cancellation, and failure detail. Evidence: live fault journey. - [ ] Y5.6.a Define audience-safe projections for request/plan/DAG/job/stage/ attempt/worker-provider/reservation/budget/cost/output/error/events. Evidence: view contracts. - [ ] Y5.6.b Build job list/detail with stable filters/URLs, dependency graph, queue/capacity/reservations, inputs/versions, and bounded live updates. Evidence: UI tests. - [ ] Y5.6.c Present estimate/reserved/actual compute/storage/egress/time/cost, pending/unbilled/variance and attribution by stage/artifact. Evidence: cost tests. - [ ] Y5.6.d Present typed progress/checkpoints/logs/outputs/gates/refusal/ policy/capacity/timeout/malformed/worker-loss/internal failures with redaction. Evidence: failure view tests. - [ ] Y5.6.e Implement authorized cancel/retry/replay/redirect with state/ impact/cost/reason/confirmation and immutable attempt/run lineage. Evidence: action tests. - [ ] Y5.6.f Run live injected dependency/provider/worker/storage failure, reconnect/recovery/late output/tenant/accessibility journey. Evidence: Playwright fault E2E. - [ ] Y5.7 Build production verification before asset promotion. Evidence: checksum, technical, rights, and content gates. - [ ] Y5.7.a Resolve exact source/output/asset/proxy/rendition/dependency/ target/profile revisions and required verification registry. Evidence: plan tests. - [ ] Y5.7.b Verify bytes/manifest/dependencies/checksums/signatures/content type/storage integrity and quarantine corruption. Evidence: integrity tests. - [ ] Y5.7.c Run asset-kind/target technical format/dimensions/color/audio/ video/3D/engine/DCC/performance gates. Evidence: technical fixtures. - [ ] Y5.7.d Verify source/license/consent/attribution/provenance/watermark/ canon/continuity and content/safety/age/accessibility gates. Evidence: trust fixtures. - [ ] Y5.7.e Bind raw measurements/verdicts/freshness/overrides/reviews to exact candidate and block promotion on missing/stale/failed mandatory gate. Evidence: promotion tests. - [ ] Y5.7.f Promote as a new asset status/revision with decision/audit and revalidate on downstream release. Evidence: lifecycle tests. - [ ] Y5.8 Build project-Obsidian or external-project import/export only through versioned safe adapters. Evidence: path, conflict, and round-trip tests. - [ ] Y5.8.a Define adapter interface/version/capabilities/source-target profile, manifest/mapping/loss/diagnostic/security contracts and approved adapter registry. Evidence: adapter schema. - [ ] Y5.8.b Parse imports in quarantine with archive/path/symlink/absolute/ traversal/hidden/script/plugin/size/depth/version protections. Evidence: hostile path tests. - [ ] Y5.8.c Map project/entities/tree/graph/timeline/notes/assets/links/ metadata/locales/IDs/versions to canonical contracts with source provenance. Evidence: mapping tests. - [ ] Y5.8.d Preview create/update/merge/skip/conflict/duplicate/loss/ unsupported/external dependency and require authorized resolution. Evidence: conflict tests. - [ ] Y5.8.e Export deterministic safe package with exact revisions, relative paths, manifest/hashes/standards metadata/rights and no secrets/local paths. Evidence: export tests. - [ ] Y5.8.f Round-trip every supported adapter/version/edge profile and reject unknown/unsupported versions explicitly. Evidence: adapter suite. - [ ] Y5.9 Build writers-room/director agent run plans with tool grants, budgets, sources, canon snapshot, and stop conditions. Evidence: plan validation. - [ ] Y5.9.a Define distinct writers-room/director plan/step/output contracts for ideation/dialogue/structure/continuity/production planning. Evidence: schemas. - [ ] Y5.9.b Bind exact project/premise/case/scenes/sources/citations/canon/ continuity/assets/profile/policy revisions and spoiler compartments. Evidence: input tests. - [ ] Y5.9.c Resolve allowlisted versioned tool/model/provider grants by operation/data/project/tenant/network/resource/output and expiry. Evidence: grant tests. - [ ] Y5.9.d Allocate per-step/total token/tool/compute/cost/time budgets, dependencies/retries/approvals and hard stops for safety/canon/source/ budget/timeout/verification. Evidence: budget/stop tests. - [ ] Y5.9.e Validate DAG/types/grants/inputs/freshness/policy/budget/ destinations before dispatch; reject injected/arbitrary plans. Evidence: zero-dispatch tests. - [ ] Y5.9.f Ensure plans grant no maturity/canon/approval/promotion/publish/ budget exception authority. Evidence: authority tests. - [ ] Y5.10 Build run/queue/budget/provenance views scoped to authoring project. Evidence: cross-project access test. - [ ] Y5.10.a Define project-filtered request/plan/step/queue/run/attempt/tool/ event/budget/evidence/output/decision/lineage projections. Evidence: contracts. - [ ] Y5.10.b Build list/detail/DAG/timeline/live reconnect with exact versions, queue/reservation/status/stops/approvals/failures. Evidence: run UI tests. - [ ] Y5.10.c Present tool purpose/status/timing and redacted inputs/outputs, allocated/consumed/remaining budgets, sources/canon/provenance/proposals. Evidence: detail tests. - [ ] Y5.10.d Enforce tenant/organization/project/role/spoiler/object/property/ function authorization on query/search/count/URL/stream/export/action. Evidence: cross-project tests. - [ ] Y5.10.e Verify long-run performance, accessibility/responsive modes and project switch/back/role revoke/cache behavior. Evidence: E2E. - [ ] Y5.11 Build human-override pause, redirect, accept, reject, and abort. Evidence: overrides are audited and cannot rewrite history. - [ ] Y5.11.a Define separate command eligibility/role/scope/reason/evidence/ idempotency/expected version/outcome and human-only operations. Evidence: schemas. - [ ] Y5.11.b Pause at safe boundary/checkpoint and resume only after full source/canon/grant/policy/budget/dependency revalidation. Evidence: pause tests. - [ ] Y5.11.c Redirect through a new plan revision with changed objective/ steps/tools/inputs/budget and preserved completed outputs/history. Evidence: redirect tests. - [ ] Y5.11.d Accept/reject exact attributed proposals into review/new authoring revisions without approving canon/gates/maturity/publish. Evidence: decision tests. - [ ] Y5.11.e Abort/cancel queued/running/downstream calls with late-result fencing, partial evidence/cost, resource cleanup, and explicit outcome. Evidence: abort race tests. - [ ] Y5.11.f Record append-only commands/events/actor/authority/plan before- after links and prohibit state/history rewriting. Evidence: audit tests. - [ ] Y5.12 Build agent-output intake as proposals. Evidence: no agent directly advances maturity, approves gates, or publishes. - [ ] Y5.12.a Define signed/hashed result envelope with agent/run/step/tool/ model/config/input versions, output kind/schema, evidence/sources/canon, confidence/cost/status. Evidence: schema. - [ ] Y5.12.b Validate signature/hash/schema/size/type/expected output/project/ tenant/source locators and scan files/content. Evidence: hostile tests. - [ ] Y5.12.c Reject/redact forbidden secrets/protected sources/solutions/ unrelated project data and unsupported canon/approval claims. Evidence: property tests. - [ ] Y5.12.d Store text/structure/dialogue/asset/production/review results only as attributed proposals with exact authoring target linkage. Evidence: persistence tests. - [ ] Y5.12.e Require human inspect/accept/edit/reject/defer; acceptance creates a new revision and reruns applicable gates. Evidence: review tests. - [ ] Y5.12.f Prove no payload/property/event can advance maturity, resolve canon, pass/waive gates, promote assets, approve budget, or publish. Evidence: authority suite. - [ ] Y5.13 Build cost and capacity estimates for writing, generation, rendering, compilation, localization, and review. Evidence: planned versus actual reconciliation. - [ ] Y5.13.a Define versioned price/rate/productivity/resource/capacity models and units for labor/tool/provider/compute/storage/egress/vendor/reviewer work. Evidence: model schemas. - [ ] Y5.13.b Estimate writing/editorial/research/canon/solver/review labor by volume/complexity/locale/risk/role/rates/availability. Evidence: labor fixtures. - [ ] Y5.13.c Estimate generation/render/compilation/postproduction/storage/ egress by plan/variants/assets/passes/targets/provider/resources/retries. Evidence: technical fixtures. - [ ] Y5.13.d Estimate localization/translation/media adaptation/locale review/ rendition/build and named reviewer capacity/schedule. Evidence: locale fixtures. - [ ] Y5.13.e Return low/expected/high, confidence/unknowns/assumptions/ bottlenecks/calendars/currencies/rate versions and threshold confirmation. Evidence: estimate tests. - [ ] Y5.13.f Ingest actual labor/jobs/providers/storage/reviews, allocate by project/stage/artifact/locale/target, and report pending/unbilled/ variance/cause without double count. Evidence: reconciliation tests. - [ ] Y5.14 Build web/desktop background-job handoff and reconnect. Evidence: closing a client never corrupts server job state. - [ ] Y5.14.a Define server-owned durable job identity/state/event cursor/ subscription/cancellation/action contracts independent of client process/window/session. Evidence: job contract. - [ ] Y5.14.b Submit idempotently with exact project/input/plan/version and return durable job ref before client background tracking. Evidence: submission tests. - [ ] Y5.14.c Handoff between web/desktop/window/process/device by signed project-scoped link/notification and current reauthorization. Evidence: handoff tests. - [ ] Y5.14.d Reconnect from last cursor/snapshot with dedup/out-of-order/gap/ terminal handling; refresh expired credentials without resubmission. Evidence: reconnect tests. - [ ] Y5.14.e Close/crash/update/offline/reopen clients during queued/running/ callback/finalizing and prove job/checkpoints/outputs unaffected. Evidence: lifecycle tests. - [ ] Y5.14.f Make cancel/retry/replay explicit server commands and never infer cancellation from client disconnect. Evidence: authority tests. ### Y5A — Existing AAA production-suite feature completion - [ ] Y5A.1 Complete project creation, template, workspace, membership, favorites/recent, duplicate, import/export, archive, restore, retention, and project-type migration. Evidence: every supported project profile has a durable lifecycle journey and no hidden local-only state. - [ ] Y5A.1.a Build typed project creation for profile/type/template, organization/workspace, title/code/locale/timezone/units/color, owner, classification/retention, targets, and validation. Evidence: creation tests. - [ ] Y5A.1.b Build versioned project templates with inheritance/defaults/ required entities/pipeline/roles/gates/folders/config, preview, review, code floors, and lifecycle. Evidence: template tests. - [ ] Y5A.1.c Build project workspace configuration for navigation/layout/ saved views/default tools/capabilities/integrations without local-only canonical state. Evidence: workspace sync tests. - [ ] Y5A.1.d Build owner/member/team/service-account/guest invite/accept/ revoke/role/scope/expiry/conflict and project leave/transfer workflows. Evidence: membership tests. - [ ] Y5A.1.e Build per-user favorite/unfavorite/reorder and derived recent/ last-opened state across web/desktop/devices with privacy/retention. Evidence: favorites/recent tests. - [ ] Y5A.1.f Duplicate/fork exact project revision with selective content/ assets/config/history/member/link options, new IDs, rights/canon/source checks, progress, and provenance. Evidence: duplication tests. - [ ] Y5A.1.g Import through approved versioned adapters with quarantine, preview/conflicts/mappings/loss/authorization/idempotency and source package retention. Evidence: import tests. - [ ] Y5A.1.h Export deterministic project package with exact revisions/ manifests/dependencies/hashes/rights/redactions and no local paths/ secrets, then round-trip. Evidence: export tests. - [ ] Y5A.1.i Archive project from normal discovery/mutation with active job/ lock/build/release/dependency/member impact, and preserve authorized read/history. Evidence: archive tests. - [ ] Y5A.1.j Restore archive as explicit state transition after policy/ retention/dependency/capability checks without resurrecting revoked rights/secrets/jobs. Evidence: restore tests. - [ ] Y5A.1.k Enforce retention/deletion/legal hold/export/backup/local-cache schedules and verified downstream cleanup/irrecoverable copies. Evidence: retention tests. - [ ] Y5A.1.l Migrate project type/profile through versioned impact preview, entity/pipeline/gate/asset/role/target mappings, conflicts, new revision, rollback, and no silent defaults. Evidence: migration tests. - [ ] Y5A.1.m Run durable create-to-archive/restore/migrate journey for every supported profile across web/desktop/restart/two tenants. Evidence: lifecycle matrix. - [ ] Y5A.2 Complete the asset library across the ratified asset-type registry, including upload/capture/generation/import, folders/collections, tags, search, exact/perceptual dedupe, versions, relationships, dependencies, rights, provenance, proxy/rendition, approval, promotion, quarantine, archive, and restore. Evidence: per-asset-kind capability and gate matrix. - [ ] Y5A.2.a Define ratified asset-kind/version registry with schemas/ formats/roles/technical metadata/preview/editor/gates/targets/rights/ provenance and explicit unsupported cells. Evidence: registry. - [ ] Y5A.2.b Implement upload with streaming hash/sniff/quarantine/scan/ dedupe/metadata/rights/progress/cancel/resume and asset revision creation. Evidence: upload tests. - [ ] Y5A.2.c Implement governed device/file/desktop capture with permission, calibration/timecode/color/audio, consent, local temp security, ingest, and failure cleanup. Evidence: capture tests. - [ ] Y5A.2.d Implement Isis generation handoff/return and manual/external import with exact provenance, safe adapters, quarantine, and proposal acceptance. Evidence: generation/import tests. - [ ] Y5A.2.e Implement versioned folder hierarchy and collection/static-smart/ ordered membership with cycle, permissions, bulk move, and no ownership ambiguity. Evidence: organization tests. - [ ] Y5A.2.f Implement governed tag/taxonomy/alias/locale authoring and permission-safe search/filter/facet/sort/pagination/autocomplete. Evidence: metadata/search tests. - [ ] Y5A.2.g Implement exact cryptographic/content duplicate and calibrated modality-specific perceptual near-duplicate detection with candidate evidence/uncertainty and human merge/keep decisions. Evidence: dedupe tests. - [ ] Y5A.2.h Implement immutable logical/revision history, semantic/media diff, compare/select/supersede/restore and current projection without overwrites. Evidence: version tests. - [ ] Y5A.2.i Implement typed asset-to-entity/asset/dependency/ingredient/ derivative/rendition/variant/continuity/canon/production relationships with impact queries. Evidence: relationship tests. - [ ] Y5A.2.j Implement rights/license/consent/attribution/embargo/provenance/ source/generation/model/workflow/watermark/C2PA status and blast radius. Evidence: trust tests. - [ ] Y5A.2.k Implement original/proxy/thumbnail/streaming/edit/review/delivery/ locale/LOD/mip/stem/rendition manifests, jobs, hashes, compatibility, and source linkage. Evidence: rendition tests. - [ ] Y5A.2.l Implement asset-kind/target quality/safety/rights/canon/ continuity/accessibility/technical review, decisions, and stale evidence. Evidence: approval tests. - [ ] Y5A.2.m Implement promote/link/use only for eligible exact revisions and revalidate in build/release; reject direct stale IDs. Evidence: promotion tests. - [ ] Y5A.2.n Implement quarantine/recall with admission block/dependency/ project/build/release propagation and restricted evidence. Evidence: quarantine tests. - [ ] Y5A.2.o Implement archive/restore/retention/delete/legal hold while preserving history/lineage and rejecting active dependencies where required. Evidence: lifecycle tests. - [ ] Y5A.2.p Run per-asset-kind source-to-approved-to-target journey and fail every registry cell without current capability/gate proof. Evidence: matrix gate. - [ ] Y5A.3 Complete screenplay authoring for structured scenes, slug lines, action, dialogue, characters, revisions, colored pages, locks, notes, breakdowns, reports, compare, table read, and interchange. Evidence: production-script golden and collaborative editing journey. - [ ] Y5A.3.a Define screenplay/project/logical/revision/page/scene/block/ character/dialogue/production metadata contracts and supported interchange profiles. Evidence: schemas. - [ ] Y5A.3.b Build structured scene/act/sequence order and slug line INT/EXT/ location/time/continuity/special qualifier editor with stable IDs. Evidence: structure tests. - [ ] Y5A.3.c Build typed action/description/transition/shot/text/lyrics/ centered/page-break and format rules with keyboard-first editing. Evidence: action block tests. - [ ] Y5A.3.d Build character cues/dialogue/parentheticals/dual dialogue/ extensions/voiceover/offscreen/language/pronunciation and canonical character links. Evidence: dialogue tests. - [ ] Y5A.3.e Implement pagination/layout/font/margins/widow-orphan/continued/ page numbering/title pages and accessible semantic alternative. Evidence: render goldens. - [ ] Y5A.3.f Implement revisions/sets/colored pages/date/version marks/ changed-line indicators and compare/diff/report without changing content identity. Evidence: revision tests. - [ ] Y5A.3.g Implement scene/page/line locks, production revisions, omitted/ added scenes, numbering/revisions, conflict/override authority and audit. Evidence: lock tests. - [ ] Y5A.3.h Implement anchored notes/comments/suggestions/assignments/ mentions/resolve and stable anchor migration. Evidence: note tests. - [ ] Y5A.3.i Build breakdown categories/items/characters/props/wardrobe/ locations/VFX/SFX/stunts/extras/safety with entity/asset/task links. Evidence: breakdown tests. - [ ] Y5A.3.j Build scene/character/dialogue/location/page/revision/breakdown/ duration/cast/day-night reports with permission-safe exports. Evidence: report tests. - [ ] Y5A.3.k Build semantic side-by-side compare/merge and consented table-read cast/voice/timing/missing-lines/captions/script output. Evidence: compare/table-read tests. - [ ] Y5A.3.l Implement Final Draft/FDX and other ratified import/export with source retention, mapping/loss diagnostics, deterministic round-trip, and no answer/spoiler leak. Evidence: interchange tests. - [ ] Y5A.3.m Run collaborative two-editor/offline/reconnect/lock/revision/ conflict/restore production-script journey and compare golden. Evidence: E2E. - [ ] Y5A.4 Complete storyboard and animatic authoring for panels, shots, framing, lens/camera, timing, dialogue/audio, continuity, versions, generated assets, sequence playback, exports, and production links. Evidence: script→storyboard→animatic lineage and round-trip. - [ ] Y5A.4.a Define storyboard/sequence/shot/panel/version/timeline/track/ media/annotation contracts with exact script/scene/beat links. Evidence: schemas. - [ ] Y5A.4.b Build panel create/import/draw/generate/replace/crop/annotate/ caption/action/dialogue/shot-number/order with asset provenance. Evidence: panel tests. - [ ] Y5A.4.c Build stable shot identity/scene/sequence/order/type/coverage/ transition/status/owner/production links and conflict-safe reorder. Evidence: shot tests. - [ ] Y5A.4.d Author composition/framing/aspect/safe area/subject placement/ eyeline/screen direction/axis/depth/scale and visual annotations. Evidence: framing tests. - [ ] Y5A.4.e Author camera/lens/sensor/focal/aperture/focus/height/distance/ pose/movement/path/shake in explicit units with preview. Evidence: camera tests. - [ ] Y5A.4.f Author frame/timecode/seconds duration/handles/rate/transition/ retime and dialogue/SFX/music/ambience/guide audio tracks with sync. Evidence: timing/audio tests. - [ ] Y5A.4.g Apply character/wardrobe/prop/location/light/palette/lens/camera/ motion/canon continuity profiles and drift/conflict annotations. Evidence: continuity tests. - [ ] Y5A.4.h Version/diff/branch/merge/restore panels/shots/timeline/tracks and preserve stable unaffected identities. Evidence: revision tests. - [ ] Y5A.4.i Attach generated panels/audio through governed Isis/Euterpe handoffs with run/input/model/workflow/rights/provenance and human acceptance. Evidence: generation tests. - [ ] Y5A.4.j Build synchronized sequence animatic playback/scrub/loop/ thumbnails/waveforms/captions/comments/comparison with accessible lists. Evidence: playback tests. - [ ] Y5A.4.k Export image boards/PDF/video/editorial EDL/XML/AAF or ratified profiles with stable IDs/timebases/media/metadata/loss reports and round-trip. Evidence: export tests. - [ ] Y5A.4.l Link shots to schedule/tasks/assets/renders/dailies/editorial/ engine/DCC and propagate script/panel/timing/continuity changes. Evidence: production linkage tests. - [ ] Y5A.4.m Run script-scene-to-board-to-generated-panel-to-animatic-to- editorial round-trip with exact lineage. Evidence: E2E. - [ ] Y5A.5 Complete character, creature, prop, world, location, environment, lore, relationship, visual-development, reference, canon, and continuity-design workspaces. Evidence: source and generated assets remain linked to approved entity revisions and downstream scenes. - [ ] Y5A.5.a Define versioned entity-kind registry/common identity/locale/ source/canon/asset/continuity/production fields and per-kind schemas. Evidence: registry. - [ ] Y5A.5.b Build character/creature anatomy/appearance/identity/age/ personality/goals/arc/voice/performance/wardrobe/rig/consent authoring. Evidence: character tests. - [ ] Y5A.5.c Build prop/item identity/function/dimensions/materials/state/ ownership/interaction/handedness/variants/continuity authoring. Evidence: prop tests. - [ ] Y5A.5.d Build world/setting geography/history/cultures/politics/economy/ technology/rules/time/canon/regions and hierarchy authoring. Evidence: world tests. - [ ] Y5A.5.e Build location/environment layout/scale/architecture/biome/ weather/time/light/set-dressing/accessibility/production constraints. Evidence: location tests. - [ ] Y5A.5.f Build lore assertion/event/faction/object/ritual/language/ chronology/source/authority/contradiction/retcon/continuity authoring. Evidence: lore tests. - [ ] Y5A.5.g Build directed relationship type/history/strength/state/knowledge/ conflict/secret/temporal/canon and accessible graph/table views. Evidence: relationship tests. - [ ] Y5A.5.h Build visual-development brief/mood/palette/silhouette/shape/ material/scale/style/reference explorations/variants/decisions. Evidence: visual development tests. - [ ] Y5A.5.i Build source/reference ingest/boards/roles/crop/annotation/ rights/attribution/consent/authority/avoidance/conditioning links. Evidence: reference tests. - [ ] Y5A.5.j Build canon assertion/conflict/source/decision/status/namespace/ temporal review and blast-radius within each entity workspace. Evidence: canon tests. - [ ] Y5A.5.k Build continuity profiles/revisions for identity/appearance/ scale/state/material/wardrobe/props/environment/lore/relationships across scenes/shots/assets. Evidence: continuity tests. - [ ] Y5A.5.l Attach source/manual/generated asset revisions with role/ provenance/rights/gates/decision, compare/select/promote, and no auto- canon. Evidence: asset linkage tests. - [ ] Y5A.5.m Link approved exact entity revisions to script/scenes/shots/ gameplay/NPCs/schedule/tasks/builds and propagate changes/stale state. Evidence: downstream linkage tests. - [ ] Y5A.5.n Run representative per-entity source-to-design-to-approved-asset- to-scene journey with graph/accessibility/tenant proof. Evidence: E2E. - [ ] Y5A.6 Complete production scheduling for breakdown items, shots/tasks, dependencies, milestones, calendars, call sheets, locations, crew, availability, time zones, schedule optimization/sharing, conflicts, and actuals. Evidence: schedule-to-call-sheet and change-impact journeys. - [ ] Y5A.6.a Define schedule/project/version/task/shot/breakdown/resource/ dependency/milestone/calendar/booking/call-sheet/actual contracts and stable IDs. Evidence: schemas. - [ ] Y5A.6.b Convert approved script/entity/scene/shot/breakdown revisions into estimable schedulable items with quantities/durations/skills/resources/ locations/constraints and change links. Evidence: breakdown tests. - [ ] Y5A.6.c Build task/shot create/assign/status/priority/estimate/duration/ dates/owner/crew/resource/budget/asset/gate/version and bulk operations. Evidence: task tests. - [ ] Y5A.6.d Build finish-start/start-start/finish-finish/lag/lead/required/ soft dependency DAG, cycle/reachability/critical-path checks, and impact. Evidence: dependency tests. - [ ] Y5A.6.e Build milestones/deliverables/reviews/release windows/embargo/ approval criteria and slip/escalation behavior. Evidence: milestone tests. - [ ] Y5A.6.f Build production/institution/crew/location/stage/device/provider calendars, work rules/holidays/quiet hours/recurrence/availability/ holds/bookings in IANA time zones. Evidence: calendar tests. - [ ] Y5A.6.g Build location/permit/weather/travel/setup/strike/capacity/ accessibility/safety constraints and crew role/rate/union/rest/ qualification/consent/contact projections. Evidence: resource tests. - [ ] Y5A.6.h Detect double-booking, impossible dependencies, insufficient turnaround/rest/travel/resources/capacity/skills, milestone misses, and timezone/DST conflicts. Evidence: conflict tests. - [ ] Y5A.6.i Build deterministic optimization suggestions for critical path, resource leveling, grouping/location moves, cost/quality/risk tradeoffs with assumptions and no automatic apply. Evidence: optimization tests. - [ ] Y5A.6.j Build schedule version/diff/what-if/approval/publish/share/export/ subscriber access with role redaction and stable links. Evidence: schedule lifecycle tests. - [ ] Y5A.6.k Generate versioned call sheets from committed scene/shot/ location/crew/cast/equipment/safety/weather/travel/contact/access/ schedule refs with acknowledgements. Evidence: call-sheet tests. - [ ] Y5A.6.l Capture start/end/progress/completion/actual labor/resource/ incident/cost/delay reasons separately from plan and reconcile. Evidence: actuals tests. - [ ] Y5A.6.m Run script change→breakdown impact→optimized committed schedule→ call sheet→actuals/replan journey across zones. Evidence: E2E. - [ ] Y5A.7 Complete budgeting for templates, line items, versions, multi-currency/rates, estimates, approvals, commitments, actuals, variance, cost prediction, contingency, and audit. Evidence: exact arithmetic, rate-version, permission, and reconciliation tests. - [ ] Y5A.7.a Define budget/template/version/category/account/line-item/rate/ estimate/approval/commitment/actual/contingency/forecast/audit contracts with currencies/units/tax/time. Evidence: schemas. - [ ] Y5A.7.b Build versioned budget templates/mappings/formulas/required categories/assumptions/floors by project profile/region and inheritance. Evidence: template tests. - [ ] Y5A.7.c Build line items for quantity/unit/rate/currency/tax/markup/ discount/vendor/crew/resource/task/asset/shot/date/cost center/funding with decimal arithmetic. Evidence: line-item tests. - [ ] Y5A.7.d Build immutable exchange/pay/union/provider/vendor/tax rate versions with source/effective period/rounding and exact consumed rate. Evidence: rate tests. - [ ] Y5A.7.e Build low/expected/high estimates/scenarios/quotes/assumptions/ confidence, import, compare, freeze/baseline, and budget revision diff. Evidence: estimate tests. - [ ] Y5A.7.f Build submit/review/request-changes/approve/reject with thresholds, role/quorum/separation, exact version, evidence, conditions, and expiry. Evidence: approval tests. - [ ] Y5A.7.g Build purchase order/contract/booking/reservation/commitment, encumbrance, status, vendor, approval, cancellation, and remaining available balance. Evidence: commitment tests. - [ ] Y5A.7.h Ingest verified invoice/timecard/provider/job/storage/expense/ payment actuals with source/idempotency/allocation/status/corrections. Evidence: actual tests. - [ ] Y5A.7.i Compute planned/baseline/current/committed/actual/forecast/ remaining variance by amount/percentage/currency/category/task/period with typed cause. Evidence: variance goldens. - [ ] Y5A.7.j Build cost prediction from versioned measurements/model/ assumptions/uncertainty and compare champion/challenger; never overwrite estimates. Evidence: prediction tests. - [ ] Y5A.7.k Build contingency reserve/allowance/risk trigger/draw/replenish/ approval/release and prevent hidden negative budget. Evidence: contingency tests. - [ ] Y5A.7.l Enforce project/org/role/property/spend-limit/separation/ concurrency/idempotency and immutable correction/audit/export. Evidence: permission/audit tests. - [ ] Y5A.7.m Reconcile budget/commitments/actuals/provider bills/currency/ refunds/credits and run exact arithmetic/rate-version journey. Evidence: reconciliation E2E. - [ ] Y5A.8 Complete dailies, editorial, timing, cleanup, object removal, relighting/lighting, HDR trim, localization, foley, score, portrait, motion-camera, AV narrative, and video-edit workspaces by integrating existing pages and libraries. Evidence: each page has live backing, immutable review media, per-frame/timecode notes, gates, and handoff. - [ ] Y5A.8.a Inventory every existing page/library/route/API/store/job/ capability/owner/live-fixture state and assign reuse/refactor/merge/ retire/gap disposition. Evidence: workspace ledger. - [ ] Y5A.8.b Define shared exact project/sequence/shot/asset/source/render/ edit/timeline/track/version/timebase/color/audio/review/job/gate/handoff contracts. Evidence: shared schemas. - [ ] Y5A.8.c Complete dailies ingest/playlist/proxy/color/audio/playback/ compare/frame-time notes/decisions/rerender/promotion. Evidence: dailies journey. - [ ] Y5A.8.d Complete editorial sequence/track/clip/source-timecode/record- timecode/trim/transition/retime/multicam/audio/captions/version/conform/ interchange. Evidence: editorial journey. - [ ] Y5A.8.e Complete animation/action/audio timing/exposure/beat/marker/ duration/rate/sync/retime comparison and accessible timeline/list. Evidence: timing journey. - [ ] Y5A.8.f Complete cleanup/paint/roto/mask/stabilize/denoise/artifact/ beauty/fix layers with source frames, versioned patches, preview, gates, and revert. Evidence: cleanup journey. - [ ] Y5A.8.g Complete object-removal target/mask/tracking/occlusion/background/ temporal consistency/generation provenance/review and non-destructive replacement. Evidence: removal journey. - [ ] Y5A.8.h Complete relighting/lighting source/environment/light/camera/ geometry/material/exposure/shadow/reflection/render-pass/HDR/color workflows. Evidence: lighting journey. - [ ] Y5A.8.i Complete HDR trim target display/profile/master/shot controls/ metadata/measurement/compare/version/signoff/export. Evidence: HDR journey. - [ ] Y5A.8.j Complete localization script/dialogue/text/captions/dub/voice/ timing/lip-sync/graphics/locale review/rendition/package parity. Evidence: localization journey. - [ ] Y5A.8.k Complete foley cue/object/surface/action/performer/take/timing/ sync/edit/mix/rights/asset handoff and review. Evidence: foley journey. - [ ] Y5A.8.l Complete score spotting/cue/tempo/meter/key/hit points/stems/ mockup/recording/license/timeline/mix/delivery through Euterpe seams. Evidence: score journey. - [ ] Y5A.8.m Complete portrait identity/consent/reference/selection/retouch/ crop/color/background/renditions/rights/quality/promotion. Evidence: portrait journey. - [ ] Y5A.8.n Complete motion-camera tracking/solve/path/lens/distortion/ coordinates/scale/confidence/cleanup/preview/DCC-engine export. Evidence: motion-camera journey. - [ ] Y5A.8.o Complete AV narrative script/story/sequence/picture/dialogue/ narration/music/SFX/captions/renditions/review/package authoring. Evidence: AV narrative journey. - [ ] Y5A.8.p Complete video-edit source/sequence/clip/track/effects/color/ audio/titles/captions/version/render/conform/export workflows. Evidence: video-edit journey. - [ ] Y5A.8.q For every workspace, require live owner backing, immutable source/ review media, stable frame/timecode/object anchors, typed gates, job progress/cancel/failure, and governed upstream/downstream handoff. Evidence: per-page invariant matrix. - [ ] Y5A.8.r Verify cross-workspace edit/rerender/review/handoff lineage, web/desktop/accessibility/role/tenant and no duplicated mutation owner. Evidence: integration E2E. - [ ] Y5A.9 Complete real-time collaboration for CRDT document sync, presence, cursor/selection, comments/suggestions, edit locks, voice/video, recording/transcript, reconnect, guest access, and approved production management/video-conference integrations. Evidence: degraded and cross-version collaboration journeys. - [ ] Y5A.9.a Define collaboration document/room/session/participant/client/ protocol/version/operation/vector/awareness/event/snapshot contracts per editor/entity type. Evidence: schemas. - [ ] Y5A.9.b Implement CRDT operations/schema validation/stable IDs/order/ transactions/undo/redo/snapshots/compaction/persistence/audit and reject unauthorized fields. Evidence: sync tests. - [ ] Y5A.9.c Implement online/offline/multi-device concurrent create/edit/ reorder/delete/merge with deterministic convergence and semantic conflict escalation where CRDT cannot decide meaning. Evidence: convergence tests. - [ ] Y5A.9.d Implement permission-filtered ephemeral presence, identity/ status/active tool/viewport, heartbeat/expiry/privacy, and no hidden participant leakage. Evidence: presence tests. - [ ] Y5A.9.e Implement cursor/text range/block/entity/graph/timeline/asset/ frame/time selection awareness with stable anchor mapping and accessible participant list. Evidence: cursor tests. - [ ] Y5A.9.f Implement durable comments/threads/replies/mentions/attachments/ suggestions/accept-reject/resolve/reopen/notifications with exact revision anchors. Evidence: review collaboration tests. - [ ] Y5A.9.g Implement edit/production/asset/scene/shot locks with lease/ fencing/heartbeat/expiry/read-only/takeover/override/audit and no split- brain commit. Evidence: lock tests. - [ ] Y5A.9.h Implement voice/video room permission/device selection/mute/ screen share/quality/network/encryption/participant/accessibility/ captions and honest degraded state. Evidence: conference tests. - [ ] Y5A.9.i Implement explicit consented recording/stop/indicator/storage/ access/retention/export/delete plus attributed transcript/speaker/time/ correction/caption and no covert capture. Evidence: recording tests. - [ ] Y5A.9.j Implement reconnect from vector/cursor/snapshot with auth refresh, replay/dedup/gap/schema migration/conflict and no duplicated operations. Evidence: reconnect tests. - [ ] Y5A.9.k Implement guest invite/identity/role/project/entity/spoiler/ duration/download/recording limits, revocation, watermark, and audit. Evidence: guest tests. - [ ] Y5A.9.l Integrate approved production-management/video-conference systems through versioned public adapters for identity/calendar/task/ meeting/recording/links/events with source-of-truth directionality. Evidence: integration tests. - [ ] Y5A.9.m Run mixed web/desktop/old-new client/offline/partition/reconnect/ revoked guest/degraded media journey with convergence/accessibility/ tenant proof. Evidence: cross-version E2E. - [ ] Y5A.10 Complete pipeline-template and step authoring, configuration, validation, dry run, versioning, scheduling, budget/resource policy, human checkpoints, autonomous film/game execution, pause/redirect/cancel, retry, rollback, and output review. Evidence: agents never bypass safety, budget, production-verification, or human-override floors. - [ ] Y5A.10.a Define immutable pipeline/template/version/step/port/edge/ parameter/dependency/tool/model/host/resource/checkpoint/schedule/run/ output contracts and canonical serialization. Evidence: schemas. - [ ] Y5A.10.b Build versioned template metadata/profile/operation/input-output/ default/extension/inheritance/owner/lifecycle authoring. Evidence: template tests. - [ ] Y5A.10.c Build typed step catalog and graph authoring for services/tools/ agents/providers/renderers/DCC-engine/human tasks with stable ports/ dependencies and no arbitrary code. Evidence: editor tests. - [ ] Y5A.10.d Build parameter/config/environment/secret-ref/target/condition/ retry/timeout/idempotency/concurrency/artifact/resource policies with effective-value provenance. Evidence: configuration tests. - [ ] Y5A.10.e Validate graph types/cycles/reachability/dead outputs/ dependencies/versions/licenses/security/rights/capabilities/resources/ targets/policy/authority. Evidence: validation suite. - [ ] Y5A.10.f Dry-run resolution/authorization/dependency availability/ estimates/plan/checkpoints/outputs without external side effects. Evidence: zero-side-effect tests. - [ ] Y5A.10.g Version/diff/review/approve/promote/deprecate/quarantine/rollback exact signed pipelines and preserve historical run bindings. Evidence: lifecycle tests. - [ ] Y5A.10.h Schedule one-time/recurring/event/dependency-triggered runs with timezone, capacity/reservation, priority/fairness, concurrency, embargo, and missed-run behavior. Evidence: schedule tests. - [ ] Y5A.10.i Allocate/enforce quota/budget/token/tool/compute/GPU/CPU/VRAM/ storage/egress/time per step/total with estimates, reservations, stops, and reconciliation. Evidence: resource tests. - [ ] Y5A.10.j Insert human-only review/approval/decision checkpoints with eligible roles/quorum/evidence/unchanged plan/expiry and no system actor completion. Evidence: checkpoint tests. - [ ] Y5A.10.k Execute bounded autonomous film pipelines for script/board/ asset/shot/render/edit/audio/localize/build outputs and game pipelines for design/asset/level/gameplay/NPC/build/test. Evidence: execution tests. - [ ] Y5A.10.l Implement pause/resume/redirect/cancel/abort/budget kill with safe boundaries/new plan revisions/provider propagation/late-result fencing/partial evidence. Evidence: command race tests. - [ ] Y5A.10.m Implement stage-scoped retry/new attempt and rollback/ compensation to prior admitted versions without rewriting runs or deleting outputs. Evidence: recovery tests. - [ ] Y5A.10.n Route every attributed output through integrity/technical/ safety/rights/canon/continuity/production verification and human accept/reject/revise before promotion. Evidence: output review tests. - [ ] Y5A.10.o Adversarially prove agents/flags/imports/API payloads cannot bypass code floors, reservations, checkpoints, verification, or human override. Evidence: authority boundary suite. - [ ] Y5A.11 Complete Blender, Godot, Unreal, Houdini, and DaVinci workflows through the canonical Bellona/public adapter boundaries, including host capability, project/asset handoff, command status, version compatibility, round-trip loss, and recovery. Evidence: no private bridge duplication in Yemaya Studio. - [ ] Y5A.11.a Define Yemaya-to-Bellona public handoff/session/command/artifact/ progress/error/capability/compatibility/loss/recovery contracts and ownership rules. Evidence: boundary schema. - [ ] Y5A.11.b Build host capability discovery for installed/connected host/ plugin/version/OS/features/commands/formats/targets and supported/ degraded/unavailable reasons. Evidence: capability tests. - [ ] Y5A.11.c Implement Blender project/scene/asset/geometry/material/rig/ animation/camera/render/export handoffs and status through Bellona. Evidence: Blender journey. - [ ] Y5A.11.d Implement Godot project/scene/resource/gameplay/build/import/ export handoffs and status through Bellona. Evidence: Godot journey. - [ ] Y5A.11.e Implement Unreal project/content/level/asset/sequence/gameplay/ build/import/export handoffs and status through Bellona. Evidence: Unreal journey. - [ ] Y5A.11.f Implement Houdini project/hip/network/asset/cache/simulation/ cook/export handoffs and status through Bellona. Evidence: Houdini journey. - [ ] Y5A.11.g Implement DaVinci project/timeline/media/color/audio/caption/ conform/render/interchange handoffs and status through Bellona. Evidence: DaVinci journey. - [ ] Y5A.11.h Preserve exact Yemaya project/entity/asset/shot/sequence/build context, revisions/hashes/units/axes/color/timebase/rights/provenance on outbound and returned artifacts. Evidence: lineage tests. - [ ] Y5A.11.i Present typed queued/running/progress/output/partial/cancelled/ failed/unknown command state, logs/receipts/cost and authorized cancel/ retry/replay without raw shell. Evidence: status tests. - [ ] Y5A.11.j Enforce host/plugin/server/adapter/project/format/feature version compatibility, migration window, and explicit unsupported behavior. Evidence: version matrix. - [ ] Y5A.11.k Compute/report semantic round-trip losses/substitutions for hierarchy/transforms/units/materials/rig/animation/camera/timeline/ metadata and require review. Evidence: loss tests. - [ ] Y5A.11.l Recover from disconnect/host crash/plugin restart/partial transfer/command timeout/artifact mismatch with reconciliation and no duplicate mutation. Evidence: recovery tests. - [ ] Y5A.11.m Add forbidden-import/IPC/API/schema checks proving no private bridge/session/command implementation in Yemaya. Evidence: ownership gate. - [ ] Y5A.12 Complete gameplay and NPC design for mechanics, rules, states, behaviors, dialogue, navigation, encounters, inventory/combat hooks, simulation, playtest, balance, safety, and engine export. Evidence: design-to-supported-engine bundles and deterministic simulation fixtures. - [ ] Y5A.12.a Define versioned gameplay project/system/mechanic/rule/state/ event/action/parameter/entity/component/behavior/encounter/test/export contracts and registries. Evidence: schemas. - [ ] Y5A.12.b Author mechanics with player/NPC actions, inputs, preconditions, effects, resources, feedback, failure/success, timing, tuning, objective, dependencies, and accessibility. Evidence: mechanic tests. - [ ] Y5A.12.c Author rule sets with typed conditions/effects/priorities/scope/ conflicts/invariants/cooldowns/probability/seed and no arbitrary code. Evidence: rule tests. - [ ] Y5A.12.d Author finite/hierarchical state machines and event flows with initial/final states, transitions/guards/effects, parallel regions, resets, cycle/dead/unreachable analysis. Evidence: state tests. - [ ] Y5A.12.e Author NPC identity/role/goals/personality/knowledge/memory/ perception/needs/emotion/relationship/consent/canon and gameplay links. Evidence: NPC tests. - [ ] Y5A.12.f Author behavior tree/utility/planner/task/condition/blackboard/ interrupt/fallback/timing/resource/safety contracts and accessible graph/table parity. Evidence: behavior tests. - [ ] Y5A.12.g Author branching dialogue with speaker/knowledge/relationship/ condition/choice/consequence/voice/localization/spoiler/canon and integrity constraints. Evidence: dialogue tests. - [ ] Y5A.12.h Author navigation spaces/agents/links/areas/costs/obstacles/ paths/avoidance/traversal/off-mesh/crowds and reachability validation. Evidence: navigation tests. - [ ] Y5A.12.i Author encounters with participants/waves/spawns/objectives/ triggers/space/resources/difficulty/rewards/fail/reset/pacing/safety and dependency state. Evidence: encounter tests. - [ ] Y5A.12.j Author inventory/item/equipment/crafting/economy and combat stats/actions/damage/status/targeting/AI/animation/VFX/audio hooks as typed public interfaces. Evidence: hook tests. - [ ] Y5A.12.k Build deterministic seeded headless simulation with exact design/runtime versions, scenarios/bots, progress/cancel/traces/metrics/ counterexamples and bounded resources. Evidence: simulation fixtures. - [ ] Y5A.12.l Build playtest config/build/participant/consent/telemetry/ feedback/replay/privacy linkage and compare synthetic versus human evidence. Evidence: playtest tests. - [ ] Y5A.12.m Build balance analysis for win/loss/time/resources/difficulty/ economy/encounter/NPC outcomes with uncertainty/cohort privacy and explainable human tuning decisions. Evidence: balance tests. - [ ] Y5A.12.n Run harmful mechanic/dark pattern/age/violence/chat/NPC manipulation/bias/accessibility/content safety and human review gates. Evidence: safety matrix. - [ ] Y5A.12.o Map canonical design to supported Godot/Unreal/other engine profiles through Bellona with stable IDs/versioned adapters/loss report/ import/read-back. Evidence: engine bundle suite. - [ ] Y5A.13 Complete virtual-production and XR project workflows for remote actor capture, stage/session planning, camera tracking, timecode/genlock, LED/ICVFX, spatial review, device/target profiles, recording, dailies, and Bellona handoff. Evidence: capability-gated host/device matrix. - [ ] Y5A.13.a Define VP/XR project/stage/session/device/performer/camera/ tracking/timebase/display/render/recording/artifact/profile/handoff contracts and ownership. Evidence: schemas. - [ ] Y5A.13.b Build remote actor invite/auth/consent/identity/voice-likeness/ device/network/calibration/rehearsal/capture/monitor/stop/revocation and Aja motion handoff. Evidence: remote capture tests. - [ ] Y5A.13.c Build stage/session plan for location/stage volume/date/time/ participants/crew/roles/shots/assets/sets/equipment/devices/safety/ permits/schedule/call sheet. Evidence: planning tests. - [ ] Y5A.13.d Build camera/lens/sensor/distortion/focus/pose/tracking system/ markers/origin/coordinate/units/calibration/quality/drift/redundancy/ recording. Evidence: camera tracking tests. - [ ] Y5A.13.e Build timecode/genlock/PTP/clock/source/rate/drop-frame/ synchronization/calibration/offset/drift/failover and per-device status. Evidence: sync tests. - [ ] Y5A.13.f Build LED/ICVFX wall/processor/panel/canvas/nDisplay or profile/ camera frustum/color pipeline/latency/genlock/content/lighting/heat/ safety configuration. Evidence: LED tests. - [ ] Y5A.13.g Build XR scene/space/anchor/scale/origin/tracking/input/ locomotion/interaction/passthrough/performance/comfort/accessibility/ safety authoring. Evidence: XR tests. - [ ] Y5A.13.h Build spatial review for synchronized multiuser scene/assets/ cameras/takes/annotations/measurements/versions with desktop/2D semantic alternative. Evidence: spatial review tests. - [ ] Y5A.13.i Define host/device/OS/runtime/plugin/firmware/model/capability/ input-output/latency/accuracy/profile/target support matrix and honest unavailable/degraded states. Evidence: capability tests. - [ ] Y5A.13.j Build multistream video/audio/motion/tracking/timecode/metadata/ camera/device recording with immutable take IDs/checksums/proxies/ dropped-frame status/consent. Evidence: recording tests. - [ ] Y5A.13.k Build take/dailies ingest/sync/playback/compare/notes/select/ reject/retake/promotion and exact stage/shot/performer/device lineage. Evidence: dailies tests. - [ ] Y5A.13.l Handoff stage/project/assets/cameras/tracks/takes/builds through Bellona public contracts and returned artifacts/status/loss/recovery; no duplicate bridge authority. Evidence: handoff tests. - [ ] Y5A.13.m Run capability-gated session from plan/calibrate/capture/review/ handoff/recovery across supported host/device cells. Evidence: matrix E2E. - [ ] Y5A.14 Complete unified search across projects, assets, scripts, shots, characters, worlds, locations, tasks, people, comments, jobs, plugins, models, and marketplace items with permission-safe facets/snippets. Evidence: protected, unreleased, and cross-tenant data cannot leak through counts, suggestions, or caches. - [ ] Y5A.14.a Define versioned searchable-kind registry and per-kind index document with canonical ID/revision/tenant/project/owner/status/locale/ classification/searchable/display-only/forbidden fields. Evidence: schemas. - [ ] Y5A.14.b Implement project/asset/script/shot/character/world/location/ task documents and entity-specific title/text/tags/relations/status/ rights/canon/production metadata. Evidence: content index tests. - [ ] Y5A.14.c Implement people/comment/job/plugin/model/marketplace documents with least privilege, no secrets/private prompt/spoiler/biometric/ billing/protected evidence. Evidence: platform index tests. - [ ] Y5A.14.d Build transactional/outbox-driven create/update/version/ permission/membership/publish/quarantine/archive/delete events with checkpoints/idempotency/order/rebuild reconciliation. Evidence: index lifecycle tests. - [ ] Y5A.14.e Implement text/exact/fuzzy/tag/entity/relation/reference search with allowlisted query grammar, stable ranking, locale analysis, typo/synonym rules, and version/source. Evidence: query tests. - [ ] Y5A.14.f Implement permission-safe kind/project/status/date/owner/tag/ asset type/production/marketplace/plugin/model facets and stable signed cursor pagination. Evidence: facet tests. - [ ] Y5A.14.g Generate snippets/highlights only from authorized fields after property checks and suppress spoiler/protected-source/solution/unreleased context. Evidence: snippet tests. - [ ] Y5A.14.h Generate autocomplete/typeahead/recent/popular/recommendations with authorization/privacy thresholds and no hidden-title/existence inference. Evidence: suggestion tests. - [ ] Y5A.14.i Apply current route/object/property/function authorization after every hit and before counts/facets/cache, not solely index ACL snapshots. Evidence: authorization tests. - [ ] Y5A.14.j Scope query/result/count/facet/suggestion caches by actor/ tenant/project/roles/permissions/locale/version and purge on access/ lifecycle changes. Evidence: cache tests. - [ ] Y5A.14.k Test colliding tenant/project/title/tag/ID/timestamps, guessed protected terms, membership revoke, stale index, timing/count/empty/ forbidden differences. Evidence: adversarial suite. - [ ] Y5A.14.l Load-test production-scale mixed kinds/facets/permissions/index lag/rebuild while meeting search SLO and no leakage. Evidence: performance report. - [ ] Y5A.15 Complete asset, plugin, workflow/template, and AI-model marketplace flows for submission, packaging, compatibility, security/license review, pricing/entitlement, install/update/remove, ratings/reporting, creator attribution/payout, deprecation, takedown, and project dependency impact. Evidence: marketplace content cannot bypass runtime or release policy. - [ ] Y5A.15.a Define marketplace enablement/audience/region/tenant/host and separate versioned item contracts for asset, plugin, pipeline/workflow/ template, and model/modifier with lifecycle. Evidence: schemas. - [ ] Y5A.15.b Build creator enrollment/identity/authority/tax/payout/terms/ rights/contact/security and organization/team publishing roles. Evidence: creator tests. - [ ] Y5A.15.c Build item/version submission with immutable source/artifact/ hash/dependencies/metadata/docs/examples/license/model card/provenance/ pricing/targets/creator attribution. Evidence: submission tests. - [ ] Y5A.15.d Build deterministic safe package/manifest/signature/checksum/ relative paths/permissions/entry points/dependency lock and independent unpack/install validation. Evidence: packaging tests. - [ ] Y5A.15.e Build per-host/version/profile/OS/runtime/engine/DCC/model/ workflow/asset/project-type input-output compatibility and declared loss/ unsupported cells. Evidence: matrix. - [ ] Y5A.15.f Quarantine and run malware/archive/path/serialization/code/ dependency/vulnerability/signature/sandbox/network/resource/security review by item type. Evidence: security tests. - [ ] Y5A.15.g Review source/ownership/license/rights/consent/training data/ attribution/territory/term/derivative/commercial/safety/quality/ accessibility and human approvals. Evidence: trust tests. - [ ] Y5A.15.h Build offers/prices/currencies/taxes/fees/promotions/refunds/ trials/seats/usage/region/term and server-side entitlement grant/check/ revoke. Evidence: commerce tests. - [ ] Y5A.15.i Build download/install with dependency/permission/impact/ confirmation, isolated staging, verification, lockfile, project linkage, and rollback. Evidence: install tests. - [ ] Y5A.15.j Build update/migration/change log/compatibility/project impact/ staged canary/backup/rollback and remove/disable constraints for active dependencies. Evidence: update/remove tests. - [ ] Y5A.15.k Build verified-purchase/use ratings/reviews, moderation, version relevance, anti-manipulation, replies, reporting/appeal and no secret/project leakage. Evidence: rating tests. - [ ] Y5A.15.l Preserve creator/item/version/source attribution through installation/use/derivative/generation/build/release and calculate royalty/fee/hold/refund/chargeback/payout ledger. Evidence: attribution/ payout tests. - [ ] Y5A.15.m Build deprecate/supersede/end-of-support/revoke/quarantine/ takedown/appeal/restore with consumer notices/download/entitlement/ project/build/runtime/cache/payout effects. Evidence: lifecycle tests. - [ ] Y5A.15.n Query exact project dependency/blast radius for item/version/ transitive dependencies and preview breakage/migration/rebuild/recall before mutation. Evidence: impact tests. - [ ] Y5A.15.o Revalidate marketplace item/license/entitlement/security/ compatibility at runtime/build/release and prohibit listing/review/ purchase from satisfying production gates. Evidence: boundary tests. - [ ] Y5A.15.p Run submission-to-review-to-purchase/install/use/build/release/ update/takedown/payout journey with cross-tenant/fraud/security failures. Evidence: E2E. - [ ] Y5A.16 Complete organization, team, user, RBAC, invitations, API keys, enterprise plan/entitlement, audit/compliance, analytics, webhook, and integration administration. Evidence: property-level authorization, separation of duties, billing/entitlement consistency, and audit export. - [ ] Y5A.16.a Define organization/workspace/team/user/membership/role/ permission/entitlement/key/webhook/integration/admin contracts and canonical ownership. Evidence: schemas. - [ ] Y5A.16.b Build organization create/profile/domains/regions/locale/ security/data/retention/billing owner/transfer/suspend/archive/delete with step-up and audit. Evidence: org tests. - [ ] Y5A.16.c Build hierarchical/static/dynamic project teams, membership/ manager/guest/service account/role inheritance and cycle/scope controls. Evidence: team tests. - [ ] Y5A.16.d Build user status/profile/contact/identity provider/MFA/device/ sessions/recovery/lock/suspend/delete/export with privacy/redaction. Evidence: user tests. - [ ] Y5A.16.e Build typed RBAC roles/permissions/resource/property/function/ conditions/deny/precedence/effective inspector/change preview/version/ assignment/revocation and code floors. Evidence: RBAC tests. - [ ] Y5A.16.f Build invite create/role/scope/expiry/domain/seat/send/resend/ accept/decline/revoke/conflict/duplicate/transfer and anti-enumeration. Evidence: invitation tests. - [ ] Y5A.16.g Build API key/service credential purpose/scope/project/ operations/network/expiry/create-once-secret/rotate/revoke/last-use/ anomaly and no UI/log secret. Evidence: key tests. - [ ] Y5A.16.h Build enterprise plan/seat/storage/compute/provider/feature/ support/region/marketplace limits and server-side effective entitlement from billing/contract/manual grant. Evidence: entitlement tests. - [ ] Y5A.16.i Reconcile subscription/invoice/payment/credit/refund/usage/ purchase/payout/plan changes to entitlements idempotently without access ambiguity. Evidence: billing consistency tests. - [ ] Y5A.16.j Build immutable audit for auth/admin/content/asset/job/spend/ marketplace/build/release/integration actions with protected fields, search/export/retention/tamper evidence. Evidence: audit tests. - [ ] Y5A.16.k Build compliance policy/control/evidence/request/attestation/ exception/retention/legal hold/export and framework mappings without self-certification. Evidence: compliance tests. - [ ] Y5A.16.l Build privacy-safe organization/project/usage/cost/performance/ collaboration/marketplace analytics with metric definitions/cohort thresholds/role filters and no worker surveillance. Evidence: analytics tests. - [ ] Y5A.16.m Build webhook endpoint/event filters/signing secret ref/ verification/retry/backoff/rate/dedup/order/dead letter/replay/log/ rotate/disable and payload redaction. Evidence: webhook tests. - [ ] Y5A.16.n Build approved integration install/config/OAuth/scopes/ mapping/sync/direction/status/log/revoke/data deletion through public adapters. Evidence: integration tests. - [ ] Y5A.16.o Enforce maker-checker/separation for ownership/security/RBAC/ billing/spend/key/compliance/export/kill actions and property-level auth throughout. Evidence: authority suite. - [ ] Y5A.16.p Export deterministic redacted signed audit/compliance/admin evidence and run organization lifecycle/tenant/billing/entitlement E2E. Evidence: audit export journey. - [ ] Y5A.17 Disposition community/showcase features explicitly: creator profile, publish/share, follow, comment, remix/fork, moderation, report, attribution, rights, privacy, and takedown if retained; otherwise define their separate host or retirement. Evidence: no orphan `community` capability or accidental publication path. - [ ] Y5A.17.a Inventory all community/showcase routes/components/APIs/stores/ events/jobs/packages/flags/navigation/consumers/tests and live/fixture state at atomic operation level. Evidence: inventory. - [ ] Y5A.17.b Decide retain-in-Yemaya, move-to-separate-host/service, retire, or explicitly defer per capability with audience/owner/data/authority/ migration/expiry. Evidence: decision record. - [ ] Y5A.17.c If retained, build creator profile identity/display/links/ portfolio/visibility/verification/block/mute/privacy and no private project leakage. Evidence: profile tests. - [ ] Y5A.17.d If retained, build explicit publish candidate/review/gates/ visibility/audience/license/embargo/share-link/revoke/read-back rather than making project/asset visibility publish. Evidence: publish tests. - [ ] Y5A.17.e If retained, build follow/unfollow/request/block/mute/feed/ notification/privacy/rate/anti-enumeration with no authority inheritance. Evidence: social graph tests. - [ ] Y5A.17.f If retained, build comments/replies/mentions/reactions/edit/ delete/report/moderation/notifications with audience/asset-version/ accessibility and abuse controls. Evidence: interaction tests. - [ ] Y5A.17.g If retained, build remix/fork eligibility/license/attribution/ source-version/copy scope/new project identity/rights/gates and source revocation effects. Evidence: remix tests. - [ ] Y5A.17.h If retained, build content/user moderation classifier/rule/ human queue/uncertainty/decision/appeal/sanction/audit without auto- publication or false accusation. Evidence: moderation tests. - [ ] Y5A.17.i If retained, build report type/subject/evidence/reporter safety/ triage/status/anti-abuse/privacy/escalation and no reporter authority. Evidence: report tests. - [ ] Y5A.17.j Preserve creator/source/project/asset/model/tool/version/ derivative attribution and license/consent/rights/territory/term/ disclosure through showcase/remix/download. Evidence: attribution tests. - [ ] Y5A.17.k Build privacy controls for profile/content/follow/interactions/ discoverability/search/counts/download/contact/minors/blocked users/ retention/deletion. Evidence: privacy tests. - [ ] Y5A.17.l Build takedown/quarantine/unpublish/appeal/restore with blast radius/caches/links/downloads/remixes/notifications/receipts/history. Evidence: takedown tests. - [ ] Y5A.17.m If moved, implement signed least-privilege publication/handoff/ return contracts and remove duplicate UI/data authority. Evidence: separate-host tests. - [ ] Y5A.17.n If retired, disable creation/discovery/mutation, migrate/export/ retain/delete data per policy, remove routes/flags/dependencies, and verify no accidental publication path. Evidence: retirement tests. - [ ] Y5A.17.o Add bidirectional inventory/route/dependency gate proving no orphan `community` capability or unreviewed live surface. Evidence: disposition gate. - [ ] Y5A.18 Complete developer surfaces for REST/WebSocket APIs, webhooks, CLI, TypeScript/Python/C++ SDKs, documentation playground, capability discovery, authentication, examples, rate limits, versioning, and deprecation. Evidence: generated contracts and end-to-end external-client conformance for every supported operation. - [ ] Y5A.18.a Inventory/version every supported external operation/resource/ event/stream/command, audience/scope, owner, route/protocol, stability, consumer, and evidence. Evidence: developer surface registry. - [ ] Y5A.18.b Generate/validate REST OpenAPI for auth/scopes, requests/ responses/errors, pagination/idempotency/concurrency, uploads/downloads, versions/units, examples, and redactions. Evidence: REST contracts. - [ ] Y5A.18.c Define WebSocket/SSE connection/auth/subscribe/filter/snapshot/ cursor/event/order/dedup/reconnect/backpressure/heartbeat/error/version/ close semantics. Evidence: realtime contracts. - [ ] Y5A.18.d Implement webhook event catalog/payload/version/signature/ rotation/replay/retry/order/dedup/rate/redaction/test/reconciliation semantics. Evidence: webhook contracts. - [ ] Y5A.18.e Build CLI config/profile/auth/project context, typed commands, input/output formats, interactive/noninteractive, dry run/confirm, progress/cancel, exit codes, version update, and no secret logs. Evidence: CLI tests. - [ ] Y5A.18.f Generate TypeScript SDK models/clients/pagination/streams/ uploads/errors/retries/idempotency/examples and package/version/browser- Node compatibility. Evidence: TS conformance. - [ ] Y5A.18.g Generate Python SDK sync/async models/clients/iterators/streams/ uploads/errors/retries/idempotency/examples and supported runtime versions. Evidence: Python conformance. - [ ] Y5A.18.h Generate C++ SDK typed models/client/auth/async/callback/ streaming/binary transfer/errors/cancellation/build systems/platform ABI support. Evidence: C++ conformance. - [ ] Y5A.18.i Build documentation from canonical contracts with operation/ concepts/auth/permissions/lifecycle/failure/limits/version/migration/ security guides and runnable examples. Evidence: doc drift tests. - [ ] Y5A.18.j Build isolated playground using synthetic/sandbox tenant and bounded scoped credentials, editable requests, response/event inspector, rate/cost warning, reset, and no production secret/data access. Evidence: playground tests. - [ ] Y5A.18.k Build audience/authenticated capability discovery for operations/ asset kinds/hosts/providers/targets/limits/versions/degraded states without hidden feature/provider leakage. Evidence: capability tests. - [ ] Y5A.18.l Implement OAuth/API key/service identity/session/device flows, scopes/project/tenant/resource/property authorization, rotation/revoke/ expiry, and step-up for dangerous actions. Evidence: auth suite. - [ ] Y5A.18.m Enforce request/data/compute/cost/concurrency/stream/webhook limits with headers/retry/reset, tenant fairness, and no bypass through batch/SDK/alternate protocol. Evidence: rate-limit tests. - [ ] Y5A.18.n Define URL/schema/event/SDK semantic versioning, compatibility windows/negotiation, additive/breaking policy, changelog, migration, and consumer testing. Evidence: version matrix. - [ ] Y5A.18.o Define deprecation announce/headers/docs/telemetry/owner/ replacement/sunset/block/exception and remove only after consumer gate. Evidence: deprecation tests. - [ ] Y5A.18.p Run generated contract tests and real external TS/Python/C++/ CLI/webhook/realtime journeys for every supported operation; fail untested cells. Evidence: conformance matrix. - [ ] Y5A.19 Complete production safety for prompts/media, model/provider use, consent/likeness, rights, content classification, age rating, moderation, project policy, incident quarantine, recall, and audit across every AAA lane. Evidence: a feature-specific policy matrix; generic upload moderation is not accepted as proof. - [ ] Y5A.19.a Enumerate every AAA feature/lane/input/output/action/asset kind/ host/audience/target/provider and map applicable safety controls, owners, stages, and proof. Evidence: policy matrix. - [ ] Y5A.19.b Validate prompt/brief/reference/retrieved/imported content for injection, disallowed intent, identity/spoiler/protected-source leakage, unsafe tools, and policy before planning. Evidence: prompt tests. - [ ] Y5A.19.c Moderate generated/uploaded/captured/edited image/video/audio/ voice/3D/text/code/project/package metadata at ingest, preview, promotion, build, release with uncertainty. Evidence: media tests. - [ ] Y5A.19.d Admit models/providers/endpoints/workflows/nodes/adapters only with identity/version/hash/license/training provenance/security/ evaluation/data-use/residency/target approval and revalidate. Evidence: model/provider tests. - [ ] Y5A.19.e Enforce subject/performer/actor/voice/face/likeness/biometric/ capture consent with scope/purpose/use/territory/term/disclosure/ revocation at every derivative/use/release. Evidence: consent tests. - [ ] Y5A.19.f Enforce asset/source/music/script/reference/model/license/ ownership/use/adaptation/training/commercial/distribution/attribution/ territory/term/embargo rights. Evidence: rights tests. - [ ] Y5A.19.g Classify content by violence/sexual/hate/self-harm/child/ substances/language/fear/gambling/user interaction/context/intensity and preserve raw evidence. Evidence: classification tests. - [ ] Y5A.19.h Map platform/region/audience/project type/content/interactivity to age-rating descriptors/evidence/reviewer/label/target requirements. Evidence: rating matrix. - [ ] Y5A.19.i Build input/output/project/user/marketplace/community moderation rules/classifiers/human queue/decisions/appeals/uncertainty/ anti-bias/privacy and no automatic accusation. Evidence: moderation tests. - [ ] Y5A.19.j Build platform/region/organization/project/profile/campaign typed policy overlays that only tighten code floors, with effective preview/version/approval/freshness. Evidence: policy property tests. - [ ] Y5A.19.k Apply safety checks at feature-specific typed context points for writing, boards, design, gameplay/NPC, VP/XR/capture, DCC/engine, rendering/post, collaboration, agents, marketplace/community, developer/export/release. Evidence: lane coverage tests. - [ ] Y5A.19.l Create incident case/scope/severity/evidence/authority and quarantine affected model/provider/workflow/source/asset/project/build/ marketplace/release from new use. Evidence: quarantine tests. - [ ] Y5A.19.m Compute blast radius and recall/unpublish/disable downstream projects/assets/derivatives/builds/gallery/marketplace/community/ external targets/caches/links with receipts. Evidence: recall tests. - [ ] Y5A.19.n Persist immutable decision/override/exception/scan/model/policy/ action/notification/verification audit with protected-field controls and nonwaivable floors. Evidence: audit tests. - [ ] Y5A.19.o Build feature-specific calibrated/adversarial fixtures and fail every matrix cell relying only on generic upload moderation. Evidence: safety coverage gate. - [ ] Y5A.20 Complete animation learning and motion authoring for references, timing/exposure charts, poses/keyframes, arcs/spacing, cleanup, retiming, camera, performance notes, motion assets, Aja capture/retarget handoff, preview/onion-skin or semantic equivalent, critique, versioning, and export. Evidence: reference→motion→approved shot lineage and accessible timing/curve alternatives. - [ ] Y5A.20.a Define animation project/sequence/shot/character/rig/control/ clip/layer/pose/key/curve/annotation/reference/motion asset/version/ target contracts and units/timebases. Evidence: schemas. - [ ] Y5A.20.b Build reference ingest/record/link/trim/sync/loop/annotation/ rights/consent/source/performer/camera/timecode and side-by-side study. Evidence: reference tests. - [ ] Y5A.20.c Build exposure/timing sheet with frame/timecode/beat/phoneme/ action/pose/dialogue/audio/camera tracks, holds/inbetweens/accents/ breakdowns, versions, and list/table parity. Evidence: timing tests. - [ ] Y5A.20.d Build pose/keyframe authoring for rig/control/body/face/hands/ props/contacts/constraints/space/IK-FK/keys/interpolation/tangents with stable identities. Evidence: keyframe tests. - [ ] Y5A.20.e Build motion path/arcs/spacing/velocity/acceleration/easing/ silhouette/line-of-action/weight/balance/contact trajectory visualization and measurable diagnostics. Evidence: arc/spacing tests. - [ ] Y5A.20.f Build cleanup for curve noise/key reduction/tangent/foot slide/ penetrations/jitter/pops/constraints/contacts/rig errors as reversible layers with before-after. Evidence: cleanup tests. - [ ] Y5A.20.g Build retiming/ripple/stretch/compress/hold/ramp/offset/loop/ frame-rate conversion/audio sync with key/event/annotation/shot impact preview. Evidence: retime tests. - [ ] Y5A.20.h Build camera shot/lens/framing/pose/path/focus/shake/cut/ continuity/constraints and motion-camera/Bellona engine-DCC handoffs. Evidence: camera tests. - [ ] Y5A.20.i Build performance notes with character/shot/frame-range/body/ facial/voice/emotion/intent/reference anchors, assignments/resolution, and actor/consent privacy. Evidence: note tests. - [ ] Y5A.20.j Build motion asset clip/take/rig/skeleton/source/performer/ consent/units/rate/root motion/contacts/tags/versions/gates/library/ promotion. Evidence: motion asset tests. - [ ] Y5A.20.k Handoff capture/calibration/solve/clean/retarget jobs to Aja public contracts with exact project/performer/rig/shot context, progress, returned lineage, and no duplicate motion pipeline. Evidence: Aja tests. - [ ] Y5A.20.l Build retarget source-target skeleton/rig/map/rest pose/scale/ root/IK/contacts/rules/version/preview/loss/validation and acceptance. Evidence: retarget tests. - [ ] Y5A.20.m Build synchronized playback/scrub/loop/speed/onion skin/ghost/ trajectory/curve/dope sheet/reference/audio/camera overlays plus semantic timing/key/curve/path tables/forms. Evidence: preview/accessibility tests. - [ ] Y5A.20.n Build rule/model/human critique for timing/arcs/spacing/contact/ continuity/anatomy/weight/performance/camera/technical quality with exact regions/uncertainty/decisions. Evidence: critique tests. - [ ] Y5A.20.o Implement immutable versions/layers/diff/branch/merge/restore/ compare/approval and downstream shot/render/build invalidation. Evidence: version tests. - [ ] Y5A.20.p Export ratified animation/motion formats through Bellona with skeleton/rig/keys/curves/events/camera/units/timebase/materials/ metadata/rights/provenance/loss/read-back. Evidence: export tests. - [ ] Y5A.20.q Run reference→timing→keys→Aja capture/retarget→cleanup/ critique→approved shot→engine/DCC export journey with accessible alternatives. Evidence: E2E. ### Y6 — Persistence, APIs, desktop security, and collaboration - [ ] Y6.1 Decide authoritative stores for projects, study content, cases, canon, assets, reviews, playtests, and releases. Evidence: ownership ADR. - [x] Y6.1.a Inventory existing databases/schemas/tables/blobs/indexes/caches/ repositories/services/events/backups/production data per aggregate. Evidence: storage inventory. - [ ] Y6.1.b Assign exactly one mutation owner/store and identity/version/ tenant/transaction/retention/security requirements for each named aggregate. Evidence: ownership matrix. - [ ] Y6.1.c Distinguish canonical records from blobs, derived read/search/ consumer projections, caches, audit/outbox, analytics, and desktop local working copies. Evidence: data-flow map. - [ ] Y6.1.d Resolve cross-store links/events/consistency/failure/recovery/ deletion/legal hold/backup and prohibit distributed shadow writes. Evidence: consistency design. - [ ] Y6.1.e Ratify owner/store/migration/operational owner/rejected alternative ADR and add schema/import ownership checks. Evidence: approved ADR. - [ ] Y6.2 Add missing explicit-column schemas and safe migrations. Evidence: production-size rehearsal. - [ ] Y6.2.a Diff ratified contracts against owner schemas and classify reusable fields versus genuine missing tables/columns/constraints/ indexes. Evidence: gap report. - [ ] Y6.2.b Separate tenant/identity/state/version/owner/time/lock/freshness/ classification/query-critical columns from immutable typed content payloads. Evidence: schema design. - [ ] Y6.2.c Add expand migrations and backward-compatible read/write/ conversion code without destructive rename/drop/default ambiguity. Evidence: expand tests. - [ ] Y6.2.d Backfill resumably in bounded tenant-safe batches with checkpoints, errors/quarantine, throttling, and observable progress. Evidence: backfill tests. - [ ] Y6.2.e Verify counts/FK/unique/check/null/hash/semantic/read/query-plan/ divergence invariants before cutover. Evidence: verification report. - [ ] Y6.2.f Cut over reversibly, monitor, then contract after rollback window/ consumer inventory; rehearse at production scale/locks/resources. Evidence: migration rehearsal. - [ ] Y6.3 Implement durable stores with optimistic concurrency and tombstones. Evidence: real-database tests. - [ ] Y6.3.a Define store interfaces/transactions for exact aggregate/revision/ relation/read/list/transition/restore operations and authorization context. Evidence: repository contracts. - [ ] Y6.3.b Persist immutable revisions, operational projection, audit, and outbox atomically before acknowledge with tenant-scoped constraints. Evidence: transaction tests. - [ ] Y6.3.c Enforce expected revision/ETag/lease/fencing and return safe conflicts; prohibit last-write-wins or stale worker commits. Evidence: concurrency tests. - [ ] Y6.3.d Represent delete/archive/unlink through typed tombstone with actor/reason/time/prior revision/retention/restore scope rather than dangling hard delete. Evidence: tombstone tests. - [ ] Y6.3.e Make reads/relations/search/events respect tombstone visibility and restore as new revision without resurrecting invalid dependencies. Evidence: lifecycle tests. - [ ] Y6.3.f Test real database restart/deadlock/duplicate/retry/branch/merge/ retention/two-tenant/production-size paths. Evidence: integration suite. - [ ] Y6.4 Implement authoring APIs through versioned public contracts. Evidence: web/desktop consumer-driven contracts. - [ ] Y6.4.a Inventory every project/study/case/canon/source/asset/review/ playtest/build/release operation and canonical command/query/event/ stream contracts. Evidence: API inventory. - [ ] Y6.4.b Implement versioned list/detail/create-revision/transition/ relationship/comment/review/job/import-export operations with stable errors. Evidence: API tests. - [ ] Y6.4.c Enforce route/function/object/property/tenant/project/spoiler/ protected-source authorization, idempotency, optimistic concurrency, pagination, rate/budget. Evidence: security tests. - [ ] Y6.4.d Generate OpenAPI/realtime/IPC-facing shared schemas with versions/ units/discriminators/absence-redaction and no renderer-local shapes. Evidence: contract generation. - [ ] Y6.4.e Verify web and desktop consumers for success/empty/stale/conflict/ offline/degraded/not-configured/forbidden/failure/version skew. Evidence: consumer-driven suite. - [ ] Y6.5 Implement compiler/verifier/eval/canon jobs as durable work. Evidence: retry, cancellation, lease-loss, and stale-input tests. - [ ] Y6.5.a Define job/plan/stage/DAG/attempt/lease/checkpoint/input/output/ progress/error/cost/event contracts and separate compiler/verifier/eval/ canon operation schemas. Evidence: job schemas. - [ ] Y6.5.b Create idempotently with exact immutable project/case/study/ source/canon/policy/tool versions and transaction-bound audit/outbox. Evidence: submission tests. - [ ] Y6.5.c Claim with fenced lease/heartbeat/expiry/CAS and checkpoint only validated stage artifacts/hashes/consumed versions. Evidence: worker tests. - [ ] Y6.5.d Retry only explicit idempotent eligible stage/new attempt with limits/backoff; resume only supported checkpoints. Evidence: retry tests. - [ ] Y6.5.e Cancel queued/running/provider work with late-result fencing, resource cleanup, partial evidence and explicit outcome. Evidence: cancellation tests. - [ ] Y6.5.f Detect lease loss/split brain/worker restart/out-of-order callbacks and prevent stale commits/duplicate assets/cost. Evidence: race tests. - [ ] Y6.5.g Revalidate input/canon/source/policy/tool/dependency freshness before stage/commit and reject stale results. Evidence: stale-input tests. - [ ] Y6.6 Implement permission-aware search across study and case content. Evidence: spoiler/protected-source leak tests. - [ ] Y6.6.a Define per-kind index documents/fields/classification for study sources/notes/materials/concepts and case entities/scenes/dialogue/clues/ canon/assets with exact revisions. Evidence: schemas. - [ ] Y6.6.b Build outbox-driven version/tombstone/permission/reveal/ retraction/publication indexing and reconciliation. Evidence: lifecycle tests. - [ ] Y6.6.c Implement allowlisted query/filter/facet/sort/snippet/suggestion/ cursor operations with locale analysis and current object/property authorization. Evidence: query tests. - [ ] Y6.6.d Exclude/redact protected source/solution/secret/reveal/future clue/ unpublished/canon dispute/playtest participant fields from indexes, counts, snippets, suggestions, caches, logs. Evidence: leak tests. - [ ] Y6.6.e Test actor reveal progression/role change/project switch/offline cache/stale index/colliding tenants/timing/count inference. Evidence: adversarial suite. - [ ] Y6.7 Harden desktop IPC with an allowlisted, versioned, validated command surface. Evidence: arbitrary channel/message tests fail. - [x] Y6.7.a Inventory every renderer-preload-main/worker/native IPC channel/ direction/message/handler/privilege/caller and eliminate unregistered channels. Evidence: IPC registry. - [ ] Y6.7.b Expose context-isolated preload API with stable versioned typed command/query/event capabilities and no raw ipcRenderer/Node/Electron objects. Evidence: preload tests. - [ ] Y6.7.c Validate channel/version/schema/size/depth/count/unknown fields, origin/window/webContents/session, actor/project/capability/permission at main process. Evidence: validation tests. - [ ] Y6.7.d Define structured errors/timeouts/cancellation/idempotency/ concurrency/progress/event unsubscribe and protect secrets/paths. Evidence: protocol tests. - [ ] Y6.7.e Sandbox navigation/window creation/webviews/devtools/clipboard/ shell/external URL/file/device/native modules according to policy. Evidence: Electron security tests. - [ ] Y6.7.f Fuzz arbitrary/unknown/nested/alias/mass-assignment/oversize/ prototype/serialized object/replay/cross-window messages. Evidence: negative suite. - [ ] Y6.8 Harden local file access with user grants, canonical paths, safe archives, symlink controls, and scoped bookmarks. Evidence: malicious filesystem corpus. - [ ] Y6.8.a Define typed open/save/import/export/project/cache/temp operation, allowed file/dir/profile, user gesture, purpose, read/write/create/ overwrite/delete scope, and lifecycle. Evidence: file contract. - [ ] Y6.8.b Obtain OS picker/grant/bookmark/token with opaque reference, project/actor/device binding, expiry/revocation and never trust renderer raw path. Evidence: grant tests. - [ ] Y6.8.c Canonicalize existing/nonexisting path parent, normalize Unicode/ case/separators, enforce allowlisted roots/extensions, and reject traversal/absolute/device/network/ADS/special paths. Evidence: path corpus. - [ ] Y6.8.d Resolve/check every path component and reject symlink/junction/ hardlink/alias/mount/race escape using safe open semantics. Evidence: link/TOCTOU tests. - [ ] Y6.8.e Parse archives with entry/count/depth/size/ratio/path/symlink/ duplicate/case collision/encryption/hidden/executable protections into temp quarantine. Evidence: archive tests. - [ ] Y6.8.f Implement atomic save/rename/fsync/backup/overwrite confirmation/ partial cleanup and hash/read-back. Evidence: write tests. - [ ] Y6.8.g Store scoped bookmarks/recents/local project grants securely, reauthorize on use, revoke/logout/device-loss cleanup, and redact logs. Evidence: bookmark tests. - [ ] Y6.9 Harden protocol/deep-link handlers against command injection and cross-tenant replay. Evidence: negative suite. - [ ] Y6.9.a Define allowlisted custom/HTTPS link schemes, hosts/routes/intents, canonical grammar, minimal signed claims, max sizes, and version. Evidence: link registry. - [ ] Y6.9.b Parse without shell/interpolation, reject credentials/fragments/ unknown params/duplicate keys/control chars/Unicode confusables/encoded traversal/nested URLs. Evidence: parser tests. - [ ] Y6.9.c Validate signature/key/issuer/audience/intent/tenant/project/ subject/version/expiry/not-before/nonce/replay/host-instance before navigation/action. Evidence: validation tests. - [ ] Y6.9.d Reauthenticate/reauthorize current actor/object/property/function and require confirmation/step-up for allowed mutations; links never carry commands/scripts/paths/secrets. Evidence: authority tests. - [ ] Y6.9.e Handle single-instance startup/queued links/login continuation/ window focus/concurrent links/expired/deleted objects safely. Evidence: lifecycle tests. - [ ] Y6.9.f Test shell metacharacters/URL injection/open redirect/replay/ tenant substitution/role revoke/old links/offline cache. Evidence: negative suite. - [ ] Y6.10 Harden updater, signing, and version rollback. Evidence: signature, channel, expiry, downgrade, and interrupted-update tests. - [ ] Y6.10.a Define signed update manifest/artifact/delta/full package with product/platform/arch/channel/version/min OS/server/schema/published/ expiry/hash/size/URL/release notes/rollback rules. Evidence: schema. - [ ] Y6.10.b Verify HTTPS pinned/allowlisted source, manifest/artifact hash/ signature/certificate/status/timestamp/key rotation/revocation before staging. Evidence: signing tests. - [ ] Y6.10.c Enforce stable/beta/internal channel authorization and prevent cross-channel injection, expired/future/stale manifests, mirror/ redirect/DNS abuse. Evidence: channel tests. - [ ] Y6.10.d Enforce monotonic upgrade and explicit authorized compatible rollback; block version/schema/security downgrade and replay. Evidence: downgrade tests. - [ ] Y6.10.e Download resumably with size/disk/resource limits, verify, stage atomically, quiesce jobs/files/locks, migrate, restart, and health check. Evidence: update tests. - [ ] Y6.10.f Recover from network/disk/power/process/signature/install/ migration/health failure to previous intact version/data with audit. Evidence: interrupted-update tests. - [ ] Y6.10.g Test old/new app-server-protocol-project compatibility and forced security update/offline behavior. Evidence: compatibility suite. - [ ] Y6.11 Implement presence and collaboration across web and desktop. Evidence: reconnect, stale presence, and conflict journey. - [ ] Y6.11.a Use the shared collaboration protocol/CRDT/session/auth/version contracts through web transport and desktop adapter without forked semantics. Evidence: parity tests. - [ ] Y6.11.b Implement permission/spoiler-filtered presence/heartbeat/expiry/ participant/tool/viewport and stable cursor/selection awareness across content/graph/timeline/media. Evidence: presence tests. - [ ] Y6.11.c Implement durable CRDT operations/snapshots/compaction/offline/ schema migration with convergence and semantic conflict escalation. Evidence: sync tests. - [ ] Y6.11.d Reconnect from vector/cursor/snapshot with auth refresh/dedup/ gap/order/role revoke/project lock and no duplicate edits. Evidence: reconnect tests. - [ ] Y6.11.e Mark/remove stale presence promptly without deleting edits or treating disconnect as lock release/approval/cancel. Evidence: stale tests. - [ ] Y6.11.f Run mixed web/desktop/version/partition/offline/conflict/ cross-project/accessibility journey. Evidence: E2E. - [ ] Y6.12 Implement anchored comments/suggestions on all stable anchor kinds. Evidence: anchor survival and orphan workflow. - [ ] Y6.12.a Define comment/thread/reply/suggestion/decision identity, exact subject revision/typed anchor/author/visibility/status/mentions/ attachments/time. Evidence: schema. - [ ] Y6.12.b Support source/page/text, study/tree/concept, case/entity/scene/ dialogue/clue/timeline/graph, asset/object/region/frame/timecode/shot/ curve anchors. Evidence: kind matrix. - [ ] Y6.12.c Implement create/reply/edit/suggest/accept/reject/resolve/reopen/ assign/mention/navigate with object/property/spoiler permissions and immutable history. Evidence: interaction tests. - [ ] Y6.12.d Map anchors on revision as exact/shifted/ambiguous/orphaned/ invalid and preserve original context/hash plus reattach/dismiss workflow. Evidence: survival tests. - [ ] Y6.12.e Ensure suggestion acceptance creates a new authored revision and comments cannot approve/canonize/publish/change production state. Evidence: authority tests. - [ ] Y6.12.f Provide synchronized accessible comment/anchor list and test all kinds through web/desktop/offline/merge/locale changes. Evidence: E2E. - [ ] Y6.13 Implement review assignments, quorum, conflicts, escalation, and notifications. Evidence: role-policy tests. - [ ] Y6.13.a Define review template/dimension/assignment/reviewer qualification/ locale/role/quorum/sequence/deadline/decision/freshness contracts. Evidence: schemas. - [ ] Y6.13.b Assign eligible reviewers by project/track/content/gate/risk/ locale/skills/workload/availability with conflict/delegation/substitute rules. Evidence: assignment tests. - [ ] Y6.13.c Calculate quorum from independent eligible fresh decisions per dimension; handle reject/request-changes/abstain/timeout/reassignment. Evidence: quorum tests. - [ ] Y6.13.d Capture conflict-of-interest declaration/detected conflicts/ recusal/mitigation/reviewer privacy and block incompatible signoff. Evidence: conflict tests. - [ ] Y6.13.e Compute SLA/business-calendar/quiet-hours/breach and escalate to owner/substitute/on-call without changing decision authority. Evidence: escalation tests. - [ ] Y6.13.f Send localized role-filtered in-app/email/webhook notifications with idempotency/preferences/urgent override/ack/redaction. Evidence: notification tests. - [ ] Y6.13.g Test exact subject/evidence change invalidation, system actor refusal, stale role, two-tenant, and time zones. Evidence: role-policy suite. - [ ] Y6.14 Implement two-tenant/project isolation across APIs, search, blobs, jobs, desktop cache, playtests, and export. Evidence: integration suite. - [ ] Y6.14.a Seed two tenants/projects with colliding names/IDs-like slugs/ tags/files/times/entities/assets/canon/solutions/actors/roles and separate keys/policies. Evidence: fixture. - [ ] Y6.14.b Exercise every API/IPC/deep-link/object/property/function/ membership/role/guest path using foreign IDs/cursors/idempotency keys. Evidence: API tests. - [ ] Y6.14.c Exercise search/facets/counts/snippets/suggestions/caches/index lag and spoiler/protected-source/solution terms. Evidence: search tests. - [ ] Y6.14.d Exercise blob/original/proxy/rendition/package/signed URL/hash/ dedupe/cache/temp/local desktop files/bookmarks/offline data. Evidence: storage/cache tests. - [ ] Y6.14.e Exercise queues/jobs/events/progress/cancel/retry/callback/ provider/tool/worker/log/trace/cost and project switching. Evidence: job tests. - [ ] Y6.14.f Exercise playtest participant/config/build/session/telemetry/ replay/feedback/consent/retention and reveal state. Evidence: playtest tests. - [ ] Y6.14.g Exercise project/study/case/asset/audit/standards/marketplace/ evidence/export/package/download/notifications. Evidence: export tests. - [ ] Y6.14.h Inspect UI/error/timing/count/existence/client state/service worker/clipboard/recent/app updater channels for leakage. Evidence: integration suite. ### Y7 — Review, compilation, localization, publication, and catalog - [ ] Y7.1 Define review templates for study content and cases. Evidence: source grounding, canon, solvability, safety, accessibility, rights, localization, and producer roles are explicit. - [ ] Y7.1.a Define versioned template identity/track/profile/risk/locale/target applicability, dimensions/checklists/evidence/roles/quorum/order/ deadlines/expiry/floors. Evidence: schema. - [ ] Y7.1.b Define study source authority/currency/grounding/citation/ structure/order/accessibility/rights/localization/consumer/producer review criteria. Evidence: study matrix. - [ ] Y7.1.c Define case canon/continuity/solvability/uniqueness/fairness/ safety/age/accessibility/rights/localization/assets/engine/producer criteria. Evidence: case matrix. - [ ] Y7.1.d Resolve qualified SME/researcher/canon/solver/safety/accessibility/ legal/localization/producer/publisher roles with separation/conflicts/ quorum. Evidence: role tests. - [ ] Y7.1.e Bind decisions to exact candidate/evidence/template versions and invalidate affected signoffs on changes. Evidence: freshness tests. - [ ] Y7.1.f Prove project/season/tenant overlays can add/tighten but never remove code-required dimensions/roles. Evidence: property tests. - [ ] Y7.2 Build the unified review inbox with track-specific saved views. Evidence: assignment, SLA, gate, and role filters. - [ ] Y7.2.a Define permission/spoiler-filtered queue item projection for exact candidate/project/track/revision/template/gates/assignment/deadline/ priority/state. Evidence: contract. - [ ] Y7.2.b Build deterministic filters/facets/sort/pagination for track/ profile/content kind/role/assignee/SLA/status/gate/risk/locale/release. Evidence: query tests. - [ ] Y7.2.c Build personal/team/track study/case/canon/solver/localization/ production/release saved views with versioned query/columns/order/share/ default. Evidence: saved-view tests. - [ ] Y7.2.d Build claim/reassign/decline/recuse/request info/open subject/ review action with expected version, workload/conflict/permission/audit. Evidence: action tests. - [ ] Y7.2.e Present loading/empty/stale/blocked/overdue/degraded/offline/ unauthorized without title/spoiler/count leakage. Evidence: state tests. - [ ] Y7.2.f Verify keyboard/screen-reader/responsive/live-update/large queue/ two-tenant journey. Evidence: Playwright. - [ ] Y7.3 Lock review candidates to exact content, canon, source, asset, evaluator, and policy versions. Evidence: dependency change invalidates signoff. - [ ] Y7.3.a Define candidate manifest containing exact project/content/tree/ graph/timeline/case/solution/locale/build schema revisions and hashes. Evidence: manifest schema. - [ ] Y7.3.b Include exact canon assertions/namespaces/decisions, sources/ extractions/claims/citations/rights, assets/renditions/provenance/ continuity revisions. Evidence: dependency manifest tests. - [ ] Y7.3.c Include exact solver/compiler/engine/evaluator/model/corpus/ config/gate/policy/threshold/profile versions and results. Evidence: evidence binding tests. - [ ] Y7.3.d Canonicalize/hash/lock manifest and bind assignment/comments/ decisions/quorum/approvals/exception to digest. Evidence: lock tests. - [ ] Y7.3.e Rehash/revalidate on decision/compile/publish and mark approvals stale on any bound dependency/status/rights/policy change. Evidence: invalidation tests. - [ ] Y7.3.f Route changes to new candidate/revision and retain historical locked candidates/signoffs. Evidence: immutability tests. - [ ] Y7.4 Compile study read models from approved authoring revisions. Evidence: deterministic golden bundle. - [ ] Y7.4.a Resolve exact approved study candidate/hierarchy/materials/ sources/concepts/order/activities/assets/locales/accessibility/target and reject missing/stale dependencies. Evidence: input tests. - [ ] Y7.4.b Normalize/validate content blocks, stable IDs/links/anchors/ citations/rights, reading order/prerequisites, locale fallback, and consumer capabilities. Evidence: compile tests. - [ ] Y7.4.c Derive navigation/content/search/concept/glossary/activity/media/ accessibility/provenance models and exclude author/review/protected fields. Evidence: projection goldens. - [ ] Y7.4.d Serialize deterministic manifest/files/order/numbers/Unicode/ timestamps/config with compiler/version/input hashes. Evidence: determinism tests. - [ ] Y7.4.e Validate bundle schema/links/hashes/rights/gates and rebuild/read through consumer workspace. Evidence: golden/read-back tests. - [ ] Y7.5 Compile case bundles through the real case compiler and pipeline. Evidence: deterministic golden case. - [ ] Y7.5.a Resolve exact approved locked case/premise/entities/canon/source/ scenes/dialogue/timeline/clues/solution/branch/state/assets/locales/ profile/target. Evidence: input tests. - [ ] Y7.5.b Invoke canonical real case compiler through public contract with pinned version/config, durable job/checkpoints/progress/cancel/errors and no workbench substitute. Evidence: integration tests. - [ ] Y7.5.c Compile stable runtime world/entity/scene/dialogue/timeline/clue/ state/branch/rule/hint/save/ending models and spoiler partitions. Evidence: compiler goldens. - [ ] Y7.5.d Run canonical production pipeline for assets/renditions/ localization/accessibility/runtime/package/provenance with exact dependencies. Evidence: pipeline tests. - [ ] Y7.5.e Serialize deterministic bundle/manifest/hashes/order/IDs/config/ tool versions and validate through real engine loader. Evidence: golden case/read-back. - [ ] Y7.6 Validate case bundles with engine, solver, canon, localization, asset, and schema gates. Evidence: broken-bundle corpus. - [ ] Y7.6.a Validate bundle/manifest/schema/version/files/hashes/refs/IDs/ types/cardinality/size/resource/safe package and runtime compatibility. Evidence: schema fixtures. - [ ] Y7.6.b Load/run with real hermetic engine for init/navigation/state/ branches/clues/dialogue/save/load/reset/ending/error/performance and no protected partition leak. Evidence: engine fixtures. - [ ] Y7.6.c Run solver reachability/existence/uniqueness/alternative/fair timing/dead-end/soft-lock/timeline traces on compiled bundle, not source alone. Evidence: solver fixtures. - [ ] Y7.6.d Validate canon entity/assertion/namespace/temporal/knowledge/ continuity and exact compiled-to-authoring mapping. Evidence: canon fixtures. - [ ] Y7.6.e Validate every locale’s structure/IDs/branches/clues/solution/ timing/text/assets/accessibility/spoiler partitions and fallback. Evidence: locale fixtures. - [ ] Y7.6.f Validate every asset/rendition/dependency/hash/format/target/ technical/right/consent/provenance/gate and no quarantined inputs. Evidence: asset fixtures. - [ ] Y7.6.g Preserve raw results separately, require all mandatory gates, and maintain broken-bundle corpus for each failure family. Evidence: coverage gate. - [ ] Y7.7 Build localization packages with spoiler segmentation and role restrictions. Evidence: translators see only authorized context. - [ ] Y7.7.a Define locale package/job/unit/segment/source-target/revision/ role/spoiler tier/context/asset/status/manifest contracts. Evidence: schemas. - [ ] Y7.7.b Segment study/case text/metadata/dialogue/clues/hints/reveals/ solution/UI/assets by stable ID, required context, translation memory/ glossary, and spoiler boundary. Evidence: segmentation tests. - [ ] Y7.7.c Generate minimal role/assignment/locale/segment-scoped package with only authorized context/source/canon/character/timing/asset references, pseudonyms where needed. Evidence: minimization tests. - [ ] Y7.7.d Encrypt/sign/hash/package, issue expiring access, disable download/ copy as policy permits, watermark, audit, and revoke. Evidence: security tests. - [ ] Y7.7.e Import translated units/assets with stable IDs, source revision/ TM/glossary/provenance, validation/conflicts, reviewer decision, and no hidden solution fields. Evidence: import tests. - [ ] Y7.7.f Test translator/reviewer/solver/producer roles, escalation for additional context, cross-locale/package/tenant and expired/revoked access. Evidence: boundary suite. - [ ] Y7.8 Build locale parity gates for structure, clues, solution, accessibility, assets, and timing. Evidence: known mismatch fixtures. - [ ] Y7.8.a Resolve source/target locale bundles and exact structure/entity/ scene/branch/clue/solution/asset/timebase/accessibility revisions and profile. Evidence: inputs. - [ ] Y7.8.b Compare stable hierarchy/order/IDs/refs/conditions/effects/ branches/reachability and detect added/removed/orphaned structure. Evidence: structure fixtures. - [ ] Y7.8.c Compare clue/red-herring/interpretation/dependency/weight/ discovery/reveal/spoiler and solution/proof/alternative/ending semantics. Evidence: case fixtures. - [ ] Y7.8.d Validate translated text/dialogue/terminology/pronunciation/canon/ source/citation/meaning and intentional adaptations with review. Evidence: language tests. - [ ] Y7.8.e Validate alt/long descriptions/captions/transcripts/sign/ noninteractive alternatives/keyboard/reading order and locale metadata. Evidence: accessibility fixtures. - [ ] Y7.8.f Validate asset role/version/locale/renditions/graphics/audio/voice/ rights/consent and duration/timecode/dialogue/audio/branch timing. Evidence: asset/timing fixtures. - [ ] Y7.8.g Persist raw mismatches/uncertainty/N/A/adaptations separately and block unresolved mandatory parity. Evidence: parity gate. - [ ] Y7.9 Publish through plan, execute, read-back verify, and compensate. Evidence: partial target failure recovery. - [ ] Y7.9.a Define immutable per-target release plan with exact locked bundle/ candidate/revisions/hashes, prerequisites, destination IDs/config, steps/compensation/estimate/idempotency. Evidence: schema. - [ ] Y7.9.b Revalidate approvals/gates/canon/source/rights/assets/locales/ target/capability/embargo/authorization immediately before confirmation and each write. Evidence: TOCTOU tests. - [ ] Y7.9.c Execute durable target steps idempotently with checkpoints/ receipts/partial state/retries/timeouts/cancel and no hidden success. Evidence: execution tests. - [ ] Y7.9.d Read back authoritative target bytes/manifest/hash/metadata/ visibility/links/runtime/consumer models and mark success only after verification. Evidence: read-back tests. - [ ] Y7.9.e Reconcile interruption/unknown destination state before retry; compensate eligible successful writes in dependency-safe order and verify. Evidence: recovery tests. - [ ] Y7.9.f Preserve per-target succeeded/failed/unknown/compensated/residual state, all attempts/cost/audit/notifications. Evidence: partial failure E2E. - [ ] Y7.10 Build release calendar for study drops, case episodes, playtests, localization, and production capacity. Evidence: dependency and time-zone tests. - [ ] Y7.10.a Define versioned event/resource/reservation/dependency contracts for study drop/case episode/playtest/locale/review/build/release/ embargo/capacity with time zone. Evidence: schema. - [ ] Y7.10.b Build month/week/list/timeline views with filters, role/spoiler projection and keyboard/non-drag create/move/resize. Evidence: UI tests. - [ ] Y7.10.c Build dependency DAG/backward plan for source/canon/content/ asset/solver/review/localize/compile/validate/publish/verify tasks and buffers. Evidence: dependency tests. - [ ] Y7.10.d Reserve authors/solvers/reviewers/localizers/producers/stages/ providers/render/compile/targets/budget and reject committed overbooking. Evidence: capacity tests. - [ ] Y7.10.e Monitor freshness/slip/conflict/risk and authorize reschedule/ scope/fallback/hold/cancel through versioned impact decision. Evidence: contingency tests. - [ ] Y7.10.f Test IANA zones/DST/recurrence/quiet hours/embargo/dependency/ reserved slot/actuals and scheduled release read-back. Evidence: suite. - [ ] Y7.11 Build study collection and case-season curation through bundles. Evidence: no direct catalog writes. - [ ] Y7.11.a Define collection/season/bundle version, purpose/audience/locale/ owner/schedule/ordered exact study/case episode/build members/metadata/ targets/lifecycle. Evidence: schema. - [ ] Y7.11.b Build draft add/remove/reorder/group/feature/episode numbering/ arc/dependency/locale/metadata editor and eligibility checks. Evidence: curation tests. - [ ] Y7.11.c Validate member availability/target/rights/canon/source/gates/ reviews/spoiler/order/prerequisite/season continuity and steering policy. Evidence: membership tests. - [ ] Y7.11.d Preview deterministic catalog/consumer/search/navigation/order/ schedule/metadata/add/remove diffs and impacted links. Evidence: preview. - [ ] Y7.11.e Review/approve/release exact bundle through governed publication; prohibit direct catalog/search/consumer write. Evidence: boundary tests. - [ ] Y7.11.f Preserve historical releases and propagate member supersession/ recall/canon/source changes via new bundle/incident. Evidence: lifecycle. - [ ] Y7.12 Build supersession, correction, unpublish, archive, recall, and canon hotfix paths. Evidence: customer read models and audit reconcile. - [ ] Y7.12.a Define distinct command/state/reason/authority/scope/effective- time/targets/notification/verification contracts for every lifecycle path. Evidence: schemas. - [ ] Y7.12.b Supersede with eligible replacement exact revision/bundle, effective behavior/migration/redirect/prior availability/consumer notice. Evidence: supersession tests. - [ ] Y7.12.c Correct factual/typographic/localization/metadata/content via new revisions, source/canon evidence, review/build and correction notice, never historical mutation. Evidence: correction tests. - [ ] Y7.12.d Unpublish target visibility/links/downloads/search/catalog/ consumer models/caches with receipts while preserving authoring/release evidence. Evidence: unpublish tests. - [ ] Y7.12.e Archive inactive authoring/catalog records with retention/ dependencies/authorized history/restore and no accidental delivery. Evidence: archive tests. - [ ] Y7.12.f Recall affected source/canon/asset/bundle/release through blast radius, quarantine/disable/removal/notification/verification/residual copies. Evidence: recall tests. - [ ] Y7.12.g Apply canon hotfix as scoped authorized assertion/content/build revision with solver/continuity/localization/asset impact and expedited but nonwaived gates. Evidence: hotfix tests. - [ ] Y7.12.h Rebuild/reconcile customer read/search/catalog/cache/links/state from authoritative events/bundles and compare audit. Evidence: lifecycle E2E. - [ ] Y7.13 Build deep links from released items to authorized source, provenance, and authoring history. Evidence: role-based disclosure tests. - [ ] Y7.13.a Define allowlisted link intents/routes for released study/case/ asset/bundle to source/citation/provenance/lineage/revision/decision/ authoring views with minimal claims. Evidence: schema. - [ ] Y7.13.b Issue signed opaque tenant/project/subject/version/audience/ intent/expiry/nonce links only after source authorization. Evidence: issuance tests. - [ ] Y7.13.c Revalidate signature/time/replay/host/route and current actor/ object/property/function/reveal/embargo/source rights at open. Evidence: validation tests. - [ ] Y7.13.d Project learner/customer/participant/author/reviewer/producer/ operator fields separately, redacting protected source/solution/spoiler/ private authoring/identity details. Evidence: disclosure tests. - [ ] Y7.13.e Handle logged-out/expired/revoked/deleted/superseded/recalled/ cross-tenant links, back/return context, referrer/log scrubbing. Evidence: lifecycle tests. - [ ] Y7.14 Build post-release feedback intake without silently modifying canon or source truth. Evidence: triage-to-revision journey. - [ ] Y7.14.a Define feedback/report identity, released item/build/revision/ locale/target, actor/anonymous/consent, category/severity, text/media/ anchor, visibility, status, and provenance. Evidence: schema. - [ ] Y7.14.b Ingest consumer/support/playtest/reviewer/partner/analytics/ correction/safety/rights/accessibility feedback with rate/abuse/PII/ spoiler controls. Evidence: intake tests. - [ ] Y7.14.c Triage/deduplicate/cluster/link sources/canon/issues with attributed rules/models, uncertainty, counterevidence and human priority/owner. Evidence: triage tests. - [ ] Y7.14.d Route to source update, canon proposal, content/locale/asset/ build revision, bug, incident, support, reject/defer decision; no direct truth/canon edit. Evidence: authority tests. - [ ] Y7.14.e Require normal source/canon/review/gate/build/release lifecycle and link outcome/decision/notification back. Evidence: E2E. - [ ] Y7.15 Build program/season/collection steering overlays for cadence, difficulty, canon, source, safety, production, and release constraints. Evidence: tighten-only property tests and impact preview. - [ ] Y7.15.a Define versioned overlay scope/priority/effective dates/owner and typed cadence/difficulty/canon/source/safety/production/budget/audience/ locale/release fields. Evidence: schema. - [ ] Y7.15.b Resolve platform/region/organization/program/season/collection/ project/profile precedence with conflict/cycle detection. Evidence: resolution tests. - [ ] Y7.15.c Merge by narrower eligibility/allowed canon/source, stricter gates/thresholds/reviewer/limits, lower budget/capacity, or additional requirements only. Evidence: monotonicity tests. - [ ] Y7.15.d Reject omission/default/inheritance/alias attempts to loosen safety/rights/privacy/accessibility/canon/source/authority/code floors. Evidence: property tests. - [ ] Y7.15.e Preview affected content/cases/clues/difficulty/schedules/assets/ pipelines/budgets/locales/builds/releases/consumers/conflicts. Evidence: impact tests. - [ ] Y7.15.f Review/approve/version/schedule/deactivate/rollback and revalidate dependent state without history rewrite. Evidence: lifecycle tests. - [ ] Y7.16 Build UI-governed study, case, genre, clue, audience, difficulty, production, and catalog taxonomies over code-owned floors. Evidence: versioned review, alias, deprecation, localization, and migration journey. - [ ] Y7.16.a Define separate typed registry entry/version/relationship/ lifecycle contracts and stable codes for every named taxonomy. Evidence: schemas. - [ ] Y7.16.b Declare code-owned noneditable identities/semantics/required fields/forbidden relations/safety-fairness-rights-accessibility/profile floors. Evidence: floor tests. - [ ] Y7.16.c Build restrained operator list/detail/create-draft/edit/diff/ validation/dependency/usage UI with typed fields and no arbitrary JSON. Evidence: authoring tests. - [ ] Y7.16.d Build alias/synonym/parent/related/mapping with scope/uniqueness/ collision/cycle/semantic equivalence and no silent merge. Evidence: relation tests. - [ ] Y7.16.e Build locale label/description/help/search terms/fallback/ completeness/translator context without localized identity codes. Evidence: localization tests. - [ ] Y7.16.f Review/approve/publish/deprecate/supersede/archive exact versions with effective dates, owner, audit, compatibility checks. Evidence: lifecycle tests. - [ ] Y7.16.g Preview/execute resumable dependency migrations across projects/ content/cases/assets/templates/overlays/builds/catalogs with conflicts/ rollback/history. Evidence: migration tests. - [ ] Y7.16.h Verify unknown/deprecated/missing entries fail/degrade safely in every consumer/export and run accessibility/performance/drift tests. Evidence: registry journey. ### Y8 — Yemaya UX, accessibility, offline, and performance - [ ] Y8.1 Add study and case entries to the existing Yemaya project navigation. Evidence: no second global shell. - [ ] Y8.1.a Register study/case routes, labels/icons/keywords/capabilities/ project profiles/roles in canonical project navigation/command palette. Evidence: IA registry tests. - [ ] Y8.1.b Show entries only for compatible project type/track/entitlement/ role/capability and safe unavailable/degraded states. Evidence: visibility tests. - [ ] Y8.1.c Preserve current project/revision/entity/return context and dirty state warnings across entry/exit/deep links. Evidence: navigation tests. - [ ] Y8.1.d Reuse existing global/project shell, breadcrumbs, switcher, identity/notifications/search/help and remove duplicate nav headers. Evidence: shell conformance. - [ ] Y8.1.e Test direct authorized/unauthorized routes, project switch/profile migration, web/desktop, keyboard/screen reader. Evidence: route E2E. - [ ] Y8.2 Build project dashboards around actionable work, not a card mosaic. Evidence: frontend conformance review. - [ ] Y8.2.a Define primary user triage questions and live view models for assignments/blockers/gate failures/jobs/reviews/schedule/budget/incidents/ releases per profile. Evidence: dashboard contract. - [ ] Y8.2.b Compose a restrained hierarchy with actionable queue/production state first, recent project context and secondary metrics second, no hero or repeated container cards. Evidence: design review. - [ ] Y8.2.c Implement stable filters/sorts/grouping/URLs/freshness/live updates and clear owner/deadline/severity/status/units. Evidence: UI tests. - [ ] Y8.2.d Implement eligible inline claim/assign/open/remediate/retry/hold/ review actions with permission/state/version/reason/confirmation. Evidence: action tests. - [ ] Y8.2.e Render loading/empty/stale/degraded/offline/fixture/error/partial/ unauthorized honestly and verify responsive/accessibility/scale. Evidence: frontend conformance E2E. - [ ] Y8.3 Build workspaces with primary editor, navigation, inspector, and visible gate/job status. Evidence: responsive browser snapshots. - [ ] Y8.3.a Define shared workspace shell contract for project/context nav, primary canvas/editor, contextual inspector, status rail, command palette, focus/selection/dirty/capability state. Evidence: shell spec. - [ ] Y8.3.b Compose study source/material/order and case dossier/entity/graph/ timeline/scene/solution editors using the shared shell. Evidence: workspace tests. - [ ] Y8.3.c Compose AAA script/board/design/schedule/budget/asset/dailies/ pipeline/marketplace/admin workspaces without nested global shells. Evidence: production tests. - [ ] Y8.3.d Keep applicable gates/freshness/blockers/remediation and jobs/ progress/cost/cancel/failure visible without obscuring the primary work. Evidence: status tests. - [ ] Y8.3.e Define wide/compact/single-column layouts with inspector/status drawer/tab, persistent subject identity, safe focus and no unusable squashing. Evidence: snapshots. - [ ] Y8.4 Preserve route, project, selected entity, tab, graph/timeline viewport, and inspector state in deep links. Evidence: refresh/share tests. - [ ] Y8.4.a Define canonical allowlisted URL state schema/version for route/ project/track/entity/revision/tab/selection/filter/graph-camera/timeline- range/inspector with size/privacy limits. Evidence: link schema. - [ ] Y8.4.b Encode stable opaque IDs and bounded viewport/range values while excluding secrets/prompts/protected source/solution/local paths/unsaved content. Evidence: serialization tests. - [ ] Y8.4.c Parse/validate/canonicalize and reauthorize every referenced object/property/function; handle stale/deleted/moved/revoked state. Evidence: restoration tests. - [ ] Y8.4.d Restore after refresh/back/forward/share/new window/web-desktop handoff and reconcile local unsaved state/conflicts safely. Evidence: navigation tests. - [ ] Y8.4.e Test cross-tenant/project substitution, oversized/unknown/bad viewport, role/reveal change, offline cache, link expiry. Evidence: share tests. - [ ] Y8.5 Provide semantic alternatives for graphs, timelines, rendered previews, and playback. Evidence: keyboard/screen-reader journeys. - [ ] Y8.5.a Define operation/content parity requirements and synchronized selection/focus/status between each visual surface and semantic alternative. Evidence: parity matrix. - [ ] Y8.5.b Provide graph tree/table/list/forms for nodes/edges/types/ properties/evidence/errors/path/relationships and all edit/navigation operations. Evidence: graph tests. - [ ] Y8.5.c Provide timeline ordered/grouped event table/forms with absolute/ relative/uncertain time, duration, participants/location/evidence/ conflicts and editing. Evidence: timeline tests. - [ ] Y8.5.d Provide rendered image/video/3D/audio source/scene/object/frame/ time/track/measurement/annotation list/table and controls. Evidence: preview tests. - [ ] Y8.5.e Provide playback native controls, transcript/captions/audio descriptions/chapter/shot/track/marker lists and synchronized keyboard navigation. Evidence: playback tests. - [ ] Y8.5.f Verify equivalent inspect/comment/edit/compare/decide operations, screen-reader announcements, zoom/reflow, large data performance. Evidence: semantic E2E. - [ ] Y8.6 Provide non-drag alternatives for hierarchy, graph, clue, scene, and timeline editing. Evidence: WCAG 2.2 dragging coverage. - [ ] Y8.6.a Inventory every drag/drop/pan/reorder/connect/move/resize/trim/ range operation across named editors and map equivalent outcomes. Evidence: drag inventory. - [ ] Y8.6.b Add move before/after/into/out/first/last/position commands/forms for hierarchy/scene/clue order with destination preview. Evidence: reorder tests. - [ ] Y8.6.c Add select source/target/relation/ports/condition forms and keyboard commands for graph/clue connections and node movement. Evidence: graph tests. - [ ] Y8.6.d Add date/time/duration/order/lane/range numeric/text forms and keyboard step commands for timeline events/clips/markers. Evidence: timeline tests. - [ ] Y8.6.e Keep validation/impact/permissions/concurrency/undo/audit identical between pointer and non-drag paths. Evidence: parity tests. - [ ] Y8.6.f Run WCAG keyboard/screen-reader/touch/switch-friendly journeys for every operation with focus restoration/announcement. Evidence: coverage. - [ ] Y8.7 Implement autosave/offline drafts with visible sync, conflict, and recovery. Evidence: disconnect/reconnect and two-client conflict tests. - [ ] Y8.7.a Define draft/local operation/server revision/sync checkpoint/ device/session/schema/encryption/retention contracts and eligible content types. Evidence: schema. - [ ] Y8.7.b Implement debounced idempotent autosave with expected revision, dirty/saving/saved/error/conflict/offline indicators and unload/crash recovery. Evidence: autosave tests. - [ ] Y8.7.c Store offline drafts/CRDT operations/assets securely with size/ quota/expiry/device/logout/project-access controls and no unencrypted spoilers/secrets. Evidence: cache tests. - [ ] Y8.7.d Replay/rebase/deduplicate on reconnect after current auth/project/ lock/schema/source/canon validation; never silently last-write-wins. Evidence: reconnect tests. - [ ] Y8.7.e Present mine/theirs/base semantic conflict and safe merge/manual resolution, preserve copies/export, and create new revisions. Evidence: conflict tests. - [ ] Y8.7.f Test two clients/web-desktop/offline edits/reorder/delete/role revoke/project archive/quota/crash/reconnect. Evidence: E2E. - [ ] Y8.8 Define web and desktop performance budgets for large projects, graphs, timelines, assets, video, and search. Evidence: profiling reports. - [ ] Y8.8.a Define shared client/server/end-to-end load/interaction/save/ search/preview/playback latency, CPU/memory/GPU/disk/network/payload/ query/error budgets per device/network/profile. Evidence: budget spec. - [ ] Y8.8.b Define production-scale project/entity/revision/collaborator/ source/asset/job/comment/locale/search distributions and representative fixtures. Evidence: fixture manifest. - [ ] Y8.8.c Define graph/timeline nodes/edges/events/paths/annotations/ updates/layout/validation budgets and measurement points. Evidence: editor budgets. - [ ] Y8.8.d Define asset/gallery/proxy/large image/video/audio/3D load/decode/ scrub/render/cache/disk/memory/GPU/network budgets by web/desktop. Evidence: media budgets. - [ ] Y8.8.e Define search indexing lag/query/facet/suggestion/pagination/ cache/permission overhead and large-project save/sync/reconnect/export budgets. Evidence: data budgets. - [ ] Y8.8.f Profile supported scenarios, capture client/server traces/query plans/resource graphs, trend baselines, and fail regressions. Evidence: reports. - [ ] Y8.9 Virtualize large lists and graphs without breaking accessibility or selection. Evidence: high-volume tests. - [ ] Y8.9.a Inventory virtualized candidates and define stable item/node/edge identity/order/size/focus/selection/scroll/announcement/search semantics. Evidence: virtualization spec. - [ ] Y8.9.b Implement lists/tables/trees/grids with overscan/dynamic size/ grouped rows/sticky headers/infinite cursor loading and no duplicate/ missing entries. Evidence: list tests. - [ ] Y8.9.c Implement graph semantic view and visual culling/LOD/tile/layout/ cluster/incremental updates without dropping reachable selected entities or validation. Evidence: graph tests. - [ ] Y8.9.d Preserve focus/active descendant/selected/expanded/anchor/keyboard index and screen-reader position/count when items unmount/remount. Evidence: accessibility tests. - [ ] Y8.9.e Preserve URL selection/scroll/viewport across filter/sort/update/ pagination/refresh/back/reconnect and handle deleted targets. Evidence: state tests. - [ ] Y8.9.f Load-test high-volume pointer/keyboard/screen-reader/search/live updates and memory over sustained use. Evidence: performance tests. - [ ] Y8.10 Add reduced-motion behavior to route, panel, graph, and timeline transitions. Evidence: automated assertions. - [ ] Y8.10.a Inventory route/page/panel/dialog/menu/toast/loading/progress/ graph layout/pan-zoom/highlight/timeline scroll/playhead/drag/preview animations. Evidence: motion inventory. - [ ] Y8.10.b Define semantic state change/feedback purpose and reduced-motion replacement as instant, short fade, static highlight, manual control, or removal. Evidence: behavior spec. - [ ] Y8.10.c Honor OS/browser/app preference before first paint across web/ desktop and update live without layout/focus loss. Evidence: preference tests. - [ ] Y8.10.d Disable parallax/spring/large translation/auto pan/continuous layout/animated zoom and provide nonmotion graph/timeline state changes. Evidence: component tests. - [ ] Y8.10.e Preserve essential progress/playback/time/capture indicators with accessible text and user-controlled motion. Evidence: parity tests. - [ ] Y8.10.f Assert computed styles/animation frames/scroll behavior across routes/panels/graphs/timelines/themes/platforms. Evidence: automation. - [ ] Y8.11 Test themes, density, zoom, RTL, long locale, and high-contrast modes. Evidence: visual/a11y matrix. - [ ] Y8.11.a Define supported light/dark/system/high-contrast themes, compact/ comfortable/touch density, 100–400% zoom/reflow, RTL/bidi/long/CJK locales, and OS contrast modes. Evidence: matrix. - [ ] Y8.11.b Test color tokens/contrast/focus/selection/status/charts/graphs/ media annotations/canvas-semantic alternatives in every theme. Evidence: theme tests. - [ ] Y8.11.c Test density/touch targets/spacing/editor controls/tables/ timeline/graph labels and user preference persistence. Evidence: density tests. - [ ] Y8.11.d Test browser/app/text zoom/reflow without clipping/overlap/ hidden controls/two-dimensional scroll except essential surfaces. Evidence: zoom tests. - [ ] Y8.11.e Test RTL navigation/order/icons/bidi isolation/mixed script/ timeline/graph/tree/forms and long/expanding labels/dialogue/captions. Evidence: locale tests. - [ ] Y8.11.f Run visual regression plus automated/manual accessibility and keyboard/screen-reader tests across web/desktop/viewports. Evidence: report matrix. - [ ] Y8.12 Surface fixture, offline, stale, degraded, unavailable, and failed state consistently across web and desktop. Evidence: state matrix. - [ ] Y8.12.a Define canonical data-origin/service-state discriminators, safe messages/timestamps/reasons/actions/recovery/announcements and telemetry. Evidence: state contracts. - [ ] Y8.12.b Label fixture/demo/synthetic content persistently and prevent production mutation/promotion/build/release. Evidence: fixture tests. - [ ] Y8.12.c Show offline cached versus unavailable, sync/queued edits/ prohibited actions/freshness/reconnect and no simulated network success. Evidence: offline tests. - [ ] Y8.12.d Show stale subject/dependency/evidence/capability with exact invalidating version and block unsafe actions. Evidence: stale tests. - [ ] Y8.12.e Show per-capability degraded/partial/unavailable/not-configured/ failed/unknown with safe alternatives and no global healthy implication. Evidence: service tests. - [ ] Y8.12.f Exercise each state/recovery across every critical web/desktop route with identical semantics and accessible announcements. Evidence: state matrix. - [ ] Y8.13 Reconcile navigation and command-palette reachability for every retained AAA, production, marketplace, organization, study, and case capability. Evidence: route/role/project-type matrix has no reachable unauthorized item and no authorized orphan capability. - [ ] Y8.13.a Generate retained atomic capability/owner/host/route/project-type/ role/entitlement/capability/command registry from Y0.16/Y5A and source routes. Evidence: reachability manifest. - [ ] Y8.13.b Register each authorized page/action/deep link/command exactly once in existing shell/project nav/palette with contextual prerequisites. Evidence: IA tests. - [ ] Y8.13.c Compute expected-versus-observed visibility/reachability for every role/project type/web-desktop/capability state and classify unauthorized exposure/orphan/duplicate/stale/misroute. Evidence: matrix. - [ ] Y8.13.d Test navigation hides unauthorized items without hint leaks and server rejects direct route/command/field/function attempts. Evidence: auth tests. - [ ] Y8.13.e Test authorized items resolve to owned live/degraded route with correct project context/back path and no second shell/duplicate mutation. Evidence: positive tests. - [ ] Y8.13.f Fail CI on unreviewed retained capability, authorized orphan, reachable unauthorized item, unknown registry row, or expired disposition. Evidence: route/role/profile gate. - [ ] Y8.14 Provide responsive review/incident projections for scripts, storyboards, assets, dailies, budgets, schedules, pipeline runs, marketplaces, study, and cases while reserving precision editing for capable hosts. Evidence: mobile/tablet critical-action journeys. - [ ] Y8.14.a Define mobile/tablet review versus precision-edit capability matrix, subject identity/context, eligible actions, step-up, and desktop/ host handoff per named surface. Evidence: responsive spec. - [ ] Y8.14.b Build script/storyboard semantic read/diff/comments/review, asset/dailies preview/annotations/gates/decisions, and study/case content/ canon/solver review projections. Evidence: review tests. - [ ] Y8.14.c Build budget/schedule current-versus-baseline/variance/conflicts/ approvals and pipeline run/plan/progress/cost/failure/pause/cancel/ incident projections. Evidence: operations tests. - [ ] Y8.14.d Build marketplace item/security/license/compatibility/report/ takedown and incident scope/evidence/actions/status views with protected data controls. Evidence: marketplace/incident tests. - [ ] Y8.14.e Implement comment/approve/reject/request changes/hold/escalate/ pause/cancel/kill/ack only for current role/state with impact/reason/ confirmation/concurrency/audit. Evidence: action tests. - [ ] Y8.14.f Provide semantic graph/timeline/3D/curve snapshots/tables instead of full precision editors and signed open-on-desktop/host return links. Evidence: handoff tests. - [ ] Y8.14.g Test touch/keyboard/screen reader/zoom/orientation/safe area/slow- offline/reconnect/direct authorization/role revoke across representative critical journeys. Evidence: E2E. ### Y9 — Yemaya verification, operations, and launch - [ ] Y9.1 Run contract and migration compatibility tests for case, study, project, canon, and release schemas. Evidence: old-version corpus. - [ ] Y9.1.a Assemble supported historical case/study/project/canon/release records, events, blobs, indexes, manifests, and client payloads with provenance and expected outcomes. Evidence: version corpus. - [ ] Y9.1.b Test forward migrations one version at a time and from every supported direct upgrade point without silent defaulting or data loss. Evidence: migration matrix. - [ ] Y9.1.c Test current writers with supported old readers and old writers with current readers at explicit compatibility boundaries. Evidence: mixed-version tests. - [ ] Y9.1.d Verify identifiers, ordering, uncertainty, evidence, permissions, reveal state, checksums, and release signatures survive round trips. Evidence: semantic diffs. - [ ] Y9.1.e Test interrupted/retried migrations, rollback or restore, malformed/unknown fields, and unsupported versions fail safely. Evidence: failure tests. - [ ] Y9.1.f Record compatibility window, irreversible steps, operator prerequisites, and corpus ownership in the release gate. Evidence: compatibility report. - [ ] Y9.2 Run known-value source, hierarchy, reading-order, canon, timeline, solvability, uniqueness, fairness, reachability, and spoiler tests. Evidence: gate registry coverage. - [ ] Y9.2.a Curate positive, boundary, counterexample, adversarial, and intentionally indeterminate fixtures with expert-reviewed expected measurements and verdicts. Evidence: known-value corpus. - [ ] Y9.2.b Verify source integrity, hierarchy/reference resolution, and deterministic reading order across format, locale, revision, and partial-ingest cases. Evidence: source gate tests. - [ ] Y9.2.c Verify canon contradiction, timeline consistency/uncertainty, and stale-dependency invalidation against expected finding sets. Evidence: canon/timeline tests. - [ ] Y9.2.d Verify solver completeness, uniqueness/ambiguity, reachability, hint progression, dead ends, and assumption budgets. Evidence: solver tests. - [ ] Y9.2.e Verify fairness/accessibility and spoiler/reveal boundaries by role, stage, locale, export, search, cache, and notification. Evidence: boundary tests. - [ ] Y9.2.f Map every retained gate to fixtures, measurement assertions, verdict assertions, remediation, owner, and current execution result. Evidence: gate registry coverage report. - [ ] Y9.3 Run calibrated safety/AI evaluations with threshold, subgroup, and uncertainty reports. Evidence: review approval. - [ ] Y9.3.a Freeze representative allowed/refuse/escalate/abstain fixtures, subgroup labels, protected-content classes, and expert ground truth. Evidence: evaluation manifest. - [ ] Y9.3.b Evaluate extraction/generation/solver/agent quality separately from safety, grounding, leakage, and authorization behavior. Evidence: metric suite. - [ ] Y9.3.c Report threshold curves, confidence intervals, calibration, abstention, false-positive/negative severity, and subgroup deltas. Evidence: evaluation report. - [ ] Y9.3.d Test prompt/source injection, spoiler elicitation, sensitive inference, unsafe-media requests, tool misuse, and multi-turn attacks. Evidence: adversarial suite. - [ ] Y9.3.e Reproduce regressions against prior approved baselines and route misses to mitigation, model/prompt rollback, or human-only disposition. Evidence: regression decisions. - [ ] Y9.3.f Obtain named domain/safety/editorial approval for thresholds, residual risk, exceptions, and expiry. Evidence: signed review. - [ ] Y9.4 Run real-database, blob, search, queue, compiler, and read-model integration suites. Evidence: durable round-trip. - [ ] Y9.4.a Provision supported production-equivalent database/blob/search/ queue/compiler/read-model versions with isolated tenant fixtures. Evidence: environment manifest. - [ ] Y9.4.b Exercise transactional writes, outbox/events, blob completion, indexing, queued compilation, and consumer projection end to end. Evidence: trace-linked tests. - [ ] Y9.4.c Verify retries/idempotency/order/deduplication, concurrent edits, partial outages, poison messages, dead letters, and replay. Evidence: fault tests. - [ ] Y9.4.d Verify tenant/role/field/reveal isolation in primary records, blobs, indexes, queue payloads, compiler artifacts, and read models. Evidence: isolation tests. - [ ] Y9.4.e Compare authoritative and projected states after create/update/ delete/archive/restore/release and repair induced divergence. Evidence: reconciliation report. - [ ] Y9.4.f Preserve durable IDs/checksums/provenance/audit across backup, restart, retry, and cold consumer rebuild. Evidence: round-trip proof. - [ ] Y9.5 Run web full journey: source to published study material. Evidence: live backing and verified consumer read model. - [ ] Y9.5.a Create an authorized study project and ingest representative files/URLs/media with real blob storage, parsing, provenance, and quarantine outcomes. Evidence: journey trace. - [ ] Y9.5.b Review source structure/reading order/metadata/rights, correct issues, and approve a pinned source revision. Evidence: review audit. - [ ] Y9.5.c Author grounded material, ordering, questions/hints/accessibility/ locale variants with citations and protected answer boundaries. Evidence: authoring trace. - [ ] Y9.5.d Run applicable source/canon/fairness/accessibility/spoiler gates, remediate a failure, and prove verdict freshness. Evidence: gate trace. - [ ] Y9.5.e Preview as eligible learner/reviewer roles and prove protected fields do not leak through route, API, search, cache, or export. Evidence: role tests. - [ ] Y9.5.f Publish through real job/release services, then consume the signed immutable read model and reconcile it to the approved revision. Evidence: published-consumer proof. - [ ] Y9.6 Run web full journey: premise to solved, reviewed, localized, published case. Evidence: real compiler/verifier. - [ ] Y9.6.a Create a case project from premise and build dossier/entities/ clues/relationships/timeline/scenes with source-backed uncertainty. Evidence: authoring trace. - [ ] Y9.6.b Define reveal order, red herrings, hints, solution/assumptions, alternate hypotheses, and role-specific spoiler boundaries. Evidence: case revision. - [ ] Y9.6.c Run real graph/timeline/canon/solvability/uniqueness/fairness/ reachability gates, repair failures, and rerun against pinned inputs. Evidence: verifier trace. - [ ] Y9.6.d Complete independent editorial/domain/safety review with comments, changes, approvals, audit, and stale-approval invalidation. Evidence: review trace. - [ ] Y9.6.e Localize content, clues, layouts, captions, reading order, and solution reveal while preserving IDs, evidence, and solver parity. Evidence: locale comparison. - [ ] Y9.6.f Compile/publish through real services and solve the immutable consumer artifact as intended and plausible alternate paths. Evidence: release/consumer proof. - [ ] Y9.7 Run desktop full journey with local import, offline edit, sync conflict, render job, and publish handoff. Evidence: signed build. - [ ] Y9.7.a Install/launch the signed supported desktop build in a clean standard-user profile and authenticate/open an entitled real project. Evidence: build/install trace. - [ ] Y9.7.b Import representative local files through approved pickers, validate/quarantine/deduplicate/upload them, and preserve local-source provenance without exposing paths. Evidence: import trace. - [ ] Y9.7.c Disconnect, edit eligible content/assets, close/relaunch, and recover encrypted offline drafts with honest availability state. Evidence: offline trace. - [ ] Y9.7.d Create a concurrent web edit, reconnect, inspect mine/theirs/base, resolve the semantic conflict, and verify revision/audit continuity. Evidence: conflict trace. - [ ] Y9.7.e Submit/monitor/cancel/retry and complete a real render/compile job with progress/cost/logs/artifacts and resource limits. Evidence: job trace. - [ ] Y9.7.f Hand off the approved revision to web publish, consume the released artifact, and verify signed-build/deep-link/updater boundaries. Evidence: desktop journey report. - [ ] Y9.8 Run agent fault, budget, cancellation, and human-override journeys. Evidence: no unauthorized direct mutation. - [ ] Y9.8.a Exercise approved agent plans across representative read, recommend, draft, job-submit, and proposed-mutation capabilities. Evidence: journey manifest. - [ ] Y9.8.b Inject model/tool/provider timeout, malformed output, rate limit, stale subject, dependency outage, and partial-result failures. Evidence: fault traces. - [ ] Y9.8.c Exhaust token/cost/time/tool/step/concurrency budgets and verify deterministic stop, retained partial artifacts, and no hidden overrun. Evidence: budget tests. - [ ] Y9.8.d Cancel before execution, during tool work, during durable job, and after commit boundary; verify compensation and truthful terminal state. Evidence: cancellation tests. - [ ] Y9.8.e Pause/override/edit/reject/escalate from the human control surface and verify revalidation, approval, audit, and ownership transitions. Evidence: override tests. - [ ] Y9.8.f Attempt prompt/tool/direct API mutation outside the plan/role/ capability/project and prove server rejection with no side effect. Evidence: authorization report. - [ ] Y9.9 Run WCAG 2.2 AA, keyboard, announcement, and semantic-equivalence suites on web and desktop renderer. Evidence: matrix report. - [ ] Y9.9.a Define route/workspace/dialog/editor/action coverage across wide/compact/single-column, web/desktop, themes, zoom, RTL, and locales. Evidence: accessibility matrix. - [ ] Y9.9.b Run automated WCAG rules, contrast, name/role/value, landmark/ heading, form/error, target-size, reflow, and motion assertions. Evidence: automation report. - [ ] Y9.9.c Complete keyboard-only journeys with logical order, visible focus, no traps, skip/recovery paths, and non-drag alternatives. Evidence: keyboard traces. - [ ] Y9.9.d Verify live announcements for save/sync/job/gate/filter/error/ conflict/review state without duplication, interruption, or silent change. Evidence: announcement tests. - [ ] Y9.9.e Compare graph/timeline/render/playback visual and semantic paths for content, selection, editing, decisions, validation, and permissions. Evidence: equivalence tests. - [ ] Y9.9.f Run named assistive-technology/manual audits on supported web and desktop combinations and close or explicitly block every finding. Evidence: signed matrix report. - [ ] Y9.10 Run large-project performance, memory, startup, search, graph, timeline, render-monitor, and sync tests. Evidence: budgets pass. - [ ] Y9.10.a Generate versioned production-scale fixtures matching documented project/entity/asset/revision/collaboration/job distributions. Evidence: fixture report. - [ ] Y9.10.b Measure cold/warm web and desktop startup, project open, route/ workspace transition, idle, and sustained-session memory. Evidence: startup/memory profiles. - [ ] Y9.10.c Measure indexed search/facets/pagination/update visibility and large graph/timeline load/layout/query/edit/validation. Evidence: interaction profiles. - [ ] Y9.10.d Measure proxy/media load, scrub/playback, render-monitor live updates/logs/artifacts, and bounded client/server resource use. Evidence: media/job profiles. - [ ] Y9.10.e Measure large save/autosave/offline cache/reconnect/rebase/ conflict/export with concurrency and constrained networks. Evidence: sync profiles. - [ ] Y9.10.f Compare every metric to platform/device/network budgets, retain traces, fail regressions, and assign any exception with expiry. Evidence: signed budget report. - [ ] Y9.11 Run desktop IPC, filesystem, deep-link, updater, signing, sandbox, and dependency security tests. Evidence: zero blockers. - [ ] Y9.11.a Enumerate every renderer-to-main IPC channel with input/output schema, caller capability, authorization, timeout, size, and audit requirements. Evidence: IPC security manifest. - [ ] Y9.11.b Fuzz unknown/malformed/oversized/replayed/concurrent IPC and prove privileged operations cannot be invoked from untrusted content. Evidence: IPC adversarial tests. - [ ] Y9.11.c Test picker-scoped filesystem access, traversal/symlink/race/ archive/device-file attacks, permissions, quotas, cleanup, and path redaction. Evidence: filesystem report. - [ ] Y9.11.d Test deep-link allowlists, canonical parsing, reauthorization, expired/replayed links, malicious schemes/arguments, and safe focus. Evidence: link security tests. - [ ] Y9.11.e Test signed update metadata/download/install/rollback/recovery against downgrade, tamper, interruption, channel/version skew, and revoked keys. Evidence: updater report. - [ ] Y9.11.f Verify code signing/notarization or platform equivalent, sandbox/CSP/permission boundaries, SBOM/licenses/vulnerabilities, and release artifact provenance with zero blockers. Evidence: security gate. - [ ] Y9.12 Run source injection, spoiler leak, canon tamper, unsafe media, archive, SSRF, auth, and tenant adversarial tests. Evidence: zero blockers. - [ ] Y9.12.a Inject active instructions/markup/scripts/formulas/links and Unicode/bidi/confusable payloads through every supported source format and derived field. Evidence: source-injection tests. - [ ] Y9.12.b Probe spoiler/answer/solution leakage through API fields, errors, search, suggestions, notifications, logs, cache, exports, model context, and timing. Evidence: leak report. - [ ] Y9.12.c Tamper with canon/evidence/revision/gate/result/read-model/release IDs, hashes, ordering, signatures, and stale approvals. Evidence: integrity tests. - [ ] Y9.12.d Upload polyglot/malformed/oversized/decompression-bomb/active/ prohibited media and verify quarantine, transform isolation, and safe preview. Evidence: media tests. - [ ] Y9.12.e Exercise archive traversal/symlink/nesting/ratio and URL import SSRF/DNS rebinding/redirect/private-network/credential attacks. Evidence: import security tests. - [ ] Y9.12.f Test cross-role/project/tenant object, field, function, blob, search, queue, export, deep-link, and cache access with zero side effects. Evidence: authorization gate. - [ ] Y9.13 Run backup/restore and web/desktop version-skew drills. Evidence: RPO/RTO and compatibility results. - [ ] Y9.13.a Define protected data/services, backup cadence/retention/ encryption/immutability/region, recovery order, RPO/RTO, and owners. Evidence: recovery contract. - [ ] Y9.13.b Restore database/blob/search/queue/config/secrets references and release artifacts into an isolated environment from selected full/ incremental/point-in-time backups. Evidence: restore trace. - [ ] Y9.13.c Reconcile records, blobs, indexes, projections, jobs, audits, signatures, tenant boundaries, and unresolved edits after restore. Evidence: integrity report. - [ ] Y9.13.d Exercise supported older/newer web API, desktop client, schema, job worker, compiler, and read-model combinations. Evidence: version-skew matrix. - [ ] Y9.13.e Verify incompatible combinations block safely with upgrade/ retry/export/recovery guidance and no corrupt or silently dropped edits. Evidence: boundary tests. - [ ] Y9.13.f Measure achieved data loss and recovery duration, record gaps/ exceptions, and obtain operations/security approval. Evidence: signed drill report. - [ ] Y9.14 Publish author, canon, solver, localization, producer, desktop, incident, and recovery runbooks. Evidence: game-day. - [ ] Y9.14.a Publish author/source-ingest and canon/timeline remediation runbooks with prerequisites, diagnostics, safe edits, revalidation, and escalation. Evidence: runbook review. - [ ] Y9.14.b Publish solver/uniqueness/fairness/spoiler investigation runbooks with known-value comparisons and human disposition. Evidence: runbook review. - [ ] Y9.14.c Publish localization/release and producer schedule/budget/ pipeline/job/engine handoff runbooks with rollback boundaries. Evidence: runbook review. - [ ] Y9.14.d Publish desktop import/offline/conflict/filesystem/deep-link/ updater/signing support runbooks without requesting secrets or unsafe filesystem access. Evidence: support review. - [ ] Y9.14.e Publish security/safety/privacy/availability incident triage, containment, evidence, communication, recovery, and postmortem runbooks. Evidence: incident review. - [ ] Y9.14.f Run timed cross-role game-days from detection through recovery, capture unclear/missing/unsafe steps, revise, and reapprove. Evidence: game-day report. - [ ] Y9.15 Produce engineering-readiness evidence per track and host. Evidence: all required reports current. - [ ] Y9.15.a Define required architecture/contracts/migrations/security/ privacy/safety/accessibility/quality/operations evidence by study, case, production, marketplace, organization, and developer track. Evidence: readiness matrix. - [ ] Y9.15.b Define additional web, desktop, mobile/tablet review, engine/DCC, virtual-production/XR, and external-host evidence with owners/freshness. Evidence: host matrix. - [ ] Y9.15.c Link each retained capability and release cell to current test/ evaluation/report/runbook/approval artifacts and immutable versions. Evidence: evidence index. - [ ] Y9.15.d Verify evidence was produced against the candidate commit, configuration, models/providers, dependencies, schemas, and build. Evidence: provenance check. - [ ] Y9.15.e Classify missing/stale/failed/waived evidence, block required cells, and require named owner/reason/scope/expiry for exceptions. Evidence: readiness gate. - [ ] Y9.15.f Publish a per-track/host go/no-go summary with residual risks and explicit unsupported combinations. Evidence: readiness packet. - [ ] Y9.16 Obtain named editorial, domain, safety, accessibility, privacy/security, engineering, and product approvals. Evidence: human signoff. - [ ] Y9.16.a Define each approver’s scope, required evidence, decision criteria, independence/conflict rules, delegates, and expiry. Evidence: approval policy. - [ ] Y9.16.b Route immutable candidate/evidence packets to named editorial and relevant study/case/production/domain reviewers. Evidence: review records. - [ ] Y9.16.c Route calibrated safety, accessibility, privacy, and security reports with open findings/exceptions to accountable reviewers. Evidence: specialist decisions. - [ ] Y9.16.d Route engineering/operations and product readiness, support, compatibility, rollout, and residual-risk evidence. Evidence: launch decisions. - [ ] Y9.16.e Record approve/reject/request-changes/conditional decisions with identity, role, scope, candidate, reason, conditions, and timestamp. Evidence: signed audit. - [ ] Y9.16.f Invalidate affected approvals after candidate/evidence/config/ model/dependency/schema changes and block launch until renewed. Evidence: stale-approval tests. - [ ] Y9.17 Run full-journey coverage for project/asset lifecycle, script→storyboard→animatic, character/world→scene, schedule/budget/call sheet, animation/motion, dailies/editorial, collaboration, autonomous film/game pipeline, engine round-trip, gameplay/NPC, virtual production/XR, marketplace, organization administration, community disposition, and developer integration. Evidence: one generic project test cannot stand in for these distinct workflows. - [ ] Y9.17.a Run project/asset create-import-version-relate-search-review/ archive/restore/release across authorized roles and web/desktop. Evidence: lifecycle journey. - [ ] Y9.17.b Run script→storyboard→animatic and character/world→scene continuity, provenance, review, change-impact, and handoff journeys. Evidence: creative journeys. - [ ] Y9.17.c Run schedule/budget/call-sheet and animation/motion with baseline/ variance/conflict/approval and Aja/host round-trip. Evidence: production journeys. - [ ] Y9.17.d Run dailies/editorial and multi-user collaboration through ingest/proxy/sync/notes/decisions/CRDT conflict/offline recovery. Evidence: review/collaboration journeys. - [ ] Y9.17.e Run autonomous film and game pipelines through approved plan, budget, jobs, human override, artifacts, gates, and publish handoff. Evidence: agent pipeline journeys. - [ ] Y9.17.f Run engine round-trip, gameplay/NPC behavior, and virtual production/XR capture/calibration/session/incident journeys. Evidence: runtime/VP journeys. - [ ] Y9.17.g Run marketplace submit-scan-review-install-license-update/ report/takedown and organization membership/policy/audit/retention/ billing administration. Evidence: marketplace/admin journeys. - [ ] Y9.17.h Run community submission/moderation/appeal/disposition and developer API/webhook/service-account/key rotation/rate-limit/version journeys. Evidence: community/developer journeys. - [ ] Y9.17.i Prove each journey uses real owned services, isolates tenants/ roles, emits trace/audit evidence, and cleans or retains fixtures by policy. Evidence: journey coverage ledger. - [ ] Y9.18 Run pairwise compatibility and loss-profile gates for every supported project type, asset kind, web/desktop version, engine/DCC host, external integration, marketplace package, and release target. Evidence: unsupported combinations are explicit and supported cells have current proof. - [ ] Y9.18.a Build canonical dimensions/values/constraints from supported project profiles, assets/formats, clients, hosts/versions, integrations, packages, locales, and release targets. Evidence: compatibility model. - [ ] Y9.18.b Generate deterministic pairwise cells plus required high-risk higher-order combinations and label invalid/unsupported cells with rationale. Evidence: coverage set. - [ ] Y9.18.c Define loss profile per transform/round-trip for identity, hierarchy, metadata, timing, geometry/materials/animation/audio, interactivity, accessibility, provenance, and rights. Evidence: loss contracts. - [ ] Y9.18.d Execute import/export/round-trip/install/build/release cells on exact versioned hosts and compare semantic measurements to tolerances. Evidence: compatibility results. - [ ] Y9.18.e Exercise version skew, optional capability absence, degradation, warnings, refusal, repair, and rollback without silent loss. Evidence: boundary tests. - [ ] Y9.18.f Publish current supported/conditional/unsupported matrix with evidence age, known loss, prerequisites, owner, and expiry; fail stale or unproven supported cells. Evidence: release gate. - [ ] Y9.19 EVE-SEAM-EXIT: require "required Eve reads and writes admitted with source and behavior evidence, or an exact task-0.8 explicit non-goal proves zero operations; a named defer preserves ownership but never passes completion" before this phase exits. Evidence: source-derived totality record and passing verifier. - [ ] Y9.19.a Re-run the route, bridge, state-signal, and complete domain-code envelope census; review every changed candidate instead of carrying a stale phase disposition forward. Evidence: current ratchets. - [ ] Y9.19.b Bind the exact ratified task-0.8 workflow and requirement set; classify it as a required seam or an exact source-backed non-goal. Evidence: charter-bound disposition set. - [ ] Y9.19.c For a required seam, admit both read and write operations with byte-pinned source and behavior evidence. A named defer retains its owner and unblock condition but fails completion. Evidence: operation proofs. - [ ] Y9.19.d Permit a zero-operation boundary only for an exact ratified task-0.8 explicit non-goal; absence or unavailability is not a non-goal. Evidence: source-bound non-goal proof. - [ ] Y9.19.e Run the totality verifier, every retained gate-case CLI, and the injected durable-candidate control; retain red and green receipts. Evidence: release gate logs. --- ## Phase V — Veritas newsroom workbench Veritas is the V1 grounded-story domain. The workbench must preserve source protection, make claims and counterclaims inspectable, enforce the implemented editorial and attestation policies, publish through the real CMS, and carry corrections or retractions to every dependent surface. ### V0 — Newsroom scope, route, roles, and ethics - [ ] V0.1 Reconcile Oshun Studio, `apps/veritas/web`, `apps/veritas/cms`, and existing BFF routes. Evidence: canonical authoring/reader/operator route map. - [ ] V0.1.a Inventory Studio, Veritas web/CMS, BFF, public reader, deep-link, redirect, navigation, and command registrations with owners/audiences. Evidence: route inventory. - [ ] V0.1.b Trace each newsroom authoring/review/publish/operations journey through current UI, BFF, service, CMS, and public read-back. Evidence: current-state diagrams. - [ ] V0.1.c Identify duplicate shells/routes/mutations, split ownership, legacy aliases, dead paths, and protected/public boundary violations. Evidence: collision ledger. - [ ] V0.1.d Assign one canonical host/route/API owner and migration/redirect/ removal disposition to every retained capability. Evidence: route map. - [ ] V0.1.e Verify authorized entry/back/deep-link behavior and prevent reader/operator navigation from exposing protected newsroom surfaces. Evidence: route tests. - [ ] V0.2 Map all `libs/veritas/*` packages to newsroom capabilities or explicit out-of-scope products. Evidence: complete package ledger. - [x] V0.2.a Enumerate every package, public export, consumer, runtime target, persistence/integration dependency, test, and documented purpose. Evidence: package inventory. - [ ] V0.2.b Map retained exports to atomic newsroom capabilities, canonical contracts, owning host/service, and accountable team. Evidence: capability ledger. - [ ] V0.2.c Classify duplicate/legacy/dead/demo/reader/commercial/platform code with keep/merge/migrate/deprecate/remove/out-of-scope disposition. Evidence: disposition ledger. - [ ] V0.2.d Identify protected-source, authorization, standards, provenance, and editorial-policy bypasses at package boundaries. Evidence: boundary review. - [ ] V0.2.e Verify every package and export has one reviewed disposition and no retained consumer depends on an orphan or forbidden path. Evidence: completeness gate. - [ ] V0.3 Reconcile canonical V1 contracts with legacy Veritas API/client models. Evidence: translation boundaries and no new third vocabulary. - [x] V0.3.a Inventory canonical and legacy story/source/claim/evidence/review/ release field names, types, enums, defaults, nullability, and versions. Evidence: contract diff. - [ ] V0.3.b Decide canonical source of truth and explicit adapter/migration boundary for each semantic mismatch. Evidence: mapping table. - [ ] V0.3.c Define lossless conversions or documented refusal/known-loss behavior for legacy-only and canonical-only values. Evidence: transform contracts. - [ ] V0.3.d Update serializers/clients/routes/storage mappings without publishing a hybrid third vocabulary. Evidence: schema/API tests. - [ ] V0.3.e Round-trip historical/current fixtures across server, clients, jobs, CMS, and public projections. Evidence: compatibility goldens. - [ ] V0.4 Reconcile story record states, canonical editorial workflow states, and legacy snake-case states. Evidence: lossless mapping or approved migration. - [x] V0.4.a Inventory every persisted/API/client/job/CMS/public state value, transition, terminal condition, and side effect. Evidence: state inventory. - [ ] V0.4.b Define canonical state machine, orthogonal embargo/review/release/ correction dimensions, actor/guard rules, and invalid transitions. Evidence: transition specification. - [ ] V0.4.c Map legacy snake-case and story-record states with explicit ambiguity, split/merge, terminal, and unknown handling. Evidence: mapping matrix. - [ ] V0.4.d Migrate durable records/events/jobs/read models idempotently and preserve history, audit, schedules, and in-flight work. Evidence: migration rehearsal. - [ ] V0.4.e Run mixed-version and transition/property tests; reject unmapped states rather than defaulting to a publishable state. Evidence: state compatibility suite. - [ ] V0.5 Define reporter, researcher, producer, assignment editor, copy editor, fact-checker, standards editor, legal reviewer, source-protection officer, publisher, corrections editor, and administrator roles. Evidence: permission matrix. - [ ] V0.5.a Define duties and least-privilege object/field/function rights for each named role across pitch through archive/correction. Evidence: role definitions. - [ ] V0.5.b Define desk/project/story/source-compartment/locale/territory scope, temporary delegation, break-glass, and separation-of-duties. Evidence: scope policy. - [ ] V0.5.c Define create/read/edit/review/attest/waive/publish/correct/ retract/export/admin rights per state and data class. Evidence: permission matrix. - [ ] V0.5.d Define incompatible role combinations, recusal/conflict effects, quorum, and independent specialist approvals. Evidence: SoD tests. - [ ] V0.5.e Verify UI projection and server enforcement for positive, negative, stale-session, revoked, cross-desk, and cross-compartment cases. Evidence: authorization suite. - [ ] V0.6 Define protected-source compartment, access-grant, emergency-access, disclosure, retention, and audit policy. Evidence: security/legal review. - [ ] V0.6.a Define compartment identity/key boundary and which source identifiers, contacts, communications, documents, locations, and linkage metadata are protected. Evidence: data-boundary model. - [ ] V0.6.b Define nominative/time-bound/purpose-bound access requests, approvals, step-up, session restrictions, revocation, and periodic review. Evidence: grant policy. - [ ] V0.6.c Define emergency-access eligibility, dual control where required, minimal disclosure, alerts, expiry, evidence preservation, and mandatory post-event review. Evidence: break-glass policy. - [ ] V0.6.d Define redacted projections for ordinary stories/reviews/search/ notifications/logs/analytics/exports/support and safe reidentification boundary. Evidence: disclosure rules. - [ ] V0.6.e Define retention/deletion/legal hold/key destruction/backup/ recovery and subject-safety exception behavior. Evidence: lifecycle policy. - [ ] V0.6.f Define tamper-evident access/attempt/export/disclosure audit with protected details visible only to authorized reviewers. Evidence: security/legal approval. - [ ] V0.7 Define editorial AI disclosure and acceptable-use policy. Evidence: authoring, publication, correction, and reader-visible requirements. - [ ] V0.7.a Classify allowed, approval-required, prohibited, and human-only AI uses across research, sourcing, drafting, verification, media, localization, distribution, correction, and moderation. Evidence: use matrix. - [ ] V0.7.b Define input restrictions for protected sources, personal/ licensed/embargoed/legal data, external providers, retention, and model training. Evidence: data-use policy. - [ ] V0.7.c Define per-change provenance, model/provider/version, prompt/tool/ source use, human acceptance, and audit requirements. Evidence: provenance policy. - [ ] V0.7.d Define internal reviewer and reader-visible disclosure thresholds by materiality, content type, target, locale, and correction status. Evidence: disclosure rules. - [ ] V0.7.e Define prohibited fabricated sources/quotes/citations/attribution, automated attestation/approval/publication/correction, and enforcement. Evidence: acceptable-use controls. - [ ] V0.7.f Define incident, correction, notification, model rollback, and retrospective duties for AI-caused errors. Evidence: governance review. - [ ] V0.8 Define conflicts, recusal, attestation independence, false-balance, corrections, takedown, and retraction policies. Evidence: ethics decision records. - [ ] V0.8.a Define personal/financial/political/source/advertiser/partner/ prior-work conflicts, declarations, scope, updates, and visibility. Evidence: conflict policy. - [ ] V0.8.b Define recusal effects on assignment, editing, review, attestation, publishing, correction, reassignment, and audit. Evidence: recusal policy. - [ ] V0.8.c Define attestor credential/domain/independence/conflict/ disagreement/expiry floors and prohibited manufactured independence. Evidence: attestation policy. - [ ] V0.8.d Define evidence-based counterclaim surfacing and false-balance suppression with uncertainty and human accountability. Evidence: balance decision record. - [ ] V0.8.e Distinguish clarification/update/correction/takedown/retraction, thresholds, authority, reader notice, distribution, appeal, and restoration. Evidence: remedy policy. - [ ] V0.8.f Define emergency/legal requests without silent deletion or retraction suppression and require immutable decisions. Evidence: ethics approvals. - [ ] V0.9 Threat-model source coercion, identity leakage, poisoned evidence, prompt injection, fabricated citations, defamation, legal exposure, embargo leak, account compromise, mass publishing, and retraction suppression. Evidence: mitigation/test map. - [ ] V0.9.a Map actors, assets, trust boundaries, data flows, privileged actions, public/distribution surfaces, and protected compartments. Evidence: threat-model diagrams. - [ ] V0.9.b Model coercion, impersonation, correlation, metadata/log/search/ notification leakage, compromised reviewer, and emergency-access abuse. Evidence: source-protection threats. - [ ] V0.9.c Model poisoned/malicious evidence, prompt/tool injection, fabricated/washed citations, provenance tamper, and correlated agent failure. Evidence: integrity threats. - [ ] V0.9.d Model defamation/privacy/contempt/rights exposure, unsafe media, false balance, election/emergency misuse, and jurisdictional conflict. Evidence: harm/legal threats. - [ ] V0.9.e Model embargo/schedule leak, credential/session compromise, mass publish/notification, correction/retraction suppression, and audit tamper. Evidence: operations threats. - [ ] V0.9.f Assign preventive/detective/recovery controls, owners, residual risk, abuse tests, monitoring, and review cadence to every scenario. Evidence: mitigation/test map. - [ ] V0.10 Define data classification for pitches, drafts, embargoes, source identities, communications, evidence, legal notes, unpublished media, analytics, and public content. Evidence: retention and residency rules. - [x] V0.10.a Inventory each named data class plus derived/indexed/cached/log/ backup/export/model-context forms and accountable owner. Evidence: data catalog. - [ ] V0.10.b Assign sensitivity, compartment, tenant/desk/story scope, lawful basis/purpose, and permitted actors/actions. Evidence: classification matrix. - [ ] V0.10.c Define encryption/key, region/residency/transfer, provider, masking/minimization, and device/offline restrictions. Evidence: handling rules. - [ ] V0.10.d Define active/archive/legal-hold/backup retention, deletion/ anonymization, correction preservation, and conflict resolution. Evidence: lifecycle schedule. - [ ] V0.10.e Define safe public/redacted/aggregate projections and prohibit protected data in analytics/search/logs/notifications/support/model training. Evidence: projection policy. - [ ] V0.10.f Verify rules against representative end-to-end flows and obtain privacy/security/legal/source-protection approval. Evidence: signed review. - [ ] V0.11 Define newsroom SLOs and success metrics without optimizing for volume at the expense of accuracy. Evidence: quality guardrails. - [ ] V0.11.a Define availability/latency/durability/freshness/recovery SLOs separately for protected authoring, publish, correction/retraction, and public read-back. Evidence: service objectives. - [ ] V0.11.b Define accuracy, citation/support, gate escape, correction propagation, source freshness, accessibility, and safety quality measures. Evidence: quality metric catalog. - [ ] V0.11.c Define measurement windows, denominators, exclusions, data lineage, privacy floors, uncertainty, and alert thresholds. Evidence: metric contracts. - [ ] V0.11.d Define balanced scorecard rules so speed/output/engagement/ revenue never override accuracy, protected-source, ethics, or correction obligations. Evidence: guardrail policy. - [ ] V0.11.e Define error budgets, stop-the-line conditions, escalation, remediation, and release consequences. Evidence: SLO policy. - [ ] V0.11.f Validate dashboards with known-value fixtures and prevent individual/source identification or automatic editorial scoring. Evidence: observability review. - [ ] V0.12 Ratify the NewsML-G2, IPTC Media Topics, C2PA, and CMS publication profiles. Evidence: standards decision record. - [ ] V0.12.a Pin standard/profile/schema/validator versions, namespaces, required/optional extensions, compatibility window, and update owner. Evidence: standards manifest. - [ ] V0.12.b Map internal stories/packages/planning/concepts/topics/rights/ embargo/update/correction fields to NewsML-G2/IPTC semantics. Evidence: mapping matrix. - [ ] V0.12.c Define governed IPTC topic selection, aliases, localization, deprecation, and internal taxonomy relationships. Evidence: vocabulary profile. - [ ] V0.12.d Define C2PA claims/ingredients/actions/signers/trust validation for media and article packages, including stripped/unknown provenance. Evidence: provenance profile. - [ ] V0.12.e Define CMS plan/publish/read-back/update/correct/retract behavior, target extensions, idempotency, and partial-failure compensation. Evidence: CMS profile. - [ ] V0.12.f Validate representative and edge-case fixtures, record deviations/interoperability findings, and obtain editorial/engineering approval. Evidence: decision record. - [ ] V0.13 Author and ratify `V1/VERITAS_NEWSROOM_WORKBENCH_DESIGN_2026-07-23.md` with current-state, host, roles, protected-source boundary, data, APIs, editorial policy, UI, standards, migration, rollout, and decision records. Evidence: approved doc and resolved review comments. - [ ] V0.13.a Document current applications/packages/routes/services/stores/ integrations, duplicate ownership, constraints, and known gaps. Evidence: current-state chapter. - [ ] V0.13.b Document target hosts/ownership/roles/protected-source and public boundaries, data contracts/stores/APIs/events/jobs, and threat controls. Evidence: architecture chapters. - [ ] V0.13.c Document editorial/ethics/AI/regulatory/standards/gate policies, raw measurement versus verdict, approvals, and remedies. Evidence: governance chapters. - [ ] V0.13.d Document task-led UI/IA, responsive/accessibility/offline/ performance states, semantic alternatives, and authorized reachability. Evidence: experience chapter. - [ ] V0.13.e Document migrations/compatibility, rollout/rollback, operations/ recovery/observability, verification, evidence, and launch criteria. Evidence: delivery chapters. - [ ] V0.13.f Record alternatives/decisions/owners/dates, resolve every substantive review comment, and obtain named ratification. Evidence: approved design. - [ ] V0.14 Reconcile every Veritas application, `libs/veritas/*` package, database entity, BFF/CMS/API route, reader walkthrough, agent, worker, scheduled job, and documented feature at atomic-feature level. Evidence: explicit dispositions cover ingestion, research/tips, editorial/claims, knowledge graph, multimedia/live, newsletter/social, multilingual, election/regulatory, community, notifications/emergency, reader/search/ recommendation, B2B/USSD, subscription/revenue, analytics, archive, and operations. - [x] V0.14.a Build a source inventory across code, schema, routes, navigation, walkthroughs, workers/jobs/agents, documentation, flags, and deployed integrations. Evidence: reconciliation inputs. - [ ] V0.14.b Split each source item into atomic user/operator/system capabilities with host, audience, owner, dependencies, data class, and current implementation status. Evidence: atomic ledger. - [ ] V0.14.c Cover ingestion/research/tips, editorial/claims/graph, multimedia/live, newsletter/social/messaging, multilingual/election/ regulatory, and community explicitly. Evidence: editorial coverage. - [ ] V0.14.d Cover reader/search/recommendation/archive, notifications/ emergency, B2B/USSD/voice, subscriptions/revenue/analytics, and operations explicitly. Evidence: audience/operations coverage. - [ ] V0.14.e Assign keep/consolidate/migrate/replace/deprecate/remove/ externalize decisions with rationale, target owner/host, dependencies, and delivery/expiry. Evidence: disposition ledger. - [ ] V0.14.f Reconcile ledger to routes/packages/entities/contracts/tests and fail any orphan, duplicate owner, unknown feature, or unreviewed row. Evidence: completeness gate. - [ ] V0.15 Define the boundary among protected newsroom authoring, public reader/mobile, source/tip intake, live/community moderation, commercial operations, B2B developer, USSD/voice, and platform-operator surfaces. Evidence: every retained capability has one host and audience plus a redacted handoff where appropriate. - [ ] V0.15.a Define audience/trust/data/action boundaries for each named surface and prohibit shared UI/service assumptions that cross them. Evidence: surface boundary matrix. - [ ] V0.15.b Assign every retained capability and privileged mutation to one canonical host/owner, with authorized role/project/channel context. Evidence: host ledger. - [ ] V0.15.c Define typed redacted handoffs for tips, public feedback, moderation, live operations, commercial conflicts, B2B consumption, and operator incidents. Evidence: handoff contracts. - [ ] V0.15.d Define identity/session/token/deep-link/storage/logging/ notification separation and step-up transitions between surfaces. Evidence: security model. - [ ] V0.15.e Define public correction/retraction and emergency propagation without granting public/commercial/channel systems editorial authority. Evidence: control-flow diagrams. - [ ] V0.15.f Test authorized journeys and attempted cross-surface field/ function/object access; eliminate duplicate mutations. Evidence: boundary suite. - [ ] V0.16 Ratify Ghana NMC/editorial, election-period, data-protection, accessibility, child/trauma, advertising/sponsorship, payment, emergency broadcast, and platform-channel obligations separately. Evidence: jurisdiction/version/owner matrix and feature-specific enforcement plan. - [ ] V0.16.a Identify current authoritative obligations, jurisdiction/scope/ effective date/version/review cadence, counsel or specialist owner, and conflicts for each named regime. Evidence: obligation register. - [ ] V0.16.b Translate NMC/editorial/election obligations into content/ source/claim/review/schedule/publish/complaint/remedy controls. Evidence: editorial enforcement map. - [ ] V0.16.c Translate data-protection/accessibility/child/trauma obligations into collection, minimization, consent, display, distribution, retention, request, and review controls. Evidence: rights/safety map. - [ ] V0.16.d Translate advertising/sponsorship/payment obligations into separation, disclosure, consent, entitlement, refund, audit, and newsroom-independence controls. Evidence: commercial map. - [ ] V0.16.e Translate emergency-broadcast and each platform/channel rule into authority, template, targeting, delivery, correction/recall, moderation, rate, and archival controls. Evidence: channel map. - [ ] V0.16.f Link each obligation to feature/code-owned floor, policy version, tests/evidence/approver, operator runbook, and update trigger; record unresolved legal questions. Evidence: ratified matrix. ### V1 — Story, source, claim, evidence, and editorial contracts - [ ] V1.1 Define story, pitch, assignment, draft, block, headline, dek, byline, topic, desk, edition, package, media, and publish-target entities. Evidence: schema fixtures. - [ ] V1.1.a Define stable identity, tenant/newsroom/desk/project scope, lifecycle, version, timestamps, actor, and audit fields for each entity. Evidence: base schemas. - [ ] V1.1.b Define pitch→assignment→story→draft/block and headline/dek/byline ownership/cardinality/order/reference invariants. Evidence: editorial relationship fixtures. - [ ] V1.1.c Define topic/desk/edition/package/media/publish-target membership, locale/territory/rights, scheduling, and release relationships. Evidence: distribution fixtures. - [ ] V1.1.d Define state-transition, deletion/archive, validation, unknown enum, and cross-tenant reference constraints. Evidence: schema invariant tests. - [ ] V1.1.e Publish storage/API/event/read-model schemas with versioning and representative valid/invalid fixtures. Evidence: contract package. - [ ] V1.2 Define immutable draft revisions and semantic block/range anchors. Evidence: paragraph, quote, claim, and comment anchors survive edits or become explicitly orphaned. - [ ] V1.2.a Define immutable revision identity, parent(s), author, cause, schema/editor version, created time, and content hash. Evidence: revision contract. - [ ] V1.2.b Define stable block identity/type/order and semantic text-range anchors with context/fingerprint/affinity. Evidence: anchor schema. - [ ] V1.2.c Define deterministic anchor mapping across insert/delete/move/ split/merge/replace and concurrent-operation histories. Evidence: transformation tests. - [ ] V1.2.d Preserve paragraph/quote/claim/citation/comment/review anchors or mark ambiguous/orphaned with candidates and reason; never silently retarget. Evidence: edit corpus. - [ ] V1.2.e Define restore/branch/merge/compaction/migration and archival behavior without mutating historical revisions. Evidence: history tests. - [ ] V1.3 Use the canonical 15-kind source vocabulary. Evidence: no lossy fallback to the smaller legacy type enum. - [ ] V1.3.a Pin the canonical 15 identifiers, labels, definitions, permitted locators/metadata, and unknown/extension policy. Evidence: vocabulary contract. - [ ] V1.3.b Inventory every legacy/API/client/storage/index/import/export source enum and its consumers. Evidence: usage ledger. - [ ] V1.3.c Map each legacy value losslessly or require explicit review/ refusal for ambiguous values; never collapse to an approximate kind. Evidence: migration matrix. - [ ] V1.3.d Update validation/forms/search/facets/scoring/gates/NewsML/CMS adapters to preserve the canonical kind. Evidence: integration tests. - [ ] V1.3.e Round-trip all 15 kinds and unknown historical inputs across storage/API/UI/jobs/export. Evidence: kind fixture suite. - [ ] V1.4 Define source identity separately from protected identity details. Evidence: ordinary source records cannot expose compartment secrets. - [ ] V1.4.a Define ordinary source pseudonymous/public identity, descriptive metadata, type, publisher/organization, quality, and safe display key. Evidence: ordinary source schema. - [ ] V1.4.b Define separately encrypted/compartmented legal/contact/ communications/location/safety/linkage identity details and keys. Evidence: protected schema. - [ ] V1.4.c Define opaque join/reference/tokenization and authorized reveal/ reidentification workflows without inferable sequential identifiers. Evidence: boundary contract. - [ ] V1.4.d Define redacted projections for stories, claims, reviews, search, notifications, logs, analytics, exports, backups, and public products. Evidence: projection fixtures. - [ ] V1.4.e Test object/field/function/correlation access across roles, tenants, compartments, revocation, and emergency grants. Evidence: negative suite. - [ ] V1.5 Define source quality vector, domain weight profile, band, adjustments, reasons, evaluator version, and evidence. Evidence: canonical algorithm fixture. - [ ] V1.5.a Define each raw factor’s meaning, domain/range/unit, missing/ unknown handling, evidence locator, and measurement provenance. Evidence: factor schema. - [ ] V1.5.b Define versioned domain weight profiles, applicability, normalization, combination/rounding, band thresholds, and confidence. Evidence: algorithm specification. - [ ] V1.5.c Define manual adjustment direction/magnitude/floor/cap/reason/ evidence/authority/expiry and keep it separate from raw measurement. Evidence: adjustment contract. - [ ] V1.5.d Define result identity, source/revision/domain, evaluator/ weights/policy versions, inputs, timestamp, staleness, and supersession. Evidence: result schema. - [ ] V1.5.e Publish hand-calculated positive/boundary/missing/adversarial fixtures and property invariants. Evidence: canonical goldens. - [ ] V1.6 Define claim class, text, anchor, severity/risk, confidence band, retraction state, supporting sources, counter-sources, and status. Evidence: canonical contract invariants. - [ ] V1.6.a Define claim identity/class/text/normalized proposition, story/ draft/revision/anchor scope, author/origin, and lifecycle. Evidence: claim schema. - [ ] V1.6.b Define independent severity/harm/legal risk, evidential confidence, verification/editorial status, and contested/retraction state vocabularies. Evidence: state model. - [ ] V1.6.c Define typed supporting/contradicting/contextual/irrelevant source links with citation locator, assessment, version, and reviewer. Evidence: evidence-link schema. - [ ] V1.6.d Define status-transition, minimum evidence, stale-source, counter-source, merge/split, anchor orphan, correction, and retraction invariants. Evidence: contract tests. - [ ] V1.6.e Define protected/public/read-model projections and prohibit confidence/status conflation or unsupported “verified” defaults. Evidence: projection fixtures. - [ ] V1.7 Define citation locator types for page, section, paragraph, quote, dataset slice, court record, transcript, audio/video timecode, image region, and URI fragment. Evidence: validation fixtures. - [ ] V1.7.a Define a discriminated locator contract with common source/ revision/content-hash identity and kind-specific fields. Evidence: locator schema. - [ ] V1.7.b Define page/section/paragraph/quote locators with numbering, labels, text/context fingerprints, editions, and range rules. Evidence: document fixtures. - [ ] V1.7.c Define dataset/court/transcript locators with table/query/row/ column/cell, jurisdiction/docket/filing, speaker/turn/line semantics. Evidence: structured fixtures. - [ ] V1.7.d Define media/URI locators with time/range/track/frame/region/ coordinate/version/fragment and bounded normalization. Evidence: media/ web fixtures. - [ ] V1.7.e Define resolution/unreachable/changed/ambiguous/stale handling and prohibit silent relocation to new source content. Evidence: validation corpus. - [ ] V1.8 Define evidence packs with story/claim/source membership, reviewer, state, version, and integrity hash. Evidence: referential-integrity tests. - [ ] V1.8.a Define immutable pack identity/version/parent, story/draft/ revision scope, purpose, creator, created time, and integrity algorithm. Evidence: pack schema. - [ ] V1.8.b Define ordered typed membership for claims/sources/citations/ excerpts/media/measurements/attestations with pinned versions/hashes. Evidence: membership schema. - [ ] V1.8.c Define draft/in-review/approved/rejected/superseded/invalid state, reviewer/quorum/decision, and mutation-invalidates-approval rules. Evidence: pack state machine. - [ ] V1.8.d Define canonical serialization/hash/signature verification and behavior for missing, changed, unauthorized, or retracted members. Evidence: integrity tests. - [ ] V1.8.e Test cross-story/tenant/compartment references, duplicate/ circular membership, stale versions, and tampering. Evidence: referential-integrity suite. - [ ] V1.9 Define counterclaim and unsupported-claim entities without manufacturing equivalence. Evidence: canonical four-way surfacing result. - [ ] V1.9.a Define counterclaim identity/proposition/class/origin/anchor/ evidence/confidence/status and relation to one or more subject claims. Evidence: counterclaim schema. - [ ] V1.9.b Define unsupported-claim reason, missing evidence, attempted verification, severity, owner, remediation, and allowed disposition. Evidence: unsupported schema. - [ ] V1.9.c Define versioned measurements for relevance, evidential quality, independence, consensus, harm, uncertainty, and false-balance risk. Evidence: assessment contract. - [ ] V1.9.d Define four distinct surfacing results—surface, suppress false balance, require more evidence, editorial review—with reason/evidence/ policy version. Evidence: decision schema. - [ ] V1.9.e Test that popularity/number of sources alone cannot create equivalence and that contested/unknown/evaluator failure never becomes settled. Evidence: invariant fixtures. - [ ] V1.10 Define attestor identity, scope, credential, domain, conflict, validity, disagreement, and decision. Evidence: attestation invariants. - [ ] V1.10.a Define attestor person/organization/service identity and verified contact/credential references separate from public display identity. Evidence: identity schema. - [ ] V1.10.b Define attestation scope over exact claim/source/evidence-pack/ draft revision, domain/jurisdiction, question, and permitted conclusion. Evidence: scope contract. - [ ] V1.10.c Define credential/issuer/verification/domain fit, conflict/ independence declaration, validity window, revocation, and expiry. Evidence: eligibility schema. - [ ] V1.10.d Define agree/disagree/qualified/abstain/unable decisions with rationale/evidence/uncertainty, signature, and immutable timestamp. Evidence: decision contract. - [ ] V1.10.e Define disagreement aggregation, quorum, specialist floors, supersession, stale-input invalidation, and public/redacted projection. Evidence: attestation invariants. - [ ] V1.11 Define correction notes, prior public version, reader-visible change, distribution action, and affected claims. Evidence: chronological and text-match invariants. - [ ] V1.11.a Define correction identity/type/severity/status/reason/discovery/ owner, exact story/release/locale/target, and immutable chronology. Evidence: correction schema. - [ ] V1.11.b Pin prior and replacement public revisions/blocks/ranges/text/ media with semantic diff and hashes. Evidence: version-link contract. - [ ] V1.11.c Define affected claims/citations/sources/packages and whether evidential confidence, status, or downstream content changes. Evidence: impact schema. - [ ] V1.11.d Define reader-visible note wording/placement/timestamp/history and target-specific update/replace/notify actions. Evidence: notice/ action schema. - [ ] V1.11.e Enforce prior-text match, chronological append-only history, immutable published evidence, idempotency, and correction-of-correction. Evidence: invariant tests. - [ ] V1.12 Define retraction cascade, cause, source/claim/story graph, actions, target states, owner, progress, and verification. Evidence: schema. - [ ] V1.12.a Define cascade identity/cause/scope/severity/authority/trigger/ source revision and required emergency/standard process. Evidence: cascade schema. - [ ] V1.12.b Represent affected source→citation→claim→story→package→target dependency graph with versioned discovery and completeness state. Evidence: impact graph. - [ ] V1.12.c Define per-node/edge retain-correct-withdraw-retract-unpublish/ notify/reindex/invalidate actions and desired target state. Evidence: action plan schema. - [ ] V1.12.d Define owner/approval/dependency/order/attempt/idempotency/ progress/failure/retry/compensation state per action. Evidence: execution schema. - [ ] V1.12.e Define downstream read-back verification, unresolved/unsupported target handling, closure criteria, audit, and reopen behavior. Evidence: verification contract. - [ ] V1.13 Define embargo, schedule, exclusivity, rights, territory, and syndication metadata. Evidence: policy tests. - [ ] V1.13.a Define embargo policy independently from editorial/release state with start/end/event trigger/time zone/authority/beneficiaries. Evidence: embargo schema. - [ ] V1.13.b Define schedule windows, target/locale/edition dependencies, readiness conditions, retries, missed-window, and reschedule semantics. Evidence: schedule schema. - [ ] V1.13.c Define exclusivity type/party/window/channel/exception and relationship to embargo, rights, and syndication. Evidence: exclusivity contract. - [ ] V1.13.d Define rights holder/license/use/format/channel/territory/ language/duration/attribution/fee/expiry and proof. Evidence: rights schema. - [ ] V1.13.e Define syndication partner/package/transform/attribution/ correction-retraction obligations and validate overlapping/conflicting/ expired policies. Evidence: policy tests. - [ ] V1.14 Define NewsML-G2 News Item, Package Item, Concept/Knowledge Item, Planning Item, and update/correction mappings. Evidence: profile matrix. - [ ] V1.14.a Map story releases and media renditions to News Item identity, version/status, content metadata, rights, subjects, and content sets. Evidence: News Item mapping. - [ ] V1.14.b Map editions/collections/related coverage and ordered/ role-qualified membership to Package Items. Evidence: Package mapping. - [ ] V1.14.c Map people/organizations/places/events/topics/claims and their aliases/relationships/validity/provenance to Concept/Knowledge Items. Evidence: concept mapping. - [ ] V1.14.d Map assignments/coverage plans/schedules/embargoes/deliverables/ contacts to Planning Items without leaking protected sources. Evidence: planning mapping. - [ ] V1.14.e Define initial/update/correction/replacement/retraction version chains, signals, prior references, and target read-back. Evidence: lifecycle matrix. - [ ] V1.14.f Validate required/optional/extension/cardinality/code-list rules against the pinned profile and goldens. Evidence: profile tests. - [ ] V1.15 Define C2PA media and article-package provenance relationships. Evidence: ingredient and editing lineage fixture. - [ ] V1.15.a Define claim generators/signers/trust stores/identities and supported C2PA version/algorithms/assertions. Evidence: trust profile. - [ ] V1.15.b Map original media captures/imports as ingredients with hashes, capture/source metadata, rights, and protected-data minimization. Evidence: ingredient schema. - [ ] V1.15.c Record edit/transform/AI/action lineage, tools/versions/ parameters, ingredient relationships, and derived renditions. Evidence: action lineage. - [ ] V1.15.d Relate article/package manifests to exact media/article revisions, NewsML/CMS release, corrections, and replacements. Evidence: package relationship. - [ ] V1.15.e Define valid/tampered/stripped/unknown/untrusted/expired states and display/gate behavior without treating absence as falsity. Evidence: validation fixtures. - [ ] V1.16 Define version compatibility with existing Veritas records. Evidence: migration goldens. - [ ] V1.16.a Inventory deployed record/event/blob/index/API/client/CMS/ distribution versions and historical edge cases. Evidence: version corpus. - [ ] V1.16.b Define support window and per-version read/write/migrate/export/ rollback behavior for every contract in V1. Evidence: compatibility matrix. - [ ] V1.16.c Write deterministic adapters/migrations for renamed/split/ merged/encrypted/compartmented/versioned fields with explicit loss. Evidence: migration code/tests. - [ ] V1.16.d Rebuild indexes/read models and reconcile references/hashes/ anchors/state/history after migration. Evidence: rehearsal report. - [ ] V1.16.e Round-trip goldens through old/current readers and writers, interrupted retries, unknown fields, and downgrade refusal. Evidence: migration suite. - [ ] V1.16.f Document irreversible steps, backup/restore, rollout/rollback, telemetry, and operator approval. Evidence: migration runbook. ### V2 — Pitch, assignment, research, and source registry - [ ] V2.1 Build zero-form pitch capture with desk, topic, thesis, public interest, urgency, location, sources, risks, format, and target window. Evidence: keyboard-first journey. - [ ] V2.1.a Define a fast capture command/inbox entry with minimal required text, reporter identity, timestamp, origin, and draft privacy. Evidence: capture contract. - [ ] V2.1.b Add progressive structured extraction/editing for desk/topic/ thesis/public interest/urgency/location/format/window without blocking initial capture. Evidence: field tests. - [ ] V2.1.c Attach existing/new/protected source references and safety/legal/ conflict/embargo risks through authorized redacted projections. Evidence: source/risk tests. - [ ] V2.1.d Support save/duplicate/merge/submit/park/discard with autosave, stable identity, validation, audit, and explicit state. Evidence: lifecycle tests. - [ ] V2.1.e Complete capture/triage/edit/submit using keyboard and screen reader on responsive web/desktop without a long mandatory form. Evidence: keyboard-first E2E. - [ ] V2.2 Build story-angle and headline divergence behind the fenced provider seam. Evidence: exact outputs, attribution, and no auto-selection. - [ ] V2.2.a Define request contract with pinned pitch/story revision, allowed source excerpts, constraints, locale/desk/style, count, and budget. Evidence: provider request schema. - [ ] V2.2.b Generate materially distinct angle and headline candidates separately, preserving factual constraints and protected-data policy. Evidence: known-input tests. - [ ] V2.2.c Return exact candidate text, rationale, source-use/citations, model/provider/prompt/version, cost, uncertainty, and safety results. Evidence: attributed response. - [ ] V2.2.d Present unranked or transparently scored candidates for human compare/edit/accept/reject with no hidden winner or automatic mutation. Evidence: selection tests. - [ ] V2.2.e Evaluate duplication, factual drift, sensationalism, source invention, protected leakage, provider failure, and deterministic replay. Evidence: divergence eval. - [ ] V2.3 Build pitch comparison with novelty, evidence readiness, risk, audience, production scope, and conflict views. Evidence: score provenance. - [ ] V2.3.a Define comparable raw measures, units, missing/unknown handling, weights/policies, and provenance for each named dimension. Evidence: comparison contract. - [ ] V2.3.b Select two or more pitch revisions and show normalized side-by- side thesis/source/evidence/risk/audience/scope/conflict differences. Evidence: comparison UI tests. - [ ] V2.3.c Show measurement evidence, evaluator/weight/policy versions, uncertainty, freshness, and manual adjustments rather than opaque scores. Evidence: provenance tests. - [ ] V2.3.d Preserve protected-source redaction and prevent count/timing/ similarity leakage to unauthorized comparators. Evidence: auth tests. - [ ] V2.3.e Record commission/merge/park/kill decision with chosen revision, rationale, conflicts/recusal, dissent, and no automatic selection. Evidence: decision audit. - [ ] V2.4 Build assignment planning with owner, contributors, deadlines, deliverables, budget, embargo, dependencies, and safety plan. Evidence: state and notification tests. - [ ] V2.4.a Define assignment identity/story/pitch revision, accountable owner, role-qualified contributors, desk, state, priority, and scope. Evidence: assignment schema. - [ ] V2.4.b Define milestone/deadline/time-zone/deliverable/format/locale/ target acceptance criteria and dependency graph. Evidence: plan schema. - [ ] V2.4.c Define budget/currency/approval/spend constraints, embargo/ exclusivity/rights, and fieldwork/source/data/media safety plan. Evidence: constraint schema. - [ ] V2.4.d Implement propose/accept/decline/reassign/update/pause/complete/ cancel transitions with reason, optimistic concurrency, and audit. Evidence: state tests. - [ ] V2.4.e Send permission-filtered deadline/dependency/risk/change/ escalation notifications without embargo or protected-source leakage. Evidence: notification suite. - [ ] V2.5 Build protected-source onboarding in a compartmented workflow. Evidence: step-up authorization and redacted audit. - [ ] V2.5.a Begin onboarding from an authorized story/tip with purpose, pseudonymous ordinary source record, compartment request, and safety assessment. Evidence: initiation tests. - [ ] V2.5.b Capture identity/contact/communications/relationship/consent/ risk details only inside the encrypted compartment with minimization. Evidence: storage inspection. - [ ] V2.5.c Verify source-protection role, step-up, grant/quorum/expiry, device/session restrictions, and emergency contact rules. Evidence: authorization tests. - [ ] V2.5.d Create opaque linkage/redacted projections for assignment, claims, evidence, reviews, notifications, logs, search, and exports. Evidence: projection tests. - [ ] V2.5.e Exercise onboard/update/revoke/reidentify/emergency-access/ retention/legal-hold workflows with tamper-evident redacted audit. Evidence: protected-source E2E. - [ ] V2.6 Build public-source intake from URL, document, feed, wire, dataset, court record, transcript, image, audio, and video. Evidence: kind-specific validation. - [ ] V2.6.a Define intake request/status/result contracts and kind-specific metadata/locator/rights/language/size/type requirements. Evidence: source intake schemas. - [ ] V2.6.b Implement URL/feed/wire fetch through allowlisted network policy with redirects, robots/license/rate, authenticity, and capture metadata. Evidence: remote intake tests. - [ ] V2.6.c Implement document/dataset/court/transcript parsing with format/ structure/encoding/schema/table/docket/speaker validation. Evidence: structured intake tests. - [ ] V2.6.d Implement image/audio/video ingest with media probing, duration/ dimensions/tracks, metadata privacy, transcripts/proxies, and safe preview. Evidence: media intake tests. - [ ] V2.6.e Classify canonical source kind, deduplicate without destroying provenance, preserve failures/quarantine, and require human metadata/ rights review. Evidence: intake journey. - [ ] V2.7 Quarantine and scan remote/downloaded content. Evidence: malicious file, SSRF, redirect, archive, and decompression corpus. - [ ] V2.7.a Place all untrusted bytes in isolated non-executable quarantine before parsing/preview/indexing/model use. Evidence: storage boundary tests. - [ ] V2.7.b Enforce URL scheme/host/IP/port/redirect/DNS/private-network/ credential/size/time policy at every fetch hop. Evidence: SSRF corpus. - [ ] V2.7.c Detect type/signature mismatch, malware/active content/polyglots, malformed media, and unsafe parser conditions. Evidence: scan corpus. - [ ] V2.7.d Enforce archive path/symlink/nesting/member/count/ratio/ decompressed-size limits and scan every extracted member. Evidence: archive bomb tests. - [ ] V2.7.e Record scan engine/signature/policy versions and release/reject/ manual-review decisions; rescan on updates. Evidence: quarantine audit. - [ ] V2.7.f Test timeout/crash/partial scan/unknown type/false-positive override with no unscanned content escaping. Evidence: failure suite. - [ ] V2.8 Preserve original bytes, fetch metadata, checksum, extraction, capture time, and rights. Evidence: immutable source evidence. - [ ] V2.8.a Store original bytes in immutable content-addressed blobs after quarantine with tenant/compartment encryption and retention policy. Evidence: blob tests. - [ ] V2.8.b Record origin URL/provider/request/redirect/headers/status/ filename/MIME/size/fetcher/version and trusted clock capture time. Evidence: fetch manifest. - [ ] V2.8.c Compute/version strong checksums for original and every derived extraction/proxy/transcript/snapshot with parent lineage. Evidence: integrity tests. - [ ] V2.8.d Record extractor/parser/model/version/config/output/errors and exact source ranges so derived text remains traceable. Evidence: extraction provenance. - [ ] V2.8.e Capture rights/license/terms/territory/expiry/attribution/proof separately from factual provenance and block unsupported use. Evidence: rights tests. - [ ] V2.8.f Prove later refetch/update cannot overwrite originals and that export/read-back verifies bytes, metadata, and chain. Evidence: immutable evidence suite. - [ ] V2.9 Build source-quality scoring from the canonical composite and domain weights. Evidence: independently verified known values. - [ ] V2.9.a Implement each raw factor as a versioned pure measurement with evidence, unit, missing/unknown state, and no policy verdict. Evidence: factor tests. - [ ] V2.9.b Resolve the applicable pinned domain-weight profile and validate completeness/ranges/normalization before computation. Evidence: profile tests. - [ ] V2.9.c Implement the canonical combine/adjust/round/band/confidence algorithm exactly and preserve all intermediate values. Evidence: algorithm tests. - [ ] V2.9.d Persist result/source revision/evaluator/weight/policy/corpus versions and mark stale when inputs or policy change. Evidence: provenance tests. - [ ] V2.9.e Compare independently hand-calculated positive/boundary/missing/ adversarial fixtures and cross-language implementations. Evidence: known-value report. - [ ] V2.10 Build source review with factor evidence, manual adjustments, conflict, attestation, and expiry. Evidence: override authorization. - [ ] V2.10.a Show source identity/redacted projection, revision, raw factors, locators, measurements, algorithm, band, confidence, freshness, and prior reviews. Evidence: review UI. - [ ] V2.10.b Require factor-by-factor inspect/confirm/challenge/recompute and preserve reviewer disagreement instead of overwriting measurements. Evidence: review tests. - [ ] V2.10.c Implement bounded manual adjustment with authorized role, direction/value/reason/evidence, conflict/recusal, and second approval where required. Evidence: override tests. - [ ] V2.10.d Attach applicable attestation with exact scope, credential, independence, decision, expiry, and redacted protected-source handling. Evidence: attestation tests. - [ ] V2.10.e Set review/adjustment/attestation expiry and stale triggers for source updates, retractions, policy/weight changes, or new contrary evidence. Evidence: lifecycle tests. - [ ] V2.10.f Record immutable approve/reject/request-evidence/contest/ override decisions and prohibit unauthorized direct score edits. Evidence: authorization/audit suite. - [ ] V2.11 Build source search, dedupe, relationship, publisher history, and retraction history. Evidence: protected fields never enter the index. - [ ] V2.11.a Define permission-aware indexed safe fields, tokenization/ language, facets, freshness, deletion, and compartment exclusion. Evidence: search schema. - [ ] V2.11.b Implement exact/fuzzy/semantic retrieval with stable pagination, result reasons, current source revision, and no protected count/snippet/ suggestion/timing leaks. Evidence: search tests. - [ ] V2.11.c Implement deterministic/explainable duplicate candidates using public identifiers, publisher, content hashes, locators, and reviewed merge/link/not-duplicate decisions. Evidence: dedupe tests. - [ ] V2.11.d Model source/publisher/ownership/derivation/citation/translation/ syndication relationships with temporal validity and provenance. Evidence: relationship tests. - [ ] V2.11.e Show publisher correction/retraction/reliability history with evidence, scope, version, and no automatic guilt-by-association verdict. Evidence: history tests. - [ ] V2.11.f Inspect index/documents/logs/cache/analytics under two tenants and compartments to prove protected fields never enter search. Evidence: leakage suite. - [ ] V2.12 Build source communications references without storing plaintext in ordinary newsroom tables. Evidence: vault/secure-system links and access audit. - [ ] V2.12.a Define opaque communication-reference contract for external secure-system/provider/conversation/item identity, type, time, and safe label. Evidence: reference schema. - [ ] V2.12.b Store addresses, message bodies, attachments, keys, and sensitive metadata only in approved compartment/vault systems. Evidence: storage inspection. - [ ] V2.12.c Implement authorized create/link/open/verify/unlink with step-up, short-lived scoped tokens, current access grants, and safe return. Evidence: access journey. - [ ] V2.12.d Provide redacted ordinary projections that reveal only existence and workflow state when authorized, never participant/content metadata. Evidence: projection tests. - [ ] V2.12.e Audit attempts and successful access/export without copying plaintext into ordinary audit/log/notification/search/analytics data. Evidence: audit tests. - [ ] V2.13 Build research notebook and evidence-board views. Evidence: every excerpt remains anchored to a source. - [ ] V2.13.a Define notebook note/question/hypothesis/task/excerpt/entity/ relationship/timeline item and board grouping/order/link contracts. Evidence: workspace schema. - [ ] V2.13.b Create excerpts only from pinned source revisions with exact locator/text/hash/context and protected/redacted identity semantics. Evidence: anchoring tests. - [ ] V2.13.c Support authoring/linking/grouping/filtering/reordering/status/ assignment without converting notes or hypotheses into verified claims. Evidence: editor tests. - [ ] V2.13.d Detect source change/retraction/unreachable locator and show stale/orphan/candidate remap with explicit reviewer action. Evidence: update tests. - [ ] V2.13.e Support collaborative revision/comments/offline conflicts/ export with story/compartment permissions and legal holds. Evidence: collaboration tests. - [ ] V2.13.f Verify every displayed/exported excerpt resolves to exact source evidence or is visibly unresolved. Evidence: integrity gate. - [ ] V2.14 Build story cluster and related coverage suggestions. Evidence: human acceptance and model/version attribution. - [ ] V2.14.a Define candidate inputs/features/exclusions and cluster/ relationship types without exposing protected or embargoed material. Evidence: suggestion contract. - [ ] V2.14.b Generate cluster membership/related-story suggestions with similarity/evidence/rationale, confidence/uncertainty, and freshness. Evidence: model tests. - [ ] V2.14.c Attribute model/provider/version/config/index/source revisions, cost, and generation time; retain raw result separately from decisions. Evidence: provenance record. - [ ] V2.14.d Let editors accept/reject/merge/split/relabel suggestions individually with rationale and no automatic public curation/ranking. Evidence: decision tests. - [ ] V2.14.e Evaluate duplication, topic drift, feedback loops, subgroup/ language performance, correction/retraction propagation, and stale suggestions. Evidence: calibrated report. - [ ] V2.15 Build source update/retraction preview. Evidence: read-only blast radius across claims, stories, packages, newsletters, social, audio, video, and archives. - [ ] V2.15.a Ingest or draft a source update/retraction event with exact source/revision, publisher evidence, cause, scope, time, confidence, and verification state. Evidence: event contract. - [ ] V2.15.b Traverse versioned source→citation→claim→story→package→target dependencies without performing mutations. Evidence: impact query. - [ ] V2.15.c Include draft/published stories, packages, newsletters, social, audio/video timecodes, archives/search, B2B/channel consumers, and unknown/unregistered edges. Evidence: coverage tests. - [ ] V2.15.d Show exact affected locator/claim/release/target, current state, proposed remedy, owner, urgency, confidence, and permission-filtered redaction. Evidence: preview UI. - [ ] V2.15.e Pin the preview graph/version and require a separately authorized correction/retraction plan before any downstream action. Evidence: read-only enforcement. - [ ] V2.15.f Verify completeness against registered consumers and display unresolved/stale/unauthorized targets rather than reporting a safe blast radius. Evidence: reconciliation tests. - [ ] V2.16 Build decision records for pitch commission, kill, park, merge, and reassignment. Evidence: rationale and source state preserved. - [ ] V2.16.a Define immutable decision identity/type/actor/role/time and exact pitch/story/assignment/source/evidence revisions considered. Evidence: decision schema. - [ ] V2.16.b Require decision-specific rationale, public-interest/novelty/ readiness/risk/scope/conflict considerations, uncertainty, and dissent. Evidence: policy validation. - [ ] V2.16.c For commission, create a linked assignment without mutating the original pitch/evidence snapshot. Evidence: commission tests. - [ ] V2.16.d For kill/park, record retention/reopen/review conditions and preserve sources, safety restrictions, and legal holds. Evidence: disposition tests. - [ ] V2.16.e For merge/reassign, preserve lineage, duplicate identity, source/compartment grants, deadlines, ownership acceptance, and audit. Evidence: transfer tests. - [ ] V2.16.f Enforce roles/recusal/concurrency and prohibit model/agent impersonation or silent state change. Evidence: authorization tests. - [ ] V2.17 Build ingestion operations for feed/source schedules, crawl and social monitors, normalization, language detection, dedupe, clustering, retries, quarantine, source health, rate limits, robots/licensing policy, and operator replay. Evidence: live item-to-story-cluster lineage and failure journey. - [ ] V2.17.a Define feed/source/crawl/social monitor configuration, owner, credential reference, schedule, cursor, locale/territory, policy, and enabled state. Evidence: monitor contracts. - [ ] V2.17.b Implement due scheduling, leases, concurrency, backoff/jitter, rate/provider quotas, cancellation, missed runs, and no duplicate active run. Evidence: scheduler tests. - [ ] V2.17.c Enforce robots/licensing/terms/allowlist/network/redirect/ credential policy before fetch and record policy version/decision. Evidence: fetch policy tests. - [ ] V2.17.d Preserve raw response/item bytes and fetch provenance, then quarantine/scan/unpack/parse with isolated failures. Evidence: intake trace. - [ ] V2.17.e Normalize identifiers/times/authors/publishers/topics/content/ media/rights while retaining original values and transform lineage. Evidence: normalization tests. - [ ] V2.17.f Detect language/script with uncertainty and human correction; deduplicate exact/near/updated/syndicated items without losing sources. Evidence: language/dedupe tests. - [ ] V2.17.g Generate reviewed story-cluster candidates with versioned model/ features/evidence and preserve correction/retraction relationships. Evidence: clustering tests. - [ ] V2.17.h Expose source health/run/item/quarantine/error/dead-letter/ retry/replay state with permissioned logs and trace correlation. Evidence: operations UI. - [ ] V2.17.i Make replay idempotent against pinned raw inputs/config/code and prevent re-notification or auto-publication. Evidence: replay tests. - [ ] V2.17.j Run live item→raw evidence→normalized item→cluster lineage plus outage/rate/policy/malware/parser/poison-item recovery. Evidence: end-to-end journey. - [ ] V2.18 Build anonymous tip intake and investigative triage with secure submission, attachment scanning, identity/minimization choices, receipt code, threat/safety assessment, protected assignment, retention, and source conversion. Evidence: no ordinary newsroom log, notification, analytics event, or search index reveals the tipster. - [ ] V2.18.a Define an isolated public intake surface with current threat guidance, no required identity, locale/accessibility, rate/abuse controls, and safe emergency alternatives. Evidence: intake design. - [ ] V2.18.b Collect tip text and optional contact/identity/minimization/ consent/retention choices into the protected compartment only. Evidence: storage tests. - [ ] V2.18.c Upload attachments directly to quarantine with metadata minimization, malware/archive/media scanning, and no ordinary preview. Evidence: attachment tests. - [ ] V2.18.d Issue a high-entropy nonenumerable receipt code and protected status/reply channel with no existence, timing, or identity oracle. Evidence: receipt tests. - [ ] V2.18.e Triage credibility/urgency/coercion/retaliation/legal/physical/ digital safety with trained roles, step-up, and protected notes. Evidence: safety triage. - [ ] V2.18.f Create a redacted protected assignment and least-privilege grants without disclosing tip content/source beyond need to know. Evidence: assignment tests. - [ ] V2.18.g Convert to a source only through explicit authorized review, preserving tip lineage/choices/consent and not inventing identity. Evidence: conversion tests. - [ ] V2.18.h Apply retention/deletion/legal hold/emergency access and redacted tamper-evident audit. Evidence: lifecycle tests. - [ ] V2.18.i Inspect ordinary DB/logs/errors/traces/notifications/search/ analytics/cache/backups/support exports for tipster leakage. Evidence: non-leakage gate. - [ ] V2.19 Build investigative research plans for document sets, datasets, entities, relationships, timelines, public records, interviews, requests, hypotheses, verification status, and collaboration compartments. Evidence: every assertion remains anchored and export respects source protection/legal holds. - [ ] V2.19.a Define plan identity/scope/question/owner/team/state/milestones/ risk/budget/legal-hold and exact pitch/story revision. Evidence: plan schema. - [ ] V2.19.b Define document/dataset collections with immutable inputs, schemas/queries/transforms/snapshots, review status, and rights. Evidence: material contracts. - [ ] V2.19.c Define entity/alias/relationship/timeline items with temporal validity, uncertainty, provenance, merge/split, and protected identity. Evidence: research graph schema. - [ ] V2.19.d Define public-record/interview/information-request tasks with jurisdiction/contact/deadline/response/appeal/safety and secure communication references. Evidence: task contracts. - [ ] V2.19.e Define hypothesis/assertion/counter-hypothesis, required evidence, supporting/contradicting locators, confidence, verifier, and status without promoting notes to facts. Evidence: hypothesis schema. - [ ] V2.19.f Build compartmented workstreams/membership/grants/comments/ notifications/search with cross-compartment redacted handoffs. Evidence: collaboration tests. - [ ] V2.19.g Build plan board/timeline/notebook/evidence views with stable filters, dependencies, stale-source warnings, and complete anchor resolution. Evidence: workspace tests. - [ ] V2.19.h Export an authorized purpose-bound snapshot with redaction/ watermark/expiry/audit while enforcing source protection and legal holds. Evidence: export tests. - [ ] V2.19.i Verify every assertion resolves to pinned evidence or is explicitly unsupported/contested/unknown. Evidence: integrity gate. - [ ] V2.20 Build knowledge-graph entity resolution and relationship review for people, organizations, places, events, topics, claims, aliases, temporal validity, merge/split, confidence, provenance, and retractions. Evidence: graph suggestions require review and protected entities remain compartmented. - [ ] V2.20.a Define canonical entity/relation/alias/identifier/attribute schemas with type, temporal validity, uncertainty, provenance, tenant/ compartment scope, and version. Evidence: graph contracts. - [ ] V2.20.b Extract resolution/link candidates from pinned source/story/ claim revisions behind the provider seam with model/features/evidence/ confidence attribution. Evidence: candidate tests. - [ ] V2.20.c Present side-by-side candidate/current records and conflicting identifiers/attributes/relationships/times for human accept/reject/ defer. Evidence: resolution review. - [ ] V2.20.d Implement merge with surviving identity, field-level provenance, alias/edge/reference redirect, protected-grant union constraints, and reversible audit. Evidence: merge tests. - [ ] V2.20.e Implement split with explicit record/alias/edge/evidence/ history allocation, downstream impact preview, and no orphaned claims. Evidence: split tests. - [ ] V2.20.f Review/create/update/delete relationships with source locators, direction/type, validity interval, confidence, contradiction, and authorization. Evidence: relation tests. - [ ] V2.20.g Propagate source/claim/entity retraction or correction as versioned invalidation/review signals without deleting historical graph evidence. Evidence: retraction tests. - [ ] V2.20.h Exclude protected entities/identifiers/degree/count/snippets from unauthorized graph/search/API/log/cache projections. Evidence: compartment tests. - [ ] V2.20.i Provide a semantic table/tree/path alternative and verify keyboard/screen-reader operation for all review actions. Evidence: accessible graph E2E. ### V3 — Drafting, media, claims, and authoring assist - [ ] V3.1 Build the story board with guarded editorial-state transitions. Evidence: server state-machine tests. - [ ] V3.1.a Define board columns/views from canonical editorial state plus independent desk/owner/priority/deadline/embargo/gate/review dimensions. Evidence: board view model. - [ ] V3.1.b Query permission-filtered live story summaries with stable sort/ filter/group/pagination and no protected source or embargo leakage. Evidence: board query tests. - [ ] V3.1.c Expose only server-authorized transitions for current state/role/ revision/gates/approvals, with reason/impact/confirmation. Evidence: transition UI tests. - [ ] V3.1.d Enforce transitions atomically server-side with optimistic concurrency, idempotency, audit, notifications, and no drag-only path. Evidence: state-machine suite. - [ ] V3.1.e Handle stale cards, conflicts, partial/degraded data, revoked access, and real-time updates without implying a transition succeeded. Evidence: resilience tests. - [ ] V3.2 Build the story dossier with assignment, draft, sources, claims, evidence, media, gates, reviews, schedule, distribution, and history. Evidence: live-data browser journey. - [ ] V3.2.a Define dossier route/context/read model pinned to story and selected revision with permission-filtered section summaries/freshness. Evidence: dossier contract. - [ ] V3.2.b Compose primary draft editor with assignment/source/claim/ evidence/media inspectors rather than duplicating owned records. Evidence: workspace tests. - [ ] V3.2.c Show gates/reviews/schedule/distribution current state, blockers, owners, versions, timestamps, remediation, and eligible actions. Evidence: status tests. - [ ] V3.2.d Provide chronological state/revision/decision/approval/publish/ correction history with redacted protected events. Evidence: history tests. - [ ] V3.2.e Exercise authorized/unauthorized live database journey from assignment through current public read-back, including stale/degraded/ empty states. Evidence: browser E2E. - [ ] V3.3 Build a structured article editor for paragraph, heading, list, quote, fact box, data, table, image, gallery, audio, video, embed, correction, and disclosure blocks. Evidence: block registry. - [ ] V3.3.a Define versioned block registry with stable ID, kind-specific content, children/order, validation, serialization, migration, and semantic output contract. Evidence: registry schema. - [ ] V3.3.b Implement text structure blocks—paragraph/heading/list/quote/fact box—with canonical commands, paste normalization, and anchor stability. Evidence: text block tests. - [ ] V3.3.c Implement data/table blocks with source/dataset/query/transform/ units/uncertainty and accessible table semantics. Evidence: data block tests. - [ ] V3.3.d Implement image/gallery/audio/video/embed blocks via approved assets/allowlists with captions/transcripts/rights/provenance and safe fallbacks. Evidence: media block tests. - [ ] V3.3.e Implement correction/disclosure blocks with policy-required immutable links and target renderer behavior. Evidence: policy block tests. - [ ] V3.3.f Test add/edit/move/split/merge/copy-paste/delete/undo/redo/ collaboration across all kinds and reject unknown/unsafe content. Evidence: block registry suite. - [ ] V3.4 Build attribution-aware quote editing with speaker, source, locator, verification, context, edit notation, and consent. Evidence: quote validation. - [ ] V3.4.a Define quote text/language, exact source revision/locator, speaker/public label versus protected identity, and captured context. Evidence: quote contract. - [ ] V3.4.b Support exact/paraphrase/translated/edited quote types with omission/interpolation/clarification notation and immutable original. Evidence: edit tests. - [ ] V3.4.c Record verifier/method/time/result, recording/transcript/source relationship, uncertainty, and stale/unreachable state. Evidence: verification tests. - [ ] V3.4.d Record consent/on-record/background/off-record terms, scope, expiry/withdrawal, rights, safety restrictions, and authorized display. Evidence: consent tests. - [ ] V3.4.e Gate publication on kind-specific attribution/context/locator/ verification/consent rules and prevent identity leakage. Evidence: quote validation suite. - [ ] V3.5 Build media attachment with rights, caption, credit, alt text, transcript, content warning, location/privacy, and C2PA status. Evidence: publish gate. - [ ] V3.5.a Attach only approved immutable media asset/revision/rendition with source/story provenance, hash, scan state, and intended block/target. Evidence: attachment contract. - [ ] V3.5.b Capture rights/license/holder/territory/channel/locale/expiry/ attribution and block unsupported use or expired rights. Evidence: rights tests. - [ ] V3.5.c Capture factual caption/credit, language, alt text/long description, transcript/captions/audio description, and review status. Evidence: accessibility tests. - [ ] V3.5.d Capture graphic/trauma/child/privacy/location/doxxing warnings, redactions/crops, consent, and distribution-specific restrictions. Evidence: harm/privacy tests. - [ ] V3.5.e Validate C2PA valid/tampered/stripped/unknown lineage separately from editorial truth and show exact provenance status. Evidence: C2PA tests. - [ ] V3.5.f Compute target-specific publish eligibility from all current fields/reviews without silently dropping media or metadata. Evidence: publish gate suite. - [ ] V3.6 Build selection-anchored claim creation. Evidence: claim remains attached through unrelated edits. - [ ] V3.6.a Capture current draft revision, selected block/range/text/context, direction/affinity, author, and intended claim class. Evidence: creation contract. - [ ] V3.6.b Create normalized claim text separately from quoted selection while preserving exact origin anchor and requiring human confirmation. Evidence: creation tests. - [ ] V3.6.c Map the anchor through unrelated before/after edits, formatting, block moves, and collaboration operations. Evidence: survival tests. - [ ] V3.6.d Mark ambiguous/deleted/split/merged replacement as orphaned or candidate-remap requiring review, never silently retarget. Evidence: adversarial edit tests. - [ ] V3.6.e Preserve stable claim identity and history across revisions, undo/redo, restore, copy, and branch/merge. Evidence: revision tests. - [ ] V3.7 Build claim extraction behind the fenced provider seam. Evidence: proposals require human confirmation. - [ ] V3.7.a Define request with pinned draft blocks/revision, eligible text, locale/domain/classes, excluded protected fields, budget, and policy. Evidence: request schema. - [ ] V3.7.b Return candidate claim text/class/anchor/severity/confidence/ rationale and source-use without writing canonical claim records. Evidence: response tests. - [ ] V3.7.c Record provider/model/prompt/config/version, input/output hashes, cost/latency/safety, and run provenance. Evidence: attribution. - [ ] V3.7.d Present candidates for individual accept/edit/reject/duplicate handling and revalidate anchors against the current revision. Evidence: confirmation tests. - [ ] V3.7.e Evaluate missed high-risk claims, invented/merged claims, bad anchors, protected leakage, injection, and provider failure. Evidence: extraction eval. - [ ] V3.8 Build citation and counter-source attachment with exact locators. Evidence: duplicate and invalid link tests. - [ ] V3.8.a Search/select an authorized source revision and create/validate a kind-specific exact locator with excerpt/context/hash. Evidence: locator journey. - [ ] V3.8.b Classify relationship as supporting/contradicting/contextual/ irrelevant/counter-source with assessment, confidence, and reviewer. Evidence: link contract. - [ ] V3.8.c Show source quality/retraction/rights/freshness/protection state without leaking compartmented identity. Evidence: projection tests. - [ ] V3.8.d Detect exact/overlapping/semantically duplicate links and require deliberate merge/retain decisions. Evidence: duplicate tests. - [ ] V3.8.e Reject cross-tenant/story-policy violations, invalid/unreachable/ stale locators, wrong revisions, unsupported kinds, and unauthorized fields. Evidence: invalid link suite. - [ ] V3.8.f Preserve link revision/history and invalidate affected gates/ approvals when citation/source/claim changes. Evidence: lifecycle tests. - [ ] V3.9 Build source/claim/evidence sidebar with authority, confidence, status, contradiction, attestation, and retraction context. Evidence: screen-reader accessible. - [ ] V3.9.a Define sidebar view model pinned to draft/selection/claim/source revisions with permissions, freshness, loading, and partial state. Evidence: inspector contract. - [ ] V3.9.b Show sources/citations/evidence locators, raw quality factors, band/confidence/authority, and protected redaction. Evidence: source inspector tests. - [ ] V3.9.c Show claim severity/status/support/counter-sources/ contradictions/unsupported state and exact anchors. Evidence: claim inspector tests. - [ ] V3.9.d Show evidence-pack integrity, attestation scope/credential/ conflict/disagreement/expiry, and retraction/correction impact. Evidence: evidence inspector tests. - [ ] V3.9.e Support inspect/link/unlink/request review/remediate operations with server authorization and focus returning to the editor. Evidence: action tests. - [ ] V3.9.f Provide headings/lists/tables/status text/announcements and keyboard synchronization with the editor at zoom/reflow. Evidence: screen-reader E2E. - [ ] V3.10 Build headline/dek variants and body-accuracy comparison. Evidence: exact gate outputs. - [ ] V3.10.a Create immutable human or attributed AI headline/dek candidate revisions linked to exact body/claim/evidence revision. Evidence: variant schema. - [ ] V3.10.b Compare candidates side by side for factual propositions, entities/numbers/time/location, certainty, omissions, tone, length, target, and accessibility. Evidence: comparison UI. - [ ] V3.10.c Run versioned accuracy/sensationalism/clickbait/SEO/format gates and display raw findings/evidence separately from verdicts. Evidence: gate output tests. - [ ] V3.10.d Allow edit/select/reject only by authorized humans with rationale and no model/score auto-selection. Evidence: decision tests. - [ ] V3.10.e Recompute/invalidate comparison and approval when body/claims/ sources/candidate/policy changes. Evidence: freshness tests. - [ ] V3.11 Build authoring assist for structure, clarity, headline, summary, SEO, localization, and format adaptation. Evidence: per-change accept and AI attribution. - [ ] V3.11.a Define separate assist operations with pinned input revision/ selection, constraints, eligible sources, target/locale/style, provider policy, and budgets. Evidence: operation contracts. - [ ] V3.11.b Generate structure/clarity suggestions as minimal anchored diffs that preserve claims/quotes/citations/meaning. Evidence: editing tests. - [ ] V3.11.c Generate headline/summary/SEO suggestions with factual proposition comparison and no keyword-driven certainty or sensational drift. Evidence: accuracy tests. - [ ] V3.11.d Generate localization/format adaptations linked to exact source text, terminology, claims/evidence, disclosure, rights, and target constraints. Evidence: adaptation tests. - [ ] V3.11.e Present each change for accept/edit/reject with preview, rationale/source use, conflicts, and stale-revision rebase. Evidence: interaction tests. - [ ] V3.11.f Record model/provider/prompt/config/version/input/output/cost and accepted human actor per change; never bulk-apply silently. Evidence: attribution audit. - [ ] V3.12 Prohibit AI from silently inventing sources, quotes, facts, citations, or named attribution. Evidence: adversarial generation eval. - [ ] V3.12.a Enforce typed outputs that distinguish verbatim source content, grounded inference, proposal, placeholder, uncertainty, and refusal. Evidence: response schema tests. - [ ] V3.12.b Allow source/quote/citation/attribution references only to authorized provided stable IDs and validate locators/text exactness. Evidence: grounding validator. - [ ] V3.12.c Reject or visibly flag invented/altered/unresolvable references, unsupported facts, merged speakers, and implied named attribution. Evidence: enforcement tests. - [ ] V3.12.d Require human confirmation before canonical claim/citation/quote/ source/attribution creation and retain generator provenance. Evidence: mutation boundary tests. - [ ] V3.12.e Evaluate prompt/source injection, plausible fake citations, source laundering, paraphrase drift, multilingual names, and multi-turn persistence. Evidence: adversarial eval. - [ ] V3.12.f Define stop-the-line thresholds, regression ownership, provider/ model rollback, and approved residual exceptions. Evidence: safety gate. - [ ] V3.13 Build word/character, reading time, media, claim density, citation, and freshness meters from server logic. Evidence: known-value tests. - [ ] V3.13.a Define canonical eligible content, Unicode/grapheme/locale rules, exclusions, units, rounding, and versions for word/character/reading time. Evidence: metric contracts. - [ ] V3.13.b Define media counts/durations/types and claim/citation density numerators, denominators, duplicate/overlap, and zero-content behavior. Evidence: density contracts. - [ ] V3.13.c Define source/citation/claim/evidence/policy freshness inputs, clocks, thresholds, unknown/unavailable state, and invalidation. Evidence: freshness contract. - [ ] V3.13.d Compute authoritatively on exact server revision and return raw values, units, timestamp, calculator/policy version, and evidence. Evidence: API tests. - [ ] V3.13.e Show advisory meters without converting them into automatic quality/editorial scores or overriding gates. Evidence: UI tests. - [ ] V3.13.f Verify hand-calculated Unicode/locale/block/media/anchor/stale/ missing fixtures. Evidence: known-value suite. - [ ] V3.14 Build preview for reader web, mobile, newsletter, wire/package, audio, video, and social targets. Evidence: renderer parity. - [ ] V3.14.a Define target/version/locale/device/audience preview request pinned to exact draft/media/policy/template/config revisions. Evidence: preview contract. - [ ] V3.14.b Render reader web/mobile and newsletter using production-shared renderers with navigation, disclosures, corrections, accessibility, and responsive behavior. Evidence: reader/email previews. - [ ] V3.14.c Render NewsML/wire/package structured payload and validation diagnostics without hiding unsupported/dropped fields. Evidence: package preview. - [ ] V3.14.d Render audio/video timeline/transcript/captions/chapters/media/ provenance and platform aspect/safe-area variants. Evidence: AV preview. - [ ] V3.14.e Render social/channel copy/media/link/cards/disclosures/ corrections/limits per current adapter capability. Evidence: target previews. - [ ] V3.14.f Compare preview semantic output to published/read-back output, label fixtures/staleness, and block unsupported target claims. Evidence: renderer parity suite. - [ ] V3.15 Build autosave, undo/redo, revision history, semantic diff, restore, presence, and conflict resolution. Evidence: concurrent edit Playwright. - [ ] V3.15.a Define local operation/draft/server revision/checkpoint/presence/ conflict schemas and eligible protected/offline storage policy. Evidence: collaboration contract. - [ ] V3.15.b Implement debounced idempotent autosave with expected revision, dirty/saving/saved/error/offline/conflict state and crash recovery. Evidence: autosave tests. - [ ] V3.15.c Implement operation-aware undo/redo scoped to the actor/session without reverting collaborators or immutable published history. Evidence: history tests. - [ ] V3.15.d Provide immutable revision timeline and semantic block/text/ claim/citation/media/disclosure diff with author/cause/provenance. Evidence: diff tests. - [ ] V3.15.e Restore as a new revision with preview, permissions, invalidated gates/approvals/schedules, and no history rewrite. Evidence: restore tests. - [ ] V3.15.f Show privacy-filtered presence/selection and resolve concurrent block/text/anchor/source/claim edits using mine/theirs/base with copies. Evidence: conflict tests. - [ ] V3.15.g Run two-client web/desktop/offline/delete/reorder/role-revoke/ reconnect journeys. Evidence: concurrent Playwright. - [ ] V3.16 Build disclosure editor for AI assistance, methodology, corrections, conflicts, sponsorship, and limitations. Evidence: target-specific required-field gates. - [ ] V3.16.a Define typed disclosure records with scope, exact story/block/ media/release/locale/target revision, author, status, and history. Evidence: disclosure schema. - [ ] V3.16.b Build AI-use and methodology disclosures from attributed provenance/methods while allowing accurate human-authored explanation. Evidence: disclosure tests. - [ ] V3.16.c Build correction/history and conflicts/recusal disclosures linked to canonical decisions without exposing protected/legal details. Evidence: editorial disclosure tests. - [ ] V3.16.d Build sponsorship/advertising/partnership and limitations/ uncertainty disclosures separated from editorial content and controls. Evidence: independence tests. - [ ] V3.16.e Define required types/fields/placement/wording/reviewer by desk/ risk/audience/locale/target and recompute on changes. Evidence: policy matrix. - [ ] V3.16.f Preview/read-back exact reader-visible disclosures and block release if required content is missing, stale, or silently dropped. Evidence: target gate tests. - [ ] V3.17 Build journalism, research, fact-checking, standards, copy-edit, format, and distribution agent plans with least-privilege tool grants. Evidence: story revision, allowed sources, policy, budget, stop conditions, and approval points are locked before dispatch. - [ ] V3.17.a Define distinct plan templates and allowed outcomes for journalism/research/fact-check/standards/copy-edit/format/distribution; prohibit unsupported role blending. Evidence: template registry. - [ ] V3.17.b Pin tenant/story/draft/source/evidence/policy/locale/target revisions, objective, constraints, expected artifacts, and acceptance criteria. Evidence: immutable plan inputs. - [ ] V3.17.c Resolve allowed sources/fields and least-privilege read/search/ analyze/draft/propose/job tools with object/function scopes and expiry. Evidence: grant manifest. - [ ] V3.17.d Lock token/cost/time/step/tool/concurrency/provider budgets, retry/fallback, data-use rules, and protected-source exclusions. Evidence: budget/policy manifest. - [ ] V3.17.e Define checkpoint/human approval/attestation-required/stop-the- line/cancellation/escalation conditions before dispatch. Evidence: control contract. - [ ] V3.17.f Preview exact plan/grants/risks to an authorized human, record approval, sign/hash it, and reject stale or mutated dispatch. Evidence: dispatch tests. - [ ] V3.18 Build Veritas-scoped agent run, queue, plan, tool-call, budget, source-use, output, and provenance views. Evidence: protected-source redaction and live trace. - [ ] V3.18.a Define run/step/tool-call/queue/event/budget/source-use/output/ artifact/provenance state contracts and retention. Evidence: run schema. - [ ] V3.18.b Build queue/run list with owner/story/plan/status/progress/ budget/priority/wait reason/failure/created/updated and stable filters. Evidence: operations view. - [ ] V3.18.c Build live run timeline showing immutable plan, step transitions, tool name/scoped purpose/input-output summaries, retries, decisions, and human interventions. Evidence: trace view. - [ ] V3.18.d Show token/cost/time/tool/step limits versus actual/forecast and stop/cancel controls with truthful delayed accounting. Evidence: budget view tests. - [ ] V3.18.e Show exact allowed/used source/evidence IDs, locators, revision, result attribution, and derived artifact lineage. Evidence: provenance view. - [ ] V3.18.f Apply compartment/field redaction to UI/API/events/logs/export and prevent counts/timing/tool summaries from revealing protected sources. Evidence: non-leakage tests. - [ ] V3.18.g Test live update reconnect/order/deduplication/stale/partial/ unavailable and terminal-state reconciliation. Evidence: live trace E2E. - [ ] V3.19 Intake agent output only as attributed suggestions, proposed claims, or draft revisions. Evidence: agents cannot create source identity, attest facts, approve legal/standards gates, publish, correct, or retract. - [ ] V3.19.a Define an allowlisted output envelope for suggestion, proposed claim/citation, anchored edit set, or complete draft revision with run/ plan/model/tool/source provenance. Evidence: output schema. - [ ] V3.19.b Validate output type/schema/size/anchors/revisions/source IDs/ locators/grounding/rights/safety and quarantine malformed content. Evidence: intake validation. - [ ] V3.19.c Store output in a proposal namespace with explicit unreviewed state, no canonical source/attestation/approval/release semantics, and safe rendering. Evidence: persistence tests. - [ ] V3.19.d Present semantic diff/evidence/source use/uncertainty for per-item authorized human accept/edit/reject; rebase or invalidate stale outputs. Evidence: review tests. - [ ] V3.19.e Apply accepted content as a human-attributed new draft/claim revision while retaining AI contribution attribution and re-running gates. Evidence: acceptance tests. - [ ] V3.19.f Attempt source identity creation, attestation, legal/standards approval, publish/correct/retract, privilege escalation, and direct API mutation; prove rejection/no side effect. Evidence: capability tests. - [ ] V3.20 Implement agent pause, redirect, cancel, budget kill, and replay. Evidence: partial results retain source/run provenance and cannot appear approved. - [ ] V3.20.a Define legal control transitions by run/step/job state, actor, authority, idempotency, and terminal/commit boundary. Evidence: control state machine. - [ ] V3.20.b Pause at safe checkpoints, freeze new tools, retain leases/ partial state, and resume only after current plan/grant validation. Evidence: pause tests. - [ ] V3.20.c Redirect via a reviewed plan amendment/new plan with changed objective/constraints/grants/budgets, preserving the original. Evidence: redirect tests. - [ ] V3.20.d Cancel queued/running/tool/job phases with provider cancellation, compensation, timeout, and honest requested-versus-completed state. Evidence: cancellation tests. - [ ] V3.20.e Enforce automatic/manual budget kill at every metering boundary with bounded overshoot and no new unmetered actions. Evidence: kill tests. - [ ] V3.20.f Replay from pinned plan/inputs/tool versions or explicitly mark substitutions/nonreproducibility; deduplicate committed effects. Evidence: replay tests. - [ ] V3.20.g Preserve all partial suggestions/artifacts/source use/run lineage as incomplete/unapproved and require fresh human review. Evidence: status tests. - [ ] V3.21 Evaluate multi-agent handoffs for fabricated citation, source laundering, instruction loss, privilege expansion, and correlated error. Evidence: adversarial corpus and stop-the-line thresholds. - [ ] V3.21.a Define typed handoff envelope with parent/child run, pinned constraints/policy/grants/budget, source/evidence IDs, claims, artifacts, uncertainty, and unresolved issues. Evidence: handoff schema. - [ ] V3.21.b Verify receivers cannot reinterpret unavailable/protected/ unverified sources as ordinary evidence or drop source-use provenance. Evidence: laundering tests. - [ ] V3.21.c Test altered/invented citations/quotes/claims across extraction, research, fact-check, editing, localization, and distribution hops. Evidence: fabrication corpus. - [ ] V3.21.d Test loss/contradiction of negative instructions, disclosure/ embargo/rights/locale constraints, approval requirements, and stop conditions. Evidence: instruction-retention tests. - [ ] V3.21.e Test delegated tool/role/field/object/tenant/compartment privilege expansion and confused-deputy attacks. Evidence: capability tests. - [ ] V3.21.f Measure correlated error/amplification, independence, calibration, detection/abstention, and subgroup/language performance over chained runs. Evidence: evaluation report. - [ ] V3.21.g Set per-severity stop thresholds, block dispatch/intake/release on breach, assign mitigation/model rollback, and require human approval. Evidence: stop-the-line gate. - [ ] V3.22 Build audio/podcast production for script/rundown, host/voice, recording, clips, music/SFX, edit, mix, loudness, transcript, chapters, captions, translations, rights, provenance, review, and feed/package outputs. Evidence: story claims and corrections stay linked to timecoded audio. - [ ] V3.22.a Define audio project/episode/script/rundown/segment/track/clip/ marker/version schemas linked to exact story/claim/evidence revisions. Evidence: audio contracts. - [ ] V3.22.b Build script/rundown editing with host/guest/voice assignments, pronunciation, fact-check holds, timing, disclosures, and source timecode/citation links. Evidence: preproduction tests. - [ ] V3.22.c Ingest or capture recording with device/session/files/checksums/ consent, original immutable audio, proxies, and privacy-safe metadata. Evidence: recording lineage. - [ ] V3.22.d Build clip/select/trim/sequence/fade/music/SFX editing using nondestructive operations, licensed assets, and semantic/non-drag controls. Evidence: edit tests. - [ ] V3.22.e Build mix/render with track/voice/music/SFX balances, channel/ codec/rate, target loudness/true peak, deterministic job provenance, and quality measurements. Evidence: mix tests. - [ ] V3.22.f Generate/edit/align transcripts, speakers, chapters, captions, descriptions, and translations with human review and locale parity. Evidence: accessibility/localization tests. - [ ] V3.22.g Enforce voice/music/recording/source/territory/channel/expiry rights, AI/synthetic voice disclosure, consent, and C2PA/provenance. Evidence: rights/provenance gate. - [ ] V3.22.h Build editorial/fact-check/legal/accessibility/audio review on exact version with timecoded comments and stale invalidation. Evidence: review journey. - [ ] V3.22.i Generate/validate feed/enclosure/NewsML/CMS/article/package outputs with renditions, metadata, chapters, transcripts, and read-back. Evidence: distribution tests. - [ ] V3.22.j Preserve claim/citation/correction/retraction links to timecoded ranges through edits/renders/replacements and cascade every target. Evidence: correction lineage E2E. - [ ] V3.23 Build video and short-form production for script, shot list, source media, edit/timeline, graphics, captions, voice, aspect renditions, thumbnails, platform-safe areas, rights, provenance, review, and correction replacement. Evidence: YouTube/Shorts/TikTok and article embeds derive from locked story evidence. - [ ] V3.23.a Define video project/version/sequence/track/clip/shot/graphic/ caption/marker/rendition schemas linked to locked story evidence. Evidence: video contracts. - [ ] V3.23.b Build script/shot-list/storyboard planning with claim/source/ locator, capture/acquisition, contributor, safety, rights, and target requirements. Evidence: production plan. - [ ] V3.23.c Ingest source media as immutable scanned assets with checksums/ capture metadata/C2PA/proxies/transcripts and privacy review. Evidence: media lineage. - [ ] V3.23.d Build nondestructive edit/timeline for clips/audio/voice/music/ graphics/lower thirds with semantic/non-drag controls and source links. Evidence: timeline tests. - [ ] V3.23.e Build factual graphics, names/numbers/maps/charts, captions/ translations/audio descriptions, and human verification against evidence. Evidence: overlay/accessibility tests. - [ ] V3.23.f Generate landscape/vertical/square renditions and thumbnails with crop/reframe/safe-area/text-length/codec/bitrate constraints and no meaning loss. Evidence: rendition tests. - [ ] V3.23.g Enforce media/music/voice/likeness/location/platform/territory/ expiry rights, safety warnings, disclosure, and provenance. Evidence: publish gates. - [ ] V3.23.h Run editorial/fact-check/legal/standards/accessibility review on exact timeline/renditions with timecoded comments. Evidence: review journey. - [ ] V3.23.i Publish/read back YouTube/Shorts/TikTok and article embeds through target adapters with partial failure, acknowledgement, and no silent auto-publish. Evidence: channel tests. - [ ] V3.23.j Replace/correct/retract exact ranges/renditions/thumbnails/ captions across targets while retaining prior lineage and notices. Evidence: correction E2E. - [ ] V3.24 Build live-program rundown and stream production for segments, guests, sources, lower thirds, fact-check hold, delay, captions, translations, moderator cues, Q&A, emergency stop, recording, clipping, archive, and post-live correction. Evidence: live urgency never becomes a generic editorial-gate bypass. - [ ] V3.24.a Define live program/rundown/segment/cue/guest/source/claim/ destination/session/version/state contracts and accountable operator roles. Evidence: live schemas. - [ ] V3.24.b Build ordered/timed rundown with script, guests/consent, sources/evidence, assets, lower thirds, transitions, moderator cues, contingencies, and approvals. Evidence: rundown tests. - [ ] V3.24.c Validate names/titles/numbers/claims/media/rights/disclosures against locked story evidence and route unresolved items to fact-check hold. Evidence: preflight gate. - [ ] V3.24.d Build ingest/encoder/stream/destination health, preview/program, delay buffer, captions/translations, recording, and failover controls. Evidence: stream operations tests. - [ ] V3.24.e Build moderated Q&A with question intake/screening/source status/ identity safety, answer evidence, block/remove/escalate, and audit. Evidence: Q&A tests. - [ ] V3.24.f Enforce role/step-up/two-step confirmation for go-live, fact- check release, delay dump, destination changes, emergency stop, and restart. Evidence: control authorization. - [ ] V3.24.g Record synchronized program/clean feeds, captions/translations, operator/decision/incident timeline, and immutable provenance. Evidence: session record. - [ ] V3.24.h Create reviewed clips/archive/article embeds with timecode/ claim/source linkage, rights, accessibility, and target approvals. Evidence: post-live workflow. - [ ] V3.24.i Author and propagate post-live correction/retraction to recordings/clips/captions/transcripts/archive/embeds/channels with notices and read-back. Evidence: correction E2E. - [ ] V3.24.j Prove urgency cannot bypass protected-source, legal/high-risk, evidence, disclosure, accessibility, or human publish floors; test emergency authority separately. Evidence: gate suite. - [ ] V3.25 Build data/visual journalism authoring for datasets, queries, transformations, charts/maps/tables, methodology, uncertainty, source snapshots, accessible alternatives, responsive embeds, and update detection. Evidence: published visualization is reproducible from locked data/code and has semantic parity. - [ ] V3.25.a Define data project/dataset snapshot/schema/query/transform/ visualization/view/release contracts linked to story/claims/sources. Evidence: data-viz schemas. - [ ] V3.25.b Ingest immutable licensed datasets with checksum, acquisition/ refresh metadata, schema/profile, privacy/classification, and quarantine. Evidence: dataset lineage. - [ ] V3.25.c Build parameterized query/notebook/transform pipeline with pinned engine/dependencies/code/config/random seeds, review, and reproducible outputs. Evidence: compute tests. - [ ] V3.25.d Build chart/map/table specifications with units/denominators/ baselines/scales/geography/time, annotation, provenance, and no misleading defaults. Evidence: visual contract tests. - [ ] V3.25.e Author methodology/limitations/uncertainty/missing-data/ statistical notes tied to exact data/code/output revisions. Evidence: methodology review. - [ ] V3.25.f Provide equivalent accessible table/text/key findings, data download where permitted, keyboard navigation, contrast/pattern, and noncolor encodings. Evidence: semantic parity tests. - [ ] V3.25.g Generate responsive embeds/static/social/print renditions with stable canonical URL, safe sizing, fallback, performance, and target metadata. Evidence: renderer tests. - [ ] V3.25.h Detect upstream data/schema/code/dependency changes, compare outputs, mark stale, and require human review before update. Evidence: update detection. - [ ] V3.25.i Publish/read back locked data/code/spec/output/provenance and verify independent reproduction within declared tolerances. Evidence: reproducibility gate. - [ ] V3.25.j Propagate corrections/retractions through claims, annotations, tables, embeds, images, downloads, caches, and archives. Evidence: correction journey. ### V4 — Verification, balance, attestation, and editorial gates - [ ] V4.1 Implement canonical source-quality scoring with published factor weights and adjustments. Evidence: known-value suite per claim domain. - [ ] V4.1.a Implement versioned factor measurements from pinned source evidence with explicit missing/unknown/unavailable states. Evidence: factor unit tests. - [ ] V4.1.b Resolve applicable claim-domain weight profile and validate factor/weight ranges, completeness, normalization, and effective date. Evidence: profile tests. - [ ] V4.1.c Compute canonical composite/intermediate values/rounding/band/ confidence deterministically and separately from manual adjustments. Evidence: algorithm tests. - [ ] V4.1.d Apply only authorized bounded reasoned adjustments with evidence, actor, expiry, conflict, and immutable raw score. Evidence: adjustment tests. - [ ] V4.1.e Persist all input/evaluator/weight/policy versions and recompute or mark stale on any change. Evidence: provenance tests. - [ ] V4.1.f Compare independently calculated boundary/missing/adversarial fixtures for every ratified claim domain. Evidence: known-value suite. - [ ] V4.2 Implement claim extraction quality evaluation against a labeled corpus. Evidence: precision/recall and missed-high-risk analysis. - [ ] V4.2.a Build versioned representative corpus with exact draft blocks/ ranges, claim classes, severities, locales/desks, negatives, and expert labels. Evidence: corpus manifest. - [ ] V4.2.b Define matching rules for span overlap, normalized proposition, duplicate/merged/split claims, class, severity, and anchor correctness. Evidence: scoring spec. - [ ] V4.2.c Run pinned model/provider/prompt/config against held-out corpus with deterministic request/output provenance. Evidence: evaluation run. - [ ] V4.2.d Report precision/recall/F-score, calibration, duplicate/bad-anchor rate, latency/cost, and subgroup/locale/desk slices. Evidence: metrics. - [ ] V4.2.e Review every missed high-risk and dangerous false-positive claim, classify causes/severity, and assign mitigation. Evidence: error analysis. - [ ] V4.2.f Enforce thresholds/regression comparisons/stop-the-line and named human approval before deployment. Evidence: evaluation gate. - [ ] V4.3 Implement claim-citation support and locator verification. Evidence: supporting, irrelevant, contradicted, and unreachable source fixtures. - [ ] V4.3.a Resolve exact authorized source revision/locator/content/hash and classify unreachable/changed/ambiguous/protected state. Evidence: locator tests. - [ ] V4.3.b Measure proposition-level entailment/support/contradiction/ relevance/context and coverage without treating source quality as support. Evidence: measurement tests. - [ ] V4.3.c Combine multiple citations with independence/duplication/ conflicts and explicit insufficient/contested/unknown state. Evidence: multi-source tests. - [ ] V4.3.d Persist claim/source/locator/evaluator/model/prompt/corpus/policy versions, raw findings, evidence excerpts, uncertainty, and freshness. Evidence: result provenance. - [ ] V4.3.e Apply versioned verdict thresholds separately and invalidate on claim/source/locator/policy change or retraction. Evidence: verdict tests. - [ ] V4.3.f Verify supporting/partial/irrelevant/contradicted/unreachable/ injection/multilingual fixtures with expert expected results. Evidence: known-value suite. - [ ] V4.4 Implement confidence-band rules, including source-count and counter-source invariants. Evidence: canonical contract fixtures. - [ ] V4.4.a Define versioned inputs for source quality/independence/count, citation support, counter-sources, contradiction, attestation, and uncertainty. Evidence: confidence contract. - [ ] V4.4.b Implement band thresholds and minimum independent-source/ specialist/evidence requirements by claim class/severity/domain. Evidence: rule tests. - [ ] V4.4.c Enforce counter-source and contested/unsupported/stale/unavailable rules that cap, block, or require review; never count duplicates as independence. Evidence: invariant tests. - [ ] V4.4.d Persist raw inputs/calculation separately from policy verdict and recompute when any dependency/policy changes. Evidence: recomputation tests. - [ ] V4.4.e Test exact boundaries, missing data, many low-quality dependent sources, one high-quality source, contradictions, and evaluator failure. Evidence: canonical fixtures. - [ ] V4.5 Implement statistical-claim checks for denominator, population, period, method, uncertainty, and source dataset. Evidence: crafted corpus. - [ ] V4.5.a Parse or author-review statistic value/unit/direction/comparison, numerator/denominator, population/sample, geography, period, and claim anchor. Evidence: statistic schema/tests. - [ ] V4.5.b Resolve exact dataset snapshot/table/query/row/column/cell and verify value/denominator/population/period match. Evidence: data locator tests. - [ ] V4.5.c Check sampling/design/method/weighting/adjustment/base rate, uncertainty/interval/significance, missingness, and limitations. Evidence: method checks. - [ ] V4.5.d Check chart/text/headline transformations, relative versus absolute change, percentage points, causal language, rounding, and cherry-picked windows. Evidence: presentation checks. - [ ] V4.5.e Return findings/evidence/uncertainty separately from domain- versioned risk verdict and specialist requirements. Evidence: result contract. - [ ] V4.5.f Validate correct/error/ambiguous/adversarial and subgroup- sensitive crafted fixtures with expert review. Evidence: corpus report. - [ ] V4.6 Implement quote checks for source, speaker, context, edit, locator, and verification. Evidence: altered-context fixtures. - [ ] V4.6.a Resolve exact source revision/locator and compare quote/paraphrase/ translation text to the immutable excerpt/recording/transcript. Evidence: text-match tests. - [ ] V4.6.b Verify speaker identity/public label/protected projection and distinguish reporter attribution from source assertion. Evidence: speaker tests. - [ ] V4.6.c Check surrounding context, question/answer, temporal setting, selective omission, sentence joins, and meaning-changing truncation. Evidence: context tests. - [ ] V4.6.d Validate edit/ellipsis/interpolation/translation notation, verification status, consent/terms, and rights. Evidence: policy checks. - [ ] V4.6.e Persist raw match/context findings and versions separately from editorial verdict; mark stale on source/draft change. Evidence: provenance tests. - [ ] V4.6.f Run exact/edited/paraphrased/translated/misattributed/altered- context/unreachable fixtures. Evidence: quote corpus. - [ ] V4.7 Implement legal/scientific/high-risk severity and specialist-review floors. Evidence: no general source policy discharges specialist gates. - [ ] V4.7.a Define versioned legal/scientific/public-health/election/safety/ financial/other high-risk classes and severity indicators. Evidence: risk taxonomy. - [ ] V4.7.b Classify applicable risk from exact claims/sources/media/context with evidence/uncertainty and authorized human correction. Evidence: classification tests. - [ ] V4.7.c Map class/severity/jurisdiction/target to named credential/domain/ independence/quorum/recusal/expiry specialist floors. Evidence: review matrix. - [ ] V4.7.d Enforce specialist review as an independent blocking gate that source score, general fact-check, AI result, waiver, or urgency cannot satisfy. Evidence: bypass tests. - [ ] V4.7.e Invalidate review on relevant claim/evidence/media/policy/ jurisdiction/target change and retain immutable decisions. Evidence: freshness tests. - [ ] V4.8 Implement contradiction detection against current and archived claims. Evidence: known contradiction fixtures and uncertainty. - [ ] V4.8.a Build permission-aware candidate retrieval over current/archived claims by entities, normalized proposition, time, location, units, and topic. Evidence: retrieval tests. - [ ] V4.8.b Compare exact claim revisions for contradiction/qualification/ update/different scope/uncertain relation with evidence and confidence. Evidence: relation evaluator. - [ ] V4.8.c Account for temporal change, definitions, population, units, negation, modality, attribution, and correction/retraction state. Evidence: semantic fixtures. - [ ] V4.8.d Attribute model/rules/corpus/index/source versions and keep candidate measurements separate from reviewed relationships. Evidence: provenance tests. - [ ] V4.8.e Require human confirm/reject/defer and prevent protected/embargoed archived claim leakage through results or counts. Evidence: review/auth tests. - [ ] V4.8.f Evaluate known contradiction/noncontradiction/ambiguous/changed- world/multilingual fixtures and calibration. Evidence: corpus report. - [ ] V4.9 Implement counterclaim surfacing through the canonical policy. Evidence: surface, suppress-false-balance, require-more-evidence, and editorial-review outcomes. - [ ] V4.9.a Gather exact claim/counterclaim/evidence/quality/independence/ consensus/harm/context measurements with policy version. Evidence: input contract. - [ ] V4.9.b Compute all four canonical outcomes without reducing them to a binary “both sides” or popularity rule. Evidence: decision tests. - [ ] V4.9.c Return reason codes, contributing measurements, uncertainty, required evidence/reviewer, and safe presentation constraints. Evidence: result contract. - [ ] V4.9.d Require authorized human disposition for editorial-review and bounded override with rationale/evidence/conflict/expiry. Evidence: override tests. - [ ] V4.9.e Recompute on claim/counter-source/source-quality/consensus/policy change and show contested/stale/evaluator-failure explicitly. Evidence: lifecycle tests. - [ ] V4.9.f Validate each outcome across science/legal/election/identity/ opinion and adversarial false-balance fixtures. Evidence: canonical suite. - [ ] V4.10 Implement bias/loaded-language assist with uncertainty and human review. Evidence: calibrated corpus and subgroup report. - [ ] V4.10.a Define limited assist scope, taxonomy, context-sensitive labels, locale/desk/genre applicability, and prohibited ideology/author scoring. Evidence: assist policy. - [ ] V4.10.b Return anchored language findings with rationale, alternatives, uncertainty, model/prompt/corpus versions, and no silent edit. Evidence: response tests. - [ ] V4.10.c Distinguish loaded wording from accurate quotation, legal/ scientific terminology, reclaimed terms, direct attribution, and necessary specificity. Evidence: context fixtures. - [ ] V4.10.d Present accept/edit/reject/false-positive feedback to authorized humans with per-change provenance and stale-anchor handling. Evidence: review tests. - [ ] V4.10.e Measure calibration/error severity and subgroup/dialect/locale/ identity/desk differences with expert review. Evidence: evaluation report. - [ ] V4.10.f Block use as author/reporter/source/subject reputation or publish score and define regression/rollback thresholds. Evidence: misuse tests. - [ ] V4.11 Implement headline/dek accuracy versus body and evidence. Evidence: omission, exaggeration, certainty, and clickbait fixtures. - [ ] V4.11.a Extract or compare headline/dek propositions, entities, numbers, time/location, causal/attribution/modality/certainty against exact body and verified claims. Evidence: comparison tests. - [ ] V4.11.b Detect unsupported additions, material omissions, scope drift, exaggeration, certainty inflation, contradiction, and misleading question framing. Evidence: finding tests. - [ ] V4.11.c Evaluate sensational/clickbait cues separately from factual accuracy and respect genre/locale/desk context. Evidence: style tests. - [ ] V4.11.d Persist anchored findings/evidence/model/rule/policy versions, uncertainty, and raw measurements separately from verdict. Evidence: provenance. - [ ] V4.11.e Require edit/review according to risk, invalidate on body/claim/ evidence/headline changes, and prohibit automatic selection. Evidence: gate tests. - [ ] V4.11.f Run omission/exaggeration/certainty/clickbait/accurate-strong/ multilingual/adversarial fixtures. Evidence: known-value suite. - [ ] V4.12 Implement plagiarism/similarity and attribution checks. Evidence: quoted, licensed, common-phrase, and copied fixtures. - [ ] V4.12.a Define permissioned comparison corpus, retention/license/ protected-source exclusions, normalization, and versioned index. Evidence: corpus policy. - [ ] V4.12.b Detect exact/near/paraphrase/structural overlap with anchored matching passages, source candidates, score/uncertainty, and provenance. Evidence: similarity tests. - [ ] V4.12.c Classify quotation with valid citation, licensed/reused copy, wire/syndication, press/common phrases, self-reuse, and unattributed copy separately. Evidence: classification tests. - [ ] V4.12.d Check exact attribution/quotation/rights/transform requirements for source kind and target. Evidence: attribution gate. - [ ] V4.12.e Require human review of findings, false positives, contested ownership, and protected comparisons; never auto-accuse. Evidence: review tests. - [ ] V4.12.f Evaluate quoted/licensed/common/copied/paraphrased/multilingual/ adversarial fixtures and corpus leakage. Evidence: evaluation report. - [ ] V4.13 Implement rights, media, accessibility, disclosure, and localization gates. Evidence: gate registry coverage. - [ ] V4.13.a Implement rights/license/consent/territory/channel/locale/expiry/ attribution checks per source/media/target. Evidence: rights gate tests. - [ ] V4.13.b Implement media scan/integrity/provenance/caption/credit/privacy/ harm/rendition/target eligibility checks. Evidence: media gate tests. - [ ] V4.13.c Implement structure/semantics/alt text/transcript/captions/audio description/contrast/reflow/keyboard checks with manual-review floors. Evidence: accessibility gate tests. - [ ] V4.13.d Implement required AI/methodology/correction/conflict/ sponsorship/limitation type/content/placement/reviewer checks. Evidence: disclosure tests. - [ ] V4.13.e Implement locale completeness/terminology/name/number/date/ claim-evidence parity/layout/media-text/cultural-review checks. Evidence: localization tests. - [ ] V4.13.f Register applicability/input/output/remediation/owner/version/ failure state for every gate and prove each retained target is covered. Evidence: gate registry report. - [ ] V4.14 Implement attestation validity, credential, conflict, disagreement, expiry, and independence rules. Evidence: canonical tests. - [ ] V4.14.a Resolve exact attestation scope and reject mismatched or stale claim/source/evidence-pack/draft revisions. Evidence: scope tests. - [ ] V4.14.b Verify attestor identity/credential/issuer/domain/jurisdiction/ validity/revocation with pinned evidence and verification method. Evidence: credential tests. - [ ] V4.14.c Evaluate declared/detected conflicts, prior involvement, organizational relationships, compensation, recusal, and required independence. Evidence: conflict tests. - [ ] V4.14.d Aggregate agree/disagree/qualified/abstain/unable responses under quorum/specialist/independence rules without hiding disagreement. Evidence: decision tests. - [ ] V4.14.e Enforce expiry and invalidation on scope/evidence/credential/ policy/conflict changes; prohibit automation impersonation. Evidence: lifecycle tests. - [ ] V4.14.f Verify canonical valid/invalid/conflicted/disagreeing/expired/ revoked/insufficient fixtures. Evidence: invariant suite. - [ ] V4.15 Implement evidence-pack completeness and integrity validation. Evidence: missing/member/hash mismatch fixtures. - [ ] V4.15.a Resolve exact pack version and required members by claim class/ severity/desk/target/policy. Evidence: completeness rules. - [ ] V4.15.b Validate every member identity/version/tenant/story/compartment/ permission/reference and required citation locator. Evidence: referential tests. - [ ] V4.15.c Recompute canonical serialization/member/root hashes and signatures, detecting reorder/replace/duplicate/missing/tampered data. Evidence: integrity tests. - [ ] V4.15.d Check source/claim/attestation/review freshness, retraction/ correction state, and applicable quality/specialist floors. Evidence: semantic validation. - [ ] V4.15.e Return separate missing/unauthorized/stale/unreachable/hash- mismatch/unsupported-version results and block unverifiable packs. Evidence: failure-state tests. - [ ] V4.15.f Run missing/member/hash/cross-tenant/protected/expired/reordered fixture corpus. Evidence: canonical suite. - [ ] V4.16 Persist raw measurements and evidence separately from policy verdicts. Evidence: policy recomputation. - [ ] V4.16.a Define immutable measurement record with subject/input revisions, metric values/units, evidence locators, uncertainty, evaluator/model/ corpus version, and time. Evidence: measurement schema. - [ ] V4.16.b Define separate verdict record with measurement references, applicable policy/rules/thresholds, outcome/reason/remediation, and time. Evidence: verdict schema. - [ ] V4.16.c Prevent verdict fields from overwriting/denormalizing raw measurements and prevent missing/error measurements from defaulting to pass. Evidence: storage invariants. - [ ] V4.16.d Recompute new verdicts from retained measurements after policy/ threshold changes without rerunning evaluators when inputs remain valid. Evidence: recomputation tests. - [ ] V4.16.e Rerun measurements only on input/evaluator invalidation and retain prior measurement/verdict lineage for audit. Evidence: lifecycle tests. - [ ] V4.16.f Compare old/new policy decisions and explain deltas to reviewers without rewriting historical approvals/releases. Evidence: policy change report. - [ ] V4.17 Version every evaluator, model, domain-weight table, threshold, and corpus. Evidence: result provenance. - [ ] V4.17.a Define immutable identities/digests for rules/code/config, provider/model/prompt/tool, weight tables, thresholds/policies, and corpora/splits/labels. Evidence: version contracts. - [ ] V4.17.b Resolve and pin every dependency before evaluation; prohibit mutable aliases as sole provenance. Evidence: dispatch tests. - [ ] V4.17.c Persist complete dependency graph plus runtime/build/environment/ locale/randomness/input/output hashes on every result. Evidence: provenance tests. - [ ] V4.17.d Define approval/effective/retired/blocked states, compatibility, rollback, retention, and artifact availability for versions. Evidence: lifecycle policy. - [ ] V4.17.e Detect missing/unknown/revoked/unavailable versions and make results unverifiable/stale rather than current. Evidence: failure tests. - [ ] V4.17.f Reproduce representative results from provenance and report any nondeterminism/substitution explicitly. Evidence: reproducibility gate. - [ ] V4.18 Make unavailable, insufficient-evidence, contested, stale, and evaluator-failure states explicit. Evidence: none renders as pass. - [ ] V4.18.a Define canonical distinct measurement/execution/verdict states, reason codes, timestamps, owners, safe messages, and retry/remediation. Evidence: state taxonomy. - [ ] V4.18.b Map dependency outage/not-configured/unauthorized/timeout/rate/ malformed/unknown version to unavailable or evaluator-failure. Evidence: execution tests. - [ ] V4.18.c Map missing/weak/unreachable/conflicting evidence and disagreement/ambiguity to insufficient or contested with uncertainty. Evidence: evidence-state tests. - [ ] V4.18.d Mark stale with exact invalidating subject/dependency/policy/ evaluator version and prohibit silent use after change. Evidence: freshness tests. - [ ] V4.18.e Define gate/review/publish behavior per state and require human authority for any bounded exception with scope/expiry. Evidence: policy tests. - [ ] V4.18.f Verify API/UI/export/notifications/analytics never serialize or display any nonpass state as pass/healthy/current. Evidence: projection suite. - [ ] V4.19 Implement Ghana NMC complaint/content checks and remedy workflow with current rule/category, evidence, response deadline, transition, decision, correction/apology/right-of-reply, escalation, and audit. Evidence: legal/regulatory decision remains human and versioned. - [ ] V4.19.a Pin current NMC/jurisdiction profile, rule/category identifiers, effective dates, authoritative references, counsel owner, and review cadence. Evidence: regulatory profile. - [ ] V4.19.b Define content-check applicability/inputs/findings/evidence/ uncertainty/remediation for ratified editorial categories without encoding legal conclusion as model output. Evidence: check registry. - [ ] V4.19.c Intake complaint with complainant/privacy/consent, story/release/ claim/target, allegation/category, evidence, received channel/time, and authenticity. Evidence: complaint schema. - [ ] V4.19.d Calculate statutory/policy response deadline/calendar/time-zone, assign accountable owner/specialists, acknowledge safely, and escalate approaching breach. Evidence: SLA tests. - [ ] V4.19.e Implement triage/investigate/response-draft/review/decide/remedy/ appeal/close transitions with roles, evidence, concurrency, and immutable audit. Evidence: workflow tests. - [ ] V4.19.f Require named human legal/editorial decision with exact rule/ evidence/rationale/uncertainty/conditions and prohibit automated disposition. Evidence: authority tests. - [ ] V4.19.g Execute approved correction/apology/right-of-reply/takedown/ retraction/escalation through canonical release/cascade workflows and verify downstream notice. Evidence: remedy journey. - [ ] V4.19.h Preserve protected/legal notes and complainant/source identity through redacted notifications/exports; retain/reopen/appeal per policy. Evidence: privacy/audit tests. - [ ] V4.20 Implement election-coverage gates for phase, equal opportunity, silence periods, results/source verification, polling methodology, advertising/sponsorship, incitement, misinformation, candidate treatment, and current jurisdictional rules. Evidence: election and phase fixtures plus specialist signoff. - [ ] V4.20.a Pin election/jurisdiction/contest/phase/calendar/time-zone/rule profile, authoritative sources, effective dates, and specialist owner. Evidence: election profile. - [ ] V4.20.b Determine phase/silence/emergency/result-certification state from trusted inputs and handle uncertain/changed/court-ordered calendars. Evidence: phase tests. - [ ] V4.20.c Check candidate/party treatment, access/equal-opportunity/ response records, coverage context, and documented editorial basis without imposing false numerical equivalence. Evidence: treatment gate. - [ ] V4.20.d Check polling/survey source, sponsor, field dates, population/ sample/method/weighting/question/order/margin/uncertainty/disclosure. Evidence: polling gate. - [ ] V4.20.e Check result source/status/geography/contest/precinct/denominator/ timestamp and prohibit unverified projections or certification claims. Evidence: result gate. - [ ] V4.20.f Check advertising/sponsorship identity/disclosure/separation and silence-period/channel/territory scheduling constraints. Evidence: campaign-content gate. - [ ] V4.20.g Check incitement/violence/doxxing/manipulated media/ misinformation risks with uncertainty, escalation, and harm-minimizing distribution treatment. Evidence: safety gate. - [ ] V4.20.h Persist raw findings separately from human legal/editorial verdict, require specialist signoff, invalidate on phase/rule/content/ source changes, and test edge fixtures. Evidence: signed phase suite. - [ ] V4.21 Implement data-protection consent, lawful basis, purpose, subject request, redaction, retention, and disclosure checks across sources, tips, media, community, analytics, subscriptions, and B2B products. Evidence: end-to-end DPA request and legal-hold conflict tests. - [ ] V4.21.a Build processing inventory per named domain with data subjects/ fields/sensitivity/source/controller-processor/purpose/basis/recipient/ region/retention. Evidence: processing register. - [ ] V4.21.b Validate consent where used for specificity, informed choice, granularity, evidence, withdrawal, age/guardian, and no bundled dark patterns; validate alternate lawful bases separately. Evidence: basis tests. - [ ] V4.21.c Enforce purpose limitation/minimization/access/field projection/ model-use/analytics cohort/export/disclosure rules at collection and reuse boundaries. Evidence: policy tests. - [ ] V4.21.d Intake authenticated access/correct/delete/restrict/object/ portability requests with scope, jurisdiction, deadlines, identity minimization, and protected third-party review. Evidence: request schema. - [ ] V4.21.e Discover subject data across ordinary/protected stores, blobs, search, logs, analytics, backups, channels, payment, B2B, and processors without creating a new leakage index. Evidence: discovery tests. - [ ] V4.21.f Apply authorized redaction/correction/deletion/restriction/export and propagate to processors/consumers while preserving public-interest journalism and correction evidence as legally justified. Evidence: remedy tests. - [ ] V4.21.g Resolve retention/legal-hold/editorial-record/source-safety/ third-party-right conflicts through named human legal decision, partial action, rationale, and appeal. Evidence: conflict tests. - [ ] V4.21.h Verify response/read-back/deadline/audit and no protected-source/ other-subject disclosure in an end-to-end DPA journey. Evidence: DPA E2E. - [ ] V4.22 Implement trauma, graphic-content, child, vulnerable-person, location, doxxing, suicide/self-harm, and public-safety review with warnings, minimization, specialist escalation, and distribution-specific treatment. Evidence: harm-reduction policy and redacted-preview suite. - [ ] V4.22.a Define versioned harm categories/severity/context/uncertainty/ jurisdiction/age/vulnerability/public-interest factors and trained reviewer roles. Evidence: harm taxonomy. - [ ] V4.22.b Identify exact text/quote/media/audio/video/data/location/ metadata risks with evidence and protected reviewer annotations. Evidence: finding contract. - [ ] V4.22.c Apply identity/location/contact/image/voice/metadata minimization, pseudonymization/redaction, delayed publication, and safe source linking. Evidence: minimization tests. - [ ] V4.22.d Define consent/guardian/public-interest/safety exception and independent specialist/legal/source-protection review floors. Evidence: authority matrix. - [ ] V4.22.e Define content warnings/help context, thumbnail/autoplay/ notification/search/social/channel/locale treatment, access/age gates, and no gratuitous repetition. Evidence: distribution matrix. - [ ] V4.22.f Define suicide/self-harm language/method/location/detail/ imagery/link treatment with current specialist policy and escalation. Evidence: self-harm gate. - [ ] V4.22.g Define imminent public-safety escalation and emergency authority without exposing victims/sources or creating a generic publish bypass. Evidence: emergency tests. - [ ] V4.22.h Preview redacted versus authorized views for every target and test copy/download/cache/search/log/AI context/correction propagation. Evidence: redacted-preview suite. - [ ] V4.22.i Persist human decisions/rationale/conditions/expiry and invalidate on content/media/target/policy changes. Evidence: harm-reduction approval. ### V5 — Review, legal, standards, and protected collaboration - [ ] V5.1 Build review templates by desk, claim risk, source sensitivity, media, audience, locale, and distribution target. Evidence: role/quorum matrix. - [ ] V5.1.a Define versioned template identity/applicability/priority and required checklist/gate/evidence/reviewer/decision fields. Evidence: template schema. - [ ] V5.1.b Model desk/claim class-risk/source sensitivity/media/audience/ locale/territory/target dimensions and deterministic template composition. Evidence: applicability tests. - [ ] V5.1.c Define reviewer roles/credentials/domains/independence/recusal/ quorum/order/parallelism/deadlines and delegates. Evidence: role/quorum matrix. - [ ] V5.1.d Define tighten-only local customization versus code/policy-owned floors, governance, migration, approval, effective date, and expiry. Evidence: governance tests. - [ ] V5.1.e Preview exact resolved review plan on a pinned candidate and fail missing/ambiguous/conflicting/unversioned templates. Evidence: resolution tests. - [ ] V5.2 Build anchored comments and suggestions on blocks, ranges, claims, citations, sources, headlines, media, and disclosures. Evidence: anchor survival. - [ ] V5.2.a Define comment/thread/suggestion identity, subject kind/version/ anchor, author, visibility, state, mentions, and audit. Evidence: collaboration schema. - [ ] V5.2.b Support each named subject with kind-specific semantic anchor and protected-source/legal-note visibility rules. Evidence: anchor registry. - [ ] V5.2.c Implement reply/mention/resolve/reopen/edit-with-history/delete- tombstone and accept/reject/edit suggestion transitions. Evidence: workflow tests. - [ ] V5.2.d Transform anchors through revisions/concurrent edits or mark orphaned/ambiguous with candidates and no silent retarget. Evidence: anchor survival corpus. - [ ] V5.2.e Send redacted permission-filtered notifications/deep links and restore focus/subject context. Evidence: notification tests. - [ ] V5.2.f Test cross-role/tenant/compartment visibility, export, audit, archive/legal hold, and responsive keyboard/screen-reader interaction. Evidence: collaboration E2E. - [ ] V5.3 Build fact-check assignments and signoff. Evidence: claim-level coverage and separation of duties. - [ ] V5.3.a Resolve in-scope claims by class/severity/status and create assignments pinned to exact claim/draft/source/evidence revisions. Evidence: assignment contract. - [ ] V5.3.b Assign qualified independent fact-checker, due date/priority/ checklist, conflict/recusal, backup, and escalation. Evidence: role tests. - [ ] V5.3.c Review claim text/anchor/citations/locators/source quality/ counter-sources/contradictions/uncertainty and request evidence or edits. Evidence: review journey. - [ ] V5.3.d Record claim-level verified/unsupported/contested/needs-change/ unable decision with evidence/rationale/conditions/signature. Evidence: decision schema. - [ ] V5.3.e Compute complete coverage and block signoff for missing/stale/ orphaned/high-risk claims or self-review. Evidence: coverage tests. - [ ] V5.3.f Invalidate signoff on relevant revision/source/policy changes and preserve prior immutable decisions. Evidence: freshness/SoD tests. - [ ] V5.4 Build standards review for ethics, balance, harm, conflicts, and disclosure. Evidence: checklist and decision record. - [ ] V5.4.a Resolve versioned checklist from desk/risk/audience/target and pin exact draft/claims/media/disclosures/policies. Evidence: review plan. - [ ] V5.4.b Review ethics/public interest/method/source treatment, counterclaims/false balance, conflicts/recusals, and AI/commercial independence. Evidence: ethics checklist. - [ ] V5.4.c Review harm/minimization/warnings/children/vulnerable persons/ location/privacy and distribution-specific treatment. Evidence: harm checklist. - [ ] V5.4.d Review required methodology/AI/correction/conflict/sponsorship/ limitation disclosures for truth, placement, and target parity. Evidence: disclosure checklist. - [ ] V5.4.e Record approve/reject/request-changes/conditional/abstain with anchored findings, evidence, rationale, conditions, and dissent. Evidence: decision record. - [ ] V5.4.f Enforce qualification/recusal/quorum, stale invalidation, and no automated standards approval. Evidence: authorization tests. - [ ] V5.5 Build legal review with compartmented notes and retention. Evidence: field-level authorization and redacted notifications. - [ ] V5.5.a Define legal matter/review/note/attachment/privilege/jurisdiction/ hold/decision schema pinned to exact candidate/evidence. Evidence: legal contract. - [ ] V5.5.b Store notes/attachments/communications in a separately authorized encrypted compartment with restricted search/export/provider access. Evidence: storage tests. - [ ] V5.5.c Build request/accept/investigate/request-information/advise/ decide/escalate/close workflow with qualified counsel and conflicts. Evidence: workflow tests. - [ ] V5.5.d Expose only safe legal-review status/blocker/required action to ordinary users; redact content in UI/API/events/logs/notifications/ audit exports. Evidence: projection tests. - [ ] V5.5.e Apply retention/legal hold/access review/revocation/export/ destruction with immutable decision audit. Evidence: lifecycle tests. - [ ] V5.5.f Invalidate decision on scoped content/evidence/jurisdiction/policy changes and test cross-role/tenant/compartment access. Evidence: security tests. - [ ] V5.6 Build source-protection review without exposing identity to unauthorized reviewers. Evidence: role projections. - [ ] V5.6.a Resolve source-sensitivity/protection checklist and exact ordinary/protected records under review. Evidence: review contract. - [ ] V5.6.b Present pseudonymized source role/relationship/risk/consent/ evidence needs to ordinary reviewers with no inferable protected data. Evidence: redacted projection. - [ ] V5.6.c Present identity/contact/communications/location/safety/grants only to source-protection officers after step-up and purpose check. Evidence: protected projection. - [ ] V5.6.d Record minimize/redact/restrict/delay/approve/request-changes/ emergency/escalate decisions with separate protected and redacted audit. Evidence: decision tests. - [ ] V5.6.e Apply approved display/distribution/search/notification/export/ model-use controls and invalidate on source/content/target changes. Evidence: enforcement tests. - [ ] V5.6.f Test unauthorized UI/API/network/log/cache/count/timing/ notification/audit access and role revocation mid-review. Evidence: non-leakage suite. - [ ] V5.7 Build attestor invitation, verification, response, disagreement, and expiry workflows. Evidence: end-to-end attestation journey. - [ ] V5.7.a Create invitation for exact scope/question/domain/credential/ independence requirements, expiry, locale, and safe evidence package. Evidence: invitation contract. - [ ] V5.7.b Deliver a signed single-use/nonenumerable invitation with identity proofing, consent, authentication, and protected-source redaction. Evidence: invitation security tests. - [ ] V5.7.c Verify identity/credential/issuer/domain/validity/revocation and collect conflict/independence declarations. Evidence: eligibility tests. - [ ] V5.7.d Capture agree/disagree/qualified/abstain/unable response with rationale/evidence/uncertainty/signature and no broader approval power. Evidence: response tests. - [ ] V5.7.e Surface disagreement without suppression, apply quorum/specialist rules, and route clarification/replacement/escalation. Evidence: disagreement tests. - [ ] V5.7.f Expire/revoke/invalidate on time/credential/scope/input/conflict change and notify affected review. Evidence: lifecycle tests. - [ ] V5.7.g Run invite→verify→respond→review→expire/reinvite across success, decline, bad credential, conflict, and stale scope. Evidence: E2E. - [ ] V5.8 Build conflict-of-interest declaration and recusal. Evidence: incompatible conflict blocks approval. - [ ] V5.8.a Define versioned conflict categories, subject/scope/severity, private versus reviewer-visible details, evidence, update/expiry, and false-declaration policy. Evidence: declaration schema. - [ ] V5.8.b Prompt declaration at assignment/review/attestation/publish/ correction and when relevant relationships change. Evidence: trigger tests. - [ ] V5.8.c Let actors declare/no-conflict/update with protected details and route uncertain/material conflicts to authorized standards review. Evidence: declaration journey. - [ ] V5.8.d Compute recusal/incompatibility effects on access, assignment, contribution, quorum, decision, reassignment, and notification. Evidence: recusal rules. - [ ] V5.8.e Block approval/signoff/attestation where conflict or missing declaration violates independence and prevent self-clearance. Evidence: separation tests. - [ ] V5.8.f Preserve immutable decisions and redacted audit; invalidate affected approvals when declarations change. Evidence: lifecycle tests. - [ ] V5.9 Build copy-edit and accessibility review. Evidence: signed exact revision and locale. - [ ] V5.9.a Resolve copy/style/locale and accessibility checklist/templates for exact draft/media/target revision. Evidence: review plan. - [ ] V5.9.b Review grammar/style/names/numbers/dates/links/headlines/captions/ consistency without silently changing claims/quotes/meaning. Evidence: copy-edit tests. - [ ] V5.9.c Review headings/lists/tables/link purpose/alt text/transcripts/ captions/descriptions/reading order/language and semantic alternatives. Evidence: accessibility tests. - [ ] V5.9.d Submit anchored suggestions, accept changes as new revision, and re-run claim/evidence/accuracy gates for material edits. Evidence: revision tests. - [ ] V5.9.e Record separate qualified copy and accessibility decisions with exact revision/locale/target, findings, evidence, rationale, and conditions. Evidence: signed reviews. - [ ] V5.9.f Invalidate on relevant content/media/locale/template/policy change and prohibit inherited signoff across locales. Evidence: freshness tests. - [ ] V5.10 Build publisher signoff with fresh evidence recomputation. Evidence: stale dependency race test. - [ ] V5.10.a Create immutable release-review candidate pinning draft/claims/ sources/evidence/media/disclosures/locales/targets/policies/gates/reviews. Evidence: candidate manifest. - [ ] V5.10.b Recompute applicable raw measurements and verdicts against pinned inputs, resolving unavailable/contested/stale/failure explicitly. Evidence: fresh gate run. - [ ] V5.10.c Verify required role/quorum/independence/legal/standards/fact- check/accessibility/rights approvals are current and candidate-scoped. Evidence: approval check. - [ ] V5.10.d Present target eligibility, embargo/schedule, corrections/ conflicts, residual risks, exceptions, and read-back plan to publisher. Evidence: signoff UI. - [ ] V5.10.e Record named approve/reject/request-changes with reason, conditions, exact manifest hash, step-up, and immutable signature. Evidence: signoff record. - [ ] V5.10.f Atomically recheck manifest/dependency versions at signoff and publish dispatch; fail injected last-moment changes. Evidence: stale- dependency race test. - [ ] V5.11 Build emergency publication and correction policy with higher authority and post-event review. Evidence: no generic gate bypass. - [ ] V5.11.a Define narrowly enumerated emergency types, activation/deactivation authority, jurisdiction/target scope, duration, and required evidence. Evidence: emergency policy. - [ ] V5.11.b Define nonwaivable protected-source/legal/safety/authenticity/ human authority floors and specifically deferrable checks. Evidence: gate matrix. - [ ] V5.11.c Require step-up and higher/dual authority, exact impact preview, reason, conditions, expiry, and immutable incident linkage. Evidence: authorization tests. - [ ] V5.11.d Publish/correct through the same canonical adapters with explicit emergency label, target state, monitoring, read-back, and rollback/ recall. Evidence: emergency journey. - [ ] V5.11.e Queue deferred reviews/evidence/disclosures/corrections with owners/deadlines and block ordinary closure until complete. Evidence: follow-up tests. - [ ] V5.11.f Run mandatory independent post-event review, revoke emergency mode, remediate controls, and preserve full audit. Evidence: game-day. - [ ] V5.12 Build review SLA, escalation, after-hours, and notification routing. Evidence: embargo/source data is redacted. - [ ] V5.12.a Define SLA by review type/risk/desk/priority/phase/target with business calendars/time zones, pause conditions, and measurement events. Evidence: SLA contract. - [ ] V5.12.b Calculate due/breach state deterministically from immutable events and current assignments; handle reassign/reopen/change priority. Evidence: timing tests. - [ ] V5.12.c Define primary/backup/on-call/escalation roles, schedules, acknowledgment, handoff, higher authority, and stop-the-line actions. Evidence: routing policy. - [ ] V5.12.d Send channel-appropriate reminders/escalations with dedupe, quiet-hours/emergency rules, delivery/acknowledgment, and retry. Evidence: notification tests. - [ ] V5.12.e Redact story/embargo/source/legal/complainant detail based on recipient/channel/device while retaining safe deep link after auth. Evidence: redaction tests. - [ ] V5.12.f Report SLA with privacy floors and no reviewer productivity or editorial-quality proxy; test after-hours/time-zone/outage cases. Evidence: operations report. - [ ] V5.13 Build immutable approval and waiver records. Evidence: automation cannot impersonate a human approver. - [ ] V5.13.a Define approval/waiver identity/type/scope/subject manifest/ decision/conditions/reason/evidence/actor-role/time/signature/version. Evidence: record schema. - [ ] V5.13.b Require current authenticated human identity, step-up where needed, qualified role, independence/recusal/quorum, and explicit intent. Evidence: authority tests. - [ ] V5.13.c Restrict waiver to policy-allowed gate/risk/target scope with compensating controls, owner, expiry, review, and nonwaivable floors. Evidence: waiver policy tests. - [ ] V5.13.d Store append-only/tamper-evident records with supersession/ revocation but no mutation/deletion of prior decisions. Evidence: integrity tests. - [ ] V5.13.e Invalidate effective approval/waiver on manifest/input/policy/ role/conflict/condition/expiry change and expose stale state. Evidence: lifecycle tests. - [ ] V5.13.f Attempt service account/model/agent/header/audit-field impersonation, replay, forged signature, and direct DB/API creation. Evidence: non-impersonation suite. - [ ] V5.14 Build newsroom audit export with protected-source redaction. Evidence: authorization and tamper hash. - [ ] V5.14.a Define export purpose/scope/time/story/actor/event/data-class/ format/version request and authorized requester/approver policy. Evidence: export contract. - [ ] V5.14.b Select immutable ordered audit events and related decision/ revision/job/release references with stable cursor and completeness manifest. Evidence: selection tests. - [ ] V5.14.c Apply field/event/object redaction or pseudonymization for protected source, legal, tipster, child/vulnerable, security, and third- party data. Evidence: redaction matrix. - [ ] V5.14.d Generate readable and machine-verifiable output with schema, reason codes, gaps, time zone, chain/manifest hash, signature, and encryption. Evidence: export fixture. - [ ] V5.14.e Deliver through expiring scoped secure download with step-up, watermark if appropriate, rate/size limits, and export audit. Evidence: delivery tests. - [ ] V5.14.f Verify authorization, two-tenant/compartment nonleakage, completeness, tamper detection, replay consistency, and legal-hold behavior. Evidence: audit export suite. ### V6 — Persistence, APIs, search, and distribution integration - [ ] V6.1 Decide authoritative stores for stories, drafts, sources, claims, evidence, attestations, reviews, schedules, releases, and cascades. Evidence: ownership ADR. - [x] V6.1.a Inventory current tables/documents/blobs/indexes/caches/queues/CMS records and writers/readers for each named aggregate. Evidence: storage inventory. - [ ] V6.1.b Define authoritative system/record boundary, aggregate/ transaction ownership, immutable versus mutable data, and durability class per entity. Evidence: ownership matrix. - [ ] V6.1.c Define derived search/read-model/cache/CMS/distribution projections, freshness/rebuild/reconciliation, and forbidden reverse writes. Evidence: projection contracts. - [ ] V6.1.d Define protected-compartment, encryption/key/region, retention/ hold/backup, and access-audit storage constraints. Evidence: data placement review. - [ ] V6.1.e Resolve split/duplicate ownership, failure boundaries, outbox/ saga needs, migration, recovery, and accountable service/team. Evidence: approved ownership ADR. - [ ] V6.2 Add missing schemas with explicit queryable columns and safe migrations. Evidence: production-size rehearsal. - [ ] V6.2.a Derive missing tables/columns/types/constraints/indexes/ partitions/foreign keys from canonical contracts and required queries. Evidence: schema diff. - [ ] V6.2.b Keep identity/state/tenant/desk/story/compartment/version/time/ relationship fields explicit and queryable; avoid opaque core JSON. Evidence: schema review. - [ ] V6.2.c Design expand/backfill/dual-read-write/switch/contract migrations with chunking, checkpoints, idempotency, throttling, and rollback/ restore boundaries. Evidence: migration plan. - [ ] V6.2.d Preserve immutable revisions/hashes/audit/protected encryption and validate references/state mappings during backfill. Evidence: migration tests. - [ ] V6.2.e Rehearse production-volume/cardinality/skew/concurrency on real engine, record locks/runtime/storage/query plans, and meet budgets. Evidence: rehearsal report. - [ ] V6.2.f Deploy with observability/reconciliation/stop conditions and remove old schema only after all consumers prove compatibility. Evidence: rollout gate. - [ ] V6.3 Implement immutable revision and evidence stores with durable-before-ack behavior. Evidence: real-database tests. - [ ] V6.3.a Implement append-only revision/evidence/member/blob-reference/ hash/signature schemas with unique identity and parent/version constraints. Evidence: persistence tests. - [ ] V6.3.b Write record, required references, blob completion, and outbox atomically or through a recoverable protocol before acknowledging. Evidence: durability tests. - [ ] V6.3.c Enforce optimistic concurrency/idempotency/deduplication and immutable historical content under retry/race/replay. Evidence: concurrency tests. - [ ] V6.3.d Verify canonical hashes/signatures on read and detect missing/ changed/mismatched blobs or members without returning approved state. Evidence: integrity tests. - [ ] V6.3.e Inject database/blob/network/process failure at each boundary, restart/reconcile, and prove acknowledged writes survive. Evidence: fault suite. - [ ] V6.3.f Run backup/restore/read-back against real database/blob services with tenant/compartment isolation. Evidence: durable round-trip. - [ ] V6.4 Implement pitch/assignment/story/draft APIs with optimistic concurrency and property-level authorization. Evidence: contract suite. - [ ] V6.4.a Define versioned CRUD/query/transition/command contracts, stable IDs, errors, pagination/filter/sort, idempotency, and deprecation. Evidence: OpenAPI schemas. - [ ] V6.4.b Implement request identity/tenant/desk/story/role/state/ capability authorization for every object and function. Evidence: route auth tests. - [ ] V6.4.c Apply field-level read/write/patch/filter/sort/export projection, including embargo/protected/legal/commercial constraints. Evidence: property auth tests. - [ ] V6.4.d Require expected version/ETag for mutation and return structured conflict/current revision without silent overwrite. Evidence: concurrency tests. - [ ] V6.4.e Implement idempotent create/commands/transitions with transactional audit/outbox and safe retry. Evidence: idempotency tests. - [ ] V6.4.f Test positive/negative/cross-tenant/stale-role/direct-object/ mass-assignment/unknown-field/oversized requests. Evidence: contract suite. - [ ] V6.5 Implement compartmented source APIs and access-grant audit. Evidence: protected identity negative tests. - [ ] V6.5.a Separate ordinary source endpoints/contracts from protected identity/contact/communications/safety/grant endpoints and credentials. Evidence: API boundary. - [ ] V6.5.b Implement pseudonymous safe projection and opaque linkage without protected field/count/timing/existence leaks. Evidence: projection tests. - [ ] V6.5.c Require current nominative purpose/time/story-scoped grant, step-up/device/session policy, and field/function authorization on every protected call. Evidence: access tests. - [ ] V6.5.d Implement request/approve/deny/revoke/expire/emergency grant workflow with separation, reason, alerts, and post-review. Evidence: grant tests. - [ ] V6.5.e Emit tamper-evident redacted attempt/access/export audit without copying secrets into ordinary systems. Evidence: audit tests. - [ ] V6.5.f Test enumeration, BOLA, mass assignment, filter/sort/error/cache/ log leakage, token replay, revoked/mid-session grants, and two tenants. Evidence: protected identity negative suite. - [ ] V6.6 Implement claim/citation/evidence/attestation APIs. Evidence: canonical invariant route tests. - [ ] V6.6.a Define versioned resource/command/query/batch contracts and explicit claim/citation/evidence-pack/attestation state transitions. Evidence: API schemas. - [ ] V6.6.b Validate exact story/draft/revision/anchor/source/locator/member/ scope references and canonical class/state/value vocabularies. Evidence: invariant tests. - [ ] V6.6.c Enforce tenant/story/desk/role/field/function/compartment/ independence authorization and protected redacted projections. Evidence: authorization tests. - [ ] V6.6.d Implement optimistic concurrency/idempotency/transactional audit/ outbox and immutable revision or decision records. Evidence: mutation tests. - [ ] V6.6.e Invalidate dependent gates/reviews/releases on relevant mutation and publish versioned events with no protected payload. Evidence: dependency tests. - [ ] V6.6.f Run valid/invalid/stale/duplicate/orphan/hash/scope/cross-tenant/ mass-assignment route fixtures. Evidence: canonical contract suite. - [ ] V6.7 Implement verification/gate jobs with current policy versions. Evidence: stale input and rerun tests. - [ ] V6.7.a Define job request/run/attempt/result contracts pinning subject/ inputs/evaluator/model/corpus/weight/policy versions and requested gates. Evidence: job schema. - [ ] V6.7.b Resolve applicability/current approved versions at dispatch and reject mutable aliases, missing configuration, or unauthorized inputs. Evidence: dispatch tests. - [ ] V6.7.c Implement durable queue/lease/heartbeat/timeout/retry/backoff/ cancellation/idempotency/resource/budget behavior per gate. Evidence: worker tests. - [ ] V6.7.d Persist raw measurements/evidence before separate verdicts, terminal state, audit, and dependency invalidation events. Evidence: result tests. - [ ] V6.7.e Detect subject/input/policy version changes before execution and commit; mark stale/superseded and require explicit rerun. Evidence: stale input tests. - [ ] V6.7.f Inject provider/evaluator/queue/database/blob failure, cancel, replay, duplicate, and out-of-order events. Evidence: fault/rerun suite. - [ ] V6.8 Implement protected, permission-aware newsroom search. Evidence: titles, counts, facets, and snippets do not leak. - [ ] V6.8.a Define per-document/field classification, tenant/desk/story/ compartment/role ACL, reveal/embargo/public state, locale, freshness, and deletion schema. Evidence: search security model. - [ ] V6.8.b Index only allowlisted safe projections from authoritative events with content/version hash, current ACL, and protected fields excluded. Evidence: indexing tests. - [ ] V6.8.c Apply authorization before candidate retrieval/aggregation/ ranking/highlighting and stable cursor pagination. Evidence: query tests. - [ ] V6.8.d Prevent query suggestion/autocomplete/spelling/semantic vector/ title/snippet/count/facet/timing/cache/log leaks. Evidence: leakage suite. - [ ] V6.8.e Process access revoke/embargo/retraction/correction/delete/ compartment change promptly and reconcile index to source of truth. Evidence: update tests. - [ ] V6.8.f Run two-tenant/multi-role/existence-oracle/BOLA/injection/ high-volume/stale-index adversarial tests. Evidence: protected search report. - [ ] V6.9 Implement CMS plan/publish/read-back/compensate adapter. Evidence: idempotent partial-failure recovery. - [ ] V6.9.a Define target/versioned adapter capabilities, field/asset/locale/ rights/correction mappings, credentials, rate limits, and unsupported behavior. Evidence: adapter profile. - [ ] V6.9.b Build a read-only publication plan from immutable candidate with target operations/dependencies/idempotency keys/expected current state/ loss/impact. Evidence: plan tests. - [ ] V6.9.c Execute create/update/assets/link/schedule/publish actions in dependency order with retries, acknowledgments, and per-action durable status. Evidence: publish tests. - [ ] V6.9.d Read back public/CMS canonical content, metadata, assets, visibility, timestamps, IDs, version, and correction state; semantic- compare to plan. Evidence: verification tests. - [ ] V6.9.e Compensate only reversible actions, otherwise retain partial release with operator remediation; never report whole success. Evidence: compensation tests. - [ ] V6.9.f Test timeout after commit, duplicate request, reordered callback, rate/auth loss, asset failure, schedule race, read-back mismatch, and retry. Evidence: partial-failure suite. - [ ] V6.10 Implement NewsML-G2 package generation and validation. Evidence: golden News Item, Package, Planning, update, and correction fixtures. - [ ] V6.10.a Resolve exact pinned release/story/source/claim/media/rights/ topic/planning/correction data and profile/code-list versions. Evidence: generator inputs. - [ ] V6.10.b Generate deterministic News Items with identity/version/status/ metadata/content/rights/subjects/associations and supported extensions. Evidence: News Item goldens. - [ ] V6.10.c Generate deterministic Package and Planning Items with ordered/ role-qualified membership, schedules/embargoes, and protected redaction. Evidence: package/planning goldens. - [ ] V6.10.d Generate initial/update/correction/replacement/retraction chains with prior references, signals, notices, and target actions. Evidence: lifecycle goldens. - [ ] V6.10.e Validate schema/profile/code list/cardinality/URI/date/time/ rights/language/ID rules using pinned validator. Evidence: validation tests. - [ ] V6.10.f Round-trip through supported consumers and semantic-compare without silently dropping unsupported data. Evidence: interoperability report. - [ ] V6.11 Implement newsletter, social, audio, video, wire, and archive distribution adapters as target-specific jobs. Evidence: target matrix. - [ ] V6.11.a Define shared job/attempt/artifact/ack/read-back/correction envelope plus per-target capabilities, credentials, limits, and version. Evidence: adapter contracts. - [ ] V6.11.b Implement newsletter provider payload/delivery/archive/ unsubscribe/correction mapping from an approved edition. Evidence: newsletter tests. - [ ] V6.11.c Implement each social/channel adapter with text/media/link/ disclosure/schedule/edit-delete/correction/moderation capability and explicit unsupported cells. Evidence: social tests. - [ ] V6.11.d Implement audio/video platform feed/media/metadata/captions/ rights/provenance/replace/correct behavior. Evidence: AV adapter tests. - [ ] V6.11.e Implement wire NewsML/package acknowledgement/update and archive immutable deposit/public status/correction/legal-hold behavior. Evidence: wire/archive tests. - [ ] V6.11.f Run durable idempotent target jobs with per-target status, retry/backoff/rate/cancel/read-back and no aggregate false success. Evidence: target matrix. - [ ] V6.12 Implement C2PA signing/validation for supported media/package outputs. Evidence: tamper and trust-chain tests. - [ ] V6.12.a Define supported C2PA versions/algorithms/assertions/ingredients/ actions, claim generators, signing identities, trust stores, and key lifecycle. Evidence: C2PA profile. - [ ] V6.12.b Build deterministic manifest from exact immutable media/article package/rendition/edit/AI/rights provenance. Evidence: manifest tests. - [ ] V6.12.c Sign in isolated authorized service/HSM or equivalent with idempotency, timestamp, certificate chain, audit, and no private-key exposure. Evidence: signing tests. - [ ] V6.12.d Embed or associate manifest per format/target, preserve hashes through supported transforms, and record stripped provenance. Evidence: packaging tests. - [ ] V6.12.e Validate cryptographic integrity, ingredient/action lineage, signer trust/revocation/expiry, and expected content binding. Evidence: validation tests. - [ ] V6.12.f Test valid/tampered/replaced/stripped/unknown/untrusted/expired/ revoked/malformed chains and present precise nontruth status. Evidence: trust-chain suite. - [ ] V6.13 Implement correction and retraction cascade orchestration through outbox/saga. Evidence: duplicate and out-of-order delivery tests. - [ ] V6.13.a Create immutable cascade/plan/actions from a pinned dependency graph, approved remedy, target capabilities, and desired states. Evidence: saga contract. - [ ] V6.13.b Commit authoritative correction/retraction state and outbox event atomically with unique cascade/action/idempotency identities. Evidence: transaction tests. - [ ] V6.13.c Execute dependency-aware per-target update/replace/remove/ notify/reindex/invalidate actions with leases/retry/backoff/timeouts. Evidence: worker tests. - [ ] V6.13.d Handle duplicate/out-of-order/late callbacks/events using expected versions and monotonic state without undoing newer remedies. Evidence: delivery tests. - [ ] V6.13.e Read back every target, reconcile mismatch/unknown/unsupported/ partial state, retry or escalate, and never close unresolved targets. Evidence: verification tests. - [ ] V6.13.f Compensate only safe reversible actions, preserve audit/history, and replay after outage without duplicate notices. Evidence: fault suite. - [ ] V6.14 Implement two-tenant and protected-compartment isolation across API, search, blobs, jobs, exports, and audit. Evidence: integration suite. - [ ] V6.14.a Create two tenants with overlapping IDs/names/content plus ordinary/protected stories, sources, grants, blobs, jobs, and events. Evidence: isolation fixture. - [ ] V6.14.b Test API object/property/function/filter/sort/batch/cache/ concurrency access under direct and stale identifiers. Evidence: API isolation. - [ ] V6.14.c Test search indexing/query/suggestion/snippet/count/facet/vector/ timing and deletion/revocation. Evidence: search isolation. - [ ] V6.14.d Test blob keys/URLs/ranges/proxies/metadata/uploads/downloads/ transforms/backups and signed-link substitution. Evidence: blob isolation. - [ ] V6.14.e Test queue payloads/workers/callbacks/artifacts/logs/metrics/ retries/dead letters across tenant/compartment context. Evidence: job isolation. - [ ] V6.14.f Test audit/export/report/notification/webhook/CMS/distribution projections and redactions. Evidence: output isolation. - [ ] V6.14.g Attempt service account, admin, emergency grant, role revoke, cache poisoning, guessed ID, and cross-tenant relationship attacks. Evidence: adversarial integration suite. - [ ] V6.15 Generate OpenAPI and consumer contracts for Studio, CMS, reader, archive, and distribution consumers. Evidence: drift gate. - [ ] V6.15.a Generate canonical versioned OpenAPI from authoritative route/ schema/error/auth/pagination/idempotency contracts with stable operation IDs. Evidence: OpenAPI artifact. - [ ] V6.15.b Produce audience-specific Studio/CMS/reader/archive/distribution contract projections without publishing protected internal fields. Evidence: consumer schemas. - [ ] V6.15.c Add representative requests/responses/errors/events and generated clients/types where owned, pinned to exact spec digest. Evidence: contract fixtures. - [ ] V6.15.d Run schema lint/breaking-change/unknown route/unimplemented operation and server-versus-spec conformance tests. Evidence: provider gate. - [ ] V6.15.e Run consumer compile/fixture/semantic contract tests for each supported version and target behavior, including corrections. Evidence: consumer gate. - [ ] V6.15.f Fail CI on unreviewed drift, protected-field exposure, orphan operation, stale generated client, or unsupported breaking change. Evidence: drift gate. ### V7 — Calendar, publication, correction, retraction, and curation - [ ] V7.1 Build an editorial calendar for assignments, embargoes, coverage plans, review, publication, newsletters, and distribution windows. Evidence: accessible time-zone journey. - [ ] V7.1.a Define calendar item/reference contracts for each named entity with start/end/deadline/window/time zone/recurrence/status/owner and exact source revision. Evidence: calendar schema. - [ ] V7.1.b Build permission-filtered day/week/month/agenda views with stable filters by desk/owner/type/state/target/locale and protected redaction. Evidence: view tests. - [ ] V7.1.c Create/edit/reschedule/assign from owned workflows with validation, dependency/embargo/conflict/impact preview, concurrency, and audit. Evidence: action tests. - [ ] V7.1.d Normalize storage and display correctly across newsroom/user/ target time zones, DST transitions, ambiguous/nonexistent times, and locale calendars. Evidence: temporal tests. - [ ] V7.1.e Provide table/agenda and form alternatives to visual calendar/ drag operations with keyboard/screen-reader parity. Evidence: accessibility tests. - [ ] V7.1.f Exercise assignment→review→embargo→publish→distribution journey across time zones and responsive web/desktop. Evidence: E2E. - [ ] V7.2 Model embargo as an independent policy, not a publish status. Evidence: NewsML-G2 and CMS mapping tests. - [ ] V7.2.a Implement embargo policy entity/versions independently of story, editorial, release, schedule, and target execution states. Evidence: state model. - [ ] V7.2.b Evaluate access/display/export/model-use/notification/search/ preview/publish constraints from current time/event/party/territory/ channel and authorized exceptions. Evidence: policy tests. - [ ] V7.2.c Handle set/update/lift/expire/breach/dispute with authority, reason, source agreement, affected objects, audit, and notifications. Evidence: lifecycle tests. - [ ] V7.2.d Recompute release eligibility/schedules on policy changes without changing editorial approval or falsely marking published. Evidence: independence tests. - [ ] V7.2.e Map embargo fields/actions to NewsML-G2 and each CMS/distribution target, preserving unsupported or lossy behavior explicitly. Evidence: adapter matrix. - [ ] V7.3 Build desk capacity and specialist-review reservation. Evidence: committed slots cannot be double-booked. - [ ] V7.3.a Define staff/role/skill/credential/desk/time-zone/availability/ capacity/calendar and privacy-safe display contracts. Evidence: capacity schema. - [ ] V7.3.b Forecast assignment/review workload by type/risk/effort/deadline/ phase without turning output volume into performance scoring. Evidence: workload model. - [ ] V7.3.c Create tentative/held/committed/released/expired reservation with story/review/owner/window/capacity units, priority, and dependencies. Evidence: reservation state machine. - [ ] V7.3.d Commit atomically under concurrent booking, enforce conflicts/ leave/on-call/quorum/credential constraints, and prevent double booking. Evidence: concurrency tests. - [ ] V7.3.e Support reschedule/reassign/cancel/overbook-exception with impact, authority, notifications, SLA recalculation, and audit. Evidence: operations tests. - [ ] V7.4 Build release candidates locked to exact draft, source, claim, evidence, media, attestation, policy, and locale versions. Evidence: mutation invalidation. - [ ] V7.4.a Resolve complete transitive candidate dependency manifest across exact draft/blocks/claims/sources/citations/evidence/media/attestations/ reviews/disclosures/locales/targets/policies. Evidence: manifest schema. - [ ] V7.4.b Freeze canonical serialized references/hashes/signatures and target/template/config/adapter versions without copying protected plaintext. Evidence: candidate artifact. - [ ] V7.4.c Verify every dependency exists/is authorized/current/approved/ integrity-valid and record missing/stale/contested/unsupported state. Evidence: validation tests. - [ ] V7.4.d Allow explicit candidate create/supersede/abandon only; prohibit mutation of locked manifests or historical approvals. Evidence: immutability tests. - [ ] V7.4.e Subscribe/reconcile relevant mutations and invalidate candidate, previews, signoffs, schedules, and jobs before dispatch. Evidence: invalidation tests. - [ ] V7.4.f Recheck manifest transactionally at signoff and execution to close dependency races. Evidence: race tests. - [ ] V7.5 Build target preview and eligibility diagnostics. Evidence: unsupported or missing fields never silently drop. - [ ] V7.5.a Resolve exact release candidate/target/account/locale/audience/ template/adapter/policy versions and current credentials/capabilities. Evidence: preview inputs. - [ ] V7.5.b Render production-equivalent semantic/visual/payload preview with target limits/transforms/fallbacks/disclosures/correction behavior. Evidence: preview tests. - [ ] V7.5.c Validate required/optional fields, types/lengths/media/renditions/ rights/accessibility/embargo/schedule/approval/channel policies. Evidence: diagnostics. - [ ] V7.5.d Report unsupported/dropped/truncated/transformed/lossy fields individually with severity, effect, remediation, and no false eligible state. Evidence: loss tests. - [ ] V7.5.e Recompute on candidate/target capability/template/policy/account changes and label stale/fixture/degraded/unavailable state. Evidence: freshness tests. - [ ] V7.5.f Compare preview semantic output to actual read-back for supported cells. Evidence: parity gate. - [ ] V7.6 Build schedule, publish, read-back verification, and multi-target result views. Evidence: one failed target cannot make the release wholly successful. - [ ] V7.6.a Create per-target scheduled action with candidate/eligibility/ account/locale/time zone/window/idempotency/dependency and authorized publisher. Evidence: schedule contract. - [ ] V7.6.b Recheck embargo/candidate/gates/approvals/rights/credentials/ target capability immediately before durable dispatch. Evidence: dispatch guard tests. - [ ] V7.6.c Execute target-specific publish jobs with queue/lease/retry/rate/ cancel/callback and persist target ID/URL/version/acknowledgment. Evidence: job tests. - [ ] V7.6.d Read back public/target content, metadata, assets, visibility, correction/disclosure/provenance and semantic-compare to candidate. Evidence: read-back tests. - [ ] V7.6.e Present queued/running/scheduled/published/verified/degraded/ failed/unknown/compensated per target plus aggregate partial status. Evidence: result view. - [ ] V7.6.f Retry/remediate/recall selected targets with impact/concurrency/ audit, never converting one success/failure into whole-release success. Evidence: partial failure E2E. - [ ] V7.7 Build visible correction authoring with prior/new text, rationale, affected claims, and reader notice. Evidence: canonical correction invariants. - [ ] V7.7.a Start correction from exact public release/target or verified feedback with type/severity/discovery/source/owner and preserve prior version. Evidence: correction intake. - [ ] V7.7.b Select exact prior blocks/ranges/media/captions/metadata and author replacement/removal/addition as a new revision with semantic diff. Evidence: change editor. - [ ] V7.7.c Link affected claims/citations/sources/packages/targets and recompute evidence/gates/reviews plus blast radius. Evidence: impact tests. - [ ] V7.7.d Require factual rationale, discovery/correction time, responsible editor, applicable approvals, and target/locale-specific reader notice. Evidence: notice contract. - [ ] V7.7.e Preview prior/new content and notice at every target, including archive/history and accessible semantic output. Evidence: preview tests. - [ ] V7.7.f Enforce prior text/version/hash match, immutable chronology, concurrency, correction-of-correction, and no silent overwrite. Evidence: canonical invariant suite. - [ ] V7.8 Build source/claim/story retraction intake and impact preview. Evidence: complete dependency graph. - [ ] V7.8.a Intake source/claim/story retraction candidate with issuer/ evidence/cause/scope/severity/verification/time and exact subject revision. Evidence: intake schema. - [ ] V7.8.b Authenticate/verify external retraction or require authorized internal human decision; classify disputed/partial/unknown state. Evidence: verification tests. - [ ] V7.8.c Traverse full versioned dependency graph through citations/ claims/stories/packages/locales/media/newsletters/social/channels/audio/ video/archive/search/B2B. Evidence: impact query. - [ ] V7.8.d Show each affected node/edge/current release/target, proposed remedy, urgency/owner/state, protected redaction, and unknown consumers. Evidence: preview UI. - [ ] V7.8.e Freeze a read-only impact snapshot and reconcile against consumer registry; never mutate during preview. Evidence: completeness tests. - [ ] V7.8.f Require separately approved cascade plan and fresh graph check before execution. Evidence: authorization/race tests. - [ ] V7.9 Build retraction-cascade execution with per-target status and retry. Evidence: CMS, reader, newsletter, social, archive, search, and package fixtures. - [ ] V7.9.a Convert approved impact snapshot into dependency-ordered, target-specific retain/correct/withdraw/retract/remove/notify/reindex/ invalidate actions. Evidence: execution plan. - [ ] V7.9.b Dispatch durable idempotent saga actions with expected versions, prerequisites, attempts, rate limits, retries, and operator ownership. Evidence: orchestration tests. - [ ] V7.9.c Implement CMS/reader and NewsML/package state/notice/version updates with preserved history and canonical URLs. Evidence: core target tests. - [ ] V7.9.d Implement newsletter/social/channel/audio/video/archive/search/ B2B target capabilities with explicit unsupported/partial behavior. Evidence: channel target tests. - [ ] V7.9.e Show target/action queued/running/succeeded/verified/failed/ unknown/unsupported/compensated and allow authorized safe retry. Evidence: status UI. - [ ] V7.9.f Handle duplicate/out-of-order/late callbacks, concurrent newer corrections, auth loss, outage, and replay without reversing remedies. Evidence: fault tests. - [ ] V7.10 Build correction/retraction verification from downstream read-back. Evidence: stale dependent surface blocks closure. - [ ] V7.10.a Define expected semantic state per target/action, verification adapter/version, tolerated delay, retry policy, and closure criteria. Evidence: verification contract. - [ ] V7.10.b Read back public content/metadata/status/notices/history/assets/ search/cache/feed/API/webhook state using independent paths. Evidence: read-back tests. - [ ] V7.10.c Compare identity/version/text/media/claim/correction/retraction/ visibility/time/links semantically rather than only acknowledgment. Evidence: comparator tests. - [ ] V7.10.d Mark mismatch/stale/unreachable/unauthorized/unsupported/unknown per dependent surface with evidence, owner, retry, and escalation. Evidence: failure states. - [ ] V7.10.e Prevent cascade/correction closure while any required registered surface is unresolved or registry reconciliation is incomplete. Evidence: closure gate. - [ ] V7.10.f Reverify after caches/indexes/feeds propagate and retain signed final reconciliation plus later drift monitoring. Evidence: verification report. - [ ] V7.11 Build section, topic, package, timeline, related, and featured curation via versioned bundles. Evidence: no direct production writes. - [ ] V7.11.a Define typed versioned bundle identity/scope/locale/territory/ window/status/owner and ordered/grouped item references by curation kind. Evidence: bundle schemas. - [ ] V7.11.b Build draft editor for select/search/add/remove/order/group/ annotate/schedule with non-drag controls and protected/embargo rules. Evidence: curation UI. - [ ] V7.11.c Validate item release/rights/correction/retraction/freshness/ target/locale compatibility and required contextual notices. Evidence: eligibility tests. - [ ] V7.11.d Provide semantic diff/review/approval/preview for exact bundle revision and invalidate on item or policy changes. Evidence: review tests. - [ ] V7.11.e Publish through canonical target adapter/job/read-back with immutable prior versions, idempotency, and rollback/new revision. Evidence: bundle release tests. - [ ] V7.11.f Prohibit client/direct CMS/production mutations and audit every attempted bypass. Evidence: no-direct-write tests. - [ ] V7.12 Build archive and legal-hold behavior. Evidence: public removal does not destroy required evidence. - [ ] V7.12.a Define archive tiers/state/retention/access/index/public visibility and legal-hold scope/reason/authority/effective/expiry. Evidence: lifecycle contract. - [ ] V7.12.b Archive immutable stories/revisions/sources/evidence/media/ reviews/releases/corrections/audit with reference and integrity preservation. Evidence: archive tests. - [ ] V7.12.c Separate public unpublish/withdraw/retract/search removal from internal retention and show appropriate public notice. Evidence: removal tests. - [ ] V7.12.d Apply hold to records/blobs/indexes/backups/exports/processors, suspend conflicting deletion, and record conflicts. Evidence: hold tests. - [ ] V7.12.e Enforce archive/hold role/field/compartment access, protected search redaction, audited export, and secure restore. Evidence: authorization tests. - [ ] V7.12.f Test retention expiry/deletion request/correction/retraction/ source protection/backup restore under and after hold. Evidence: lifecycle suite. - [ ] V7.13 Build source and attestation expiry monitoring. Evidence: affected published claims enter review. - [ ] V7.13.a Define expiry/staleness triggers from source update/retraction/ rights/review interval and attestor credential/conflict/validity/scope. Evidence: monitoring rules. - [ ] V7.13.b Schedule idempotent scans and event-driven checks against current versions with leases/cursors/rate limits and clock/time-zone handling. Evidence: monitor tests. - [ ] V7.13.c Traverse affected claim/story/release/target graph and calculate risk/urgency/deadline without exposing protected source details. Evidence: impact tests. - [ ] V7.13.d Mark dependent evidence/gates/approvals/releases as stale or review-required according to policy; never silently keep current pass. Evidence: invalidation tests. - [ ] V7.13.e Create deduplicated review assignments/notifications/escalations with safe context, owner, due date, and remediation. Evidence: workflow tests. - [ ] V7.13.f Track resolve/replace/renew/correct/retract/waive outcomes and reverify downstream state. Evidence: monitoring E2E. - [ ] V7.14 Build post-publication audience feedback and complaint intake. Evidence: triage cannot directly rewrite published truth. - [ ] V7.14.a Provide accessible authenticated or permitted anonymous intake with channel/type/story/claim/target/locale/contact/consent/privacy/ evidence fields. Evidence: intake contract. - [ ] V7.14.b Scan/quarantine attachments and rate-limit/spam/abuse protect without exposing reporter/source identities or creating a public existence oracle. Evidence: security tests. - [ ] V7.14.c Classify feedback, factual correction request, NMC/legal complaint, right-of-reply, safety/privacy, accessibility, and tip as distinct queues. Evidence: routing tests. - [ ] V7.14.d Assign owner/SLA/priority/acknowledgment/status/response/ escalation with protected/redacted notes and audit. Evidence: triage workflow. - [ ] V7.14.e Link evidence to exact public version/claim without modifying canonical story, claim, correction, or public content. Evidence: immutability tests. - [ ] V7.14.f Convert only via authorized editorial/complaint/correction/tip workflow and send privacy-safe resolution. Evidence: handoff E2E. - [ ] V7.15 Build cross-domain impact hooks for explainers, saved claims, Telegram cards, and Living Scenes. Evidence: correction cascade reaches registered consumers. - [ ] V7.15.a Define versioned consumer registration with domain/owner/ endpoint/event types/subject mappings/capabilities/auth/retry/read-back/ SLA. Evidence: registry schema. - [ ] V7.15.b Publish correction/retraction/source/claim/story lifecycle events with opaque stable IDs, versions, reason/notice, and no protected data. Evidence: event contract. - [ ] V7.15.c Implement explainer, saved-claim, Telegram-card, and Living Scene adapters/projections with explicit correction/retraction behavior. Evidence: consumer tests. - [ ] V7.15.d Deliver through durable outbox with idempotency/order/retry/ dead-letter/replay and per-consumer status. Evidence: delivery tests. - [ ] V7.15.e Require acknowledgment or independent read-back and keep unknown/ stale/unregistered/unsupported consumers visible. Evidence: verification tests. - [ ] V7.15.f Reconcile capability registry to observed consumers and fail missing owner/hook/proof or protected-field exposure. Evidence: cascade coverage gate. - [ ] V7.16 Build emergency recall with step-up authorization and later review. Evidence: reversible, audited incident journey. - [ ] V7.16.a Define eligible emergency recall reasons/severity/scope/targets/ authority/nonwaivable constraints and distinction from ordinary retraction. Evidence: recall policy. - [ ] V7.16.b Build read-only blast-radius/target-capability/impact preview, alternatives, expected public state, and rollback/restoration plan. Evidence: recall plan. - [ ] V7.16.c Require current publisher/corrections/emergency role, step-up and higher/dual approval as policy requires, reason, incident, and expiry. Evidence: authorization tests. - [ ] V7.16.d Dispatch idempotent per-target hide/withdraw/replace/notify/ invalidate actions with progress, failures, and independent read-back. Evidence: execution tests. - [ ] V7.16.e Restore or replace only through new approved state after risk is addressed; retain recall notice/history and prevent stale reappearance. Evidence: reversibility tests. - [ ] V7.16.f Conduct mandatory post-event review of trigger/authority/actions/ effects/gaps, close unresolved targets, and preserve audit. Evidence: incident journey. - [ ] V7.17 Build desk/edition/program steering overlays for sourcing, specialist review, risk, style, audience, distribution, and cadence. Evidence: tighten-only property tests and impact preview. - [ ] V7.17.a Define versioned overlay identity/scope/priority/effective window/ owner/reviewer and each allowed sourcing/review/risk/style/audience/ distribution/cadence property. Evidence: overlay schema. - [ ] V7.17.b Define code/regulatory/global policy floors and partial order for stricter versus weaker values per property. Evidence: lattice spec. - [ ] V7.17.c Resolve applicable overlays deterministically across desk/ edition/program/locale/territory/phase/target with conflicts explicit. Evidence: resolution tests. - [ ] V7.17.d Preview affected drafts/gates/reviews/schedules/targets/users and newly blocked/required actions before activation. Evidence: impact preview. - [ ] V7.17.e Govern draft/review/approve/activate/supersede/rollback/migrate/ expire with separation, audit, and no direct policy-floor editing. Evidence: governance tests. - [ ] V7.17.f Property-test that every overlay composition is equal or tighter than floors and cannot relax protected-source/safety/legal/human authority. Evidence: tighten-only suite. - [ ] V7.18 Build UI-governed desk, topic, format, source, claim, risk, audience, territory, and catalog taxonomies mapped to IPTC vocabularies and code-owned floors. Evidence: versioned review, alias, deprecation, localization, and migration journey. - [ ] V7.18.a Define stable concept/code/set/version/label/definition/parent/ relation/alias/status/locale/IPTC mapping and code-owned floor schema. Evidence: taxonomy contracts. - [ ] V7.18.b Build Veritas taxonomy draft editing for add/edit/reparent/ relate/alias/merge/split/localize with cycle/duplicate/code/meaning validation. Evidence: editor tests. - [ ] V7.18.c Map to pinned IPTC Media Topics/code lists with exact/broader/ narrower/related/unmapped relation, provenance, and review. Evidence: mapping tests. - [ ] V7.18.d Preview impact across stories/sources/claims/search/analytics/ policies/routes/feeds/NewsML/targets before version activation. Evidence: impact analysis. - [ ] V7.18.e Govern review/approve/activate/supersede/deprecate with aliases/ replacements, localization completeness, immutable versions, and no floor weakening. Evidence: governance tests. - [ ] V7.18.f Migrate references/read models/indexes atomically or recoverably, preserve historical meaning, and reject orphan/unknown values. Evidence: migration journey. ### V7A — Channel, audience, community, and business operations - [ ] V7A.1 Build newsletter edition authoring for sections, story selection, summaries, subject/preheader variants, sponsorship disclosure, personalization limits, preview/test send, audience/consent, schedule, delivery, bounce/complaint, archive, correction, and unsubscribe. Evidence: edition-to-story revision lineage and downstream correction. - [ ] V7A.1.a Define newsletter/publication/edition/section/item/variant/ audience/template/schedule/send/version/state contracts. Evidence: newsletter schemas. - [ ] V7A.1.b Build ordered section/story selection from exact eligible releases with semantic/non-drag controls, duplicate/conflict checks, and correction/retraction visibility. Evidence: edition editor. - [ ] V7A.1.c Author summaries/subject/preheader variants with factual comparison, locale/length/style rules, provenance, and human selection. Evidence: content tests. - [ ] V7A.1.d Insert sponsorship/advertising blocks with advertiser/campaign/ rights/targeting, mandatory disclosure/separation, and editorial independence. Evidence: sponsorship gate. - [ ] V7A.1.e Apply bounded versioned personalization only to approved selection/order/content fields with privacy floors and no fact/ correction/disclosure hiding. Evidence: personalization tests. - [ ] V7A.1.f Render production-equivalent web/email/client previews and authorized test sends with links/assets/UTM/accessibility/dark-mode/ plain-text validation. Evidence: preview tests. - [ ] V7A.1.g Resolve consented audience/segment/suppression/unsubscribe/ locale/frequency/quiet policy at send time without exporting protected newsroom data. Evidence: audience tests. - [ ] V7A.1.h Schedule and execute idempotent provider jobs with per-recipient privacy-safe delivery/bounce/complaint/suppression aggregates, retries, and read-back/archive. Evidence: send tests. - [ ] V7A.1.i Propagate story correction/retraction to edition archive, web copy, eligible follow-up notice, links/search, and provider state while preserving exact edition→story revision lineage. Evidence: correction E2E. - [ ] V7A.2 Build social-channel planning for platform-specific copy/media, account, schedule, cadence, rights, disclosure, approval, preview, publish, acknowledgement, moderation handoff, retry, edit/delete where supported, and correction. Evidence: no optimizer can change verified meaning or silently publish. - [ ] V7A.2.a Define per-platform/account capability/version/credential/ content-limit/media/rendition/link/schedule/edit-delete/moderation/ correction contract. Evidence: channel matrix. - [ ] V7A.2.b Create post plan pinned to story release/claims/media/locale/ target with account, objective, schedule/cadence, owner, and current correction state. Evidence: plan schema. - [ ] V7A.2.c Author platform copy/media/crops/captions/alt text/link/cards/ hashtags with factual-proposition and rights checks. Evidence: authoring tests. - [ ] V7A.2.d Apply sponsorship/AI/correction/graphic-content disclosures and safe areas/length/format constraints without silent truncation/drop. Evidence: eligibility tests. - [ ] V7A.2.e Preview exact target payload/rendering and require named human approval of immutable version; optimizers remain proposal-only. Evidence: approval tests. - [ ] V7A.2.f Schedule/publish through durable idempotent jobs with account/ rate/auth checks, acknowledgment/target ID/read-back, retry, and partial status. Evidence: publish tests. - [ ] V7A.2.g Hand off replies/comments/incidents to moderation with exact post/story context and no editorial-source leakage. Evidence: moderation handoff. - [ ] V7A.2.h Execute supported edit/delete/replace/correction or follow-up notice with prior history and read-back; keep unsupported targets unresolved. Evidence: correction E2E. - [ ] V7A.2.i Attempt optimizer/model/agent direct mutation/selection/ scheduling/publish and meaning-changing rewrite; prove rejection. Evidence: independence tests. - [ ] V7A.3 Build WhatsApp/channel ecosystem operations for subscription consent, segmentation, post preview, template/policy status, schedule, delivery, reply/escalation, unsubscribe, correction, and rate/quality limits. Evidence: current channel APIs and privacy rules. - [ ] V7A.3.a Pin current WhatsApp/other channel provider/API/template/policy/ pricing/quality/rate/region capabilities and responsible owner. Evidence: channel profiles. - [ ] V7A.3.b Implement explicit opt-in/source/purpose/channel/topic/locale/ time evidence, preference updates, opt-out/suppression, and consent expiry. Evidence: consent tests. - [ ] V7A.3.c Define privacy-preserving segments with minimum cohorts, allowlisted attributes, no protected-source/editorial-sensitive data, and reproducible membership snapshot. Evidence: segmentation tests. - [ ] V7A.3.d Author/select approved template and story/card/media/correction payload with locale, parameters, disclosure, rights, length, and policy status. Evidence: content tests. - [ ] V7A.3.e Preview exact recipient-visible message/conversation context, estimated audience/cost, quiet/frequency/rate/quality impact, and require approval. Evidence: preview tests. - [ ] V7A.3.f Schedule/send idempotently with consent/template/account/rate/ quality recheck, per-message status, provider acknowledgments, retries, and aggregate privacy. Evidence: delivery tests. - [ ] V7A.3.g Route replies by intent to support/moderation/complaint/tip/ correction workflows with safe identity/context and SLA; honor unsubscribe immediately. Evidence: reply tests. - [ ] V7A.3.h Propagate corrections/recalls with platform-supported update or follow-up, archive status/read-back, and unresolved recipient/target visibility. Evidence: correction E2E. - [ ] V7A.4 Build push, email, in-app, topic/author/source follow, breaking-news, and emergency-broadcast operations with audience, severity, locale, quiet-hours override authority, dedupe, preview, delivery, acknowledgement, correction, expiry, and recall. Evidence: emergency rights and false-alarm review are separate from ordinary campaigns. - [ ] V7A.4.a Define notification/campaign/event/delivery/ack/recall contracts and per-channel capabilities for push/email/in-app. Evidence: notification schemas. - [ ] V7A.4.b Implement consented topic/author/public-source follows and audience/locale/device/entitlement/preferences/suppression resolution with protected-source exclusion. Evidence: audience tests. - [ ] V7A.4.c Define ordinary/breaking/emergency severity, eligibility, evidence, templates, authority, target scope, expiry, and quiet-hours policy separately. Evidence: authority matrix. - [ ] V7A.4.d Build factual title/body/link/media/disclosure/correction content pinned to exact public release and preview each channel/device/ locale including accessibility. Evidence: preview tests. - [ ] V7A.4.e Deduplicate by event/story/claim/target/audience/window and apply frequency/quiet limits unless a specifically authorized emergency override exists. Evidence: dedupe/policy tests. - [ ] V7A.4.f Dispatch durable per-channel jobs with current consent/authority/ release checks, provider acknowledgment, delivery/open/ack privacy floors, retry, and partial state. Evidence: delivery tests. - [ ] V7A.4.g Correct/expire/recall notifications through target capability, in-app persistent notice, links/read-back, and no false success for delivered immutable messages. Evidence: remedy tests. - [ ] V7A.4.h Run emergency activation→broadcast→acknowledgment→recall/ correction→deactivation plus mandatory false-alarm/post-event review, separately from campaigns. Evidence: emergency E2E. - [ ] V7A.5 Build community/comment moderation for thread state, identity/ pseudonymity, spam/abuse, misinformation links, source protection, appeals, rate limits, moderator notes, legal hold, transparency, and article correction synchronization. Evidence: community content is never presented as newsroom-attested fact. - [ ] V7A.5.a Define community/thread/comment/reaction/report/decision/appeal/ moderator-note/version/state schemas separately from editorial claims. Evidence: community contracts. - [ ] V7A.5.b Define identity/pseudonymity/verification/consent/age/privacy/ block/mute protections and prevent correlation with protected sources/ tips. Evidence: identity tests. - [ ] V7A.5.c Implement submit/edit/delete/reply/report with rate/spam/bot/ abuse/link/media scanning, quarantine, duplicate, and safe rendering. Evidence: intake tests. - [ ] V7A.5.d Run human-governed moderation queues for harassment/hate/threat/ doxxing/misinformation/spam/legal/safety with evidence, uncertainty, consistency, and emergency escalation. Evidence: moderation workflow. - [ ] V7A.5.e Record allow/limit/label/remove/lock/suspend/escalate decisions, reason/policy version/actor/expiry, protected moderator notes, and transparent user notice. Evidence: decision tests. - [ ] V7A.5.f Implement appeal intake/independent review/reversal/confirmation/ notice and preserve immutable prior decisions. Evidence: appeals E2E. - [ ] V7A.5.g Apply retention/deletion/legal hold/audit/export and moderator access controls without leaking reporter/source/legal data. Evidence: lifecycle tests. - [ ] V7A.5.h Synchronize story correction/retraction context/links/thread state while never labeling community content as verified newsroom fact. Evidence: correction/parity tests. - [ ] V7A.6 Build reader feedback, complaints, right-of-reply, tip conversion, fact-check requests, and correction requests as distinct queues with routing, evidence, SLA, privacy, status, response, and audit. Evidence: external submissions cannot directly mutate editorial records. - [ ] V7A.6.a Define distinct typed intake contracts, required/optional identity/consent/story/claim/evidence fields, and safe anonymous options. Evidence: queue schemas. - [ ] V7A.6.b Scan/quarantine attachments, validate target/version/link, apply rate/abuse protection, and prevent source/reporter existence leakage. Evidence: intake security tests. - [ ] V7A.6.c Route by type/rule/jurisdiction/desk/risk/locale to named owner, independent queue, SLA/calendar, escalation, and protected compartment. Evidence: routing tests. - [ ] V7A.6.d Track received/acknowledged/triaged/investigating/waiting/ decided/remedied/appealed/closed with privacy-safe external status. Evidence: state machine. - [ ] V7A.6.e Preserve submitted evidence/communications/decisions/responses/ deadlines/audit and apply minimization/retention/legal hold. Evidence: record tests. - [ ] V7A.6.f Convert only through explicit authorized handoff to anonymous tip, fact-check assignment, NMC/legal/right-of-reply, or correction workflow with lineage. Evidence: handoff tests. - [ ] V7A.6.g Respond/notify with reviewed redacted outcome and appeal path; prevent external submitters or intake workers from editing/publishing. Evidence: mutation boundary tests. - [ ] V7A.7 Build multilingual production across the ratified Ghanaian and other locales for translation, transliteration, terminology, names, audio/voice, captions, media text, fact parity, cultural review, publication, and correction cascade. Evidence: each locale locks exact source-story and evidence versions. - [ ] V7A.7.a Ratify supported locale/script/region/fallback/direction/ orthography/number/date/name/pronunciation/voice/channel capability matrix with owners. Evidence: locale profile. - [ ] V7A.7.b Create locale variant pinned to exact source story/claims/ citations/evidence/media/disclosures/terminology/policy versions. Evidence: locale manifest. - [ ] V7A.7.c Build translation/transliteration editor with segment/semantic anchors, protected terms, names/entities, citations, uncertainty, and per-change human/AI provenance. Evidence: editor tests. - [ ] V7A.7.d Localize images/graphics/tables/maps/alt text/transcripts/ captions/audio description/voice/music disclosures and generate target renditions. Evidence: media localization tests. - [ ] V7A.7.e Run claim/number/date/entity/quote/citation/uncertainty/ correction/disclosure semantic parity plus terminology consistency. Evidence: fact parity gate. - [ ] V7A.7.f Run independent qualified language/cultural/editorial/ accessibility review on exact locale revision with sensitive-context handling. Evidence: review signoff. - [ ] V7A.7.g Preview/publish/read back each locale/target independently with canonical/hreflang or equivalent links, rights, fallback, and no silent source-locale substitution. Evidence: release tests. - [ ] V7A.7.h Propagate source-story correction/retraction to every locale, invalidate approval, translate/review notices, and keep unresolved locales visible. Evidence: cascade E2E. - [ ] V7A.8 Build B2B feed, search, fact-check, entity, media, monitoring, and alert product operations for API products, clients, keys, scopes, quotas, webhooks, schemas, sandbox, usage, billing, deprecation, revocation, and correction/retraction events. Evidence: developer SDK conformance and no protected/unlicensed field exposure. - [ ] V7A.8.a Define each API product/resource/action/version/audience/data/ rights/freshness/SLO/pricing capability and explicit protected/ unlicensed exclusions. Evidence: product catalog. - [ ] V7A.8.b Build client/application/service-account onboarding with owner/ purpose/contract/region/entitlements/environments/approval/review/ suspension state. Evidence: client lifecycle. - [ ] V7A.8.c Issue hashed/rotatable scoped keys or tokens with least privilege, tenant/product/environment/IP or mTLS constraints, expiry, last-used, and emergency revoke. Evidence: credential tests. - [ ] V7A.8.d Implement versioned feed/search/fact-check/entity/media/ monitoring/alert schemas with stable IDs, pagination, field projection, attribution, rights, and current correction state. Evidence: API tests. - [ ] V7A.8.e Enforce per-client/product/operation quota/rate/concurrency/ payload/retention/export policy with consistent headers/errors and safe analytics. Evidence: limit tests. - [ ] V7A.8.f Implement signed webhooks with subscription filters, secret rotation, replay protection, idempotent delivery/retry/dead letter, and correction/retraction events. Evidence: webhook tests. - [ ] V7A.8.g Provide isolated synthetic sandbox, versioned OpenAPI/SDK/ examples/conformance, changelog/deprecation/migration, and no production protected data. Evidence: developer experience tests. - [ ] V7A.8.h Meter usage/billing/refunds/disputes separately from editorial ranking/access decisions and reconcile without placing payment data in newsroom content stores. Evidence: commerce tests. - [ ] V7A.8.i Run two-client scope/tenant/BOLA/filter/snippet/media URL/export/ log/cache/schema/version/revocation tests and prove no protected/ unlicensed exposure. Evidence: security/SDK conformance gate. - [ ] V7A.9 Build USSD and voice-callback content operations for menu/routing, concise story/fact-check variants, language, consent, telecom status, session limits, accessibility, fallback, charge disclosure, emergency, correction, and analytics minimization. Evidence: feature-phone content retains canonical story/claim identity and current correction state. - [ ] V7A.9.a Define USSD menu/session/step/content/action and voice callback/ script/recording/call state contracts with provider/network/version. Evidence: channel schemas. - [ ] V7A.9.b Author concise locale-specific story/fact-check/correction/ emergency variants pinned to canonical release/claim/evidence and human-reviewed for meaning parity. Evidence: content tests. - [ ] V7A.9.c Build bounded numbered menu/routing/back/repeat/more/language/ help/exit flows with session timeout/continuation and no inaccessible free-form dependency. Evidence: USSD journey. - [ ] V7A.9.d Build consented voice callback request/schedule/attempt/retry/ answer/opt-out with reviewed voice/pronunciation/speed and keypad alternatives. Evidence: voice journey. - [ ] V7A.9.e Integrate current telecom template/short code/caller ID/routing/ delivery/quality/rate/status/callback capabilities with explicit unavailable state. Evidence: provider tests. - [ ] V7A.9.f Disclose carrier/service charges, consent/purpose/privacy, emergency authority, accessibility/fallback, and support before commitment. Evidence: policy tests. - [ ] V7A.9.g Propagate correction/retraction/emergency recall by canonical ID to menu/voice content and prevent stale cached variants. Evidence: update tests. - [ ] V7A.9.h Minimize phone/session/location/content analytics, aggregate with privacy floors, retain briefly, and exclude protected source/editorial scoring. Evidence: privacy tests. - [ ] V7A.9.i Test session limits/drop/retry/duplicate/locale fallback/ provider outage/role/consent/current-correction state on representative devices. Evidence: feature-phone E2E. - [ ] V7A.10 Build subscription, payment, tipping, advertising, sponsorship, partnership, and entitlement administration in a separate commercial surface with newsroom-visible conflict/disclosure projections only. Evidence: commercial actors cannot suppress, prioritize, edit, correct, or retract editorial content, and payment data never enters drafts. - [ ] V7A.10.a Define separate commercial host/service/store/roles/routes/ credentials/audit and explicit prohibited newsroom capabilities. Evidence: boundary architecture. - [ ] V7A.10.b Build product/plan/subscription/entitlement/trial/cancel/pause/ renew/refund/support state with current terms/consent and provider reconciliation. Evidence: subscription tests. - [ ] V7A.10.c Build payment/tip intent/authorization/capture/failure/refund/ dispute/payout/receipt/tax handling using tokenized provider data and idempotency. Evidence: payment tests. - [ ] V7A.10.d Build advertiser/campaign/inventory/creative/targeting/ schedule/delivery/billing controls with privacy floors and no sensitive editorial/source targeting. Evidence: advertising tests. - [ ] V7A.10.e Build sponsorship/partnership contracts, deliverables, rights, conflicts, separation, disclosures, expiry, and audited exceptions. Evidence: partnership tests. - [ ] V7A.10.f Project only advertiser/sponsor/partner/conflict/disclosure/ entitlement eligibility into newsroom workflows through typed redacted read models. Evidence: projection tests. - [ ] V7A.10.g Enforce newsroom independence server-side: commercial actors/ metrics cannot assign, rank, suppress, edit, approve, publish, correct, retract, or alter gates. Evidence: negative authorization suite. - [ ] V7A.10.h Keep card/bank/mobile-money/payment/contact/billing data out of drafts/claims/search/logs/analytics/model context and inspect storage/ network. Evidence: data-boundary tests. - [ ] V7A.10.i Reconcile entitlement/revenue/disclosure state across systems, handle provider outage/webhook replay/version skew, and preserve editorial access to required corrections. Evidence: commercial E2E. - [ ] V7A.11 Build content, audience, search, recommendation, social, channel, subscription, revenue, correction, and public-interest analytics with metric definitions, cohort/privacy floors, bot filtering, attribution, latency/freshness, experiment governance, and export. Evidence: analytics cannot expose protected sources or become an automatic editorial score. - [ ] V7A.11.a Define versioned metric/event dimensions, numerator/denominator/ units/windows/attribution/source/owner/purpose for each named domain. Evidence: metric catalog. - [ ] V7A.11.b Instrument allowlisted pseudonymous events with schema/consent/ purpose/data-class/retention and prohibit protected source/tip/legal/ draft/payment content. Evidence: event contracts. - [ ] V7A.11.c Filter bots/fraud/internal/testing/retries and deduplicate/ sessionize/attribute across channels with documented uncertainty. Evidence: pipeline tests. - [ ] V7A.11.d Enforce minimum cohort/noise/suppression/access/field/row/ purpose/region/export controls and deletion/opt-out propagation. Evidence: privacy tests. - [ ] V7A.11.e Show ingestion/processing/index/report latency, freshness/ completeness/unknown state, corrections to metrics, and data-quality incidents. Evidence: observability tests. - [ ] V7A.11.f Govern experiments with hypothesis/metrics/guardrails/audience/ consent/randomization/power/duration/stop/review and no high-risk editorial manipulation. Evidence: experiment policy. - [ ] V7A.11.g Provide dashboards and purpose-bound audited exports with semantic labels/units/uncertainty/accessibility and safe small-cell behavior. Evidence: analytics UX/export tests. - [ ] V7A.11.h Block use of engagement/revenue/audience/source metrics as automatic story/reporter/source truth, quality, publish, correction, or suppression score. Evidence: editorial independence tests. - [ ] V7A.11.i Verify known-value attribution/freshness/bot/privacy/deletion/ cross-tenant scenarios and reconcile to source systems. Evidence: analytics validation. - [ ] V7A.12 Build SEO, search/recommendation, topic/entity pages, related coverage, archive, reading-list/follow, and content-discovery controls through versioned editorial policies. Evidence: ranking/metadata changes cannot fabricate facts, hide active corrections, or break canonical URLs. - [ ] V7A.12.a Define canonical public content/search/discovery document with stable URL/ID/version/locale/topic/entity/rights/release/correction/ retraction/access fields. Evidence: discovery contract. - [ ] V7A.12.b Build versioned SEO metadata/structured data/sitemap/canonical/ hreflang/robots/indexing policies derived from exact releases. Evidence: SEO tests. - [ ] V7A.12.c Build lexical/semantic search and topic/entity/archive pages with explainable facets/sorts/current state/accessibility and no stale correction hiding. Evidence: discovery tests. - [ ] V7A.12.d Build related/recommendation candidate/filter/rank/diversity/ freshness/public-interest rules with model/features/policy attribution and editorial controls. Evidence: recommendation tests. - [ ] V7A.12.e Build consented reading-list/follow/save with privacy, entitlement, deletion/export, current correction/retraction notices, and no protected source following. Evidence: reader tests. - [ ] V7A.12.f Govern policy draft/review/approve/experiment/activate/rollback/ expire with impact preview and code-owned fact/correction/rights floors. Evidence: governance tests. - [ ] V7A.12.g Reindex/invalidate caches on publish/update/correction/ retraction/rights/URL changes and preserve redirects/history/canonical identity. Evidence: lifecycle tests. - [ ] V7A.12.h Adversarially test fabricated metadata/snippets, correction demotion/hiding, broken canonical loops, filter bubbles, protected data, and ranking direct-write attempts. Evidence: independence gate. - [ ] V7A.13 Build live-stream/channel operations for stream health, encoder/ platform status, concurrent destinations, delay, moderation, Q&A, recording/clips, rights, incident, failover, and post-event archive. Evidence: operator controls are step-up authorized and editorial claims remain traceable. - [ ] V7A.13.a Define live channel/session/destination/encoder/feed/status/ incident/action/recording contracts and exact program/story/rundown revision. Evidence: operations schema. - [ ] V7A.13.b Integrate encoder/input/output/provider health, bitrate/frame/ audio/caption/delay/drop/keyframe metrics, heartbeat, and calibrated alerts. Evidence: health tests. - [ ] V7A.13.c Configure concurrent destinations with credentials/capability/ rights/locale/schedule/acknowledgment and independent partial state. Evidence: destination tests. - [ ] V7A.13.d Implement preview/program/delay/fact-check hold/caption/ translation/moderation/Q&A controls linked to rundown claims/evidence. Evidence: live control tests. - [ ] V7A.13.e Require step-up/current role/state/impact/confirmation for go-live, route change, delay dump, disconnect, emergency stop, failover, and restart. Evidence: authorization tests. - [ ] V7A.13.f Open incident automatically/manually with synchronized telemetry/actions/decisions/comms/evidence and safe escalation/ postmortem. Evidence: incident tests. - [ ] V7A.13.g Record immutable program/clean/caption/transcript feeds and create reviewed rights-cleared clips with timecoded claim/source lineage. Evidence: recording tests. - [ ] V7A.13.h Build post-event archive/metadata/accessibility/rights/ correction-retraction replacement and per-destination read-back. Evidence: archive E2E. - [ ] V7A.14 Build governed training/evaluation data intake from public and licensed corpora, newsroom decisions, corrections, fact-check outcomes, language review, channel feedback, and model disagreements. Evidence: source protection, consent/license, purpose, minimization, retention, deletion, contamination, split integrity, provenance, opt-out, and editorial-independence controls precede any training or fine-tuning. - [ ] V7A.14.a Define dataset/use-case/version/owner/model-purpose/allowed- prohibited content/fields/subjects/sources/licence/consent/retention contract. Evidence: dataset policy. - [ ] V7A.14.b Intake only approved public/licensed/newsroom-decision/ correction/fact-check/language/channel-feedback sources through quarantine and immutable provenance. Evidence: source ledger. - [ ] V7A.14.c Enforce protected source/tip/legal/embargoed/private draft/ payment/child-sensitive/opted-out exclusions before extraction, annotation, export, or provider access. Evidence: exclusion tests. - [ ] V7A.14.d Validate licence/consent/purpose/territory/provider/model-use/ derivative/attribution/deletion rights per item and dataset version. Evidence: rights gate. - [ ] V7A.14.e Minimize/redact/pseudonymize/deduplicate, detect secrets/PII/ prohibited content, and retain transformations with hashes. Evidence: preprocessing tests. - [ ] V7A.14.f Detect cross-source contamination, benchmark memorization, near-duplicate train/eval/test leakage, temporal/entity/topic leakage, label disagreement, and poisoning. Evidence: integrity tests. - [ ] V7A.14.g Define annotation/adjudication/quality/subgroup/locale/split/ version/reproducibility and prevent production feedback from silently entering training. Evidence: curation tests. - [ ] V7A.14.h Implement data subject/source/partner opt-out, deletion/ restriction/licence expiry, derived dataset/model impact trace, and legal-hold conflict review. Evidence: deletion tests. - [ ] V7A.14.i Require privacy/security/legal/source-protection/editorial/ model-governance approval with exact manifest, risks, provider terms, and expiry before use. Evidence: approval record. - [ ] V7A.14.j Prohibit model outputs/feedback/performance from automatically changing editorial policy, source scores, corrections, assignments, or publish decisions. Evidence: independence tests. - [ ] V7A.14.k Reproduce dataset build from immutable inputs/code/config and publish lineage, exclusions, counts, quality, split hashes, access, and current disposition. Evidence: reproducibility gate. ### V8 — Newsroom UI, accessibility, and resilience - [ ] V8.1 Build the newsroom hub around assignments, embargoes, gate failures, fact-check queue, corrections, and publishing state. Evidence: utility-first design review. - [ ] V8.1.a Define primary triage questions and live view models for each named queue/state with owner/desk/priority/deadline/severity/freshness/ blocker/eligible action. Evidence: hub contract. - [ ] V8.1.b Compose a restrained task-led hierarchy with urgent actionable work first, production context second, no decorative hero or repeated card mosaic. Evidence: design review. - [ ] V8.1.c Implement stable filters/sorts/grouping/search/URLs and live updates while redacting protected/embargo/legal details. Evidence: hub query tests. - [ ] V8.1.d Implement authorized claim/open/assign/escalate/remediate/retry/ hold/review actions with state/version/reason/impact/confirmation. Evidence: action tests. - [ ] V8.1.e Render Veritas route loading/empty/stale/offline/degraded/partial/ unauthorized/fixture/error honestly with accessible recovery. Evidence: state tests. - [ ] V8.1.f Verify wide/compact/single-column, keyboard/screen reader, zoom/ reflow, scale, live updates, and no sensitive count/snippet leaks. Evidence: utility-first E2E. - [ ] V8.2 Build inbox, pitch board, story workspace, source registry, claim review, calendar, publishing, corrections, and archive routes. Evidence: route integrity. - [ ] V8.2.a Register each named route with canonical path/label/keywords/ host/owner/audience/roles/capabilities/data class and project/story context. Evidence: route registry. - [ ] V8.2.b Define route-specific loaders/actions/read models/deep-link state, breadcrumbs/back paths, and safe unavailable/degraded states. Evidence: route contracts. - [ ] V8.2.c Reuse existing Studio/global/newsroom shell, identity/search/ notifications/help/command palette, and remove duplicate navigation or mutations. Evidence: shell review. - [ ] V8.2.d Enforce direct server authorization and protected/public/ commercial/operator boundary for every route/field/function. Evidence: route auth tests. - [ ] V8.2.e Test navigation/direct URL/refresh/back/forward/story switch/role revoke/not-found/archived/moved context across web/desktop. Evidence: route integrity E2E. - [ ] V8.3 Use primary editor plus evidence inspector rather than nested card dashboards. Evidence: frontend conformance review. - [ ] V8.3.a Define shared story workspace shell with primary structured editor, contextual evidence inspector, story navigation, status rail, selection/focus/dirty/capability state. Evidence: workspace spec. - [ ] V8.3.b Compose source/claim/citation/evidence/attestation/media inspectors synchronized to selection without nested global shells or duplicate canonical data. Evidence: inspector tests. - [ ] V8.3.c Keep gate/review/embargo/save/job/publish/correction status and blockers/remediation visible without obscuring the article. Evidence: status tests. - [ ] V8.3.d Use typography, spacing, dividers, disclosure, and progressive panes for hierarchy; avoid decorative card grids, gradients, oversized titles, and controls in arbitrary containers. Evidence: UI review. - [ ] V8.3.e Define wide/compact/single-column layouts with inspector/status drawer/tab, stable story identity, safe focus, and no squashed precision editor. Evidence: responsive snapshots. - [ ] V8.3.f Test long story/claims/sources/live collaboration/protected redaction/zoom/keyboard/screen reader. Evidence: frontend conformance E2E. - [ ] V8.4 Preserve story, revision, block, selection, tab, filters, and inspector in safe deep links. Evidence: protected links expire and do not reveal source identities. - [ ] V8.4.a Define versioned allowlisted URL state schema for route/story/ revision/block/range/tab/filter/sort/inspector/compare/return with size and sensitivity limits. Evidence: link schema. - [ ] V8.4.b Encode stable opaque IDs and bounded range/filter values while excluding source identity/contact, legal notes, embargo secrets, excerpts, unsaved text, local paths, and tokens. Evidence: serialization tests. - [ ] V8.4.c Parse/validate/canonicalize and reauthorize every referenced object/field/action; handle stale/deleted/moved/retracted/revoked subjects. Evidence: restoration tests. - [ ] V8.4.d Use expiring signed capability/deep links only where ordinary route authorization is insufficient, with purpose/audience/single-use/ revocation and no secret in URL. Evidence: protected-link tests. - [ ] V8.4.e Restore refresh/back/forward/share/new window/web-desktop context and reconcile unsaved/conflicting state safely. Evidence: navigation tests. - [ ] V8.4.f Test cross-tenant/story/compartment substitution, range/ID/ encoding/oversize/replay/expiry/log/referrer/history leakage. Evidence: adversarial link suite. - [ ] V8.5 Provide keyboard-first editing, claim attachment, source search, review, and publish journeys. Evidence: pointer-free Playwright. - [ ] V8.5.a Inventory every focusable/editor/selection/menu/dialog/drag/drop/ resize/reorder/compare/review/publish operation and expected keyboard outcome. Evidence: interaction inventory. - [ ] V8.5.b Implement structured-editor navigation/selection/block commands/ formatting/undo/redo/anchors without trapping standard text or assistive technology keys. Evidence: editor keyboard tests. - [ ] V8.5.c Implement keyboard claim creation and source search/select/ locator/citation/counter-source attachment with context/focus return. Evidence: grounding journey. - [ ] V8.5.d Implement review comment/suggestion/evidence inspection/checklist/ decision and non-drag reorder/relationship alternatives. Evidence: review journey. - [ ] V8.5.e Implement preview/eligibility/signoff/schedule/publish/read-back/ correction controls with state/impact/confirmation and focus recovery. Evidence: publication journey. - [ ] V8.5.f Run pointer-free Playwright across wide/compact/mobile review, web/desktop, dialogs/errors/conflicts/live updates, and role changes. Evidence: keyboard E2E. - [ ] V8.6 Provide semantic alternatives for evidence graphs, timelines, analytics, media, and compare views. Evidence: screen-reader tests. - [ ] V8.6.a Define content/operation/selection/focus/status parity contract and synchronized state between each visual surface and its semantic alternative. Evidence: parity matrix. - [ ] V8.6.b Provide evidence graph table/tree/path/forms for entities/claims/ sources/edges/types/confidence/provenance/retractions and all authorized edits. Evidence: graph tests. - [ ] V8.6.c Provide timeline ordered/grouped table/forms with exact/ approximate/uncertain time, events/participants/location/evidence/ conflicts, and edit/navigation. Evidence: timeline tests. - [ ] V8.6.d Provide analytics tables/text summaries with metric definitions, numerator/denominator/units/uncertainty/freshness/cohort privacy and accessible chart descriptions. Evidence: analytics tests. - [ ] V8.6.e Provide media native controls/transcripts/captions/descriptions/ chapters/timecode/annotation lists and synchronized playback position. Evidence: media tests. - [ ] V8.6.f Provide compare semantic diff by block/range/claim/citation/ media/disclosure with before/after/context and decision operations. Evidence: compare tests. - [ ] V8.6.g Verify keyboard/screen-reader/zoom/search/filter/edit/review parity on large data without protected redaction divergence. Evidence: semantic E2E. - [ ] V8.7 Provide status announcements for save, conflict, source update, gate, review, embargo, publish, correction, and cascade progress. Evidence: announcement assertions. - [ ] V8.7.a Define event-to-message taxonomy with priority/politeness, dedupe/coalescing, context, units/progress, terminal state, and privacy redaction. Evidence: announcement spec. - [ ] V8.7.b Announce dirty/saving/saved/offline/error/conflict and semantic conflict resolution without noisy autosave repetition. Evidence: save tests. - [ ] V8.7.c Announce source change/retraction, gate/review status/blocker/ staleness, embargo time/state, and required remediation. Evidence: editorial status tests. - [ ] V8.7.d Announce per-target queued/running/published/verified/partial/ failed and correction/cascade progress with counts and unresolved targets. Evidence: release tests. - [ ] V8.7.e Preserve current focus/typing; pair announcements with persistent visible status/history and avoid exposing protected data. Evidence: accessibility/privacy tests. - [ ] V8.7.f Assert exact announcement order/count/content for success, retries, live updates, reconnect, duplicates, errors, and cancellation. Evidence: announcement suite. - [ ] V8.8 Implement autosave/offline/conflict recovery without caching protected-source details in unsafe storage. Evidence: storage inspection. - [ ] V8.8.a Define eligible offline content and local operation/draft/ checkpoint/schema/device/session/encryption/quota/expiry/access state; explicitly exclude protected identities/legal secrets. Evidence: cache policy. - [ ] V8.8.b Implement debounced idempotent autosave with expected revision and visible dirty/saving/saved/error/offline/conflict state. Evidence: autosave tests. - [ ] V8.8.c Store eligible drafts/operations/assets encrypted and partitioned by tenant/user/story with logout/revocation/archive/retention cleanup. Evidence: storage tests. - [ ] V8.8.d Render protected source references only as safe opaque/redacted placeholders offline and require online step-up to reveal. Evidence: protected-offline tests. - [ ] V8.8.e Reauthenticate/re-authorize/rebase/deduplicate on reconnect and present mine/theirs/base semantic conflict with copy/export safeguards. Evidence: recovery tests. - [ ] V8.8.f Inspect browser/desktop storage/cache/index/telemetry/crash/ backups, then test crash/relaunch/two-client/role revoke/quota/schema update. Evidence: storage inspection E2E. - [ ] V8.9 Implement protected-field copy/download/print controls. Evidence: policy and audit tests. - [ ] V8.9.a Inventory protected fields/surfaces/actions and resolve current role/grant/purpose/device/session/story/compartment/policy constraints. Evidence: control matrix. - [ ] V8.9.b Prevent selection/copy/cut/clipboard where policy requires, sanitize rich/plain representations, and avoid leaking through hidden/ semantic DOM. Evidence: clipboard tests. - [ ] V8.9.c Gate downloads/exports/attachments/originals/proxies with step-up, scope/format/redaction/watermark/expiry/rate and signed authorization. Evidence: download tests. - [ ] V8.9.d Provide print-safe redacted layout or block printing, including browser/system preview, PDF, background, headers/URLs, and screenshots limitation disclosure. Evidence: print tests. - [ ] V8.9.e Handle drag/drop/share/open-external/devtools/accessibility/ cache/log/crash edge paths without pretending client controls prevent all exfiltration. Evidence: threat tests. - [ ] V8.9.f Audit attempted/allowed copy/download/print with redacted subject/ purpose/result and test revoked/stale/cross-role grants. Evidence: policy and audit suite. - [ ] V8.10 Test 200%/400% zoom, long stories, long locale, RTL, high contrast, theme, density, and reduced motion. Evidence: visual/a11y matrix. - [ ] V8.10.a Define browser/app/text zoom, viewport, story/source/claim volume, locale/script expansion, direction, theme, contrast, density, and motion test matrix. Evidence: coverage matrix. - [ ] V8.10.b Test 200% and 400% reflow across hub/editor/inspector/dialog/ calendar/graph/timeline/preview with no clipped/hidden/unreachable controls. Evidence: zoom tests. - [ ] V8.10.c Test very long stories/blocks/headlines/source names/URLs/ comments/errors/tables/media transcripts with virtualization and stable editing. Evidence: content stress tests. - [ ] V8.10.d Test long/CJK/complex-script/RTL/mixed-bidi names/quotes/numbers/ locators/timelines/forms/navigation and isolation against spoofing. Evidence: locale tests. - [ ] V8.10.e Test light/dark/system/high-contrast and compact/comfortable/ touch density for contrast/focus/status/selection/target size and persistent preferences. Evidence: theme/density tests. - [ ] V8.10.f Honor reduced motion before first paint; remove parallax/spring/ large translation/auto pan while preserving textual progress/playback state. Evidence: motion tests. - [ ] V8.10.g Run visual regression plus automated/manual accessibility on supported web/desktop/viewports and close all blocking findings. Evidence: visual/a11y report. - [ ] V8.11 Define performance budgets for editor, evidence sidebar, large source registry, claim graph, search, compare, and cascade. Evidence: profiling. - [ ] V8.11.a Define supported device/browser/desktop/network/data-scale/ concurrency scenarios and shared load/interaction/save/error/resource metrics. Evidence: performance profile. - [ ] V8.11.b Define editor open/type/input latency/autosave/diff/history/ collaboration budgets for long structured stories. Evidence: editor budgets. - [ ] V8.11.c Define evidence sidebar and source registry query/facet/page/ selection/update/render/memory budgets with protected authorization overhead. Evidence: evidence budgets. - [ ] V8.11.d Define claim graph retrieval/layout/semantic view/edit/ validation and search indexing/query/suggestion/update visibility budgets. Evidence: graph/search budgets. - [ ] V8.11.e Define compare computation/render/navigation and correction/ retraction cascade plan/progress/read-back/reconciliation budgets. Evidence: workflow budgets. - [ ] V8.11.f Profile production-scale fixtures with client/server traces/ query plans/CPU/memory/network, retain baselines, and fail regressions. Evidence: profiling report. - [ ] V8.12 Build honest fixture, stale, offline, degraded, not-configured, unauthorized, partial, and failed states. Evidence: state matrix. - [ ] V8.12.a Define canonical data-origin/service-state discriminators, timestamps/reasons/safe messages/eligible actions/recovery/telemetry/ announcements. Evidence: state contracts. - [ ] V8.12.b Label fixture/demo/synthetic content persistently and prevent publishing, source-quality use, external delivery, or production promotion. Evidence: fixture tests. - [ ] V8.12.c Show stale subject/source/evidence/gate/review/candidate with exact invalidating version and block unsafe continuation. Evidence: stale tests. - [ ] V8.12.d Show offline cached versus unavailable, queued/prohibited edits, freshness/reconnect and protected fields not cached. Evidence: offline tests. - [ ] V8.12.e Show per-capability degraded/not-configured/unauthorized/partial/ failed/unknown with completed and unresolved suboperations; no simulated success. Evidence: service tests. - [ ] V8.12.f Exercise every state/recovery on critical routes and web/ desktop/responsive projections with identical semantics and privacy. Evidence: state matrix E2E. - [ ] V8.13 Build responsive reporter/reviewer mode while keeping protected controls safe. Evidence: mobile/tablet auth and workflow tests. - [ ] V8.13.a Define mobile/tablet reporter/reviewer versus precision-edit capability matrix, visible data, actions, step-up, device trust, and desktop handoff. Evidence: responsive spec. - [ ] V8.13.b Build assignment/pitch/story/source-redacted/claim/evidence/gate/ review/calendar/publish/correction status projections with stable identity. Evidence: responsive views. - [ ] V8.13.c Build capture/note/photo/audio/upload/comment/request-change/ approve/reject/escalate/hold/cancel actions only where role/state/device policy permits. Evidence: action tests. - [ ] V8.13.d Present graph/timeline/compare/analytics/media semantic views and signed open-on-desktop handoff rather than unusable precision editors. Evidence: semantic/handoff tests. - [ ] V8.13.e Require step-up/current grant for protected source/legal/ publish/recall/export controls and prevent unsafe offline cache/copy/ screenshot claims. Evidence: protected control tests. - [ ] V8.13.f Test touch/keyboard/screen reader/zoom/orientation/safe area/ slow-offline/reconnect/direct authorization/role revoke. Evidence: mobile/tablet E2E. - [ ] V8.14 Register permission-filtered Studio navigation and command palette. Evidence: route and role parity. - [ ] V8.14.a Build canonical route/action registry with owner/host/path/ labels/keywords/project-story context/roles/capabilities/data class and availability. Evidence: navigation manifest. - [ ] V8.14.b Register authorized Veritas hub and project/story entries in the existing Studio shell without a second global nav or duplicate action. Evidence: shell tests. - [ ] V8.14.c Filter navigation/palette results before display by current tenant/desk/story/role/compartment/entitlement/capability and avoid count/ label existence leaks. Evidence: visibility tests. - [ ] V8.14.d Preserve context/return path/dirty warnings and run server authorization on direct route/command execution. Evidence: action tests. - [ ] V8.14.e Compare expected route/role visibility and command execution across web/desktop/project/story/protected states. Evidence: parity matrix. - [ ] V8.14.f Fail CI on authorized orphan, reachable unauthorized item, duplicate registry/mutation, stale alias, or unowned route. Evidence: reachability gate. - [ ] V8.15 Add permission-filtered routes or governed deep links for ingestion, tips/investigations, entity graph, multimedia/live, newsletters/social/ messaging, localization, compliance, community/complaints, B2B/USSD, commercial projections, and analytics. Evidence: every retained feature is reachable by its authorized audience and no protected surface is reachable through reader navigation. - [ ] V8.15.a Reconcile retained atomic capability ledger to canonical host/ route/role/audience/project/entitlement/capability and required contextual prerequisites. Evidence: reachability manifest. - [ ] V8.15.b Register newsroom routes for ingestion, tips/investigations, entity graph, multimedia/live, localization, and compliance with compartment-aware authorization. Evidence: editorial route tests. - [ ] V8.15.c Register channel/community routes for newsletters/social/ messaging/community/complaints and typed redacted newsroom handoffs. Evidence: channel route tests. - [ ] V8.15.d Register separately hosted B2B/USSD/commercial/analytics routes or governed deep links with current audience/session/scope and safe return. Evidence: external surface tests. - [ ] V8.15.e Hide protected newsroom capabilities from reader/public/ commercial navigation and reject direct URLs/commands/fields/functions server-side. Evidence: boundary tests. - [ ] V8.15.f Exercise positive authorized journey for every retained capability and every role/surface plus unauthorized cross-surface attempts. Evidence: route coverage. - [ ] V8.15.g Fail reconciliation on unreachable authorized feature, exposed protected surface, unknown/duplicate route, or handoff without redaction/ return contract. Evidence: completeness gate. ### V9 — Veritas verification, operations, and launch - [ ] V9.1 Run canonical contract, editorial state, source-quality, counterclaim, attestation, correction, and retraction suites. Evidence: current-branch reports. - [ ] V9.1.a Validate current/historical story/source/claim/evidence/ attestation/correction/retraction schemas and version compatibility. Evidence: contract report. - [ ] V9.1.b Property-test canonical editorial transitions, orthogonal embargo/release/remedy states, invalid transitions, concurrency, and audit. Evidence: state report. - [ ] V9.1.c Run hand-calculated source-quality factors/weights/adjustments/ bands and missing/unknown/domain cases. Evidence: scoring report. - [ ] V9.1.d Run all four counterclaim results across independence/quality/ consensus/harm/false-balance and contested states. Evidence: balance report. - [ ] V9.1.e Run attestation scope/credential/conflict/disagreement/quorum/ expiry/automation-impersonation invariants. Evidence: attestation report. - [ ] V9.1.f Run chronological prior-text correction and complete ordered retraction graph/action/read-back/closure invariants. Evidence: remedy report. - [ ] V9.1.g Pin reports to current branch commit/contracts/policies/corpora/ engines and fail any skipped/unreviewed canonical invariant. Evidence: suite manifest. - [ ] V9.2 Run known-value tests for claim, citation, statistical, quote, headline, source, balance, evidence, and cascade gates. Evidence: gate registry coverage. - [ ] V9.2.a Freeze expert-reviewed positive/boundary/negative/adversarial/ unavailable/indeterminate fixtures with exact expected raw measurements and verdicts. Evidence: known-value corpus. - [ ] V9.2.b Verify claim extraction/class/severity/anchor and citation locator/support/contradiction/reachability gates. Evidence: grounding results. - [ ] V9.2.c Verify statistical denominator/population/period/method/ uncertainty/dataset and quote speaker/context/edit/consent checks. Evidence: fact-check results. - [ ] V9.2.d Verify headline omission/exaggeration/certainty/clickbait, source composite, counterclaim/false-balance, and evidence-pack integrity. Evidence: editorial results. - [ ] V9.2.e Verify correction/retraction dependency/action/idempotency/ ordering/read-back/closure gates across target fixtures. Evidence: cascade results. - [ ] V9.2.f Map every retained gate to applicability, fixtures, measurement/ verdict assertions, remediation, owner, and current result; fail gaps. Evidence: gate registry coverage. - [ ] V9.3 Run calibrated evaluations for extraction, contradiction, bias, similarity, and assist models. Evidence: precision/recall, subgroup, threshold, and uncertainty report. - [ ] V9.3.a Freeze representative held-out corpora/splits/labels for each named model task, risk class, desk, locale, subgroup, and adversarial condition. Evidence: evaluation manifest. - [ ] V9.3.b Pin model/provider/prompt/tool/config/index/code versions and run with complete input/output/cost/latency provenance. Evidence: run records. - [ ] V9.3.c Report task-appropriate precision/recall/F-score/calibration/ ranking/span/meaning-preservation metrics, confidence intervals, and uncertainty/abstention. Evidence: metric report. - [ ] V9.3.d Report subgroup/locale/dialect/desk/source-kind/risk differences and severity-weighted false-positive/negative error analysis. Evidence: slice report. - [ ] V9.3.e Test prompt/source injection, fabricated/washed citations, protected leakage, correlated handoff errors, and misuse boundaries. Evidence: adversarial report. - [ ] V9.3.f Compare prior approved baseline, enforce per-severity thresholds/ stop-the-line, assign mitigation/rollback, and obtain named review. Evidence: signed evaluation. - [ ] V9.4 Run real-database, secure-store, blob, search, queue, CMS, and distribution integration suites. Evidence: durable round-trip. - [ ] V9.4.a Provision production-equivalent supported service versions with two tenants, protected compartments, representative records/blobs/ indexes/jobs/targets, and isolated credentials. Evidence: environment manifest. - [ ] V9.4.b Exercise canonical write→outbox→blob→index→gate/review→queue→CMS/ distribution→read-model flow with trace correlation. Evidence: integration trace. - [ ] V9.4.c Verify secure-store grants/revocation/redacted projections and no protected data in ordinary DB/index/queue/log/target systems. Evidence: compartment tests. - [ ] V9.4.d Inject transaction/blob/index/queue/CMS/target timeout/outage/ duplicate/order/auth/version failures and prove idempotent recovery. Evidence: fault tests. - [ ] V9.4.e Reconcile authoritative records/blobs/indexes/jobs/CMS/public/ distribution state after create/update/correction/retraction/archive/ restore. Evidence: reconciliation report. - [ ] V9.4.f Restart/replay/backup/restore and verify durable IDs/hashes/ provenance/audit plus tenant isolation. Evidence: durable round-trip. - [ ] V9.5 Run NewsML-G2 golden validation for initial, update, correction, package, planning, rights, and embargo scenarios. Evidence: pinned validator. - [ ] V9.5.a Pin NewsML-G2/profile/schema/code-list/validator versions and canonical deterministic generator inputs. Evidence: validator manifest. - [ ] V9.5.b Validate initial/update/replacement/correction/retraction News Items for identity/version/status/prior links/content metadata. Evidence: News Item goldens. - [ ] V9.5.c Validate ordered/related Package Items and Planning Items for assignments/windows/embargoes without protected-source leakage. Evidence: package/planning goldens. - [ ] V9.5.d Validate rights/territory/language/syndication/subjects/concepts/ media associations and supported extensions. Evidence: metadata goldens. - [ ] V9.5.e Test unknown/invalid codes, missing required fields, time zones, unsupported target loss, malformed/cross-version inputs. Evidence: negative corpus. - [ ] V9.5.f Round-trip through supported consumers, semantic-compare, and retain current-branch validation artifacts. Evidence: interoperability report. - [ ] V9.6 Run C2PA valid, tampered, stripped, unknown-trust, and ingredient lineage tests. Evidence: validation reports. - [ ] V9.6.a Pin C2PA/profile/SDK/algorithm/trust-store/certificate/revocation versions and representative media/package manifests. Evidence: test manifest. - [ ] V9.6.b Generate/sign/validate supported original and derived media with exact ingredient/edit/AI/action/package lineage. Evidence: valid report. - [ ] V9.6.c Tamper bytes/manifest/assertions/ingredient links/signatures/ timestamps/content binding and assert precise integrity failure. Evidence: tamper report. - [ ] V9.6.d Strip manifests or use unsupported/malformed data and verify provenance-absent/unknown behavior, not false or verified. Evidence: absence tests. - [ ] V9.6.e Test unknown/untrusted/expired/revoked signer and trust-store/ network/status uncertainty. Evidence: trust tests. - [ ] V9.6.f Verify renderer/gate/API/export/CMS display parity and correction/ replacement lineage across valid and failure states. Evidence: validation reports. - [ ] V9.7 Run BFF auth, object/property authorization, idempotency, concurrency, pagination, rate, SSRF, and tenant tests. Evidence: route inventory complete. - [ ] V9.7.a Generate complete route/method/operation/auth/scope/object/field/ function/data-class/idempotency/pagination/rate/external-fetch inventory. Evidence: route manifest. - [ ] V9.7.b Test unauthenticated/expired/revoked/stale/session-fixation/CSRF/ service-account/emergency/step-up cases. Evidence: authentication tests. - [ ] V9.7.c Test BOLA/property/mass-assignment/filter/sort/count/snippet/batch/ export/direct-function access across roles/tenants/compartments. Evidence: authorization tests. - [ ] V9.7.d Test duplicate/replayed/conflicting idempotency keys, optimistic version races, timeout-after-commit, and concurrent transitions. Evidence: mutation tests. - [ ] V9.7.e Test stable cursor/page bounds/sort ties/filter auth/large inputs, per-principal/resource rates, quotas, and safe errors. Evidence: protocol tests. - [ ] V9.7.f Test URL import/webhook/callback SSRF/DNS rebinding/redirect/ private network/credential/scheme/size/time attacks. Evidence: network tests. - [ ] V9.7.g Reconcile all implemented routes to inventory/OpenAPI and fail missing, unknown, untested, or protected-field-exposing operations. Evidence: completeness gate. - [ ] V9.8 Run full-journey Playwright: pitch to grounded CMS publication. Evidence: live backing and read-back. - [ ] V9.8.a Create/submit/compare/commission a pitch and build an assignment with owner/deadlines/risks/embargo against live services. Evidence: pitch trace. - [ ] V9.8.b Ingest/quarantine/review real source artifacts and author draft/ claims/citations/quotes/media/disclosures with immutable provenance. Evidence: grounding trace. - [ ] V9.8.c Run fact-check/gates/standards/legal/accessibility review, fix a failure, and prove exact-revision approval freshness. Evidence: review trace. - [ ] V9.8.d Create locked release candidate, preview/diagnose targets, sign off, schedule, and dispatch through real CMS adapter/job. Evidence: release trace. - [ ] V9.8.e Read back public content/metadata/media/disclosures/provenance/ revision and semantic-compare to candidate. Evidence: read-back proof. - [ ] V9.8.f Run keyboard/screen-reader responsive journey and negative role/ stale dependency/partial CMS failure paths. Evidence: Playwright report. - [ ] V9.9 Run full-journey Playwright: protected source to redacted review. Evidence: no identity leak in UI, logs, network, notifications, or audit projection. - [ ] V9.9.a Onboard a protected source after authorized step-up/grant and store identity/contact/communications only in compartment. Evidence: onboarding trace. - [ ] V9.9.b Link pseudonymous source/citations/evidence to a story and assign ordinary fact-check/standards/legal/source-protection reviews. Evidence: editorial trace. - [ ] V9.9.c Compare authorized officer and ordinary reviewer projections in UI/API/network, including counts/timing/errors/search/sidebar/comments/ notifications. Evidence: role comparison. - [ ] V9.9.d Revoke/expire grant mid-session and verify reveal/cache/copy/ download/offline/deep-link access closes safely. Evidence: revocation tests. - [ ] V9.9.e Exercise redacted audit/export and emergency access with higher authority/post-review; preserve immutable protected audit. Evidence: audit trace. - [ ] V9.9.f Inspect client/server logs/traces/analytics/crash reports/queues/ ordinary DB/index/backups for identity linkage. Evidence: no-leak report. - [ ] V9.10 Run full-journey Playwright: source retraction to verified cascade. Evidence: every registered target updated. - [ ] V9.10.a Publish a story/source/claim fixture to registered CMS/reader/ search/archive/package/newsletter/social/channel/B2B consumers. Evidence: seeded target manifest. - [ ] V9.10.b Intake and verify source retraction, preview complete dependency graph, approve per-node/target remedy plan, and freeze it. Evidence: impact trace. - [ ] V9.10.c Execute durable cascade with duplicate/out-of-order/temporary- failure injection and observe truthful per-target progress/retry. Evidence: saga trace. - [ ] V9.10.d Read back each registered consumer semantically for state/notice/ content/index/cache/event/version and reconcile. Evidence: target proof. - [ ] V9.10.e Keep an intentionally failed target unresolved, verify closure blocked, repair/retry, then close only after successful read-back. Evidence: closure test. - [ ] V9.10.f Verify audit/provenance/prior versions/protected redaction and keyboard/screen-reader operations. Evidence: cascade Playwright report. - [ ] V9.11 Run full-journey Playwright: correction and NewsML/CMS update. Evidence: reader-visible prior/new version. - [ ] V9.11.a Seed a grounded published release with NewsML/CMS/public read- back, claims/citations/media, and downstream target identity. Evidence: baseline fixture. - [ ] V9.11.b Author correction against exact prior public block/text/version, affected claims, rationale, notice, locale/target, and approvals. Evidence: correction trace. - [ ] V9.11.c Generate/validate NewsML update/correction chain and execute idempotent CMS update through real adapter. Evidence: standards trace. - [ ] V9.11.d Read back prior/new public version, semantic diff, visible correction note/timestamps/history/canonical URL and NewsML references. Evidence: reader proof. - [ ] V9.11.e Test stale prior-text race, correction-of-correction, partial target failure/retry, and no historical overwrite. Evidence: edge tests. - [ ] V9.11.f Verify accessibility, locale and cache/search/archive propagation plus exact candidate/decision/audit lineage. Evidence: Playwright report. - [ ] V9.12 Run WCAG 2.2 AA, keyboard, announcement, and semantic-equivalence suites. Evidence: themes/viewports/locales. - [ ] V9.12.a Define critical route/workspace/dialog/action matrix across web/ desktop/responsive, themes/density, 200–400% zoom, RTL/long locales, and assistive technologies. Evidence: coverage plan. - [ ] V9.12.b Run automated WCAG rules, name/role/value, landmark/heading/ form/error, contrast, focus, target size, reflow, and motion checks. Evidence: automation report. - [ ] V9.12.c Run pointer-free editing/source/citation/review/publish/ correction/protected-control journeys with logical focus and non-drag alternatives. Evidence: keyboard report. - [ ] V9.12.d Assert save/conflict/gate/review/embargo/publish/cascade/error announcements for content/order/deduplication/privacy. Evidence: announcement report. - [ ] V9.12.e Compare graph/timeline/analytics/media/diff visual and semantic paths for content/operations/selection/status/permissions. Evidence: equivalence report. - [ ] V9.12.f Run manual supported screen-reader/zoom/high-contrast/RTL review and close or block all findings. Evidence: signed matrix. - [ ] V9.13 Run long-story, source-volume, search, claim-graph, autosave, concurrent edit, publish, and cascade performance/load tests. Evidence: SLO/budget reports. - [ ] V9.13.a Generate versioned production-scale fixtures for long blocks/ claims/citations/comments/history, source registry, graph, releases, targets, corrections, and collaborators. Evidence: load manifest. - [ ] V9.13.b Measure web/desktop startup/story open/editor input/scroll/ inspector/diff/history/autosave and sustained memory. Evidence: editor profile. - [ ] V9.13.c Measure source registry/search index/query/facets/pagination/ update visibility and claim graph load/layout/semantic operations. Evidence: discovery profile. - [ ] V9.13.d Measure concurrent save/rebase/conflict/offline reconnect under multiple clients, network constraints, DB contention, and long sessions. Evidence: collaboration profile. - [ ] V9.13.e Measure candidate creation/preview/publish/read-back and large correction/retraction plan/dispatch/progress/verification/replay. Evidence: release profile. - [ ] V9.13.f Capture client/server/database/search/queue/target traces and CPU/memory/network/storage/query plans, compare to budgets, fail regressions. Evidence: SLO report. - [ ] V9.14 Run source leak, prompt injection, fabricated citation, defamation guard, embargo leak, mass publish, auth, tenant, and audit tamper adversarial tests. Evidence: zero blockers. - [ ] V9.14.a Probe protected source/tip/legal/embargo identity/content through UI/API/search/counts/snippets/errors/logs/cache/notifications/exports/ analytics/model context. Evidence: leakage report. - [ ] V9.14.b Inject instructions/active content/confusables through sources, documents, datasets, media metadata, comments, tips, provider outputs, and multi-agent handoffs. Evidence: injection report. - [ ] V9.14.c Attempt plausible fabricated/altered/washed citations, quotes, sources, claims, attribution, and evidence-pack hashes. Evidence: grounding report. - [ ] V9.14.d Exercise defamation/privacy/contempt/rights/high-risk/specialist/ false-balance guard bypass through draft, import, AI, emergency, target adapters. Evidence: harm/legal report. - [ ] V9.14.e Attempt embargo/schedule/deep-link/cache leak and bulk/mass/ replayed publish, notification, correction suppression, and target credential abuse. Evidence: operations report. - [ ] V9.14.f Attempt auth/session/role/service-account/BOLA/property/function/ tenant/compartment and audit event/hash/signature/order tamper. Evidence: authorization/integrity report. - [ ] V9.14.g Require zero severity-blocking findings; assign remediation, regression tests, owner, and approved expiring exception for lower risk. Evidence: adversarial gate. - [ ] V9.15 Run backup/restore and correction/retraction replay drills. Evidence: CMS, search, archive, audit, and distributed targets reconcile. - [ ] V9.15.a Define protected/ordinary data/services/backups/encryption/ retention/region/recovery order/RPO/RTO and target reconstruction limits. Evidence: recovery contract. - [ ] V9.15.b Restore database/secure store/blob/search/queue/config/key references/audit/release artifacts into an isolated environment. Evidence: restore trace. - [ ] V9.15.c Reconcile records/blobs/indexes/projections/grants/hashes/audit/ CMS/archive/public/target states and no cross-tenant exposure. Evidence: integrity report. - [ ] V9.15.d Replay correction/retraction outbox/saga from checkpoints with duplicate/out-of-order/partial prior actions and current expected versions. Evidence: replay tests. - [ ] V9.15.e Independently read back CMS/search/archive/NewsML/channel/B2B targets and repair or retain every unresolved mismatch. Evidence: target reconciliation. - [ ] V9.15.f Measure achieved loss/recovery time, record gaps/unsupported external restoration, update runbooks, and obtain operations/security approval. Evidence: signed drill report. - [ ] V9.16 Publish reporter, fact-check, source-protection, legal, corrections, publishing, incident, and recovery runbooks. Evidence: game-day. - [ ] V9.16.a Publish reporter/research/source-ingest/authoring/offline/ conflict runbooks with safe diagnostics, remediation, and escalation. Evidence: editorial runbooks. - [ ] V9.16.b Publish fact-check/gate/evidence/attestation/source-expiry/ disputed-result runbooks with known-value comparisons. Evidence: verification runbooks. - [ ] V9.16.c Publish source-protection/tip/grant/revocation/emergency-access/ suspected leak runbooks without copying protected details. Evidence: protection runbooks. - [ ] V9.16.d Publish legal/NMC/election/DPA/harm/complaint/hold runbooks with named counsel/specialist escalation and human decision boundaries. Evidence: compliance runbooks. - [ ] V9.16.e Publish correction/retraction/publish/target failure/embargo/ emergency recall runbooks with read-back and rollback/repair. Evidence: distribution runbooks. - [ ] V9.16.f Publish security/availability/integrity/AI/channel incident and backup/restore/replay/reconciliation runbooks. Evidence: recovery runbooks. - [ ] V9.16.g Run timed cross-role game-days, revise unclear/unsafe/missing steps, verify contacts/access, and obtain named approval. Evidence: game-day report. - [ ] V9.17 Instrument editorial funnel, gate failures, source freshness, corrections, cascades, distribution, and safe cost metrics. Evidence: privacy review and dashboards. - [ ] V9.17.a Define versioned privacy-safe events/metrics for pitch/ assignment/draft/review/release/remedy stages with denominators, timestamps, owners, and no individual productivity score. Evidence: funnel contracts. - [ ] V9.17.b Instrument gate execution/outcome/reason/severity/remediation/ retry/staleness without logging protected evidence or model prompts. Evidence: gate telemetry. - [ ] V9.17.c Instrument source review/freshness/expiry/retraction and affected claim workload using opaque IDs/cohort floors. Evidence: source telemetry. - [ ] V9.17.d Instrument correction/retraction detection-to-closure and per- target cascade/read-back/unresolved state. Evidence: remedy dashboards. - [ ] V9.17.e Instrument per-target publish/distribution/ack/read-back/failure/ rate/latency plus model/job/provider cost with currency/unit/budget. Evidence: operations dashboards. - [ ] V9.17.f Add SLO/quality/incident alerts with thresholds/uncertainty/ owner/runbook and prohibit volume/engagement/revenue from overriding quality. Evidence: guardrail tests. - [ ] V9.17.g Validate known-value telemetry, freshness/completeness, access/ redaction/retention/deletion/two-tenant privacy and obtain review. Evidence: privacy-approved observability. - [ ] V9.18 Produce engineering-readiness evidence. Evidence: all requirements map to current proof. - [ ] V9.18.a Define required architecture/contracts/migrations/security/ privacy/safety/accessibility/quality/standards/integration/operations evidence with owners/freshness. Evidence: readiness matrix. - [ ] V9.18.b Map every retained atomic capability and checklist parent/child to implementation, tests/evaluations/reports/runbooks/approvals. Evidence: evidence index. - [ ] V9.18.c Verify evidence provenance matches candidate commit/build/ contracts/schema/policies/models/providers/dependencies/config/targets. Evidence: provenance check. - [ ] V9.18.d Classify missing/stale/failed/waived proof, block required cells, and record exception owner/reason/scope/compensation/expiry. Evidence: readiness gate. - [ ] V9.18.e Reconcile route/capability/gate/consumer/obligation/standard/ channel inventories with no orphan or unknown rows. Evidence: completeness report. - [ ] V9.18.f Publish go/no-go summary, unsupported/degraded combinations, residual risks, support/rollback, and named decision. Evidence: readiness packet. - [ ] V9.19 Obtain named editorial standards, legal, source-protection, accessibility, privacy/security, engineering, and product approvals. Evidence: human signoff. - [ ] V9.19.a Define each approver’s exact scope/criteria/required evidence/ independence/delegate/expiry and nondelegable decisions. Evidence: approval policy. - [ ] V9.19.b Route immutable candidate/evidence to editorial standards and legal/jurisdictional specialists with open findings/exceptions. Evidence: editorial/legal decisions. - [ ] V9.19.c Route protected-source/tip/nonleakage/emergency-access evidence to source-protection authority through secure compartment. Evidence: protection decision. - [ ] V9.19.d Route WCAG/assistive-technology and privacy/security/DPA/threat/ adversarial evidence to named specialists. Evidence: assurance decisions. - [ ] V9.19.e Route architecture/quality/operations/recovery/support and product scope/UX/rollout/residual-risk evidence. Evidence: engineering/product decisions. - [ ] V9.19.f Record approve/reject/request-changes/conditional decisions with identity/role/scope/candidate/reason/conditions/time/signature. Evidence: human signoff. - [ ] V9.19.g Invalidate affected signoffs on commit/evidence/policy/model/ schema/dependency/config/target change and require renewal. Evidence: stale approval tests. - [ ] V9.20 Obtain named launch approval for newsroom and public correction journey. Evidence: human governance record. - [ ] V9.20.a Assemble final immutable launch packet with newsroom authoring/ protected-source/publish and public correction/retraction journey proof. Evidence: launch packet. - [ ] V9.20.b Verify candidate commit/build/config/migrations/contracts/ standards/targets/runbooks/monitoring/on-call/rollback/support and open risks. Evidence: launch checklist. - [ ] V9.20.c Run final live-backed smoke from authorized newsroom entry to verified public publish and correction/read-back without fixture data. Evidence: launch smoke. - [ ] V9.20.d Hold named editorial/governance/engineering/operations/product review with independent correction authority and no automation vote. Evidence: decision meeting record. - [ ] V9.20.e Record go/no-go/conditional decision, exact scope/regions/ channels/rollout/conditions/owners/times/expiry/rollback triggers. Evidence: governance record. - [ ] V9.20.f Verify rollout monitoring and ability to stop, recall, correct, restore, and communicate; invalidate approval on candidate change. Evidence: launch control test. - [ ] V9.21 Run distinct full journeys for feed/social ingest, anonymous tip to protected investigation, entity merge/split, data visualization, podcast/video/short-form, live program, newsletter, social/WhatsApp, emergency alert, community moderation, multilingual publication, B2B client, USSD/voice, and commercial conflict projection. Evidence: no generic story-publish test substitutes for channel-specific proof. - [ ] V9.21.a Run feed/crawl/social-monitor ingest through policy/fetch/ quarantine/normalize/language/dedupe/cluster/replay with live lineage. Evidence: ingestion journey. - [ ] V9.21.b Run anonymous submission/receipt/safety triage/protected assignment/research/source conversion and prove nonleakage. Evidence: tip journey. - [ ] V9.21.c Run entity candidate review/merge/redirect then split/ reallocation/downstream invalidation with protected graph isolation. Evidence: entity journey. - [ ] V9.21.d Run dataset snapshot→query/transform→chart/map/table→methodology/ semantic alternative→publish/reproduce/update. Evidence: data-viz journey. - [ ] V9.21.e Run podcast/audio script→record/edit/mix/transcript/review/feed and timecoded correction propagation. Evidence: podcast journey. - [ ] V9.21.f Run video/short-form plan→ingest/edit/graphics/captions/rendition/ review→platform/embed and replacement. Evidence: video journey. - [ ] V9.21.g Run live rundown/preflight/hold/delay/captions/moderation/Q&A/ failover/stop→record/clip/archive/correct. Evidence: live journey. - [ ] V9.21.h Run newsletter author/preview/test/audience/consent/schedule/send/ bounce/archive/unsubscribe/correct. Evidence: newsletter journey. - [ ] V9.21.i Run social and WhatsApp plans through approval/publish/delivery/ moderation or reply/unsubscribe/rate/correction with current APIs. Evidence: social/channel journeys. - [ ] V9.21.j Run emergency alert authority→preview→deduplicated multi-channel delivery→acknowledgment→recall/correction→post-event review. Evidence: emergency journey. - [ ] V9.21.k Run comment/report/moderate/appeal/legal hold/transparency and story correction context synchronization. Evidence: community journey. - [ ] V9.21.l Run multilingual translation/transliteration/media/captions/ factual parity/cultural review/publish/read-back/cascade. Evidence: locale journey. - [ ] V9.21.m Run B2B client/key/scope/quota/feed/search/webhook/correction/ revocation/SDK conformance with no protected fields. Evidence: B2B journey. - [ ] V9.21.n Run USSD menu and voice callback through consent/locale/session/ provider/fallback/charge/emergency/correction state. Evidence: feature-phone journey. - [ ] V9.21.o Run commercial subscription/payment/ad/sponsorship conflict and newsroom redacted disclosure projection while denying editorial mutations. Evidence: commercial journey. - [ ] V9.21.p Verify every journey uses owned live services, target read-back, trace/audit, roles/tenants, failure recovery, and current correction identity; retain distinct evidence. Evidence: journey coverage ledger. - [ ] V9.22 Run NMC complaint, election-phase, DPA subject-request, vulnerable person/child, graphic-content, right-of-reply, advertising disclosure, payment, and emergency-broadcast adversarial/compliance suites. Evidence: current jurisdictional profile and named specialist review. - [ ] V9.22.a Pin current Ghana and applicable channel/payment jurisdictional profiles/versions/effective dates/authoritative sources and specialists. Evidence: compliance manifest. - [ ] V9.22.b Run NMC complaint intake/SLA/investigation/human decision/ correction-apology-right-of-reply/escalation/appeal. Evidence: NMC suite. - [ ] V9.22.c Run pre-election/campaign/silence/polling/results/post-election phase fixtures for equal treatment/source verification/ads/incitement/ misinformation. Evidence: election suite. - [ ] V9.22.d Run DPA access/correct/delete/restrict/object/portable discovery and remedy across ordinary/protected/channel/commercial/processors plus legal-hold conflict. Evidence: DPA suite. - [ ] V9.22.e Run child/vulnerable/trauma/location/doxxing/suicide/self-harm consent/minimization/specialist/distribution/correction fixtures. Evidence: vulnerable-person suite. - [ ] V9.22.f Run graphic-content media/thumbnail/autoplay/warning/age/access/ notification/search/social/locale handling and redacted preview. Evidence: graphic-content suite. - [ ] V9.22.g Run right-of-reply authenticity/scope/deadline/editorial review/ publication/notice/appeal without direct external mutation. Evidence: reply suite. - [ ] V9.22.h Run advertising/sponsorship identity/separation/disclosure/ targeting/phase/target and attempted commercial interference. Evidence: advertising suite. - [ ] V9.22.i Run payment/subscription/tip consent/charge/tokenization/ idempotency/refund/dispute/privacy and editorial-data separation. Evidence: payment suite. - [ ] V9.22.j Run emergency-broadcast activation/authority/quiet override/ template/target/delivery/recall/false-alarm review and attempted ordinary campaign bypass. Evidence: emergency suite. - [ ] V9.22.k Require named legal/editorial/privacy/safety/accessibility/ commercial/channel specialist review and zero unmitigated blockers. Evidence: signed compliance report. - [ ] V9.23 Run correction/retraction propagation across reader web/mobile, search/recommendation, newsletter, social, WhatsApp, push/email, live archive/clips, community context, B2B APIs/webhooks, USSD/voice, analytics, and commercial placements. Evidence: every registered consumer proves read-back or remains visibly unresolved. - [ ] V9.23.a Seed one versioned story/claim/source/media/package into every registered supported consumer and record target IDs/versions/URLs. Evidence: propagation baseline. - [ ] V9.23.b Author/approve correction and source/claim retraction scenarios with exact dependency graph, desired target states, notices, and immutable plan. Evidence: remedy inputs. - [ ] V9.23.c Verify reader web/mobile, canonical/locale/history/cache and search/recommendation/topic/entity/related surfaces update. Evidence: reader/discovery read-back. - [ ] V9.23.d Verify newsletter archive/follow-up and social/WhatsApp/push/ email update/delete/follow-up/recall capability-specific state. Evidence: messaging read-back. - [ ] V9.23.e Verify live recording/archive/clips/transcript/captions and podcast/video/article embeds carry corrected ranges/notices/replacements. Evidence: media read-back. - [ ] V9.23.f Verify community thread context/labels and complaint/feedback references update without rewriting community speech. Evidence: community read-back. - [ ] V9.23.g Verify B2B feeds/search/APIs/webhooks and developer cache/version expose current state and signed correction/retraction events. Evidence: B2B read-back. - [ ] V9.23.h Verify USSD/voice menu/script/cache and callbacks present current canonical story/claim/remedy state. Evidence: feature-phone read-back. - [ ] V9.23.i Verify analytics dimensions/metrics annotate or recompute corrected/retracted content and do not preserve false editorial scores. Evidence: analytics reconciliation. - [ ] V9.23.j Verify advertising/sponsorship/partnership/commercial placements stop or update links/content/disclosures without vetoing remedy. Evidence: commercial reconciliation. - [ ] V9.23.k Inject duplicate/out-of-order/outage/auth/version/unsupported/ cache-lag failures, retry safely, and retain precise per-target state. Evidence: fault report. - [ ] V9.23.l Reconcile registered expected versus observed consumers and block closure until every required target proves semantic read-back or remains visibly owned/escalated/unresolved. Evidence: cascade gate. - [ ] V9.24 Run training/evaluation-data provenance, license/consent, protected-source exclusion, contamination, deletion/opt-out, split leakage, poisoning, feedback manipulation, and reproducibility tests. Evidence: newsroom or audience data cannot enter a model pipeline merely because it exists in Veritas. - [ ] V9.24.a Build approved/denied/boundary fixtures across public/licensed/ newsroom/audience/channel/protected/legal/embargoed/payment/child data and purposes. Evidence: policy corpus. - [ ] V9.24.b Verify item→source revision→licence/consent/purpose→transform/ annotation→dataset/split→model/evaluation lineage with hashes/versions. Evidence: provenance tests. - [ ] V9.24.c Test protected-source/tip/legal/private-draft/payment/opted-out/ disallowed licence/expired right exclusion at query/export/job/provider boundaries. Evidence: exclusion suite. - [ ] V9.24.d Detect near/exact duplicates, benchmark or production contamination, entity/topic/time/train-eval-test leakage, label leakage, and memorization canaries. Evidence: contamination report. - [ ] V9.24.e Execute deletion/withdrawal/opt-out/licence expiry/restriction through datasets/caches/providers/derived artifacts/model impact while handling legal hold. Evidence: deletion journey. - [ ] V9.24.f Inject poisoned labels/content/metadata and manipulated feedback/ brigading/bot/reward signals; verify isolation, detection, review, and no automatic ingestion. Evidence: poisoning tests. - [ ] V9.24.g Rebuild exact dataset/splits from immutable inputs/code/config/ seeds, compare manifests/counts/hashes, and disclose nondeterminism. Evidence: reproducibility report. - [ ] V9.24.h Attempt unapproved direct DB/search/log/analytics/export and model-training job access simply because data exists; prove denied/no side effect. Evidence: purpose authorization tests. - [ ] V9.24.i Require current privacy/security/legal/source-protection/ editorial/model-governance approval and fail stale/unlicensed/ contaminated/unreproducible candidates. Evidence: data release gate. - [ ] V9.25 EVE-SEAM-EXIT: require "required Eve reads and writes admitted with source and behavior evidence, or an exact task-0.8 explicit non-goal proves zero operations; a named defer preserves ownership but never passes completion" before this phase exits. Evidence: source-derived totality record and passing verifier. - [ ] V9.25.a Re-run the route, bridge, state-signal, and complete domain-code envelope census; review every changed candidate instead of carrying a stale phase disposition forward. Evidence: current ratchets. - [ ] V9.25.b Bind the exact ratified task-0.8 workflow and requirement set; classify it as a required seam or an exact source-backed non-goal. Evidence: charter-bound disposition set. - [ ] V9.25.c For a required seam, admit both read and write operations with byte-pinned source and behavior evidence. A named defer retains its owner and unblock condition but fails completion. Evidence: operation proofs. - [ ] V9.25.d Permit a zero-operation boundary only for an exact ratified task-0.8 explicit non-goal; absence or unavailability is not a non-goal. Evidence: source-bound non-goal proof. - [ ] V9.25.e Run the totality verifier, every retained gate-case CLI, and the injected durable-candidate control; retain red and green receipts. Evidence: release gate logs. --- ## Phase E — Euterpe music production workbench Euterpe already has a substantial DAW in `apps/euterpe/studio-web`; this phase must extend and integrate it rather than create a second music editor. The complete workflow spans concept, score, lyrics, arrangement, recording, performance, mix, master, rights, provenance, release, distribution, and catalog operations. ### E0 — Product boundary, existing DAW, and professional workflow - [ ] E0.1 Ratify Euterpe's product host and decide explicitly whether it is outside or inside the Oshun V1 shell. Evidence: product/architecture ADR. - [x] E0.1.a Inventory existing Studio web/desktop/native entry points, identity/project contexts, navigation shells, deployment boundaries, and audience. Evidence: host inventory. - [ ] E0.1.b Evaluate inside-shell versus standalone host for audio lifecycle, permissions, latency, offline/native/plugin needs, ownership, and operational isolation. Evidence: option analysis. - [ ] E0.1.c Decide canonical host(s), route/deep-link/handoff boundaries, data ownership, shell reuse, and prohibited duplicate editor behavior. Evidence: target architecture. - [ ] E0.1.d Define migration/redirect/session/context/telemetry/support/ rollout/rollback consequences for the chosen boundary. Evidence: delivery plan. - [ ] E0.1.e Obtain product/audio/architecture/security/accessibility ratification with alternatives and residual risks. Evidence: approved ADR. - [ ] E0.2 Inventory every Euterpe Studio route, DAW module, component, test, API, Tauri/native bridge, and service dependency. Evidence: route-capability matrix. - [x] E0.2.a Enumerate routes/navigation/commands/pages/dialogs and user/ operator journeys across web and installed desktop. Evidence: route inventory. - [x] E0.2.b Enumerate DAW engines/modules/worklets/workers/components/state/ commands/assets/device/plugin/native bridge surfaces. Evidence: module inventory. - [ ] E0.2.c Enumerate APIs/realtime protocols/stores/blobs/search/queues/ providers/distributors and service owners. Evidence: dependency inventory. - [ ] E0.2.d Map unit/integration/E2E/audio-golden/device/compatibility/ security tests to each retained capability. Evidence: test coverage ledger. - [ ] E0.2.e Reconcile routes to capabilities/owners/hosts/data classes and flag duplicate/orphan/dead/fixture/unsafe paths. Evidence: route-capability matrix. - [ ] E0.3 Map all `libs/euterpe/*` packages to workbench capabilities, services, consumer products, or out-of-scope. Evidence: complete ledger. - [x] E0.3.a Inventory every Euterpe package/export/audio consumer/runtime/ test/documented purpose and dependency direction. Evidence: package inventory. - [ ] E0.3.b Map retained exports to atomic production capabilities, canonical contracts, owning host/service, and accountable team. Evidence: capability mapping. - [ ] E0.3.c Classify consumer/conservatory/discovery/legacy/demo/duplicate/ dead code with keep/merge/migrate/deprecate/remove/out-of-scope disposition. Evidence: disposition ledger. - [ ] E0.3.d Verify every package/export/consumer has one reviewed disposition and no forbidden dependency crosses product or native security boundaries. Evidence: completeness gate. - [ ] E0.4 Classify existing DAW behavior as live, local-only, fixture-backed, service-backed, provider-gated, or incomplete. Evidence: browser/network walkthrough. - [ ] E0.4.a Build capability/scenario inventory for arrange/session/score/ mixer/devices/media/rights/release across browser and desktop. Evidence: walkthrough plan. - [ ] E0.4.b Observe UI/network/storage/audio worklets/workers/native IPC/ provider calls and trace authoritative state and side effects. Evidence: trace captures. - [ ] E0.4.c Classify each behavior by exact backing/runtime/feature flag/ configuration/dependency and distinguish partial from live. Evidence: implementation ledger. - [ ] E0.4.d Exercise loading/empty/offline/not-configured/degraded/failure/ permission/device-loss paths and identify simulated success. Evidence: state walkthrough. - [ ] E0.4.e Reconcile findings to code/tests/docs and assign remediation/ owner/evidence freshness. Evidence: reviewed classification. - [ ] E0.5 Define composer, lyricist, arranger, performer, recording engineer, editor, mix engineer, mastering engineer, producer, rights manager, label/publisher, distributor, reviewer, and administrator roles. Evidence: permission matrix. - [ ] E0.5.a Define duties and least-privilege object/field/function rights for every named role across project through catalog/remedy. Evidence: role definitions. - [ ] E0.5.b Define organization/project/song/session/release/catalog/ territory scopes, delegation, guest, service account, and temporary grants. Evidence: scope model. - [ ] E0.5.c Define edit/record/render/device/plugin/review/approve/rights/ deliver/takedown/admin rights by maturity state and host capability. Evidence: permission matrix. - [ ] E0.5.d Define separation of composition/mastering/rights/label/ distribution approvals, conflicts/recusal, quorum, and nondelegable human actions. Evidence: SoD policy. - [ ] E0.5.e Verify client projection and server/native enforcement across positive/negative/cross-project/revoked/offline/direct command cases. Evidence: authorization suite. - [ ] E0.6 Define project, song, composition, arrangement, session, recording, mix, master, release, and catalog maturity models separately. Evidence: state diagrams. - [ ] E0.6.a Define independent state vocabularies, actors, entry/exit criteria, terminal/archival conditions, and allowed transitions for each aggregate. Evidence: state definitions. - [ ] E0.6.b Define exact dependency relationships without collapsing creative version, technical readiness, rights approval, delivery, and catalog state into one status. Evidence: dependency model. - [ ] E0.6.c Define transition commands/guards/side effects/audit/invalidation for draft/review/approved/locked/released/replaced/taken-down flows. Evidence: transition tables. - [ ] E0.6.d Map existing DAW/API/storage/distributor states and ambiguous/ unknown/in-flight historical values. Evidence: compatibility matrix. - [ ] E0.6.e Property-test valid/invalid/concurrent/stale transitions and cross-model invariants. Evidence: state diagrams and tests. - [ ] E0.7 Define supported browser, desktop/Tauri, audio device, MIDI device, sample rate, channel, plugin, and offline configurations. Evidence: compatibility matrix. - [ ] E0.7.a Define supported OS/browser/desktop/app/runtime/CPU/architecture/ memory/storage/GPU combinations and lifecycle. Evidence: host matrix. - [ ] E0.7.b Define audio API/driver/device/input-output/channel/buffer/sample- rate/bit-depth/clock/hot-plug configurations and limits. Evidence: audio matrix. - [ ] E0.7.c Define MIDI 1/2, MPE, control-surface, sync/clock, port/transport, permission, and reconnect combinations. Evidence: MIDI matrix. - [ ] E0.7.d Define native/browser plugin formats/architectures/signature/ sandbox/licence/UI/state/sidechain/latency support and exclusions. Evidence: plugin matrix. - [ ] E0.7.e Define online/offline/local/remote/provider/render-worker feature availability, storage quotas, graceful degradation, and export escape. Evidence: offline matrix. - [ ] E0.7.f Publish supported/conditional/unsupported cells with known loss, evidence, owner, version, expiry, and no silent fallback. Evidence: compatibility profile. - [ ] E0.8 Define collaboration, latency, clock, sync, and ownership boundaries between browser audio, realtime services, and stored projects. Evidence: architecture diagram. - [ ] E0.8.a Define authoritative ownership for media bytes, project graph, edit operations, transport, device state, render artifacts, presence, and reviews. Evidence: ownership table. - [ ] E0.8.b Define browser/desktop audio render/control threads and real-time safety boundaries from UI/network/storage/provider work. Evidence: runtime diagram. - [ ] E0.8.c Define musical time/sample/timecode/tempo clock authority, synchronization/drift/latency measurement/compensation, and failover. Evidence: timing architecture. - [ ] E0.8.d Define collaboration operations/checkpoints/ordering/CRDT or locking/conflicts/offline queue/reconnect and transport-leader semantics. Evidence: realtime protocol. - [ ] E0.8.e Define durable-before-ack save/upload/render/job boundaries and recovery/reconciliation after browser/service/native failure. Evidence: durability model. - [ ] E0.8.f Validate architecture against solo, concurrent, remote recording, stage, offline, and render-worker scenarios. Evidence: architecture review. - [ ] E0.9 Threat-model malicious audio/plugins/presets/projects, voice impersonation, sample theft, prompt injection, rights fraud, unreleased leaks, device permission abuse, desktop bridge, and distribution fraud. Evidence: mitigation/test map. - [ ] E0.9.a Map actors/assets/trust boundaries/data flows/privileged commands across web/audio worklets/native host/plugins/providers/workers/ distributors. Evidence: threat diagrams. - [ ] E0.9.b Model malformed/polyglot/bomb media/project/preset, plugin code/ license/update/sandbox escape, unsafe DSP/feedback, and parser attacks. Evidence: content/code threats. - [ ] E0.9.c Model voice/performer impersonation, stolen samples/stems/ masters, fabricated rights/splits/consent/provenance, and similarity evasion. Evidence: identity/rights threats. - [ ] E0.9.d Model prompt/source/preset injection, model/tool misuse, provider leakage/training, generated malware/audio abuse, and agent privilege expansion. Evidence: AI threats. - [ ] E0.9.e Model unreleased/contract/voiceprint leakage through search/log/ cache/collaboration/review links/support/distribution and cross-tenant access. Evidence: confidentiality threats. - [ ] E0.9.f Model device/microphone/MIDI/OSC permission abuse, desktop IPC/ filesystem/deep-link/update attacks, mass delivery/takedown suppression, and account compromise. Evidence: platform threats. - [ ] E0.9.g Assign preventive/detective/recovery controls, residual risk, abuse tests, monitoring, owners, and review cadence. Evidence: mitigation/test map. - [ ] E0.10 Define rights and privacy classifications for demos, voice prints, stems, sessions, performer data, contracts, splits, and unreleased masters. Evidence: retention/access rules. - [ ] E0.10.a Inventory named data plus derivatives/proxies/fingerprints/ embeddings/logs/caches/backups/exports/provider/model inputs. Evidence: data catalog. - [ ] E0.10.b Assign sensitivity, rights kind, data subject/owner, purpose/ lawful basis, project/territory scope, and permitted roles/actions. Evidence: classification matrix. - [ ] E0.10.c Define encryption/key/region/provider/device/offline/clipboard/ download/share/watermark and collaboration restrictions. Evidence: handling rules. - [ ] E0.10.d Define active/archive/contract/legal-hold/backup retention, deletion/revocation/takedown, derivative impact, and conflict handling. Evidence: lifecycle schedule. - [ ] E0.10.e Define redacted projections for search/logs/analytics/ notifications/support/review/distributors and prohibit hidden training. Evidence: projection rules. - [ ] E0.10.f Validate representative workflows and obtain rights/privacy/ security/production approval. Evidence: signed policy. - [ ] E0.11 Define professional loudness, format, metadata, provenance, and distribution profiles by target. Evidence: ratified delivery matrix. - [ ] E0.11.a Inventory supported streaming/download/broadcast/podcast/video/ physical/spatial/distributor targets and current authoritative specs. Evidence: target inventory. - [ ] E0.11.b Define loudness/true-peak/dynamics/channel/layout/downmix/ duration/gap/fade constraints and pinned measurement standard per target. Evidence: audio profiles. - [ ] E0.11.c Define container/codec/sample-rate/bit-depth/dither/naming/ artwork/lyrics/captions/file-size checks and accepted alternatives. Evidence: format profiles. - [ ] E0.11.d Define title/version/contributor/identifier/genre/language/ advisory/territory/rights/pricing/date metadata and DDEX mapping. Evidence: metadata profiles. - [ ] E0.11.e Define C2PA/external provenance/signing/ingredient/AI disclosure requirements and unsupported/stripped states. Evidence: provenance profiles. - [ ] E0.11.f Pin versions/owners/effective dates, validate goldens with distributors, and publish supported/conditional/unsupported delivery cells. Evidence: ratified matrix. - [ ] E0.12 Define success measures for creative latency, glitch rate, save durability, collaboration, rights completeness, master compliance, delivery acceptance, and release correctness. Evidence: metric spec. - [ ] E0.12.a Define operation-to-audible-response/input-monitor/transport/edit latency distributions by supported host/device/buffer. Evidence: creative latency metrics. - [ ] E0.12.b Define dropout/underrun/overrun/click/xrun/glitch metrics with sampling, false-positive controls, severity, and privacy. Evidence: engine quality metrics. - [ ] E0.12.c Define acknowledged-save survival, autosave/recovery loss, collaboration convergence/conflict/reconnect, and media upload durability. Evidence: durability metrics. - [ ] E0.12.d Define rights/consent/split/provenance completeness and master target/QC conformance without reducing creativity to one score. Evidence: compliance metrics. - [ ] E0.12.e Define distributor acceptance plus semantic read-back/catalog identity/territory/correction/takedown correctness. Evidence: delivery metrics. - [ ] E0.12.f Define units/denominators/windows/slices/uncertainty/budgets/ alerts/owners and balanced quality guardrails. Evidence: metric spec. - [ ] E0.13 Author and ratify `V1/EUTERPE_MUSIC_WORKBENCH_DESIGN_2026-07-23.md` with current-state, product-host decision, DAW/audio architecture, data, APIs, rights, standards, UI, migration, rollout, and decision records. Evidence: approved doc and resolved review comments. - [ ] E0.13.a Document current routes/modules/engine/native/packages/services/ formats/workflows/tests, backing state, constraints, and gaps. Evidence: current-state chapter. - [ ] E0.13.b Document chosen host/ownership/roles/capability profiles and DAW/ audio/realtime/device/plugin/offline/render architecture. Evidence: target architecture chapters. - [ ] E0.13.c Document contracts/stores/APIs/events/jobs/providers/ distributors, compatibility/migrations, and recovery. Evidence: platform chapters. - [ ] E0.13.d Document rights/consent/splits/provenance/AI/safety/privacy/ standards/target profiles and approval boundaries. Evidence: governance chapters. - [ ] E0.13.e Document extension of existing DAW, task-led operations UI, responsive/accessibility/semantic/offline/performance states. Evidence: experience chapter. - [ ] E0.13.f Document rollout/rollback/observability/runbooks/verification/ evidence/launch criteria and all decision alternatives/owners/dates. Evidence: delivery chapters. - [ ] E0.13.g Resolve every substantive review comment and obtain named product/music/audio/rights/security/accessibility/engineering ratification. Evidence: approved design. - [ ] E0.14 Reconcile every `libs/euterpe/*` package, Studio route/component, Web Audio/native/Tauri operation, provider, agent, realtime protocol, workflow, test, documented feature, and distribution target at atomic-feature level. Evidence: explicit dispositions cover foundations/ theory, composition/score/lyrics, instruments/effects/samples, recording/ DAW, AI audio/voice, mix/master, spatial, stage/realtime, podcast/video, rights/provenance, marketing/discovery, distribution/catalog, learning, and operations. - [x] E0.14.a Inventory code/routes/components/commands/audio/native/provider/ agent/protocol/jobs/tests/docs/flags/deployed integrations and targets. Evidence: reconciliation inputs. - [ ] E0.14.b Split sources into atomic user/operator/system capabilities with host/audience/owner/state/dependencies/data class/profile. Evidence: atomic ledger. - [ ] E0.14.c Cover foundations/theory, composition/score/lyrics, instruments/effects/samples, recording/DAW, AI audio/voice, mix/master, and spatial explicitly. Evidence: production coverage. - [ ] E0.14.d Cover stage/realtime, podcast/video, rights/provenance, marketing/discovery, distribution/catalog, learning, developer/provider, and operations explicitly. Evidence: extended coverage. - [ ] E0.14.e Assign each Euterpe item keep/consolidate/migrate/replace/ deprecate/remove/externalize with target owner/host/profile/ dependencies/delivery/expiry. Evidence: disposition ledger. - [ ] E0.14.f Reconcile to routes/packages/contracts/stores/tests and fail orphan/duplicate/unknown/unreviewed capabilities. Evidence: completeness gate. - [ ] E0.15 Define the boundary among professional production, live/stage, podcast/video, label/marketing/catalog operations, artist collaboration, developer/provider administration, conservatory/ear-training, discovery, sacred/philosophy experiences, and other consumer products. Evidence: every capability has an authorized host/audience, handoff, or explicit exclusion from the production workbench. - [ ] E0.15.a Define audience/trust/data/action boundaries and product goals for each named surface. Evidence: surface matrix. - [ ] E0.15.b Assign every retained capability/mutation to one canonical host/ owner/profile/role, distinguishing production core from projections and separate products. Evidence: host ledger. - [ ] E0.15.c Define typed redacted handoffs for live/stage, podcast/video, marketing/catalog, collaboration/review, providers/developers, learning, and consumer discovery. Evidence: handoff contracts. - [ ] E0.15.d Define identity/session/token/deep-link/storage/media/provenance/ rights/logging separation and step-up transitions. Evidence: security boundary. - [ ] E0.15.e Define shared asset/release/correction/takedown identity without granting consumer/marketing/learning surfaces production authority. Evidence: control-flow diagrams. - [ ] E0.15.f Test authorized cross-surface journeys and attempted object/ field/function/media/device access; eliminate duplicate mutations. Evidence: boundary suite. - [ ] E0.16 Define capability profiles for browser, installed desktop/Tauri, native audio/plugin host, remote collaboration, live stage, offline, and render worker. Evidence: unsupported audio/MIDI/plugin/spatial/voice behavior is explicit instead of silently degraded. - [ ] E0.16.a Define profile identity/version/detection/prerequisites and authoritative capability flags/limits for every named host/mode. Evidence: profile schema. - [ ] E0.16.b Map audio input/output/latency/channel/sample rate/render/ filesystem/media/device permissions by profile. Evidence: audio capability matrix. - [ ] E0.16.c Map MIDI/MPE/sync/control/plugin/native IPC/multi-window/stage command availability and safety boundaries. Evidence: device matrix. - [ ] E0.16.d Map collaboration/provider/AI/offline storage/render-worker/ distribution features, data movement, rights/consent, and fallbacks. Evidence: service matrix. - [ ] E0.16.e Specify unavailable/degraded/read-only/handoff/export behavior, user messaging, telemetry, and no silent quality/state loss. Evidence: fallback contracts. - [ ] E0.16.f Detect at runtime, revalidate on device/network/config changes, and test every supported/conditional/unsupported cell. Evidence: capability profile suite. ### E1 — Music, session, rights, and release contracts - [ ] E1.1 Define project, composition, work, recording, version, arrangement, section, tempo map, meter map, key map, marker, and cue entities. Evidence: schema fixtures. - [ ] E1.1.a Define stable identity/tenant/project/owner/lifecycle/version/ timestamps/audit and distinguish abstract work, composition, recording, and project. Evidence: core schemas. - [ ] E1.1.b Define arrangement/version parentage and ordered/nested section identity, range, repetition, alternative, and reference semantics. Evidence: structure fixtures. - [ ] E1.1.c Define piecewise tempo/meter/key maps with musical/sample/ absolute-time anchors, ramps, pickup, polymeter/polyrhythm, and microtonal context. Evidence: map fixtures. - [ ] E1.1.d Define marker/cue types, position/range/label/action/target/ performer/control links and arrangement/version scope. Evidence: cue fixtures. - [ ] E1.1.e Define cross-reference, archive/delete, transition, unknown enum, tenant, and immutability constraints plus API/event serialization. Evidence: invariant tests. - [ ] E1.2 Define track, bus, return, clip, take, comp, lane, region, automation, device, preset, routing, send, and render entities. Evidence: DAW contract compatibility. - [ ] E1.2.a Define stable graph identity/order/type/role/channel/layout/state for track/bus/return/group/folder and device/routing ownership. Evidence: mixer graph schema. - [ ] E1.2.b Define immutable media source and clip/take/lane/region placement, offset/range/loop/stretch/fade/gain/channel/version semantics. Evidence: edit schemas. - [ ] E1.2.c Define comp segment/source/take/range/crossfade/order/revision and no-destructive-source invariants. Evidence: comp schema. - [ ] E1.2.d Define automation lane/parameter/path/timebase/point/curve/mode/ scope/version and interaction with clips/tempo. Evidence: automation schema. - [ ] E1.2.e Define typed device/preset/state/version/latency/tail/bypass/ missing/sandbox and routing/send/sidechain graph edges. Evidence: device contracts. - [ ] E1.2.f Define render request/range/source revision/profile/dependencies/ outputs/manifest/measurements/status/provenance. Evidence: DAW compatibility fixtures. - [ ] E1.3 Define score parts, notation events, articulation, dynamics, lyrics, chord, lead sheet, MIDI, and interchange metadata. Evidence: round-trip fixtures. - [ ] E1.3.a Define score/part/staff/voice/measure/time-position/event identity and pitched/unpitched/rest/grace/tuplet/tie/slur/beaming semantics. Evidence: notation schema. - [ ] E1.3.b Define pitch spelling/frequency/tuning/transposition/clef/key/ range plus articulation/ornament/dynamic/expression relationships. Evidence: musical event fixtures. - [ ] E1.3.c Define chord symbol/voicing/bass/function/scale/lead-sheet/ repeat/form/roadmap and explicit analytical assumptions. Evidence: harmony schema. - [ ] E1.3.d Link lyric syllables/melisma/elision/translation/pronunciation to notation events and timing without collapsing lyric revisions. Evidence: underlay fixtures. - [ ] E1.3.e Map MIDI/MIDI 2 note/controller/program/expression/articulation/ tempo/meter events to notation with explicit quantization/loss. Evidence: MIDI fixtures. - [ ] E1.3.f Define MusicXML/notation/MIDI interchange provenance/version/ unknown extensions/loss diagnostics and round-trip tolerances. Evidence: round-trip goldens. - [ ] E1.4 Define lyric sections, lines, syllables, stress, rhyme, language, translation, explicit-content, and timing anchors. Evidence: schema. - [ ] E1.4.a Define lyric document/revision/section/line/token/syllable stable identity, order, repetition, performer/voice, and text/script/language. Evidence: lyric schema. - [ ] E1.4.b Define normalized/pronounced syllable, stress/weight/meter/ elision/melisma and confidence/source fields. Evidence: prosody schema. - [ ] E1.4.c Define rhyme sound/family/scheme/position/exact-near/internal/ multilingual relation with declared pronunciation assumptions. Evidence: rhyme fixtures. - [ ] E1.4.d Define translation/transliteration/adaptation relationship, segment alignment, terminology/names, semantic parity, and provenance. Evidence: locale schema. - [ ] E1.4.e Define explicit/advisory/sensitive-topic finding versus human decision, locale/target scope, evidence, and disclosure. Evidence: content policy schema. - [ ] E1.4.f Define musical/sample/time anchors to score/MIDI/audio/clip ranges and orphan/ambiguous mapping through edits. Evidence: timing anchor tests. - [ ] E1.5 Define recording device, performer, microphone/input, room, take, latency, consent, and session provenance. Evidence: capture contract. - [ ] E1.5.a Define capture session/device/driver/input/channel/sample-rate/ bit-depth/buffer/clock/calibration identity and capability snapshot. Evidence: device contract. - [ ] E1.5.b Define performer/public-versus-protected identity, role/ instrument/voice, microphone/DI/preamp/input chain, room/location, and setup. Evidence: session schema. - [ ] E1.5.c Define recording/take/lane/file/channels/range/count-in/punch/ loop/dropout/overdub identity with immutable source checksums. Evidence: take schema. - [ ] E1.5.d Define measured/compensated round-trip/input/plugin/network latency, confidence/calibration version, clock drift, and alignment. Evidence: latency schema. - [ ] E1.5.e Define consent purpose/scope/territory/term/media/model/voice/ distribution/revocation/evidence separately from recording metadata. Evidence: consent contract. - [ ] E1.5.f Define complete app/device/audio-chain/operator/performer/time/ source/import/edit provenance with redacted projections. Evidence: capture fixtures. - [ ] E1.6 Define mix revision, plugin/device graph, automation, loudness, reference, notes, and approval metadata. Evidence: immutable revision tests. - [ ] E1.6.a Define immutable mix revision/parent/source session and exact track/media/arrangement/routing/device/preset/automation dependency manifest. Evidence: mix schema. - [ ] E1.6.b Define ordered typed device/routing graph, sidechains/sends/ latency compensation/tails/missing state and complete state snapshots. Evidence: graph fixtures. - [ ] E1.6.c Define automation/time maps and recalled manual controls with touch/write/latch provenance and deterministic playback intent. Evidence: automation snapshot. - [ ] E1.6.d Define loudness/peak/dynamics/spectrum/phase/headroom measurements with units/channels/range/analyzer versions separate from verdicts. Evidence: measurement schema. - [ ] E1.6.e Define reference tracks/segments/level matching/rights/ assumptions and anchored notes/comments/decisions. Evidence: reference contract. - [ ] E1.6.f Define review/approval/waiver scope/roles/exact revision/ dependencies/conditions/expiry/invalidation and immutable audit. Evidence: revision invariants. - [ ] E1.7 Define master spec, source mix, processing, measurements, format, delivery target, QC, and approval. Evidence: target profile invariants. - [ ] E1.7.a Define master job/revision identity and immutable source mix/ stems/reference/profile/target/dependency manifest. Evidence: master schema. - [ ] E1.7.b Define processing graph/order/state/plugins/analog steps/ calibration/latency/dither and deterministic or externally documented recall. Evidence: processing contract. - [ ] E1.7.c Define rendered master/container/codec/layout/sample-rate/bit- depth/channel/duration/gap/fade/checksum and alternate renditions. Evidence: format schema. - [ ] E1.7.d Define raw loudness/peak/dynamics/spectrum/phase/noise/artifact/ null measurements with analyzer/calibration versions. Evidence: QC measurement schema. - [ ] E1.7.e Define target-specific verdict/findings/remediation/unsupported/ waiver separately from measurements. Evidence: profile contract. - [ ] E1.7.f Define mastering review/approval/signature/exact output/ conditions/expiry and invalidation on source/profile/rights change. Evidence: target profile invariants. - [ ] E1.8 Define musical work, sound recording, sample, interpolation, performer, voice, model, and generated-stem rights records separately. Evidence: rights-kind validation. - [ ] E1.8.a Define common rights record identity/subject kind/version/ claimant/owner/licensor/source/jurisdiction/territory/term/evidence/state. Evidence: base rights schema. - [ ] E1.8.b Define composition/work and sound-recording/master rights with distinct parties/shares/administration/licensing uses. Evidence: work/master fixtures. - [ ] E1.8.c Define sample versus interpolation source/use/range/ recognizability/clearance/attribution/restrictions and derived works. Evidence: sample fixtures. - [ ] E1.8.d Define performer/neighboring/voice/likeness/session/union or contractual rights, consent, compensation, and revocation. Evidence: performer fixtures. - [ ] E1.8.e Define model/provider/training/inference/output/derivative/ disclosure rights and generated-stem source/condition/run provenance. Evidence: AI rights fixtures. - [ ] E1.8.f Enforce kind-specific required fields/transitions/conflicts and prohibit conversion/collapse between records. Evidence: validation suite. - [ ] E1.9 Define ownership splits with parties, roles, percentages, territories, rights types, dates, disputes, and signatures. Evidence: total/incompatibility invariants. - [ ] E1.9.a Define split sheet/version/subject work-or-recording/right type/ territory/effective window/currency and status. Evidence: split schema. - [ ] E1.9.b Define party identity/role/capacity/publisher/label/administrator/ representative/payment reference separately from public credit. Evidence: party schema. - [ ] E1.9.c Define percentage/fraction/points/recoupment/control/license/ collection shares with exact decimal/rational arithmetic. Evidence: share contract. - [ ] E1.9.d Define proposal/counter/accepted/signed/disputed/superseded/ expired state, comments/evidence, authority, and immutable revision lineage. Evidence: negotiation schema. - [ ] E1.9.e Define cryptographic/e-sign identity/intent/time/document hash, quorum, minors/representatives, revocation, and signature validity. Evidence: signature contract. - [ ] E1.9.f Enforce total exactly per right/territory/window, incompatible overlaps, duplicate parties, missing authority, and release snapshot invariants. Evidence: property tests. - [ ] E1.10 Define identifiers and metadata: ISRC, ISWC, UPC/EAN, catalog number, contributor IDs, titles, versions, genres, languages, and advisories. Evidence: format/checksum validation. - [ ] E1.10.a Define identifier type/issuer/value/status/subject/version/ territory/date/provenance and primary/alternate/replacement relations. Evidence: identifier schema. - [ ] E1.10.b Implement ISRC/ISWC/UPC/EAN syntax/check-digit/normalization/ uniqueness/scope and explicit unassigned/pending/invalid state. Evidence: identifier tests. - [ ] E1.10.c Define internal catalog/contributor/party/artist IDs and external mappings without using mutable display names as identity. Evidence: mapping tests. - [ ] E1.10.d Define title/subtitle/version/display/phonetic/sort/localized fields, contributors/roles/order/credits, and language/script. Evidence: metadata schema. - [ ] E1.10.e Define governed genre/mood/advisory/explicit/territory/target vocabularies with source/version/alias/deprecation. Evidence: vocabulary tests. - [ ] E1.10.f Validate format/checksum/collision/duplicate/reassignment/ locale/round-trip and distributor mapping. Evidence: metadata suite. - [ ] E1.11 Define provenance ingredients and transformations for generated, recorded, edited, mixed, and mastered audio. Evidence: C2PA/external ledger mapping. - [ ] E1.11.a Define immutable ingredient identity/kind/hash/rights/owner/ capture/import/generation source/version and protected/public metadata. Evidence: ingredient schema. - [ ] E1.11.b Define recording actions with performer/device/room/session/ calibration/consent and original take relationships. Evidence: capture lineage. - [ ] E1.11.c Define edit/comp/stretch/pitch/repair/separation/generation/ plugin/analog/mix/master/render actions with inputs/parameters/tools/ versions/outputs. Evidence: transformation schema. - [ ] E1.11.d Represent DAG relationships through clips/stems/mixes/masters/ artwork/packages while preserving ranges and many-to-many lineage. Evidence: provenance graph. - [ ] E1.11.e Map supported assertions/actions/ingredients/signers to C2PA and external ledgers with privacy minimization and explicit loss. Evidence: mapping matrix. - [ ] E1.11.f Define valid/tampered/missing/stripped/unknown/untrusted state, signature/hash verification, correction, and read-back. Evidence: provenance fixtures. - [ ] E1.12 Define release, product, track sequence, territory, date, pricing, rights, assets, delivery, takedown, and correction entities. Evidence: DDEX profile mapping. - [ ] E1.12.a Define release/product/version/type/title/label/catalog/UPC/ metadata/locale/status and immutable candidate relationship. Evidence: release schema. - [ ] E1.12.b Define ordered disc/side/track/hidden/bonus/component sequence with recording/version/ISRC/display/territory availability. Evidence: sequencing schema. - [ ] E1.12.c Define territory/window/street/preorder/embargo/time-zone/ pricing/tier/currency/entitlement and rights eligibility. Evidence: market schema. - [ ] E1.12.d Define master/artwork/lyrics/credits/metadata/provenance/ advisory/rendition assets with checksums and target requirements. Evidence: asset manifest. - [ ] E1.12.e Define per-distributor delivery/attempt/ack/content-status/ read-back/error/retry identifiers and partial aggregate state. Evidence: delivery schema. - [ ] E1.12.f Define takedown/redelivery/metadata correction/audio replacement/ territory change causes/actions/notices/history/verification. Evidence: remedy schema. - [ ] E1.12.g Map every entity/lifecycle to pinned DDEX ERN profile with supported extensions and explicit loss. Evidence: DDEX matrix. - [ ] E1.13 Define immutable revisions and semantic diffs for score, lyrics, arrangement, session, mix, master, rights, and release. Evidence: golden diff fixtures. - [ ] E1.13.a Define Euterpe's immutable audio revision/parent(s)/subject/ schema/tool/actor/cause/time/hash/approval lineage and branch/merge semantics. Evidence: revision contract. - [ ] E1.13.b Define score/lyrics/arrangement diffs by stable musical/text/ section identity, position, value, move, and semantic context. Evidence: creative diff fixtures. - [ ] E1.13.c Define session diffs for tracks/clips/takes/comp/routing/devices/ automation/tempo and preserve source media lineage. Evidence: session diff fixtures. - [ ] E1.13.d Define mix/master diffs for dependency graphs/plugin state/ automation/settings/renders/measurements/profile verdicts. Evidence: audio revision fixtures. - [ ] E1.13.e Define rights/splits/consent/provenance/release/territory/target diffs with protected redaction and material-change classification. Evidence: business diff fixtures. - [ ] E1.13.f Define ambiguous/unknown plugin/opaque blob/schema-version loss and test add/delete/move/split/merge/restore/concurrent goldens. Evidence: semantic diff suite. - [ ] E1.14 Define backward compatibility with current DAW project formats. Evidence: old-project migration corpus. - [ ] E1.14.a Inventory every deployed project/session/media/preset/plugin/ desktop/browser schema version and producer/consumer behavior. Evidence: version inventory. - [ ] E1.14.b Build representative historical corpus including large, missing- plugin/media, unusual routing/tempo/automation, corrupt, and partial projects. Evidence: migration corpus. - [ ] E1.14.c Define read/write/support window and deterministic migrations for renamed/split/merged/timebase/device/state fields with explicit loss. Evidence: compatibility matrix. - [ ] E1.14.d Migrate one version at a time and supported direct paths, preserving musical timing/media/hashes/routing/automation/undo history or documented boundaries. Evidence: migration tests. - [ ] E1.14.e Test old/new browser/desktop/realtime/render combinations, interrupted migration/retry/rollback/export, unknown fields, and downgrade refusal. Evidence: skew suite. - [ ] E1.14.f Publish backup/restore/operator diagnostics and require golden semantic/audio comparison before marking migrated. Evidence: rehearsal report. - [ ] E1.15 Define pitch spelling, frequency, octave, tuning/temperament, microtonal scale, key/tonality, interval, chord/voicing, rhythmic cycle, groove, form, dynamic, articulation, ornament, and cultural-source metadata. Evidence: notation/playback/analysis round-trips do not force all music into 12-tone equal temperament or Western common practice. - [ ] E1.15.a Define pitch as distinct written spelling, sounding frequency/ ratio/cents, octave/register, reference pitch, transposition, and tuning context. Evidence: pitch schema. - [ ] E1.15.b Define arbitrary scale/temperament/tuning tables, period/ nonoctave repetition, degrees/accidentals/glyphs/aliases, and Scala or ratified interchange. Evidence: tuning fixtures. - [ ] E1.15.c Define key/tonality/mode/raga or other system, interval/chord/ voicing/function only when applicable, with cultural-source and analysis assumptions. Evidence: tonal schema. - [ ] E1.15.d Define rhythmic cycle/groove/pulse/subdivision/swing/polyrhythm/ additive/free-time and meter representation without common-time floors. Evidence: rhythm fixtures. - [ ] E1.15.e Define form/dynamic/articulation/ornament/expression terminology, notation/playback mappings, locale, source tradition, and performer interpretation. Evidence: expression schema. - [ ] E1.15.f Round-trip representative culturally sourced/non-12-TET/free- rhythm notation→MIDI/control→playback→analysis with declared loss and expert review. Evidence: inclusive music goldens. - [ ] E1.16 Define instrument, sampler, synthesizer, effect, plugin, device, patch/preset, sample zone, modulation, control surface, MIDI/MPE mapping, latency, license, and state-snapshot contracts. Evidence: deterministic recall or explicit non-portability diagnostics. - [ ] E1.16.a Define device/instrument/effect/plugin identity/kind/format/ vendor/version/build/architecture/capabilities/ports/parameters and host support. Evidence: device schema. - [ ] E1.16.b Define synthesizer/sampler engine topology, voices/polyphony/ tuning/sample zones/articulations/layers/round robins/streaming and source rights. Evidence: instrument schema. - [ ] E1.16.c Define patch/preset/state blob plus normalized parameters/ resources/migrations/checksum/factory-user scope and portability. Evidence: state contract. - [ ] E1.16.d Define modulation source→target/polarity/depth/range/smoothing/ rate/sync/scope and typed audio/CV/MIDI/MPE/control mappings. Evidence: mapping schema. - [ ] E1.16.e Define control-surface port/device/profile/learn/feedback/ conflict and latency/tail/compensation/calibration state. Evidence: control contract. - [ ] E1.16.f Define license/signature/entitlement/install/update/quarantine/ missing/crash/safe-mode state and protected credentials. Evidence: lifecycle schema. - [ ] E1.16.g Validate deterministic recall hashes/audio goldens when possible and emit exact missing/version/resource/licence/opaque-state loss diagnostics otherwise. Evidence: recall suite. - [ ] E1.17 Define stem-separation, transcription, inpainting, continuation, style transfer, conditional generation, voice conversion, speech, singing, choir, and spatial-upmix jobs with source, mask/condition, identity/rights, model, parameters, output stems, confidence, and provenance. Evidence: job-kind fixtures and consent applicability. - [ ] E1.17.a Define shared immutable job request/run/attempt/status/budget/ provider-model/version/hardware/input-output/provenance contract. Evidence: base job schema. - [ ] E1.17.b Define separation/transcription source ranges/channels/targets/ notation/lyrics/speakers and output stems/events/alignments/confidence. Evidence: analysis job fixtures. - [ ] E1.17.c Define inpainting/continuation/variation/style-transfer exact mask/range/context/condition/reference/strength/preservation and generated outputs. Evidence: generative edit fixtures. - [ ] E1.17.d Define conditional/full generation prompt/score/MIDI/audio/ structure/style/instrument/seed/negative constraints and editable intermediates. Evidence: generation fixtures. - [ ] E1.17.e Define voice conversion/speech/singing/choir identity/performer/ voice model/locale/pronunciation/timing/pitch/harmony/direction and outputs. Evidence: voice job fixtures. - [ ] E1.17.f Define spatial-upmix source layout/object inference/target/ renderer/room/trajectory/downmix constraints and outputs. Evidence: upmix job fixtures. - [ ] E1.17.g Resolve source/reference/sample/model/voice/performer rights and consent scope/revocation/disclosure before dispatch; define prohibited/ nonapplicable states. Evidence: applicability tests. - [ ] E1.17.h Define measurements/confidence/uncertainty/quality/safety/raw findings separately from policy verdict/human selection. Evidence: result schema. - [ ] E1.18 Define object/channel/bed-based spatial sessions, speaker layouts, binaural render settings, ambisonic order/normalization, position/ trajectory/room metadata, head tracking, target device, downmix, and interchange. Evidence: Atmos/binaural/HOA/VR-AR profile goldens or explicit unsupported states. - [ ] E1.18.a Define spatial session/object/bed/channel/track identity, coordinate/frame/unit, position/orientation/spread/divergence/gain/ priority and automation. Evidence: spatial schema. - [ ] E1.18.b Define named/custom speaker layout/labels/angles/elevation/ distance/LFE/bed mapping, calibration, room, and target constraints. Evidence: layout schema. - [ ] E1.18.c Define ambisonic order/dimensionality/channel ordering/ normalization/coordinate orientation and HOA encode/decode metadata. Evidence: ambisonic schema. - [ ] E1.18.d Define binaural renderer/HRTF/head size/room/head tracking/ sensor/time alignment and device-specific settings. Evidence: binaural contract. - [ ] E1.18.e Define object/bed→speaker/binaural/ambisonic downmix/render matrices, metadata loss, loudness/peak, and fallback. Evidence: render profiles. - [ ] E1.18.f Define ADM-BWF/Atmos or ratified/VR-AR interchange mappings, profile/version/IDs/timing/objects and explicit unsupported fields. Evidence: interchange matrix. - [ ] E1.18.g Validate goldens per supported layout/renderer/device/target and serialize honest unsupported/degraded states. Evidence: spatial conformance suite. ### E2 — Core DAW, editing, and device workflow - [ ] E2.1 Verify sample-accurate timeline, tempo, meter, marker, loop, and transport behavior. Evidence: deterministic timing tests. - [ ] E2.1.a Define musical-tick/sample/time conversion, rounding, reference sample rate, tempo ramps, meter changes, pickups, and negative/preroll positions. Evidence: timing spec. - [ ] E2.1.b Verify event/clip/automation/marker/cue placement and rendering across tempo/meter edits without cumulative drift. Evidence: alignment tests. - [ ] E2.1.c Verify play/stop/pause/seek/scrub/locate/record/pre-roll/count-in state and exact audible/record sample boundaries. Evidence: transport tests. - [ ] E2.1.d Verify loop/cycle range, wrap, punch, metronome, latency compensation, and automation at boundaries. Evidence: loop tests. - [ ] E2.1.e Run long-duration, high/low/variable tempo, odd/additive meter, sample-rate conversion, offline/realtime render, and repeated-start deterministic goldens. Evidence: timing suite. - [ ] E2.2 Verify audio engine startup, suspend/resume, device change, sample rate, buffer size, dropout, and recovery. Evidence: device fault suite. - [ ] E2.2.a Define engine lifecycle/state/error contract and capability/ permission/device selection before graph activation. Evidence: lifecycle spec. - [ ] E2.2.b Verify cold/warm startup, user-gesture resume, background/ foreground, suspend/resume, interruption, and safe graph teardown. Evidence: lifecycle tests. - [ ] E2.2.c Verify input/output/default device add/remove/switch, channel-map change, permission revoke, and fallback without wrong-device capture. Evidence: hot-plug tests. - [ ] E2.2.d Verify sample-rate/buffer/block/clock change with resampling, latency recalibration, transport/recording handling, and explicit unsupported states. Evidence: configuration tests. - [ ] E2.2.e Inject CPU starvation/xruns/worklet crash/device loss/driver error/clock discontinuity and recover without corrupting project/media. Evidence: device fault suite. - [ ] E2.3 Build/complete track, bus, return, group, folder, send, sidechain, mute, solo, arm, monitor, and routing operations. Evidence: signal-flow tests. - [ ] E2.3.a Implement create/delete/duplicate/rename/reorder/nest/unnest for audio/MIDI/instrument/aux/bus/return/group/folder with stable IDs and non-drag commands. Evidence: structure tests. - [ ] E2.3.b Implement typed input/output/channel/layout routing with graph validation, cycle/feedback safety, disconnected/missing endpoints, and visible signal path. Evidence: routing tests. - [ ] E2.3.c Implement pre/post-fader sends, return routing, sidechain source/ destination/tap/channel mapping, gain/pan, enable, and automation. Evidence: send/sidechain tests. - [ ] E2.3.d Implement mute/solo/solo-safe/exclusive/group propagation with deterministic audible graph and no destructive state changes. Evidence: mute/solo goldens. - [ ] E2.3.e Implement record arm/input monitoring/auto/off/source selection with permissions, feedback prevention, latency, and multi-track capture. Evidence: monitor tests. - [ ] E2.3.f Cover every command with undo/redo/concurrency/persistence/ accessible grid and offline/realtime/render signal-flow goldens. Evidence: operation coverage. - [ ] E2.4 Build/complete clip create, import, move, trim, split, slip, duplicate, loop, stretch, reverse, fade, crossfade, consolidate, and bounce. Evidence: non-destructive edit tests. - [ ] E2.4.a Implement clip create/import/record-reference/duplicate with immutable source media, channel mapping, project rate, and provenance. Evidence: creation tests. - [ ] E2.4.b Implement move/copy across tracks/timebases/snap modes and trim start/end with bounded source offset and no media rewrite. Evidence: placement tests. - [ ] E2.4.c Implement split/join/slip/slide/duplicate/loop/repeat and preserve take/comp/anchor/automation relationships or explicit impact. Evidence: structural edit tests. - [ ] E2.4.d Implement nondestructive time stretch/pitch/formant/reverse with algorithm/version/quality/transient/tempo context and render provenance. Evidence: processing tests. - [ ] E2.4.e Implement fade/crossfade shapes/lengths/gains/equal-power/ overlapping source limits and sample-continuity tests. Evidence: fade goldens. - [ ] E2.4.f Implement consolidate/bounce to immutable derived media with exact range/tails/routing/effects/automation/profile and source manifest. Evidence: render lineage. - [ ] E2.4.g Verify semantic diff/undo/redo/restore, pointer/non-drag parity, sample boundary/null tests, and source bytes unchanged. Evidence: non-destructive suite. - [ ] E2.5 Build/complete MIDI record, draw, quantize, groove, velocity, articulation, expression, sustain, MPE, and humanize. Evidence: event round-trip. - [ ] E2.5.a Implement timestamped MIDI 1/MIDI 2 UMP/MPE recording with port/ channel/group/note identity, latency compensation, overdub/replace/ loop, and raw capture. Evidence: record tests. - [ ] E2.5.b Implement note/rest/controller/program/pitch/sustain/aftertouch/ per-note expression draw/edit/delete/duplicate with musical/sample timing. Evidence: editor tests. - [ ] E2.5.c Implement quantize for start/end/duration/strength/swing/iterative rules and reversible source-versus-playback timing. Evidence: quantize tests. - [ ] E2.5.d Implement groove extraction/application, velocity curves, articulation maps, sustain interpretation, and instrument-specific expression. Evidence: performance tests. - [ ] E2.5.e Implement seeded bounded humanize for timing/velocity/duration/ expression with preview, repeatability, and no note collisions/stuck notes. Evidence: humanize tests. - [ ] E2.5.f Round-trip record→edit→save→export/import→playback across MIDI/ MPE devices with undo and explicit conversion loss. Evidence: event suite. - [ ] E2.6 Build/complete score notation, parts, layout, transposition, articulation, lyric underlay, playback, and print/export. Evidence: notation goldens. - [ ] E2.6.a Implement score/part/staff/voice/measure/event authoring for pitched/unpitched/grace/tuplet/tie/slur/repeat/free-time structures. Evidence: notation editor tests. - [ ] E2.6.b Implement clef/key/tuning/accidental/spelling/transposition/ instrument range and concert/written pitch without 12-TET-only assumptions. Evidence: pitch tests. - [ ] E2.6.c Implement articulation/ornament/dynamics/expression/technique and playback mapping with instrument/library capability and fallback. Evidence: expression goldens. - [ ] E2.6.d Implement lyric underlay for syllable/melisma/elision/verse/ translation/pronunciation and synchronized lyric timing. Evidence: lyric tests. - [ ] E2.6.e Implement page/system/staff/spacing/break/visibility/cue/layout rules, extracted parts, accessibility semantics, and print preview. Evidence: layout tests. - [ ] E2.6.f Export/import MusicXML/PDF/print/MIDI or ratified formats with deterministic notation/playback comparison and loss diagnostics. Evidence: notation goldens. - [ ] E2.7 Build/complete arrangement sections, scenes, variants, and section-level move/copy. Evidence: marker/clip/automation coherence. - [ ] E2.7.a Implement stable section/scene/variant identity, nested/ordered structure, musical range/repetitions/color/label/cue and aliases. Evidence: structure tests. - [ ] E2.7.b Create/resize/split/merge/duplicate/reorder/move/copy sections with explicit ripple versus reference behavior and non-drag commands. Evidence: edit tests. - [ ] E2.7.c Move/copy affected clips/takes/comp/MIDI/score/lyrics/markers/ tempo-meter-key/automation consistently or preview exclusions. Evidence: coherence tests. - [ ] E2.7.d Create/switch/compare arrangement variants using shared media and immutable lineage without cross-variant mutation. Evidence: variant tests. - [ ] E2.7.e Verify undo/redo/concurrency/export/render/session-scene aliases and exact marker/clip/automation timing. Evidence: arrangement suite. - [ ] E2.8 Build/complete comping with take lanes, audition, swipe/segment selection, crossfades, and source trace. Evidence: comp provenance. - [ ] E2.8.a Create ordered take lanes from loop/punch/overdub/import with immutable files, performer/session/device/timing/dropout provenance. Evidence: lane tests. - [ ] E2.8.b Implement lane/take/range audition with level/pan/routing/ latency context, solo-safe restoration, and keyboard controls. Evidence: audition tests. - [ ] E2.8.c Implement swipe and form/table-based segment selection with exact source/timeline ranges, overlaps, gaps, priority, and destination. Evidence: selection tests. - [ ] E2.8.d Generate/edit adjacent crossfades with bounded handles and click-free sample continuity; preserve original takes. Evidence: crossfade goldens. - [ ] E2.8.e Persist comp revision as ordered source-segment manifest and map anchors through take edits/moves or mark stale. Evidence: provenance tests. - [ ] E2.8.f Verify flatten/bounce/restore/undo/redo/concurrent edits and null/sample comparisons against source segments. Evidence: comp suite. - [ ] E2.9 Build/complete automation for track, bus, plugin, tempo, and spatial parameters. Evidence: read/write/touch/latch and curve tests. - [ ] E2.9.a Discover/register automatable parameters with stable device/path/ unit/range/default/step/bipolar/logarithmic/discrete semantics. Evidence: parameter registry. - [ ] E2.9.b Implement lane create/show/hide/arm and point add/move/delete/ range/scale/copy with musical/sample time and non-drag forms/commands. Evidence: lane editing tests. - [ ] E2.9.c Implement step/linear/bezier/hold curves, tangents, smoothing, value clamping, sample/block interpolation, and deterministic playback. Evidence: curve goldens. - [ ] E2.9.d Implement read/off/write/touch/latch/trim modes with gesture capture, return/ramp, punch, loop, undo, and visible recording state. Evidence: mode tests. - [ ] E2.9.e Handle tempo and spatial/multidimensional parameters, clip versus track automation, section moves, device reorder/remove/missing/version migration. Evidence: lifecycle tests. - [ ] E2.9.f Verify realtime/offline render parity, latency/feedback safety, persistence/round-trip, and accessible semantic list. Evidence: automation suite. - [ ] E2.10 Build/complete plugin/device graph with latency, bypass, preset, missing-plugin, sandbox, crash, and version behavior. Evidence: fault suite. - [ ] E2.10.a Implement typed device node/port/parameter/state graph with ordered serial/parallel/rack/split/merge/sidechain routing and cycle validation. Evidence: graph tests. - [ ] E2.10.b Measure/report plugin/device latency and tail, compute graph compensation including live/record paths, and update safely on change. Evidence: latency tests. - [ ] E2.10.c Implement hard/soft/bypass/suspend behavior with gain/click/tail/ latency semantics and automation. Evidence: bypass goldens. - [ ] E2.10.d Load/save/compare/migrate factory/user/project presets and full state snapshots with hashes/resources/version/license. Evidence: preset tests. - [ ] E2.10.e Preserve missing plugin placeholder/state/routing/automation and support locate/substitute/reinstall/version migrate with impact preview. Evidence: missing-device tests. - [ ] E2.10.f Run plugins in ratified sandbox with CPU/memory/time/file/ network/device limits, crash detection/quarantine/restart/safe mode. Evidence: sandbox tests. - [ ] E2.10.g Inject scan/load/process/UI/state/crash/hang/malicious/version/ licence failures and prove project/audio recovery. Evidence: fault suite. - [ ] E2.11 Build/complete asset and sample browser with preview, tempo/key, rights, favorites, tags, search, dedupe, and project use. Evidence: permission-aware search. - [ ] E2.11.a Define asset/sample source/revision/blob/proxy/waveform/duration/ format/channel/sample-rate/tempo/key/tuning/tags/rights/provenance projection. Evidence: browser contract. - [ ] E2.11.b Ingest/scan/analyze/deduplicate immutable local/project/library/ provider assets with exact versus derived metadata and confidence. Evidence: ingest tests. - [ ] E2.11.c Implement permission-aware text/facet/semantic search, stable pagination, favorites/collections/tags, and no unreleased/protected count/snippet leaks. Evidence: search tests. - [ ] E2.11.d Implement tempo/key-aware low-latency preview with original/ processed comparison, start/loop/level/output controls, and device recovery. Evidence: preview tests. - [ ] E2.11.e Add to project/clip/sampler with immutable source link, rights/ territory/use prompt, transform/provenance, and duplicate handling. Evidence: use journey. - [ ] E2.11.f Handle removed/revoked/expired/offline/missing/provider-failed assets with honest state and replacement/locate workflow. Evidence: lifecycle tests. - [ ] E2.12 Build/complete freeze, flatten, bounce-in-place, stem export, and restore. Evidence: source/revision lineage. - [ ] E2.12.a Define operation/range/source revision/signal tap/profile/tails/ dependencies/destination/naming/rights/provenance and impact preview. Evidence: render plan. - [ ] E2.12.b Freeze track/device chain to immutable render while preserving editable graph/state/automation/media and latency/routing behavior. Evidence: freeze tests. - [ ] E2.12.c Flatten only after explicit warning/authorization into a new revision with restorable source snapshot and declared lost editability. Evidence: flatten tests. - [ ] E2.12.d Bounce-in-place clips/tracks/regions with exact timing/tails/ routing/effects/automation/channel/sample rate and source links. Evidence: bounce goldens. - [ ] E2.12.e Export deterministic stems by track/bus/group/role/range with alignment, silence/tail policy, manifest, metadata, rights, and hashes. Evidence: stem tests. - [ ] E2.12.f Restore/unfreeze to exact source revision/state, reconcile later edits, and verify null/semantic comparison plus undo/redo. Evidence: lineage suite. - [ ] E2.13 Build/complete undo/redo across all structured editing commands. Evidence: command inventory coverage. - [ ] E2.13.a Generate canonical command inventory with input/preconditions/ effects/inverse/merge boundary/side effects and undo eligibility. Evidence: command ledger. - [ ] E2.13.b Implement atomic and transaction/grouped undo for timeline/ mixer/device/score/lyrics/rights/release structured mutations. Evidence: command tests. - [ ] E2.13.c Preserve immutable media/renders/uploads/jobs/external delivery by undoing references or issuing compensating/new revisions rather than deleting history. Evidence: side-effect tests. - [ ] E2.13.d Define per-user/session/project undo scope under collaboration, remote operations, branch/merge, offline replay, and conflict. Evidence: concurrency tests. - [ ] E2.13.e Clear/fork/restore stacks correctly after undo→new edit, reload/crash/schema migration, failed command, and partial transaction. Evidence: lifecycle tests. - [ ] E2.13.f Test command→undo→redo semantic/audio equality, focus/selection restoration, keyboard announcements, and inventory coverage. Evidence: coverage gate. - [ ] E2.14 Build/complete autosave, crash recovery, project snapshots, version history, compare, and restore-as-new-version. Evidence: crash journey. - [ ] E2.14.a Define local operation/checkpoint/server revision/media-upload/ snapshot/schema/device/session/encryption/retention state. Evidence: recovery contract. - [ ] E2.14.b Implement debounced idempotent autosave with expected revision, durable-before-ack, dirty/saving/saved/error/offline/conflict indicators. Evidence: autosave tests. - [ ] E2.14.c Persist local journals/media safely before risky recording/edit/ plugin/render actions and recover after tab/app/process/device crash. Evidence: crash tests. - [ ] E2.14.d Create named/automatic immutable project snapshots with complete dependency/media/plugin/right manifests and retention/cleanup. Evidence: snapshot tests. - [ ] E2.14.e Show version history and semantic/audio-aware compare across arrangement/session/mix/rights/release with missing dependency state. Evidence: history tests. - [ ] E2.14.f Restore as a new revision, revalidate plugins/media/rights/gates/ approvals, retain current and historical versions, and test crash journey. Evidence: recovery E2E. - [ ] E2.15 Build/complete keyboard command system with remapping and collision audit. Evidence: pointer-free core edit journey. - [ ] E2.15.a Define semantic command registry with stable IDs/context/scope/ availability/default bindings/platform variants and descriptions. Evidence: command schema. - [ ] E2.15.b Implement layered global/workspace/editor/device/plugin/modal resolution with text-input/assistive technology/browser/OS reserved-key handling. Evidence: resolver tests. - [ ] E2.15.c Build searchable keyboard preferences for add/remove/remap/reset/ import/export profiles with immediate conflict and unreachable-command diagnostics. Evidence: settings tests. - [ ] E2.15.d Support chords/sequences/modifiers/repeat/hold where safe and announce unavailable/context-changing/destructive commands. Evidence: interaction tests. - [ ] E2.15.e Audit exact/shadowed/prefix/context/platform/plugin collisions and fail required commands with no usable binding. Evidence: collision report. - [ ] E2.15.f Run pointer-free create/edit/record/mix/save/review/export/ recovery journey with focus and screen-reader compatibility. Evidence: keyboard E2E. - [ ] E2.16 Build/complete non-drag alternatives for clip, automation, routing, section, and marker operations. Evidence: WCAG 2.2 dragging tests. - [ ] E2.16.a Inventory every drag/drop/move/trim/resize/reorder/connect/curve/ range operation and define equivalent semantic result. Evidence: drag inventory. - [ ] E2.16.b Add numeric/text forms and keyboard step commands for clip/ region/marker positions, ranges, offsets, fades, loops, and lanes. Evidence: timeline tests. - [ ] E2.16.c Add point/value/time/curve forms, ordered tables, nudge/scale/ delete commands for automation. Evidence: automation tests. - [ ] E2.16.d Add source/destination/port/tap/channel/gain/sidechain forms and before/after/into/out commands for routing/device graph. Evidence: routing tests. - [ ] E2.16.e Add before/after/position/range/move-copy form commands for sections/scenes/markers with affected-item preview. Evidence: structure tests. - [ ] E2.16.f Keep validation/snap/impact/permissions/concurrency/undo/audit identical and run keyboard/screen-reader/touch journeys. Evidence: WCAG 2.2 suite. - [ ] E2.17 Build/complete semantic accessible grid/list views for timeline, mixer, device graph, and automation. Evidence: screen-reader journey. - [ ] E2.17.a Define synchronized content/operation/selection/focus/playhead/ status parity contract between visual DAW surfaces and semantic views. Evidence: parity matrix. - [ ] E2.17.b Build timeline treegrid/table by track/lane/clip/region/take/ marker with musical/sample positions, ranges, state, and edit commands. Evidence: timeline semantic tests. - [ ] E2.17.c Build mixer grid/table by track/channel for level/pan/mute/solo/ arm/monitor/sends/meters/routing with units and bounded controls. Evidence: mixer semantic tests. - [ ] E2.17.d Build device/routing graph tree/table/matrix for nodes/ports/ edges/parameters/latency/errors plus connect/reorder/configure commands. Evidence: graph semantic tests. - [ ] E2.17.e Build automation table by parameter/point/time/value/curve/mode with add/edit/nudge/delete/range operations. Evidence: automation semantic tests. - [ ] E2.17.f Preserve focus/selection/playback announcements under virtualization/live updates and run end-to-end screen-reader edit/mix/ route/automate journey. Evidence: semantic E2E. - [ ] E2.18 Define and meet interactive latency, audio glitch, large-project, memory, and render performance budgets. Evidence: profiler reports. - [ ] E2.18.a Define supported host/device/buffer/sample-rate/project/network/ plugin scenarios and measurement harness/calibration. Evidence: performance profile. - [ ] E2.18.b Set input-to-monitor, control-to-audible, transport, edit, UI input/paint, waveform/scroll/zoom interaction latency budgets. Evidence: latency budgets. - [ ] E2.18.c Set xrun/dropout/click/missed-deadline/CPU audio-thread and realtime allocation/lock/GC budgets with safe instrumentation. Evidence: glitch budgets. - [ ] E2.18.d Set large track/clip/device/automation/score/media project load/ save/search/render and sustained CPU/memory/GPU/disk/network budgets. Evidence: scale budgets. - [ ] E2.18.e Set realtime/offline/batch render speed/resource/output- determinism and worker concurrency/cost budgets. Evidence: render budgets. - [ ] E2.18.f Profile production-scale fixtures, capture thread/trace/query/ memory/audio diagnostics, trend baselines, and fail regressions. Evidence: profiler reports. - [ ] E2.19 Build/complete audio recording and waveform editing for device/ channel selection, calibration, pre-roll, punch, loop recording, take lanes, comp, sample-accurate cut, spectral repair, time/pitch processing, normalization, denoise, phase alignment, and non-destructive source restore. Evidence: calibrated capture/edit fixtures. - [ ] E2.19.a Build device/input/channel/clock/sample-rate/buffer permission setup, signal level/phase/noise/latency calibration, and safe monitoring. Evidence: setup tests. - [ ] E2.19.b Implement count-in/pre-roll/manual-auto punch/loop/multitrack/ overdub capture with sample-accurate files, dropout markers, and crash- safe durable takes. Evidence: recording tests. - [ ] E2.19.c Generate waveform/peak/RMS/spectral caches from immutable media with channel/time/zoom selection and accessible numeric/semantic views. Evidence: waveform tests. - [ ] E2.19.d Implement sample-accurate cut/copy/delete/silence/gain/fade/ normalize/channel operations as nondestructive revisions. Evidence: waveform edit tests. - [ ] E2.19.e Implement spectral selection/repair/attenuation/heal with exact time-frequency masks, algorithm/version, preview, and preserved untouched samples when promised. Evidence: spectral goldens. - [ ] E2.19.f Implement time/pitch/formant/denoise/declick/dehum restoration with settings/quality/latency/tails, A/B, and provenance. Evidence: processing tests. - [ ] E2.19.g Implement multi-mic/take phase/time alignment with polarity/ delay/correlation/confidence and manual override, not forced aesthetic choice. Evidence: alignment tests. - [ ] E2.19.h Restore exact source or prior edit revision and verify calibrated capture/edit/null/undo/device-failure fixtures. Evidence: end-to-end corpus. - [ ] E2.20 Build/complete virtual instruments and samplers for oscillator/ synthesis engines, modulation, envelopes, filters, sample maps, articulation, polyphony, tuning, preset/version management, automation, freeze, and missing-device recovery. Evidence: state recall and render goldens. - [ ] E2.20.a Implement ratified synthesis engines/oscillators/noise/wavetable/ granular or other sources with oversampling/alias/CPU/polyphony/voice semantics. Evidence: engine tests. - [ ] E2.20.b Implement envelopes/LFOs/modulation matrices/filters/amplifier/ pan/unison/voice allocation/glide and per-voice/global state. Evidence: synthesis tests. - [ ] E2.20.c Implement sampler zones/key-velocity ranges/round robin/layers/ loops/crossfades/root pitch/tuning/articulation/streaming and immutable sample rights. Evidence: sample-map tests. - [ ] E2.20.d Implement polyphony/voice stealing/sustain/MIDI/MPE/per-note expression/microtonal tuning and deterministic event handling. Evidence: performance goldens. - [ ] E2.20.e Implement versioned preset/state/resources/licence/automation/ modulation mappings and compare/morph where supported. Evidence: recall tests. - [ ] E2.20.f Implement freeze/render with exact MIDI/audio/device state/ tails/latency/provenance and reversible source. Evidence: freeze tests. - [ ] E2.20.g Preserve missing-device state/resources/automation/routing and support locate/substitute/migrate/safe mode with loss diagnostics. Evidence: recovery tests. - [ ] E2.20.h Verify save/reload/version/host/sample-rate/render audio goldens and CPU/memory budgets. Evidence: instrument suite. - [ ] E2.21 Build/complete effect and signal-chain authoring for EQ, dynamics, saturation, delay, reverb/convolution, modulation, pitch, restoration, metering, parallel/mid-side/multiband routing, oversampling, latency compensation, A/B, preset, and bypass. Evidence: signal-flow and deterministic-state tests. - [ ] E2.21.a Implement ratified EQ/filter/dynamics/gate/limiter/de-esser/ saturation/distortion families with units/ranges/channels/detectors/ lookahead. Evidence: processor tests. - [ ] E2.21.b Implement delay/reverb/convolution/modulation/pitch/restoration families with sync/free timing, IR/resource rights, tails, quality, and latency. Evidence: time/effect tests. - [ ] E2.21.c Implement ordered serial/parallel/send-return/mid-side/multiband/ sidechain signal chains with split/crossover/mix/phase/feedback safety. Evidence: routing goldens. - [ ] E2.21.d Implement input/output/GR/loudness/spectrum/phase meters with calibration/units/hold/reset and no audio-thread blocking. Evidence: meter tests. - [ ] E2.21.e Implement oversampling/quality modes and complete plugin/device latency/tail compensation across live, record, bypass, freeze, and offline render. Evidence: compensation tests. - [ ] E2.21.f Implement level-matched A/B/compare, versioned presets/full state, automation/modulation, safe bypass, and undo. Evidence: interaction tests. - [ ] E2.21.g Run impulse/step/sine/noise/reference/null/signal-flow goldens across sample rates/channels/hosts and deterministic state reload. Evidence: effect suite. - [ ] E2.22 Build/complete MIDI, MPE, clock, sync, control-surface, pedal, hardware instrument, and external effect setup with discovery, mapping, learn, calibration, latency, reconnect, conflict, safe feedback, and project portability. Evidence: supported-device matrix and virtual-device automation. - [ ] E2.22.a Discover/identify/authorize hot-plug MIDI 1/MIDI 2 UMP/MPE/ control/sync/hardware ports with stable aliases and privacy-safe labels. Evidence: discovery tests. - [ ] E2.22.b Configure input/output/channel/group/MPE zones/filter/transform/ routing and project/global/default profiles. Evidence: routing tests. - [ ] E2.22.c Build learn/mapping for notes/CC/NRPN/RPN/program/pitch/pressure/ per-note expression/transport/control-surface feedback with conflicts. Evidence: mapping tests. - [ ] E2.22.d Configure MIDI clock/MTC/MMC/Link or ratified sync authority, tempo/timecode start/stop/locate/drift/jitter and safe feedback loops. Evidence: sync tests. - [ ] E2.22.e Configure pedals/hardware instruments/external effects with audio/MIDI routing, patch recall, latency/calibration, reamp/send-return, and recording provenance. Evidence: hardware tests. - [ ] E2.22.f Handle disconnect/reconnect/renamed/duplicate ports, permission revoke, stuck notes, runaway feedback, clock loss, and safe reset. Evidence: fault tests. - [ ] E2.22.g Serialize portable logical mappings plus device-specific bindings/substitution/loss diagnostics and test virtual devices across supported hosts. Evidence: device matrix. - [ ] E2.23 Build/complete tuning, notation, scale/mode, world-rhythm, microtonal, transposition, chord/voicing, orchestration/range, form, and expression editors without Western-only validation assumptions. Evidence: representative culturally sourced and non-12-TET goldens plus named musical-domain review. - [ ] E2.23.a Build tuning/temperament/reference frequency/scale degree/ accidental/glyph/keyboard-layout editor and audition across score/MIDI/ instruments. Evidence: tuning tests. - [ ] E2.23.b Build notation/spelling/clef/part/transposition views that keep written and sounding pitch plus arbitrary tunings distinct. Evidence: notation tests. - [ ] E2.23.c Build mode/raga/maqam or ratified culturally sourced system metadata, ascending/descending/context/ornament/phrase rules as optional declared assistance. Evidence: mode fixtures. - [ ] E2.23.d Build rhythmic cycle/additive/polyrhythm/groove/swing/free-time editors and metronome/grid/playback without Western meter validation floors. Evidence: rhythm goldens. - [ ] E2.23.e Build chord/voicing/range/orchestration/form/expression assistance with instrument/cultural assumptions, configurable rules, and creative exception. Evidence: analysis tests. - [ ] E2.23.f Import/export/playback/analyze representative non-12-TET/world- rhythm/culturally sourced fixtures and report exact loss/unsupported state. Evidence: round-trip suite. - [ ] E2.23.g Obtain named musical-domain/cultural review and prohibit universal aesthetic score or automatic correction. Evidence: review approval. - [ ] E2.24 Build/complete a session/clip-launch workspace with clips by scene, per-clip and scene launch, quantization, legato, follow/next actions, probability, capture-to-arrangement, arrangement-to-session aliases, recording, performance lock, and accessible grid operation. Evidence: sample-accurate launch/capture and pointer-free journeys. - [ ] E2.24.a Define session grid track/scene/slot/clip/alias identity and shared source relationship with arrangement. Evidence: session model. - [ ] E2.24.b Implement clip/scene launch/stop/retrigger/queue with global/ scene/clip quantization, legato phase, exclusive/multi launch, and exact clock authority. Evidence: launch tests. - [ ] E2.24.c Implement deterministic seeded follow/next/random/probability/ repeat actions with bounds, stop conditions, and visible upcoming state. Evidence: action tests. - [ ] E2.24.d Record MIDI/audio/automation and capture live launches/ parameters into arrangement with sample-accurate event/clip/tempo lineage. Evidence: capture tests. - [ ] E2.24.e Create arrangement-to-session aliases/copies with explicit update/independence rules and no accidental source mutation. Evidence: round-trip tests. - [ ] E2.24.f Implement performance lock, safe allowed controls, undo boundary, failure recovery, and transport/device/scene emergency stop. Evidence: performance tests. - [ ] E2.24.g Provide accessible treegrid/table and non-drag clip/scene move/ launch/configure commands with focus and status announcements. Evidence: pointer-free E2E. - [ ] E2.25 Build/complete unified modulation for LFO, envelope, MSEG, envelope/audio follower, step/random, macro/XY, MIDI/MPE, and automation sources routed to any eligible parameter with polarity, depth, smoothing, rate/sync, per-voice/global scope, visualization, and cycle/range safety. Evidence: source→target matrix coverage and deterministic renders. - [ ] E2.25.a Define typed modulation source/instance/state for every named generator/control, ownership, per-voice/global scope, phase/reset, and deterministic seed. Evidence: source contracts. - [ ] E2.25.b Implement LFO/envelope/MSEG/step/random generators with shapes/ points/curves/levels/timing/loop/one-shot/retrigger/rate/free-sync. Evidence: generator tests. - [ ] E2.25.c Implement envelope/audio followers with input tap/channel/ detector/attack/release/range and macro/XY aggregation. Evidence: follower/macro tests. - [ ] E2.25.d Implement MIDI/MPE/control/automation sources with channel/note/ expression mapping, resolution, pickup, smoothing, and feedback safety. Evidence: control tests. - [ ] E2.25.e Discover eligible typed targets and connect with polarity/depth/ offset/range/curve/smoothing/combine order and exact units. Evidence: routing tests. - [ ] E2.25.f Detect cycles/runaway/audio-rate aliasing/range overflow/ unavailable targets and enforce CPU/polyphony limits. Evidence: safety tests. - [ ] E2.25.g Visualize current/base/modulated value and provide semantic source-target matrix, keyboard forms, automation handoff, undo, preset/ state recall. Evidence: accessible UI tests. - [ ] E2.25.h Run complete source→target/profile/sample-rate/realtime-offline matrix with seeded deterministic render goldens. Evidence: coverage report. - [ ] E2.26 Build/complete native VST3, CLAP, AU and other ratified plugin hosting plus browser WAM where supported, including scan, signature/ license, architecture, sandbox, latency/tail, sidechain, MIDI/MPE, automation/modulation, preset/state, UI, crash/quarantine, missing plugin, version migration, and safe-mode recovery. Evidence: per-format/plugin/ host compatibility and malicious-plugin tests. - [ ] E2.26.a Ratify plugin formats/versions/OS/architectures/browser host profiles, SDK/licence requirements, and explicit unsupported cells. Evidence: hosting matrix. - [ ] E2.26.b Implement isolated scan/discovery/metadata/capability/port/ parameter/category/vendor/version/hash/signature/licence inventory with timeout/crash quarantine. Evidence: scan tests. - [ ] E2.26.c Host realtime/offline audio, MIDI/MPE/note expression, sidechain/ multibus/channel layouts, latency/tail/dynamic IO, and sample-rate/block changes. Evidence: processing tests. - [ ] E2.26.d Host parameter automation/modulation/gesture/state/preset/ resources/program lists with stable IDs, migration, and deterministic recall where possible. Evidence: state tests. - [ ] E2.26.e Host plugin UI/editor/window/scaling/focus/keyboard/accessibility safely and provide generic parameter UI/semantic fallback. Evidence: UI tests. - [ ] E2.26.f Sandbox native/browser code with file/network/device/process/ memory/CPU/time permissions, content security, feedback protection, and audit. Evidence: sandbox tests. - [ ] E2.26.g Preserve missing/quarantined/licence-expired/wrong-architecture/ newer-version placeholder, state/routing/automation and substitution/ reinstall/migrate diagnostics. Evidence: recovery tests. - [ ] E2.26.h Inject malicious/hanging/crashing/corrupt-state/huge-allocation/ filesystem/network/UI/scan/plugin-update attacks and recover project/ audio safely. Evidence: adversarial tests. - [ ] E2.26.i Run per-format/plugin/host/sample-rate/layout/online-offline/ save-reload/render compatibility cells with current evidence. Evidence: compatibility gate. - [ ] E2.27 Build/complete ARA2 or ratified deep-edit integration and per-clip warp markers for time/pitch, tempo mapping, formants, transient/grid alignment, comp/take context, plugin state, undo, and round-trip. Evidence: supported editor matrix and non-destructive audio goldens. - [ ] E2.27.a Ratify ARA2/deep-edit protocols/editors/versions/host profiles/ features and define document/region/track/media ownership. Evidence: editor matrix. - [ ] E2.27.b Exchange immutable audio source, musical context/tempo/meter/ tuning, clip/take/comp ranges, selection, and change notifications with version/authorization. Evidence: integration tests. - [ ] E2.27.c Persist deep-editor document/plugin state, analysis caches, resources, undo transactions, version migration, missing editor, and safe mode. Evidence: state tests. - [ ] E2.27.d Implement per-clip warp/transient anchors with source/destination time, lock/type/strength/confidence, monotonic/range/grid validation. Evidence: warp schema/tests. - [ ] E2.27.e Implement time/pitch/formant/transient/grid/tempo mapping edits and comp/take propagation as nondestructive operations with A/B. Evidence: edit goldens. - [ ] E2.27.f Coordinate host/plugin undo/redo/save/reload/offline render and concurrent clip/tempo/take changes without double application. Evidence: lifecycle tests. - [ ] E2.27.g Round-trip original→edit→project save→reopen→render/export and verify untouched regions/declared transforms/audio tolerances. Evidence: non-destructive goldens. - [ ] E2.27.h Exercise unsupported/missing/crash/corrupt/version-skew/ unavailable-analysis states with preserved source and explicit loss. Evidence: fault matrix. - [ ] E2.28 Build/complete open and professional interchange for DAWproject, Standard MIDI/MIDI 2.0 UMP, MusicXML/notation, BWF/iXML, AAF, OMF, FCPXML, MXF, ADM-BWF, stems, and every ratified format. Evidence: automation, fades, warp, devices/plugin state, note expression, sends, tempo/meter, markers, clips/scenes, metadata, and loss diagnostics are tested per format. - [ ] E2.28.a Ratify format/profile/version/import-export scope, libraries/ validators, licensing, and supported host/target cells. Evidence: interchange registry. - [ ] E2.28.b Implement DAWproject import/export for project graph/tracks/ channels/devices/clips/scenes/tempo/meter/automation/media/metadata with portable plugin state where defined. Evidence: DAWproject tests. - [ ] E2.28.c Implement Standard MIDI/MIDI 2 UMP and MusicXML/notation for events/expression/articulation/tuning/tempo/meter/key/lyrics/parts with explicit quantization/loss. Evidence: musical interchange tests. - [ ] E2.28.d Implement BWF/iXML/stems/ADM-BWF/MXF for audio/timecode/channel/ spatial/scene/take/track/rights/provenance metadata. Evidence: audio interchange tests. - [ ] E2.28.e Implement AAF/OMF/FCPXML or ratified editorial formats for tracks/clips/ranges/handles/fades/gain/automation/markers/media/ timecode with relink. Evidence: editorial interchange tests. - [ ] E2.28.f Define normalized intermediate mapping for devices/plugin state/ sends/warp/note expression/scenes/spatial/metadata and exact unsupported/ approximated/dropped fields. Evidence: mapping contracts. - [ ] E2.28.g Generate preflight/loss profile, require human acceptance where material, preserve source, provenance, rights, IDs, and reversible import namespace. Evidence: diagnostics tests. - [ ] E2.28.h Run format→project→format and cross-host semantic/audio round- trips with missing media/plugin/version/corrupt/large fixtures and validators. Evidence: per-format gate. - [ ] E2.29 Build/complete synchronization and control for Ableton Link or ratified peer sync, MTC, LTC/SMPTE, MIDI clock, word clock/jam sync, MMC, OSC, MCU/HUI/EUCON or ratified control surfaces, MIDI learn, and headless REST/control APIs. Evidence: clock-drift, feedback-loop, reconnect, authority, and unsafe-remote-command tests. - [ ] E2.29.a Ratify supported protocols/versions/transports/devices/hosts/ frame rates and define capability/security/latency profiles. Evidence: sync/control matrix. - [ ] E2.29.b Implement peer tempo/phase/quantum sync with explicit leader/ peer authority, join/leave, start-stop behavior, drift/jitter smoothing, and musical-time mapping. Evidence: peer-sync tests. - [ ] E2.29.c Implement MTC/LTC-SMPTE/MIDI clock/word-clock or jam-sync source/destination/frame-rate/drop-frame/offset/locate/chase/freewheel/ holdover. Evidence: clock tests. - [ ] E2.29.d Implement MMC/OSC/control-surface transport/mixer/device/ automation commands, display/meter feedback, touch/ownership, and profiles. Evidence: control tests. - [ ] E2.29.e Implement MIDI learn and mapping conflict/pickup/feedback/ persistence/portable aliases; prevent echo/runaway/stuck controls. Evidence: learn tests. - [ ] E2.29.f Implement authenticated scoped rate-limited headless REST/ realtime control with idempotency, expected state, allowlists, step-up for dangerous actions, and audit. Evidence: remote API tests. - [ ] E2.29.g Exercise drift/jitter/packet loss/disconnect/reconnect/leader conflict/frame-rate change/feedback loop/replay/unsafe command and emergency stop. Evidence: adversarial matrix. - [ ] E2.30 Build/complete offline-first PWA/OPFS and desktop-local operation for projects, media, undo, renders, collaboration queue, provider-gated features, quota/eviction, encryption, reconnect, merge, and recovery. Evidence: offline create/edit/reopen/export plus conflict and storage-loss journeys. - [ ] E2.30.a Define local project/media/operation/undo/render/job/cache/ collaboration state, schema/version, ownership, encryption, and supported offline capabilities per host. Evidence: offline contract. - [ ] E2.30.b Implement PWA service worker/OPFS and desktop-local durable storage with atomic writes, content hashes, journals, locks, crash-safe recording/import, and migrations. Evidence: local storage tests. - [ ] E2.30.c Implement offline create/open/edit/record/import/undo/render/ export for eligible features and honest disabled/provider-required/ licence-check states. Evidence: offline workflow tests. - [ ] E2.30.d Manage media/proxy/cache/render quota, reservation, pressure, user cleanup/export, browser eviction detection, and never evict sole acknowledged originals silently. Evidence: quota tests. - [ ] E2.30.e Encrypt local sensitive/unreleased/voice/rights data, partition by tenant/user/project, enforce device/session/logout/revocation/ retention, and protect paths. Evidence: security tests. - [ ] E2.30.f Queue collaboration/uploads/jobs with stable IDs/dependencies/ retries/cancel and reauthenticate/reauthorize/deduplicate/rebase on reconnect. Evidence: reconnect tests. - [ ] E2.30.g Resolve project/media/graph/rights conflicts with mine/theirs/ base semantic merge, retained copies, and no last-write-wins data loss. Evidence: conflict tests. - [ ] E2.30.h Run offline create→record/edit→close/reopen→render/export plus reconnect/two-client/schema/quota/eviction/storage-corruption/recovery journeys. Evidence: offline E2E. - [ ] E2.31 Build/complete customizable, multi-window, touch/pen, high-DPI, control-surface, and blind-producer workflows across arrange, session, piano roll, score, mixer, modulation, plugin, and review surfaces. Evidence: saved workspace, keyboard/treegrid, screen-reader, touch-target, zoom, and reconnect matrices. - [ ] E2.31.a Define versioned workspace layout with panels/windows/tabs/ docks/sizes/focus/context/monitor/display/DPI, named presets, migration, reset, and safe bounds. Evidence: workspace schema. - [ ] E2.31.b Implement multi-window detach/attach/focus/selection/transport/ project synchronization, restore after display loss, and no duplicate audio engine or mutation owner. Evidence: window tests. - [ ] E2.31.c Implement touch/pen gestures/targets/hover alternatives/ precision controls/palm rejection and non-gesture forms across all named surfaces. Evidence: touch/pen tests. - [ ] E2.31.d Implement high-DPI/per-monitor scaling/zoom/reflow/canvas text/ waveform/plug-in UI behavior without blurry or unreachable controls. Evidence: DPI tests. - [ ] E2.31.e Integrate control-surface focus/bank/track/device/parameter/ transport feedback with visible ownership and keyboard parity. Evidence: hardware workflow tests. - [ ] E2.31.f Provide blind-producer semantic treegrid/table/forms, command search, structured status/meters, non-drag edits, and concise announcements across all named workspaces. Evidence: screen-reader E2E. - [ ] E2.31.g Test saved layout/profile/project reopen, reconnect/device/ display change, themes/density, 200–400% zoom, RTL/long locale, and supported input modes. Evidence: workspace matrix. - [ ] E2.32 Build/complete batch render/export/convert/analyze with range, version, target/profile, naming, metadata, rights, dependencies, capacity, cost, preview, queue, partial result, retry, cancel, and output verification. Evidence: mixed-eligibility batch journey and deterministic manifest. - [ ] E2.32.a Define batch/item immutable request with project/source version, range, operation kind, target/profile, priority, owner, and expected outputs. Evidence: batch schema. - [ ] E2.32.b Resolve naming/path/template/collision, metadata/locale/ identifiers/artwork, rights/consent/territory, plugin/media/model/ renderer dependencies per item. Evidence: preflight tests. - [ ] E2.32.c Estimate capacity/CPU-GPU/memory/storage/network/time/currency/ provider cost and require authorization/budget before dispatch. Evidence: estimate tests. - [ ] E2.32.d Preview exact eligible/blocked/degraded/lossy item plan and allow scoped selection; never drop ineligible items silently. Evidence: preview tests. - [ ] E2.32.e Execute durable dependency-aware queue with leases/concurrency/ resource limits/progress/logs/artifacts/retry/cancel/idempotency. Evidence: job tests. - [ ] E2.32.f Record per-item success/partial/failed/cancelled/unknown and preserve successful outputs while retrying only safe failed work. Evidence: partial result tests. - [ ] E2.32.g Verify output bytes/hash/format/audio measurements/metadata/ rights/provenance/naming and semantic/source lineage. Evidence: output tests. - [ ] E2.32.h Emit deterministic batch/item manifest with inputs/versions/ dependencies/settings/cost/results and run mixed-eligibility E2E. Evidence: batch journey. - [ ] E2.33 Build/complete modular synthesis/control where ratified, including audio, CV/gate, trigger, MIDI/MPE, modulation and event ports; typed modules; patch cables; polyphony; feedback safety; oversampling; latency; preset/version; automation; macro; performance view; and accessible list/matrix parity. Evidence: graph validation, signal goldens, CPU budgets, and non-pointer operation. - [ ] E2.33.a Ratify modular host/profile/module SDK/trust/licence/runtime/ realtime safety and supported port/data-rate/polyphony semantics. Evidence: modular profile. - [ ] E2.33.b Define typed module/node/version/state/parameter and audio/CV/ gate/trigger/MIDI-MPE/modulation/event port compatibility. Evidence: graph contract. - [ ] E2.33.c Implement add/remove/duplicate/group/reorder modules and connect/ disconnect cables with type/range/channel/polyphony/latency validation. Evidence: graph editing tests. - [ ] E2.33.d Implement polyphonic voice/event allocation, oversampling/ resampling/block boundaries/latency compensation and deterministic scheduling. Evidence: signal tests. - [ ] E2.33.e Detect algebraic/feedback cycles, DC/runaway/NaN/denormal/high- gain/CPU overload and provide bounded feedback/delay/limiter/emergency safeguards. Evidence: safety tests. - [ ] E2.33.f Implement versioned patch/preset/resources/automation/macros and a performance view exposing only approved controls with recall/migration. Evidence: state tests. - [ ] E2.33.g Provide synchronized node/port/cable list/table/matrix and source- target forms for complete keyboard/screen-reader/non-pointer parity. Evidence: accessible graph tests. - [ ] E2.33.h Run typed graph validation, impulse/oscillator/control/event goldens, save/reload/offline render, CPU/polyphony budgets, crash/ malicious module recovery. Evidence: modular suite. ### E3 — Concept, score, lyrics, performance, and AI assist - [ ] E3.1 Build musical-concept capture from text, hum, voice memo, MIDI, chord, reference, and project context. Evidence: each input keeps provenance and rights prompts. - [ ] E3.1.a Define concept/idea/revision/input-kind/source/owner/project/ status/visibility and immutable provenance contract. Evidence: concept schema. - [ ] E3.1.b Capture text/chord/score snippets with locale/tuning/tempo/key/ theory assumptions and stable semantic anchors. Evidence: structured input tests. - [ ] E3.1.c Capture hum/voice memo/audio through permission/calibration/ immutable media/checksum/device/session/performer consent workflow. Evidence: audio capture tests. - [ ] E3.1.d Capture MIDI/MPE with device/timebase/timing/expression/tuning and raw versus interpreted events. Evidence: MIDI capture tests. - [ ] E3.1.e Attach reference/project context with exact asset/revision/range/ role, rights/consent/use prompts, protected visibility, and no silent provider upload. Evidence: reference tests. - [ ] E3.1.f Support save/tag/link/compare/park/discard/convert to proposal with autosave/accessibility/offline handling. Evidence: capture journey. - [ ] E3.2 Quarantine and analyze uploaded audio/MIDI/project files. Evidence: malicious/oversize/invalid corpus. - [ ] E3.2.a Upload untrusted files into isolated non-executable quarantine with size/quota/chunk/checksum/content-type and tenant/project scope. Evidence: upload tests. - [ ] E3.2.b Detect signature/type mismatch, malformed/polyglot/active/archive bomb/malware/project traversal and unsafe plugin/resource references. Evidence: malicious corpus. - [ ] E3.2.c Probe audio/MIDI/project structure, duration/channels/rate/events/ graph/dependencies/version without loading untrusted plugins or code. Evidence: safe parser tests. - [ ] E3.2.d Analyze waveform/tempo/key/tuning/transients/loudness/MIDI/ metadata/rights hints with algorithm versions/confidence and no authoritative overwrite. Evidence: analysis tests. - [ ] E3.2.e Release/reject/manual-review with scan/analysis/policy versions, reasons, audit, rescan, and safe proxy; preserve original bytes. Evidence: quarantine workflow. - [ ] E3.2.f Test timeout/crash/oversize/encrypted/unsupported/corrupt/ decompression/plugin-reference paths and prove nothing escapes early. Evidence: invalid corpus report. - [ ] E3.3 Build arrangement and composition divergence behind governed `lyria`/provider seams. Evidence: not-configured, failure, budget, and exact-output tests. - [ ] E3.3.a Define provider-agnostic request with pinned concept/project/ score-MIDI-audio context, desired parts/structure/style constraints, rights, seed/count, and budgets. Evidence: request schema. - [ ] E3.3.b Resolve configured eligible provider/model/version/data-use/ capability/rights region and fail honestly when unavailable. Evidence: negotiation tests. - [ ] E3.3.c Generate materially distinct arrangement/composition candidates with editable score/MIDI/audio/stem/section outputs, rationale, and source/reference use. Evidence: divergence tests. - [ ] E3.3.d Persist exact output bytes/events/settings/prompt/negative prompt/ seed/model/provider/cost/latency/provenance and safety results. Evidence: output attribution. - [ ] E3.3.e Present unranked or transparently measured candidates for human audition/compare/edit/accept/reject with no automatic project mutation. Evidence: decision tests. - [ ] E3.3.f Test not-configured/timeout/rate/malformed/partial/cancel/budget/ retry/injection/rights failure and deterministic replay limits. Evidence: provider fault suite. - [ ] E3.4 Build lyric divergence and rewrite assist with locale, theme, meter, rhyme, explicit-content, and banned-topic constraints. Evidence: explicit accept and attribution. - [ ] E3.4.a Define operation request with pinned lyric range/revision, locale/script/theme/perspective/meaning, syllable/stress/meter/rhyme/ timing, prohibited topics, and budget. Evidence: request schema. - [ ] E3.4.b Generate distinct whole-section or minimal anchored rewrite candidates with syllable/stress/rhyme/prosody/semantic comparison and uncertainty. Evidence: candidate tests. - [ ] E3.4.c Validate explicit/advisory/banned-topic/safety/identity/defamation/ similarity/rights constraints per locale without universal culture assumptions. Evidence: policy tests. - [ ] E3.4.d Attribute provider/model/prompt/version/reference use/cost and display exact diff for per-line/per-change accept/edit/reject. Evidence: review tests. - [ ] E3.4.e Rebase or invalidate on lyric/score/timing change; accepted changes create human-attributed new lyric revision with AI disclosure. Evidence: lifecycle tests. - [ ] E3.4.f Evaluate meter/rhyme/meaning preservation, stereotypes/ multilingual performance, protected references, injection, and forbidden invention. Evidence: assist evaluation. - [ ] E3.5 Build score/orchestration assist with instrument ranges, transposition, voicing, playability, and style constraints. Evidence: proposal-only mutation. - [ ] E3.5.a Define request pinned to score/arrangement/tuning/tempo/ instrument library/profile, desired scope, performer capability, style/ cultural assumptions, rights, and budget. Evidence: request contract. - [ ] E3.5.b Generate anchored proposal diffs for assignment/doubling/ transposition/range/voicing/articulation/dynamics/register/orchestration. Evidence: proposal tests. - [ ] E3.5.c Measure instrument range/transposition/technical playability/ balance/collision and expose declared model/rule assumptions separately from creative judgment. Evidence: analysis tests. - [ ] E3.5.d Preserve arbitrary tuning/non-Western notation and never “fix” intentional techniques/style exceptions automatically. Evidence: inclusive fixtures. - [ ] E3.5.e Present score/MIDI/audio audition plus semantic diff for per-part/ passage accept/edit/reject with stale revision handling. Evidence: review tests. - [ ] E3.5.f Store provider/model/prompt/reference/source/seed/cost provenance and enforce proposal-only server boundary. Evidence: mutation tests. - [ ] E3.6 Build variant compare for audio, MIDI, score, lyrics, arrangement, gates, cost, and provenance. Evidence: synchronized accessible compare. - [ ] E3.6.a Select two or more immutable variants and resolve compatible musical/sample time maps, levels, sources, target profile, and permissions. Evidence: compare contract. - [ ] E3.6.b Provide synchronized level-matched audio A/B/solo/loop/scrub/ blind playback with loudness adjustment disclosed. Evidence: audio compare tests. - [ ] E3.6.c Provide MIDI/score/lyrics/arrangement semantic diff by events/ parts/sections/lines/anchors, with visual and table/text parity. Evidence: structured compare tests. - [ ] E3.6.d Compare raw gate measurements/verdicts/freshness, render/provider/ storage cost with units/currency, and full rights/provenance lineage. Evidence: evidence compare. - [ ] E3.6.e Synchronize selection/playhead/range/focus/comments across panes and support keyboard/screen-reader/zoom/nonvisual decision journey. Evidence: accessible compare. - [ ] E3.6.f Record human select/reject/park/no-decision separately without mutating variants or using aesthetic score as automatic winner. Evidence: decision tests. - [ ] E3.7 Build decision records for selected, rejected, parked, and superseded ideas/takes/mixes/masters. Evidence: stable links. - [ ] E3.7.a Define immutable decision identity/type/subject kind/revision/ actor-role/time/project/context and considered alternatives. Evidence: decision schema. - [ ] E3.7.b Require rationale, comparison evidence, creative/technical/rights/ cost considerations, uncertainty, conflict/recusal, and dissent where applicable. Evidence: validation tests. - [ ] E3.7.c Define selected destination/version creation, rejected retention, parked revisit trigger/expiry, and superseded replacement lineage. Evidence: disposition tests. - [ ] E3.7.d Preserve stable links after rename/move/archive/restore/migration and redacted permissions for media/rights. Evidence: link tests. - [ ] E3.7.e Prevent model/agent/score from impersonating human selection and maintain immutable history under reversal/new decision. Evidence: authority tests. - [ ] E3.8 Build lyric editor with syllable/stress/rhyme/prosody, timing, translation, and pronunciation views. Evidence: known-value meter tests. - [ ] E3.8.a Build structured section/line/token/syllable editor with stable IDs, Unicode/script/language, verses/repeats, undo, and revision anchors. Evidence: editor tests. - [ ] E3.8.b Show/edit syllabification, stress/weight, meter/feet or applicable rhythmic model, melisma/elision, and declared language assumptions. Evidence: meter tests. - [ ] E3.8.c Show/edit rhyme sound/family/scheme/internal/near relationships using locale/pronunciation sources with uncertainty. Evidence: rhyme tests. - [ ] E3.8.d Align lines/syllables to score/MIDI/audio musical/sample time with tap/record/import/numeric controls and orphan/conflict handling. Evidence: timing tests. - [ ] E3.8.e Edit translation/transliteration/adaptation in aligned semantic views with terminology/names/meaning/rhyme/meter parity. Evidence: locale tests. - [ ] E3.8.f Edit IPA/phoneme/pronunciation/alternate performer guidance and audition where authorized. Evidence: pronunciation tests. - [ ] E3.8.g Validate expert-reviewed known values across ratified languages/ scripts/meters without universalizing one prosodic system. Evidence: corpus report. - [ ] E3.9 Build chord/key/theory inspector with explicit assumptions. Evidence: score and MIDI fixtures. - [ ] E3.9.a Resolve selected score/MIDI/audio-derived events, tuning/scale/ notation/tempo context, analysis scope, and applicable theory profile. Evidence: inspector contract. - [ ] E3.9.b Show observed pitch classes/frequencies/spellings, candidate key/ mode/tonality with confidence and temporal changes. Evidence: key tests. - [ ] E3.9.c Show chord/voicing/bass/inversion/function/interval/nonchord tones and alternative interpretations with exact event evidence. Evidence: chord tests. - [ ] E3.9.d Declare tuning/reference pitch/cultural/theoretical assumptions, algorithm/corpus/version, missing/ambiguous/nonapplicable state. Evidence: provenance tests. - [ ] E3.9.e Allow human choose/edit/annotate/decline an interpretation; never rewrite score/MIDI or rank aesthetic quality automatically. Evidence: interaction tests. - [ ] E3.9.f Verify Western/non-Western/non-12-TET/polychord/ambiguous/free- tonal score and MIDI fixtures plus semantic accessibility. Evidence: known-value suite. - [ ] E3.10 Build performance capture with device calibration, latency compensation, count-in, monitoring, punch, takes, and consent. Evidence: capture tests. - [ ] E3.10.a Select/authorize audio/MIDI/MPE devices/channels and calibrate levels/noise/phase/clock/round-trip latency with recorded evidence. Evidence: setup tests. - [ ] E3.10.b Create performer/session/part/arrangement/tuning/tempo/cue/ monitoring plan and verify applicable consent before arm. Evidence: capture plan. - [ ] E3.10.c Implement count-in/pre-roll/click/cue/monitor mix/direct-versus- processed path with feedback protection and disclosed latency. Evidence: monitoring tests. - [ ] E3.10.d Implement manual/automatic punch/loop/overdub/multitake capture with sample-accurate alignment, dropout markers, and crash-safe local originals. Evidence: recording tests. - [ ] E3.10.e Apply measured latency compensation without altering original timing, expose confidence/manual correction, and handle clock drift. Evidence: alignment tests. - [ ] E3.10.f Record immutable device/performer/consent/session/file/take/ operator provenance and revoke/restrict downstream use. Evidence: provenance tests. - [ ] E3.11 Build transcription for audio-to-MIDI, score, chords, and lyrics behind honest confidence/proposal states. Evidence: calibrated corpus. - [ ] E3.11.a Define request with pinned audio range/channels/stems, task, tuning/tempo/language/instrument/voice assumptions, provider/model, and budget. Evidence: request contract. - [ ] E3.11.b Produce MIDI/note events with pitch/spelling/onset/duration/ velocity/expression/instrument/voice/confidence and aligned locators. Evidence: MIDI output tests. - [ ] E3.11.c Produce score/parts/rhythm/meter/key/articulation and chord/ harmony candidates with alternative interpretations and explicit quantization. Evidence: notation output tests. - [ ] E3.11.d Produce lyric/speaker/word/syllable/phoneme/time alignments with language/uncertainty and no invented text hidden as transcript. Evidence: lyric output tests. - [ ] E3.11.e Present proposals for per-event/region/part accept/edit/reject, retain source audio and full model/run provenance. Evidence: review tests. - [ ] E3.11.f Evaluate onset/offset/pitch/chord/notation/word/alignment error, calibration, polyphony/noise/locale/instrument slices, and abstention. Evidence: calibrated corpus report. - [ ] E3.12 Build generated voice/performance only with valid consent and authorized host controls. Evidence: impersonation and revocation tests. - [ ] E3.12.a Define voice/performer identity/model/enrollment/reference/ consent purpose/scope/territory/term/host/output/disclosure contract. Evidence: authorization schema. - [ ] E3.12.b Verify current identity/consent/rights/model/provider/host/ project/role and step-up before preview, generation, export, or share. Evidence: preflight tests. - [ ] E3.12.c Watermark/fingerprint or apply ratified provenance/disclosure, retain exact run/reference/settings, and restrict protected voiceprints. Evidence: output controls. - [ ] E3.12.d Enforce host allowlists, rate/budget/target/content policy, dangerous impersonation/public-figure/fraud constraints, and human approval. Evidence: policy tests. - [ ] E3.12.e Propagate revocation/expiry/scope change to queued jobs, stored outputs, projects, mixes, masters, releases, downloads, and providers. Evidence: revocation journey. - [ ] E3.12.f Test spoofed consent/identity, cross-project/model reuse, voice extraction, prompt injection, unauthorized host/API, and revoked cache. Evidence: impersonation suite. - [ ] E3.13 Build generated stem and edit lineage down to model, prompt, reference, seed, and transformation. Evidence: provenance inspector. - [ ] E3.13.a Record immutable input source/stem/clip/range/mask/condition/ reference/rights hashes and their exact revisions. Evidence: input lineage. - [ ] E3.13.b Record provider/model/weights/prompt/negative prompt/seed/ parameters/tool/code/hardware/version/time/cost and safety policy. Evidence: generation lineage. - [ ] E3.13.c Record output stem/file/channel/range/hash/confidence/ measurements and transformation parent/child DAG. Evidence: output lineage. - [ ] E3.13.d Carry lineage through comp/edit/stretch/process/mix/master/ bounce/export/release while preserving range/ingredient relationships. Evidence: propagation tests. - [ ] E3.13.e Build permission-filtered inspector with graph plus semantic tree/table, source-use/rights/consent/disclosure/tamper/missing state. Evidence: provenance UI. - [ ] E3.13.f Verify hashes/signatures/replay where possible and label opaque/nondeterministic/stripped/untrusted lineage explicitly. Evidence: integrity tests. - [ ] E3.14 Build assist cost, progress, cancel, retry, and human-acceptance views. Evidence: provider fault journey. - [ ] E3.14.a Define run/job step/progress/unit/estimate/cost currency/ provider/budget/attempt/terminal state contract. Evidence: operations schema. - [ ] E3.14.b Show queued/running/waiting/uploading/generating/downloading/ analyzing progress, elapsed/remaining/unknown, current step, and resource use. Evidence: progress tests. - [ ] E3.14.c Show estimated versus authorized versus actual token/compute/ storage/egress/currency cost with delayed accounting and budget alerts. Evidence: cost tests. - [ ] E3.14.d Implement requested/acknowledged/completed cancellation across upload/provider/worker/download/commit boundaries with partial artifact handling. Evidence: cancel tests. - [ ] E3.14.e Implement retry/resume/replay with pinned inputs/versions or explicit substitution, idempotency, safe dedupe, and attempt history. Evidence: retry tests. - [ ] E3.14.f Present outputs as unaccepted auditionable proposals with exact compare/provenance/rights and per-output accept/edit/reject. Evidence: acceptance tests. - [ ] E3.14.g Inject not-configured/rate/timeout/malformed/partial/budget/ cancel/network/rights-revoke/provider-commit failures. Evidence: provider fault journey. - [ ] E3.15 Build composition, lyric, arrangement, performance, mix, mastering, metadata, and rights agent plans with least-privilege tool grants. Evidence: project revision, assets, policy, budget, stop conditions, and approval points are locked before dispatch. - [ ] E3.15.a Define distinct plan templates/allowed outputs for every named agent domain and prohibit blending creative, rights, QC, approval, and distribution authority. Evidence: template registry. - [ ] E3.15.b Pin project/song/session/arrangement/mix/master/release/assets/ rights/policy/profile revisions, objective, constraints, and acceptance criteria. Evidence: plan inputs. - [ ] E3.15.c Grant least-privilege read/analyze/audition/draft/propose/render/ job tools with object/field/range/host/provider/target scope and expiry. Evidence: capability manifest. - [ ] E3.15.d Lock token/compute/currency/time/step/tool/storage/egress budgets, provider/data-use/local-cloud, retry/fallback, and rights/consent scope. Evidence: budget policy. - [ ] E3.15.e Define human checkpoints, audition/approval/rights-QC-required/ stop-the-line/cancel/escalation conditions before dispatch. Evidence: control contract. - [ ] E3.15.f Preview exact plan/grants/data movement/risks to authorized human, sign/hash approval, and reject stale or mutated dispatch. Evidence: dispatch tests. - [ ] E3.16 Build Euterpe-scoped agent run, queue, plan, tool-call, budget, output, rights-use, and provenance views. Evidence: live trace and project isolation. - [ ] E3.16.a Define run/step/tool/queue/event/budget/input-rights/output/ artifact/provenance state and retention contracts. Evidence: run schema. - [ ] E3.16.b Build queue/run list with project/owner/template/status/progress/ priority/wait/failure/budget/cost and stable filters. Evidence: operations tests. - [ ] E3.16.c Build live timeline for immutable plan, model/tool calls, source/ reference use, decisions/retries/errors, artifacts, and human controls. Evidence: trace tests. - [ ] E3.16.d Show token/compute/time/currency/storage/egress limits versus actual/forecast and truthful delayed costs. Evidence: budget tests. - [ ] E3.16.e Show exact input/output media/revisions/ranges, rights/consent/ model use, hashes, transformations, and accepted status. Evidence: provenance view. - [ ] E3.16.f Enforce tenant/project/role/field/media/rights redaction in UI/ API/events/logs/export and no cross-project counts/timing. Evidence: isolation tests. - [ ] E3.16.g Test live reconnect/order/dedupe/stale/partial/offline/cancel/ terminal reconciliation. Evidence: live trace E2E. - [ ] E3.17 Intake agent output as attributed clips, takes, settings, suggestions, or release-metadata proposals. Evidence: agents cannot assert clearance/consent, sign splits, approve a master, or distribute. - [ ] E3.17.a Define allowlisted output envelopes for clip/take/stem/score- MIDI/lyric/arrangement/settings/mix-master suggestion/metadata proposal with run provenance. Evidence: output schemas. - [ ] E3.17.b Validate format/hash/duration/range/timebase/channels/events/ parameters/anchors/schema/size/rights/safety and quarantine media. Evidence: intake validation. - [ ] E3.17.c Store in a proposal namespace with explicit unaccepted state, immutable source/run links, no release/QC/rights/consent/approval semantics. Evidence: persistence tests. - [ ] E3.17.d Present level-matched audition/semantic diff/settings/input-use/ confidence/cost/rights for per-part accept/edit/reject. Evidence: review tests. - [ ] E3.17.e Apply accepted output as human-attributed new revision/reference, retaining AI provenance and rerunning technical/rights/approval gates. Evidence: acceptance tests. - [ ] E3.17.f Attempt clearance/consent assertion, split signing, master/QC approval, release/distribution/takedown, direct project mutation, or privilege expansion. Evidence: capability rejection tests. - [ ] E3.18 Implement agent pause, redirect, audition, reject, cancel, budget kill, and replay. Evidence: partial audio and metadata remain explicitly unaccepted and linked to immutable runs. - [ ] E3.18.a Define legal control transitions by run/step/provider/job/ artifact state, actor, idempotency, and commit/terminal boundary. Evidence: control state machine. - [ ] E3.18.b Pause at safe checkpoints, stop new tool calls, retain leases/ partial artifacts, and resume only after plan/grant/rights validation. Evidence: pause tests. - [ ] E3.18.c Redirect through reviewed plan amendment/new plan with changed objective/constraints/grants/budgets while preserving original. Evidence: redirect tests. - [ ] E3.18.d Audition outputs through sandboxed level-safe routing with no project mutation; reject with retained reason and immutable artifact. Evidence: audition/reject tests. - [ ] E3.18.e Cancel queued/running/provider/render/download phases with requested-versus-completed state, compensation, and timeout. Evidence: cancel tests. - [ ] E3.18.f Enforce automatic/manual budget kill with bounded overshoot and replay from pinned inputs/versions or disclosed substitutions, deduping side effects. Evidence: budget/replay tests. - [ ] E3.18.g Verify partial media/metadata/settings stay unaccepted/ unapproved/unreleased with complete run/source/rights provenance. Evidence: status tests. - [ ] E3.19 Build stem separation with source/channel selection, stem taxonomy, bleed/artifact/confidence review, manual correction, recombination, rights inheritance, and per-stem lineage. Evidence: stem-sum and known-mixture evaluation. - [ ] E3.19.a Define separation request pinned to source revision/range/ channels, target stem taxonomy/count, model/profile, rights, quality, budget, and output format. Evidence: request schema. - [ ] E3.19.b Support channel/region/mask/source selection with preview, minimum signal validation, immutable original, and protected rights/ consent checks. Evidence: selection tests. - [ ] E3.19.c Run durable provider/local job and produce aligned immutable stems plus residual, exact model/settings/seed/hardware/input-output hashes, and cost. Evidence: job tests. - [ ] E3.19.d Measure per-stem target/interference/bleed/artifact/silence/ phase/timing/confidence and mark insufficient/unsupported/failure separately. Evidence: analysis tests. - [ ] E3.19.e Provide synchronized level-matched solo/mute/residual/sum A/B and semantic measurement table for human taxonomy/quality review. Evidence: review UI. - [ ] E3.19.f Allow manual stem relabel/group/split/merge/mask correction/ spectral edit and rerun as new version without rewriting outputs. Evidence: correction tests. - [ ] E3.19.g Recombine with gain/pan/phase/alignment handling and compare stem sum to source under declared decomposition/tolerance. Evidence: recombination tests. - [ ] E3.19.h Inherit/review source/sample/performer/voice/model rights and consent per stem; prevent separation from creating new clearance. Evidence: rights tests. - [ ] E3.19.i Carry per-stem lineage through edit/mix/master/export/release and run synthetic/real known-mixture plus stem-sum evaluation. Evidence: evaluation report. - [ ] E3.20 Build audio inpainting, continuation, variation, conditional generation, and style transfer with exact masks/ranges, musical context, reference rights, continuity controls, audition, replace/comp, and provenance. Evidence: untouched samples remain bit-identical where the operation promises surgical editing. - [ ] E3.20.a Define distinct operation contracts for inpaint/continue/variant/ conditional generation/style transfer, each with allowed scope/output and no semantic aliasing. Evidence: operation registry. - [ ] E3.20.b Select exact source/mask/range/channel/stem/context handles and musical tempo/meter/key/tuning/form/neighboring audio conditions. Evidence: selection tests. - [ ] E3.20.c Define prompt/score/MIDI/reference/style/instrument/seed/ strength/negative/preservation/transition/duration constraints and resolve rights/consent. Evidence: condition schema. - [ ] E3.20.d Generate multiple immutable candidates with exact provider/model/ parameters/input-output hashes/cost/confidence/provenance and safe failure state. Evidence: generation tests. - [ ] E3.20.e Measure boundary continuity, tempo/pitch/timbre/phase/noise/ loudness, source leakage/copying, artifacts, semantic/style fit, and uncertainty. Evidence: quality tests. - [ ] E3.20.f Audition synchronized source/candidate/context with level match, waveform/spectral/semantic comparison, and per-candidate decision. Evidence: audition tests. - [ ] E3.20.g Apply by nondestructive replace/new take/comp layer/alternate arrangement, preserving source and supporting undo/restore. Evidence: edit integration tests. - [ ] E3.20.h For surgical operations, assemble output from exact source plus generated mask and byte/sample-compare every promised untouched region. Evidence: preservation goldens. - [ ] E3.20.i Carry reference/model/generated-region rights/disclosure/ provenance through project/mix/master/release and test revocation. Evidence: lineage tests. - [ ] E3.21 Build voice conversion, speech, singing, choir, harmony, dubbing, pronunciation, timing, vocal processing, and performance-direction workflows with subject/performer consent, identity scope, locale, revocation, disclosure, and misuse monitoring. Evidence: each mode has a distinct consent/policy/evaluation profile. - [ ] E3.21.a Define separate mode profiles/contracts for conversion, speech, solo singing, choir/harmony, dubbing, pronunciation/timing, processing, and direction with explicit nonapplicability. Evidence: mode registry. - [ ] E3.21.b Verify subject/performer/voice/model identity, enrollment/ reference provenance, purpose/territory/term/host/target consent, rights, and current revocation before every operation. Evidence: consent gate. - [ ] E3.21.c Define text/lyrics/phonemes/locale/accent/pronunciation/timing/ pitch/melody/harmony/voice assignment/expression/direction inputs with protected data handling. Evidence: input contracts. - [ ] E3.21.d Generate immutable takes/stems with exact provider/model/voice/ prompt/seed/settings/input-output hashes/watermark/cost/provenance. Evidence: generation tests. - [ ] E3.21.e Evaluate intelligibility/pronunciation/alignment/pitch/rhythm/ harmony/identity similarity-drift/artifact/naturalness separately with calibrated uncertainty. Evidence: mode evaluations. - [ ] E3.21.f Audition/compare/comp/edit/process with human acceptance and prevent identity similarity or quality score from asserting consent/ authenticity. Evidence: review tests. - [ ] E3.21.g Attach mode/AI/voice disclosure and rights metadata to clips/ mixes/masters/releases; restrict downloads/sharing/model reuse. Evidence: enforcement tests. - [ ] E3.21.h On revocation/expiry/scope change, cancel jobs, quarantine/ restrict outputs, preview blast radius, replace/takedown, and notify providers/targets. Evidence: revocation E2E. - [ ] E3.21.i Monitor impersonation/fraud/unauthorized cloning/voiceprint extraction/provider misuse with privacy-safe alerts and human review. Evidence: abuse tests. - [ ] E3.22 Build melody, harmony, rhythm/groove, arrangement, orchestration, accompaniment, improvisation, and full text-to-music workflows with editable intermediate score/MIDI/audio representations. Evidence: creators can inspect and accept/reject parts rather than receiving an opaque final waveform. - [ ] E3.22.a Define distinct generation/assist workflows, allowed inputs/ outputs, scope, creative assumptions, rights, provider capability, budget, and human checkpoints. Evidence: workflow registry. - [ ] E3.22.b Build melody and harmony/voicing generation from text/chords/ motifs/score/MIDI/audio context with tuning/range/form constraints and alternative interpretations. Evidence: melodic/harmonic tests. - [ ] E3.22.c Build rhythm/groove generation from tempo/cycle/pulse/style/ performance references with editable timing/velocity/expression and culturally declared assumptions. Evidence: rhythm tests. - [ ] E3.22.d Build arrangement/orchestration/accompaniment generation with sections/roles/instruments/ranges/articulations/texture/density and performer/device capabilities. Evidence: production tests. - [ ] E3.22.e Build improvisation and full text-to-music as planned sequences of editable form/chords/melody/rhythm/parts/score/MIDI/stems/audio, not a single opaque artifact. Evidence: plan/intermediate tests. - [ ] E3.22.f Provide synchronized score/MIDI/audio audition and semantic diff for per-section/part/event/stem accept/edit/reject/replace/comp. Evidence: decision UI. - [ ] E3.22.g Record every intermediate’s model/prompt/reference/seed/settings/ parent/rights/cost/provenance and carry through accepted project revision. Evidence: lineage tests. - [ ] E3.22.h Evaluate structure/timing/playability/preservation/diversity/ originality/leakage/locale-cultural slices without universal aesthetic score. Evidence: evaluation report. - [ ] E3.23 Build AI mix and master assistance as versioned, auditionable settings or renders with target/reference assumptions, explanations, confidence, cost, undo, and human approval. Evidence: assist cannot overwrite source, approve QC, or distribute. - [ ] E3.23.a Define mix versus master assist requests pinned to source revision, selected tracks/stems/range, target/reference/profile, allowed processors, rights/privacy, and budget. Evidence: request schemas. - [ ] E3.23.b Produce versioned settings/automation/routing/device proposals or immutable renders with exact changed parameters and no source mutation. Evidence: proposal tests. - [ ] E3.23.c Explain target/reference assumptions, measured issues, recommended actions, alternatives, confidence/uncertainty, and model/provider versions. Evidence: explanation tests. - [ ] E3.23.d Provide level-matched blindable A/B, loudness-normalized comparison, raw measurement deltas, semantic settings diff, and source restore. Evidence: audition tests. - [ ] E3.23.e Show estimated/actual cost/progress/cancel/retry and preserve partial outputs as unaccepted. Evidence: operations tests. - [ ] E3.23.f Accept/edit/reject per setting/range/render into a new human- attributed mix/master candidate with undo and full AI provenance. Evidence: acceptance tests. - [ ] E3.23.g Re-run independent master/target/rights/QC gates and require qualified human approval; block assist from QC approval/distribution. Evidence: authority tests. - [ ] E3.24 Build local/on-device and cloud AI capability negotiation with model/weight version, hardware/memory, privacy, latency, quality, energy, offline availability, fallback, and result equivalence policy. Evidence: unsupported hardware fails honestly, local data does not leave the device silently, and provider fallback never changes consent or rights scope. - [ ] E3.24.a Define operation capability requirements and local/browser/ desktop/native/worker/cloud provider profiles with model/weights/ runtime/version/licence. Evidence: capability contracts. - [ ] E3.24.b Detect CPU/GPU/NPU/architecture/memory/storage/energy/thermal/ network/offline/runtime support and benchmark or validate minimums. Evidence: hardware tests. - [ ] E3.24.c Resolve data classification/rights/consent/provider-training/ region/retention/encryption/model-use constraints before considering each execution location. Evidence: privacy policy tests. - [ ] E3.24.d Estimate latency/quality/resource/energy/cost/output formats and present eligible choices/limits to user or policy. Evidence: negotiation UI. - [ ] E3.24.e Dispatch locally without network when selected and verify firewall/telemetry/cache/model-download boundaries; fail honestly on unsupported hardware. Evidence: local execution tests. - [ ] E3.24.f Dispatch cloud only after explicit allowed scope with minimized encrypted data, provider/model pinning, audit, cancel, and deletion. Evidence: cloud execution tests. - [ ] E3.24.g Allow fallback only within preauthorized privacy/rights/consent/ quality/cost constraints and require reapproval for expanded data movement. Evidence: fallback tests. - [ ] E3.24.h Define semantic/audio result equivalence/tolerances and disclose nondeterminism/model substitutions rather than silently presenting identical capability. Evidence: parity report. ### E4 — Theory, audio quality, mix, and master gates - [ ] E4.1 Implement tempo/meter-map consistency and event alignment gates. Evidence: known MIDI/score fixtures. - [ ] E4.1.a Validate tempo/meter segment order/ranges/overlaps/gaps/ramps/ pickup/time signatures and musical-sample conversion continuity. Evidence: map tests. - [ ] E4.1.b Check score/MIDI/clip/marker/cue/automation/event anchors against applicable map revision and detect drift/orphan/ambiguous mapping. Evidence: alignment tests. - [ ] E4.1.c Check bar/beat/subdivision boundaries, tuplets/polyrhythm/ additive/free-time applicability and avoid common-time assumptions. Evidence: rhythmic fixtures. - [ ] E4.1.d Persist raw timing deltas/units/event IDs/map versions/evidence separately from tolerance/profile verdict. Evidence: result contract. - [ ] E4.1.e Run known MIDI/score/audio/import/export/tempo-edit/long-duration fixtures and stale-map invalidation. Evidence: known-value suite. - [ ] E4.2 Implement key/scale, chord spelling, range, voice-leading, parallel, and dissonance diagnostics as configurable theory assistance. Evidence: known score fixtures. - [ ] E4.2.a Define versioned theory profile with tuning/cultural/style/genre/ period/instrument assumptions, enabled diagnostics, thresholds, and nonapplicability. Evidence: profile schema. - [ ] E4.2.b Measure key/scale membership/spelling/alternative interpretation, chord/voicing/inversion/function and exact note evidence. Evidence: harmony tests. - [ ] E4.2.c Measure written/sounding range/transposition/playability/ instrumentation against versioned performer/instrument capabilities. Evidence: range tests. - [ ] E4.2.d Measure voice-leading/spacing/crossing/parallels/dissonance/ resolution only where declared rules apply and show creative alternatives. Evidence: counterpoint tests. - [ ] E4.2.e Keep raw findings separate from advisory verdict; allow human annotate/waive/disable and never auto-edit or assign aesthetic quality. Evidence: assistance tests. - [ ] E4.2.f Validate Western/non-Western/non-12-TET/intentional exception/ ambiguous fixtures with named musical review. Evidence: score corpus. - [ ] E4.3 Distinguish intentional creative exceptions from technical errors. Evidence: authorized waiver retains original measurement. - [ ] E4.3.a Classify diagnostics as objective technical integrity, target conformance, configurable theory/style assistance, or subjective preference. Evidence: diagnostic registry. - [ ] E4.3.b Define exception/waiver scope over exact subject/measurement/ profile/version/range, reason/evidence/actor authority/conditions/expiry. Evidence: waiver schema. - [ ] E4.3.c Preserve immutable raw measurement and original verdict while storing a separate human exception decision. Evidence: storage tests. - [ ] E4.3.d Restrict nonwaivable safety/rights/consent/integrity/target constraints and require specialist approval for bounded exceptions. Evidence: policy tests. - [ ] E4.3.e Invalidate waiver on subject/measurement/profile/target/rights/ approver/expiry change and preserve history. Evidence: lifecycle tests. - [ ] E4.3.f Show intentional/waived/unresolved state distinctly from pass and include it in review/release evidence. Evidence: UI/audit tests. - [ ] E4.4 Implement lyric syllable, stress, meter, rhyme, pronunciation, and line-timing measurements. Evidence: language-specific fixture set. - [ ] E4.4.a Pin lyric/score/audio/timing/pronunciation revision and applicable locale/prosody/rhyme/meter profile with declared assumptions. Evidence: measurement inputs. - [ ] E4.4.b Measure token/syllable boundaries, elision/melisma, stress/weight/ meter alignment and confidence/source. Evidence: prosody tests. - [ ] E4.4.c Measure rhyme families/scheme/position/exact-near/internal with pronunciation variants and uncertainty. Evidence: rhyme tests. - [ ] E4.4.d Measure phoneme/pronunciation/name/locale variants and line/ syllable onset-duration alignment to score/MIDI/audio. Evidence: pronunciation/timing tests. - [ ] E4.4.e Persist raw values/evidence/algorithm/corpus/profile versions separately from creative assist verdict and mark nonapplicable. Evidence: result contract. - [ ] E4.4.f Validate expert-reviewed fixtures per ratified language/script/ meter, including dialect/translation/free meter. Evidence: locale corpus. - [ ] E4.5 Implement recording checks for clipping, DC offset, silence, noise, dropouts, channel, sample rate, bit depth, and phase. Evidence: calibrated WAV corpus. - [ ] E4.5.a Verify file/container/codec/sample-rate/bit-depth/channel/layout/ duration/checksum and decode completeness against session/profile. Evidence: format tests. - [ ] E4.5.b Measure sample/inter-sample clipping where applicable, peak locations, DC offset, silence/digital zero, low level, and discontinuity. Evidence: signal tests. - [ ] E4.5.c Measure noise floor/SNR/hum/buzz/broadband/impulse/dropout/glitch with selected calibration and signal sufficiency. Evidence: noise tests. - [ ] E4.5.d Measure polarity/phase/correlation/time offset across channels/ microphones and detect channel swaps/duplicates/missing channels. Evidence: multichannel tests. - [ ] E4.5.e Persist raw measurements/units/ranges/analyzer/calibration/source version separately from capture-profile verdict/remediation. Evidence: provenance tests. - [ ] E4.5.f Run calibrated WAV corpus across rates/depths/layouts/noise/ deliberate clipping/dropout/phase and analyzer failures. Evidence: conformance report. - [ ] E4.6 Implement mix checks for clipping, headroom, mono compatibility, phase, spectral balance, dynamics, masking, and true peak. Evidence: reference fixtures. - [ ] E4.6.a Analyze exact mix revision/range/layout/render path and verify sufficient signal/calibration/analyzer/profile before measurement. Evidence: input tests. - [ ] E4.6.b Measure sample/true peak/clipping/headroom and integrated/short/ momentary dynamics/loudness distributions without universal targets. Evidence: level tests. - [ ] E4.6.c Measure mono/downmix compatibility, polarity/correlation/phase/ spatial energy and identify affected channels/times/frequencies. Evidence: compatibility tests. - [ ] E4.6.d Measure spectrum/tonal balance/masking/dynamic range/transients/ crest with exact references/bands/assumptions and uncertainty. Evidence: balance tests. - [ ] E4.6.e Persist raw values separately from target/reference/profile verdict and treat aesthetic comparison as advisory. Evidence: result tests. - [ ] E4.6.f Run calibrated reference/edge/intentional-exception/silence/ multichannel fixtures with known expected values. Evidence: mix corpus. - [ ] E4.7 Implement integrated, short-term, momentary loudness and loudness range per the pinned BS.1770/R128 implementation. Evidence: official or calibrated test signals. - [ ] E4.7.a Pin BS.1770/R128/EBU Tech implementation/version/channel weights/ K-weighting/gating/window/LRA/true-peak dependencies. Evidence: meter profile. - [ ] E4.7.b Implement channel-layout-aware K-weighting and absolute/relative gating for integrated loudness with exact block overlap/rounding. Evidence: integrated tests. - [ ] E4.7.c Implement short-term and momentary window/hop calculations and time-aligned result series. Evidence: window tests. - [ ] E4.7.d Implement loudness range percentile/gating/sufficient-duration rules and explicit insufficient-signal state. Evidence: LRA tests. - [ ] E4.7.e Persist LUFS/LU/true-peak raw outputs/ranges/units/layout/ algorithm/calibration/source hashes separately from target verdict. Evidence: result schema. - [ ] E4.7.f Validate official or independently calibrated mono/stereo/ multichannel/silence/short/program test signals within tolerances. Evidence: conformance report. - [ ] E4.8 Implement target-specific loudness and peak profiles rather than one universal LUFS number. Evidence: broadcast, streaming, podcast, and platform fixtures. - [ ] E4.8.a Define versioned profile per broadcast/streaming/podcast/video/ physical/spatial platform with jurisdiction/target/layout/content type. Evidence: profile registry. - [ ] E4.8.b Encode integrated/short/momentary/LRA/true-sample peak targets/ ranges, measurement standard, normalization behavior, and exceptions. Evidence: profile contracts. - [ ] E4.8.c Resolve applicable profile from release target/territory/format/ layout/version and show unknown/conflicting/unsupported explicitly. Evidence: resolution tests. - [ ] E4.8.d Compute verdict from retained raw measurements with exact delta/ reason/remediation and no reinterpretation of creative mix quality. Evidence: verdict tests. - [ ] E4.8.e Recompute verdict after profile change without rerendering valid source measurements and invalidate approval/delivery as needed. Evidence: recomputation tests. - [ ] E4.8.f Validate broadcast/streaming/podcast/platform boundary fixtures and current distributor expectations. Evidence: target suite. - [ ] E4.9 Implement master format, channel layout, codec, sample rate, bit depth, dither, gap, fade, metadata, and artwork checks. Evidence: per-target goldens. - [ ] E4.9.a Verify container/codec/profile/extension/MIME/decode/duration/ checksum/file size and target support. Evidence: file checks. - [ ] E4.9.b Verify sample rate/bit depth/endian/channel count/layout/labels/ ordering/downmix metadata and expected master spec. Evidence: audio format tests. - [ ] E4.9.c Detect/respect dither/noise shaping, unnecessary repeat dither, truncation, clipping, sample-rate conversion version, and silence. Evidence: signal processing tests. - [ ] E4.9.d Verify program start/end, pregap/postgap/intertrack gap/continuous album transitions/fade shape/tails and sequence alignment. Evidence: sequencing tests. - [ ] E4.9.e Verify identifiers/titles/versions/contributors/languages/ advisories/rights/lyrics/credits/provenance embedded and package metadata. Evidence: metadata tests. - [ ] E4.9.f Verify artwork dimensions/color/profile/format/file size/text/ rights/advisory/target safe areas and associations. Evidence: artwork tests. - [ ] E4.9.g Run per-target goldens and distinguish unsupported/missing/ invalid/stale/analyzer failure from pass. Evidence: master gate suite. - [ ] E4.10 Implement spatial/immersive profile checks where supported. Evidence: channel/object layout fixtures and explicit unsupported states. - [ ] E4.10.a Resolve exact session/layout/renderer/device/target profile and supported object/bed/channel/ambisonic/binaural capabilities. Evidence: applicability tests. - [ ] E4.10.b Validate channel labels/order/angles/elevation/LFE/bed mapping and object count/IDs/coordinates/trajectories/spread/priority/automation. Evidence: layout tests. - [ ] E4.10.c Validate ambisonic order/dimensionality/channel ordering/ normalization/coordinate orientation and conversion. Evidence: HOA tests. - [ ] E4.10.d Validate binaural renderer/HRTF/head-tracking sensor/timing/ fallback/device metadata and object-to-binaural behavior. Evidence: binaural tests. - [ ] E4.10.e Validate downmix/render loudness/peak/phase/localization/ fold-down/metadata/interchange and record exact loss. Evidence: render tests. - [ ] E4.10.f Emit explicit unsupported/degraded/unavailable/unknown renderer or layout state and run goldens per supported cell. Evidence: spatial gate. - [ ] E4.11 Implement reference-track comparison without treating aesthetic similarity as automatic quality. Evidence: raw measures and policy. - [ ] E4.11.a Define authorized reference/revision/range/rights/target/ alignment/level-match and comparison purpose. Evidence: reference contract. - [ ] E4.11.b Align tempo/time/sections and level-match transparently while preserving original playback and reporting applied transforms. Evidence: alignment tests. - [ ] E4.11.c Measure loudness/peak/dynamics/spectrum/tonal balance/stereo- spatial/phase/tempo/structure differences with units/ranges/uncertainty. Evidence: measurement tests. - [ ] E4.11.d Show synchronized A/B and semantic comparison with exact reference/source/profiles/analyzer versions. Evidence: compare tests. - [ ] E4.11.e Apply optional advisory target bands separately; prohibit a single similarity/quality verdict or automatic mix/master changes. Evidence: policy tests. - [ ] E4.11.f Validate identical/level-shifted/genre-different/intentionally different/short/unauthorized reference fixtures. Evidence: known-value suite. - [ ] E4.12 Implement render null/round-trip and stem-sum diagnostics where applicable. Evidence: known signal fixtures. - [ ] E4.12.a Define applicability/alignment/gain/polarity/delay/sample-rate/ layout/tail/tolerance and expected nondeterminism for each comparison. Evidence: diagnostic profile. - [ ] E4.12.b Render source and comparison through pinned realtime/offline/ export/import/plugin/format paths with exact manifests. Evidence: reproducible inputs. - [ ] E4.12.c Align signals and compute null residual peak/RMS/spectrum/ correlation/time-varying error by channel/range. Evidence: null tests. - [ ] E4.12.d Sum stems with declared routing/gain/pan/phase/processing/tails and compare to mix bus or source. Evidence: stem-sum tests. - [ ] E4.12.e Distinguish exact, tolerance-pass, expected nondeterministic, mismatched, insufficient, and analyzer failure with evidence. Evidence: result states. - [ ] E4.12.f Validate impulse/sine/noise/known plugin/round-trip/stem-mix/ alignment-error fixtures across sample rates/layouts. Evidence: signal corpus. - [ ] E4.13 Persist raw measurements separately from target verdicts. Evidence: profile change recomputes without rerendering. - [ ] E4.13.a Define immutable measurement record with source/render/range/ channel/layout/input hashes, values/units/series, analyzer/calibration/ plugin versions, and uncertainty. Evidence: measurement schema. - [ ] E4.13.b Define separate verdict with measurement references, applicable profile/threshold/rules, outcome/reason/remediation/exception and time. Evidence: verdict schema. - [ ] E4.13.c Prevent verdict fields from mutating/denormalizing raw values and prevent missing/unsupported/error measurements from defaulting to pass. Evidence: storage invariants. - [ ] E4.13.d Recompute new verdicts from retained valid measurements after profile/threshold change without rendering/analyzing again. Evidence: recomputation tests. - [ ] E4.13.e Rerender/reanalyze only when source/render/analyzer/calibration dependencies invalidate and preserve prior lineage. Evidence: lifecycle tests. - [ ] E4.13.f Compare old/new profile results and explain changes without rewriting historical approval/release evidence. Evidence: profile change report. - [ ] E4.14 Version algorithms, calibration signals, profiles, thresholds, and plugins. Evidence: every result is reproducible or labeled otherwise. - [ ] E4.14.a Define immutable IDs/digests for analyzer/DSP code/config/ runtime, calibration files/hardware, target/theory profiles/thresholds, and plugin/state/resources. Evidence: version contracts. - [ ] E4.14.b Resolve/pin every dependency before measurement/render and prohibit mutable aliases as sole provenance. Evidence: dispatch tests. - [ ] E4.14.c Persist dependency DAG plus OS/CPU/architecture/audio library/ sample rate/layout/random seed/input-output hashes. Evidence: provenance tests. - [ ] E4.14.d Define approved/effective/retired/revoked/blocked states, compatibility, migration, rollback, retention, and artifact availability. Evidence: lifecycle policy. - [ ] E4.14.e Detect missing/unknown/changed/unavailable versions and label result unverifiable/stale/nondeterministic instead of reproducible. Evidence: failure tests. - [ ] E4.14.f Reproduce representative measurements/renders from provenance, compare within declared tolerance, and disclose substitutions. Evidence: reproducibility gate. - [ ] E4.15 Add unavailable, unsupported, insufficient-signal, and analyzer failure states. Evidence: none renders as pass. - [ ] E4.15.a Define distinct applicability/execution/measurement/verdict states, reason codes, safe messages, owners, retry/remediation, and telemetry. Evidence: state taxonomy. - [ ] E4.15.b Map not-configured/dependency/provider/device/plugin/profile/ permission/authorization outage to unavailable. Evidence: availability tests. - [ ] E4.15.c Map host/format/layout/sample-rate/operation/profile capability absence to unsupported with supported alternatives/loss. Evidence: support tests. - [ ] E4.15.d Detect silence/too-short/too-few-events/wrong range/missing channels/low SNR or other insufficient signal with required minimum. Evidence: sufficiency tests. - [ ] E4.15.e Map timeout/crash/NaN/malformed output/version/calibration/ resource errors to analyzer failure with retained diagnostics. Evidence: fault tests. - [ ] E4.15.f Assert API/UI/export/review/release/analytics never display any nonpass state as pass/current/healthy. Evidence: projection suite. - [ ] E4.16 Build accessible quality views with values, units, thresholds, confidence, history, and remediation. Evidence: non-visual parity. - [ ] E4.16.a Define view model with measurement name/value/unit/range/ channel/time/evidence/analyzer/profile/threshold/verdict/confidence/ freshness. Evidence: quality contract. - [ ] E4.16.b Build prioritized findings/history/remediation presentation using text/table/structure, not color/graph alone, and avoid one aesthetic quality score. Evidence: UI review. - [ ] E4.16.c Provide semantic tables/descriptions for waveform/spectrum/ loudness/phase/spatial/time-series charts synchronized to visual selection/playback. Evidence: parity tests. - [ ] E4.16.d Provide keyboard inspect/filter/sort/range/audition/compare/ waive/remediate/rerun operations with focus and announcements. Evidence: keyboard tests. - [ ] E4.16.e Show unavailable/unsupported/insufficient/failure/stale/ intentional exception distinctly with eligible action and no pass styling. Evidence: state tests. - [ ] E4.16.f Test screen reader/zoom/reflow/themes/high contrast/long locale/ RTL/large result sets and compare against visual content/operations. Evidence: nonvisual E2E. - [ ] E4.17 Implement pitch/tuning, rhythm/groove, harmony/counterpoint, melody, orchestration, form, genre/style, and performance diagnostics as separable, culturally configurable assistants with declared assumptions. Evidence: no universal aesthetic "quality" score and expert-reviewed known-value corpora. - [ ] E4.17.a Define independent diagnostic modules with versioned cultural/ theoretical/style/instrument/performance profiles, applicability, assumptions, measures, and nonapplicability. Evidence: module registry. - [ ] E4.17.b Implement pitch/tuning/intonation/spelling/range diagnostics for arbitrary temperaments/reference systems with exact event/frequency evidence. Evidence: pitch corpus. - [ ] E4.17.c Implement rhythm/groove/pulse/cycle/subdivision/swing/timing/ repetition diagnostics without universal grid or common meter. Evidence: rhythm corpus. - [ ] E4.17.d Implement harmony/counterpoint/chord/voicing/voice-leading/ dissonance diagnostics only under explicit applicable systems. Evidence: harmony corpus. - [ ] E4.17.e Implement melody/contour/range/phrase/orchestration/ instrumentation/form diagnostics with performer and cultural source context. Evidence: composition corpus. - [ ] E4.17.f Implement genre/style/performance timing/dynamics/articulation/ technique comparison as descriptive assistance with uncertainty, not correctness. Evidence: style/performance corpus. - [ ] E4.17.g Persist raw findings/assumptions/evidence separately from human interpretation/exception and offer suggestions only. Evidence: policy tests. - [ ] E4.17.h Validate each module on expert-reviewed culturally diverse/ ambiguous/intentional-exception fixtures and prohibit aggregate aesthetic score. Evidence: signed evaluation. - [ ] E4.18 Implement stem-separation/inpainting/continuation/style-transfer fidelity and leakage checks. Evidence: known source/target masks, bleed, preservation, artifact, and uncertainty fixtures. - [ ] E4.18.a Define job-kind-specific applicability, source/target/mask/ reference/condition inputs, expected preserved/generated regions, and calibrated fixture truth. Evidence: evaluation contract. - [ ] E4.18.b Measure separation target capture/interference/bleed/residual/ artifact/silence/phase/timing and stem-sum error per stem. Evidence: separation tests. - [ ] E4.18.c Measure inpainting mask fidelity/boundary continuity and byte/ sample preservation of untouched regions where guaranteed. Evidence: inpaint tests. - [ ] E4.18.d Measure continuation/variation musical boundary continuity, structure/timing/pitch/timbre/energy drift and repetition/collapse. Evidence: continuation tests. - [ ] E4.18.e Measure style-transfer condition adherence separately from content/identity/source copying, reference leakage, and rights risk. Evidence: transfer tests. - [ ] E4.18.f Detect prompt/reference/training memorization or source stem leakage using ratified similarity/fingerprint methods and uncertainty. Evidence: leakage tests. - [ ] E4.18.g Persist raw metrics/model/evaluator/corpus versions separately from human acceptance/rights verdict and handle insufficient signal. Evidence: result tests. - [ ] E4.18.h Run synthetic/recorded/edge/adversarial known masks/mixtures/ references across models and report thresholds/calibration. Evidence: fidelity report. - [ ] E4.19 Implement voice/singing/choir intelligibility, pronunciation, timing, pitch, identity similarity/drift, artifact, consent, and disclosure checks. Evidence: protected calibrated corpus and explicit non-applicability. - [ ] E4.19.a Define separate evaluation profiles by speech/singing/choir/ conversion/dubbing/locale/voice type with protected corpus governance and applicability. Evidence: profile registry. - [ ] E4.19.b Measure word/phoneme intelligibility, pronunciation/name/locale accuracy, alignment/timing/duration and confidence. Evidence: language tests. - [ ] E4.19.c Measure pitch/intonation/rhythm/expressive contour/harmony/ voice-blend or separation under task-appropriate musical context. Evidence: music tests. - [ ] E4.19.d Measure identity similarity and unintended identity drift/ cross-voice leakage separately from authenticity/consent, with privacy controls. Evidence: identity tests. - [ ] E4.19.e Measure artifacts/noise/breath/sibilance/phase/discontinuity/ robotic or collapse indicators and calibrated uncertainty. Evidence: artifact tests. - [ ] E4.19.f Verify current consent/rights/model-use/territory/target/host/ disclosure/watermark/provenance; mark nonapplicable or block separately from audio metrics. Evidence: policy gate. - [ ] E4.19.g Protect voiceprints/corpus/identity outputs from unauthorized storage/search/log/export/provider access and enforce deletion/ revocation. Evidence: privacy tests. - [ ] E4.19.h Report task/subgroup/locale/voice slices, calibration/ thresholds/uncertainty with named voice/performance/rights review. Evidence: signed evaluation. - [ ] E4.20 Implement Dolby Atmos or ratified object-audio, binaural, ambisonic, immersive-device, head-tracking, downmix, loudness, peak, metadata, and renderer compatibility gates. Evidence: each supported layout/renderer/target pair has its own conformance proof. - [ ] E4.20.a Pin supported object-audio/binaural/ambisonic/device/interchange/ renderer/target profiles, SDK/validator versions, layouts, and explicit unsupported cells. Evidence: conformance matrix. - [ ] E4.20.b Validate bed/object/channel IDs/layout/count/routing, position/ trajectory/spread/priority/automation, coordinate frames, and ranges. Evidence: object-audio tests. - [ ] E4.20.c Validate ambisonic order/dimensionality/channel order/ normalization/coordinate orientation plus encode/decode rotations. Evidence: HOA tests. - [ ] E4.20.d Validate binaural HRTF/renderer/head-tracking sensor rate/ latency/frame alignment/dropout/fallback/device metadata. Evidence: binaural/device tests. - [ ] E4.20.e Render supported speakers/headphones/devices and measure loudness/true peak/phase/downmix/fold-down/localization/metadata loss per cell. Evidence: render tests. - [ ] E4.20.f Validate ADM-BWF/Atmos or ratified package structure/timing/ IDs/metadata/checksums/target constraints with pinned validators. Evidence: interchange tests. - [ ] E4.20.g Run known layout/object/trajectory/head-motion/downmix/silence/ boundary/malformed fixtures and compare render goldens/tolerances. Evidence: profile goldens. - [ ] E4.20.h Publish supported/conditional/unsupported layout×renderer×device× target cells with current proof, known loss, owner, and expiry; fail stale cells. Evidence: release gate. ### E5 — Rights, consent, originality, provenance, and splits - [ ] E5.1 Build rights registry for works, recordings, samples, stems, performances, voices, models, artwork, and references. Evidence: kind-specific forms. - [ ] E5.1.a Implement common rights subject/version/party/jurisdiction/ territory/use/term/evidence/state/search projection with stable IDs. Evidence: registry contract. - [ ] E5.1.b Build separate work/composition, sound recording/master, sample/ interpolation, and generated stem forms with kind-specific validation. Evidence: music rights forms. - [ ] E5.1.c Build performer/neighboring/voice/likeness/session consent forms with protected identity and model-use scope. Evidence: identity rights forms. - [ ] E5.1.d Build model/provider/training/inference/output/reference and artwork/image/design rights forms. Evidence: AI/artwork forms. - [ ] E5.1.e Support create/review/approve/dispute/expire/revoke/supersede/ hold with immutable history, attachments, and property authorization. Evidence: lifecycle tests. - [ ] E5.1.f Provide permission-aware search/relations/blast radius without exposing contracts, voiceprints, or unreleased media. Evidence: registry E2E. - [ ] E5.2 Build sample intake with source, license, territory, term, use, attribution, restrictions, document, and checksum. Evidence: validation. - [ ] E5.2.a Intake original sample bytes into quarantine and record source/ seller/library/URL/purchase/account/date/project/import actor. Evidence: intake provenance. - [ ] E5.2.b Preserve immutable bytes/checksum/fingerprint/media metadata/ preview proxy and scan/archive/project safety state. Evidence: file tests. - [ ] E5.2.c Capture license/rightsholder/licensee/use/synchronization/ derivative/model/distribution/monetization/attribution restrictions. Evidence: licence form. - [ ] E5.2.d Capture territory/term/effective/expiry/platform/release/project/ transfer/seat limits and current entitlement evidence. Evidence: scope tests. - [ ] E5.2.e Store contract/receipt/document encrypted with checksum/version/ issuer and redacted ordinary projection. Evidence: document tests. - [ ] E5.2.f Validate missing/conflicting/expired/nontransferable/no-AI/ no-commercial/unknown terms and block unsupported project use. Evidence: validation suite. - [ ] E5.3 Build sample and interpolation clearance workflow. Evidence: unresolved use blocks release. - [ ] E5.3.a Detect/register exact sample/interpolation use by source/range/ clip/stem/mix/master/release with recognizability and transform provenance. Evidence: use registry. - [ ] E5.3.b Create clearance case with parties/rights types/territories/ channels/term/attribution/fees/deadline/risk and source evidence. Evidence: case schema. - [ ] E5.3.c Implement research/contact/request/negotiate/counter/approve/ reject/withdraw/expire/dispute transitions with secure communications. Evidence: workflow tests. - [ ] E5.3.d Store executed licence/consent/fees/conditions/signatures and map exact allowed uses to project/release. Evidence: clearance record. - [ ] E5.3.e Re-evaluate after edit/replacement/territory/target/date/ ownership/licence change and invalidate stale clearance. Evidence: lifecycle tests. - [ ] E5.3.f Block mix/master/release/delivery as policy requires when any detected required use is unresolved, disputed, expired, or unsupported. Evidence: release gate tests. - [ ] E5.4 Build performer and voice consent with purpose, scope, territory, term, model use, revocation, and evidence. Evidence: consent matrix. - [ ] E5.4.a Define performer/subject identity/public projection/ representative/minor-capacity and protected contact/voiceprint boundaries. Evidence: identity contract. - [ ] E5.4.b Capture informed purpose/operations/content/voice model/ training-inference/output use/hosts/providers/targets/audience and prohibited uses. Evidence: consent form. - [ ] E5.4.c Capture project/work/session/range/territory/channel/locale/term/ compensation/credit/privacy/transfer/withdrawal conditions. Evidence: scope contract. - [ ] E5.4.d Record identity verification, signed intent/time/document hash/ witness or representative authority, evidence, and version. Evidence: signature tests. - [ ] E5.4.e Implement active/limited/withdrawn/revoked/expired/disputed/ superseded lifecycle and downstream blast radius/remedy. Evidence: lifecycle tests. - [ ] E5.4.f Resolve applicability per recording/generation/conversion/edit/ model/release and test consent matrix including provider fallback. Evidence: matrix suite. - [ ] E5.5 Build ownership split proposals, negotiation state, signatures, disputes, and locked release snapshot. Evidence: exact-total and authority tests. - [ ] E5.5.a Create versioned split proposal per work/recording/right/ territory/window with exact rational shares, parties/roles, rationale, and source evidence. Evidence: proposal schema. - [ ] E5.5.b Implement invite/view/counter/comment/accept/reject/abstain/ withdraw transitions with party-specific authorization and expiry. Evidence: negotiation tests. - [ ] E5.5.c Verify party/representative identity/capacity and collect signed exact document hash/intent/time with no agent impersonation. Evidence: signature tests. - [ ] E5.5.d Open/track dispute over party/share/right/territory/window/ authority with evidence, mediator/legal decision, and no silent overwrite. Evidence: dispute tests. - [ ] E5.5.e Enforce exact totals/overlap/incompatibility/duplicate/minor/ missing authority and preserve immutable version history. Evidence: property tests. - [ ] E5.5.f Lock approved release snapshot to exact split version/signatures/ territories and invalidate candidate on material change. Evidence: release snapshot tests. - [ ] E5.6 Build publishing/master ownership distinction. Evidence: contracts and UI cannot collapse the two. - [ ] E5.6.a Define separate composition/publishing and recording/master rights subjects/parties/shares/administration/licensing uses. Evidence: domain contracts. - [ ] E5.6.b Map song/work/composition versions to recordings/masters via explicit many-to-many relationships without ownership inheritance. Evidence: relationship tests. - [ ] E5.6.c Present separate forms/tables/status/search/approvals for each right with distinct labels/explanations and permissions. Evidence: UI tests. - [ ] E5.6.d Compute release/territory/target eligibility from both required rights independently and show exactly which is missing/disputed. Evidence: gate tests. - [ ] E5.6.e Test publishing-only/master-only/same-party/different-party/ cover/remix/sample/license/admin fixtures and API/export mappings. Evidence: noncollapse suite. - [ ] E5.7 Build melodic, lyrical, recording, and sample similarity screening with source corpus/version and uncertainty. Evidence: calibrated evaluation. - [ ] E5.7.a Define separate screening tasks/features/candidate corpora/ licences/permissions/retention and protected/unreleased exclusions. Evidence: screening policy. - [ ] E5.7.b Screen melody/harmony/rhythm using symbolic/audio-derived segments with transposition/tempo/variation controls and aligned evidence. Evidence: melodic tests. - [ ] E5.7.c Screen lyrics using locale/script/phonetic/semantic/exact-near spans while distinguishing common phrases/quotes/licensed reuse. Evidence: lyric tests. - [ ] E5.7.d Screen recordings/audio fingerprints and samples/interpolations with exact ranges, transforms, confidence, and corpus/source identity. Evidence: audio tests. - [ ] E5.7.e Persist model/index/corpus/version/features/threshold/raw matches/ uncertainty separately from rights verdict. Evidence: provenance tests. - [ ] E5.7.f Evaluate precision/recall/calibration/subgroup/genre/locale/ transform slices and protected corpus leakage. Evidence: calibrated report. - [ ] E5.8 Treat similarity as review evidence under ratified policy, not an automatic infringement verdict. Evidence: UI copy and gate policy. - [ ] E5.8.a Define versioned policy mapping similarity kind/score/confidence/ corpus/source/use/context to no-action/review/more-evidence/specialist outcomes. Evidence: policy contract. - [ ] E5.8.b Display aligned match excerpts/ranges/transforms/corpus rights/ uncertainty/model version and plain-language limitations. Evidence: UI tests. - [ ] E5.8.c Distinguish common elements, public-domain/licensed/authorized reuse, independent creation, reference, sample, interpolation, and unknown context. Evidence: review fixtures. - [ ] E5.8.d Require named human rights/legal review for material findings and record rationale/evidence/decision/conditions/dissent. Evidence: decision tests. - [ ] E5.8.e Prohibit automatic infringement accusation/takedown/payment/ project mutation or source/artist reputation score. Evidence: misuse tests. - [ ] E5.8.f Recompute/invalidate on subject/corpus/model/policy/rights changes and preserve prior measurement/decision separately. Evidence: lifecycle tests. - [ ] E5.9 Build AI-generated and AI-assisted disclosure metadata. Evidence: source run IDs and accepted edits. - [ ] E5.9.a Define disclosure subject/scope/mode/generated-versus-assisted/ operation/materiality/model/provider/version/time/locale/target schema. Evidence: metadata contract. - [ ] E5.9.b Link exact agent/generation/edit run IDs, input/reference/source ingredients, output ranges/stems, and accepted human edits/actor. Evidence: lineage tests. - [ ] E5.9.c Define internal reviewer, rights/provenance, distributor/DDEX, C2PA, credit, and listener-visible disclosure requirements by profile. Evidence: mapping matrix. - [ ] E5.9.d Generate/edit reviewed wording and machine metadata without exposing prompts, protected identity, contracts, or proprietary model data. Evidence: projection tests. - [ ] E5.9.e Invalidate disclosures on content/run/model/rights/target change and block release if current required metadata is missing. Evidence: gate tests. - [ ] E5.9.f Round-trip disclosure through project/master/package/DDEX/ distributor/catalog/read-back and correction. Evidence: parity tests. - [ ] E5.10 Build C2PA/external provenance for supported audio/artwork/package formats. Evidence: sign, validate, tamper, strip, recover. - [ ] E5.10.a Pin supported C2PA/external ledger profiles/formats/algorithms/ assertions/signers/trust stores/key lifecycle and target capabilities. Evidence: provenance profile. - [ ] E5.10.b Build manifest/ledger entry from exact audio/artwork/package ingredients, recording/generation/edit/mix/master actions, rights, and release revisions. Evidence: manifest tests. - [ ] E5.10.c Sign in isolated authorized service/HSM or equivalent with idempotency/timestamp/certificate chain/audit and no key exposure. Evidence: signing tests. - [ ] E5.10.d Embed/associate per format/target, preserve through supported transforms, and link stripped/external provenance explicitly. Evidence: packaging tests. - [ ] E5.10.e Validate hashes/signatures/ingredient/action lineage/trust/ revocation/expiry/content binding and display precise status. Evidence: validation tests. - [ ] E5.10.f Test valid/tampered/replaced/stripped/unknown/untrusted/expired/ malformed/recovered cases plus catalog/distributor read-back. Evidence: provenance suite. - [ ] E5.11 Build rights/consent/model/sample blast radius. Evidence: revoke preview reaches projects, clips, mixes, masters, releases, and catalog. - [ ] E5.11.a Ingest or draft exact rights/consent/model/sample change/ revocation/expiry/dispute event with evidence/scope/time/verification. Evidence: event contract. - [ ] E5.11.b Traverse versioned rights subject→sample/reference/run→media/ clip/take/stem→session/mix/master→release/delivery/catalog dependency graph. Evidence: impact query. - [ ] E5.11.c Include local/offline projects, frozen/bounced renders, collaborations/review links, provider copies, packages/distributors/ territories and unknown consumers. Evidence: coverage tests. - [ ] E5.11.d Show exact affected range/use/right/consent/model/territory/ target/current state/proposed remedy/owner/urgency with protected redaction. Evidence: preview UI. - [ ] E5.11.e Freeze read-only impact snapshot, reconcile to consumer/ capability registry, and require separate authorized remedy plan. Evidence: no-mutation tests. - [ ] E5.11.f Test complete project→clip→mix→master→release→catalog paths, stale/unauthorized/missing/offline nodes, and graph changes before execution. Evidence: blast-radius suite. - [ ] E5.12 Build quarantine, replacement, re-clearance, takedown, and correction workflows. Evidence: released-item journey. - [ ] E5.12.a Quarantine affected inputs/outputs/projects/jobs/exports/ delivery candidates by exact version/range while preserving evidence and authorized investigation access. Evidence: quarantine tests. - [ ] E5.12.b Create remedy plan with replace/edit/remove/re-record/regenerate/ relicense/reconsent/recredit/territory-limit/takedown actions and dependencies. Evidence: plan schema. - [ ] E5.12.c Implement replacement through new media/clip/mix/master/release revisions with provenance, semantic/audio diff, revalidation, and approvals. Evidence: replacement tests. - [ ] E5.12.d Re-clear or renew exact rights/consent/splits/model/sample uses with current parties/terms/signatures and no retroactive silent scope. Evidence: re-clearance tests. - [ ] E5.12.e Execute distributor/catalog/project/share takedown/restriction saga with per-target status, retry, read-back, history, and notices. Evidence: takedown tests. - [ ] E5.12.f Execute metadata/audio/provenance/credit correction/redelivery with prior/current versions and verified downstream state. Evidence: correction tests. - [ ] E5.12.g Run a released-item revocation→quarantine→replacement or takedown→re-clearance→redelivery journey with unresolved target closure blocking. Evidence: E2E. - [ ] E5.13 Protect contracts, identity, voiceprints, and unreleased media in logs, analytics, notifications, exports, and support tools. Evidence: redaction suite. - [ ] E5.13.a Classify exact protected fields/artifacts and allowed purpose/ roles/projections for each named observability/output/support surface. Evidence: redaction matrix. - [ ] E5.13.b Apply allowlisted structured logging/tracing/metrics with opaque IDs, payload scrubbing, sampling/retention/access, and no audio/text excerpts. Evidence: telemetry tests. - [ ] E5.13.c Apply cohort/privacy floors and prohibit identity/voiceprint/ contract/unreleased metadata dimensions or model-training reuse in analytics. Evidence: analytics tests. - [ ] E5.13.d Build permission-filtered notification templates/deep links/ previews with device/channel/lock-screen redaction and no existence leaks. Evidence: notification tests. - [ ] E5.13.e Build purpose-bound audited exports/support bundles with field/ file redaction, encryption, watermark, expiry, and safe diagnostics. Evidence: export/support tests. - [ ] E5.13.f Inspect UI/network/logs/traces/crash reports/cache/search/queue/ backups/notifications/exports/support across roles/tenants. Evidence: redaction suite. - [ ] E5.14 Build authorized, scoped, time-bounded waivers. Evidence: expired waiver invalidates release. - [ ] E5.14.a Define waiverable versus nonwaivable rights/consent/provenance/ technical/target rules and required authority by severity. Evidence: waiver policy. - [ ] E5.14.b Create waiver for exact subject/use/measurement/gate/profile/ project/release/territory/target/version with reason/evidence. Evidence: waiver schema. - [ ] E5.14.c Require qualified current human approver, step-up/independence/ quorum as applicable, compensating controls, conditions, and explicit expiry. Evidence: authority tests. - [ ] E5.14.d Store immutable signed record separately from underlying finding/ measurement/rights state and prevent agent/service impersonation. Evidence: integrity tests. - [ ] E5.14.e Invalidate on expiry/revocation/subject/profile/target/rights/ consent/approver/condition change and notify release owners. Evidence: lifecycle tests. - [ ] E5.14.f Recompute release eligibility and block delivery/catalog continuation when waiver is missing/stale/expired; preserve history. Evidence: release gate tests. ### E6 — Collaboration, review, realtime, and approvals - [ ] E6.1 Build project membership and role assignment. Evidence: least privilege and cross-project isolation. - [ ] E6.1.a Define membership identity/project/person/service/role/scope/ status/inviter/approver/effective/expiry and inheritance. Evidence: membership schema. - [ ] E6.1.b Implement invite/request/accept/decline/assign/change/suspend/ revoke/expire with identity verification and current project authority. Evidence: lifecycle tests. - [ ] E6.1.c Enforce least-privilege object/field/function/media/device/ rights/review/release permissions and role incompatibilities. Evidence: authorization tests. - [ ] E6.1.d Apply role changes to active sessions/offline caches/review links/ collaboration streams/jobs/search/downloads promptly. Evidence: revocation tests. - [ ] E6.1.e Test overlapping IDs/names and direct object/function/filter/ count/cache/websocket/media access across two projects/tenants. Evidence: isolation suite. - [ ] E6.2 Build presence, selection, transport-leader, and edit-lock semantics. Evidence: disconnect and stale-lock tests. - [ ] E6.2.a Define ephemeral presence/session/device/user/window/project/ workspace/last-seen/expiry and privacy-safe display. Evidence: presence contract. - [ ] E6.2.b Broadcast permission-filtered selection/cursor/playhead/range/ track/clip/score/lyric context with rate limits and no media/rights leakage. Evidence: selection tests. - [ ] E6.2.c Define transport leadership request/grant/transfer/revoke/expiry/ conflict and follower behavior for play/seek/record/loop/tempo. Evidence: leader state machine. - [ ] E6.2.d Define edit locks/reservations by data kind/range/object with optimistic operations where safe, owner/reason/lease/heartbeat/override. Evidence: lock contract. - [ ] E6.2.e Handle disconnect/sleep/crash/network partition/reconnect/role revoke with stale expiry, recovery, and no permanent lock or dual leader. Evidence: fault tests. - [ ] E6.2.f Announce ownership/lock changes accessibly and test two-client/ multi-window/realtime ordering/deduplication. Evidence: collaboration E2E. - [ ] E6.3 Build collaboration for score, lyrics, arrangement, clips, mix, rights, and release metadata. Evidence: conflict policy per data type. - [ ] E6.3.a Define operation schemas/identity/causality/checkpoints/ authorization for each named structured data type. Evidence: protocol contracts. - [ ] E6.3.b Choose CRDT/OT/optimistic concurrency/locks per data type based on semantic merge safety and document decisions. Evidence: conflict matrix. - [ ] E6.3.c Implement concurrent score/lyric/arrangement/clip edits with stable anchors/order/ranges/moves and deterministic convergence. Evidence: creative tests. - [ ] E6.3.d Implement mix graph/automation/device/routing edits with cycle/ parameter/version/transport safety and explicit semantic conflicts. Evidence: mix tests. - [ ] E6.3.e Implement rights/split/consent/release metadata changes through stricter expected-version/review/signature rules, never field-level blind merge. Evidence: governance tests. - [ ] E6.3.f Reauthorize/rebase/deduplicate offline operations, present mine/ theirs/base conflicts, preserve copies, audit, and invalidate approvals. Evidence: two-client suite. - [ ] E6.4 Build anchored comments on bars/beats, score events, lyric ranges, clips, time ranges, automation, devices, mixes, masters, and rights. Evidence: anchor survival. - [ ] E6.4.a Define comment/thread identity/subject kind/version/semantic anchor/author/visibility/state/mentions and immutable history. Evidence: comment schema. - [ ] E6.4.b Implement musical-time/score-event/lyric-range/clip-source/ sample-time/automation-point/device-parameter anchors. Evidence: anchor registry. - [ ] E6.4.c Implement mix/master revision and protected rights/contract/ split field anchors with role-filtered projections. Evidence: governed anchor tests. - [ ] E6.4.d Map anchors through insert/delete/move/stretch/tempo/comp/revision changes or mark ambiguous/orphaned with candidates, never silently retarget. Evidence: survival corpus. - [ ] E6.4.e Implement reply/mention/resolve/reopen/suggestion/notification/ deep-link/playback-focus behavior with redaction. Evidence: workflow tests. - [ ] E6.4.f Test web/desktop/offline/concurrent edits/export/archive/legal- hold and accessible keyboard/screen-reader journeys. Evidence: collaboration E2E. - [ ] E6.5 Build review versions and synchronized playback. Evidence: comment always refers to immutable audio/version. - [ ] E6.5.a Create immutable review manifest pinning project/arrangement/ session/mix/master/media/score/lyrics/metadata/rights/profile versions. Evidence: review version schema. - [ ] E6.5.b Generate or associate checksum-addressed review audio/video/ waveform/transcript/score proxies with exact range/layout/loudness profile. Evidence: proxy tests. - [ ] E6.5.c Synchronize play/pause/seek/loop/rate/playhead/time display and optional leader/follower across authorized reviewers with drift bounds. Evidence: playback tests. - [ ] E6.5.d Create comments/annotations only against immutable review version and exact time/musical/semantic anchor. Evidence: anchoring tests. - [ ] E6.5.e Show stale/superseded/missing/expired review versions distinctly and preserve previous playback/comments without retargeting. Evidence: lifecycle tests. - [ ] E6.5.f Test network jitter/reconnect/range requests/device change/ unauthorized download and screen-reader media controls. Evidence: review E2E. - [ ] E6.6 Build take, arrangement, mix, and master compare with level-matched playback where applicable. Evidence: comparison tests. - [ ] E6.6.a Select immutable compatible variants and resolve time/tempo/ arrangement/range/layout/source/profile/permission alignment. Evidence: compare contract. - [ ] E6.6.b Implement synchronized A/B/solo/blind/loop/scrub with transparent loudness/peak level matching and clip-safe gain. Evidence: playback tests. - [ ] E6.6.c Show take/comp/source, arrangement section/clip, mix graph/ automation, master settings/render/measurement semantic diffs. Evidence: structured diff tests. - [ ] E6.6.d Show provenance/rights/cost/gates/reviews/freshness and do not infer winner from loudness or similarity. Evidence: evidence compare. - [ ] E6.6.e Support comments and human select/reject/park/no-decision with stable links and no variant mutation. Evidence: decision tests. - [ ] E6.6.f Verify sample synchronization/level match/mono-spatial layouts, keyboard/screen-reader parity, and large media performance. Evidence: comparison suite. - [ ] E6.7 Build review templates for creative, performance, engineering, mix, master, rights, accessibility/metadata, label, and distribution. Evidence: role/quorum matrix. - [ ] E6.7.a Define versioned template identity/applicability/priority and required checklist/measurement/gate/evidence/reviewer/decision fields. Evidence: template schema. - [ ] E6.7.b Define independent creative/performance/engineering/mix/master/ rights/accessibility-metadata/label/distribution scopes. Evidence: template registry. - [ ] E6.7.c Resolve templates by project/release profile/risk/territory/ target/host/version and compose code/policy-owned floors. Evidence: resolution tests. - [ ] E6.7.d Define reviewer role/credential/domain/independence/recusal/ quorum/order/deadline/delegate and nondelegable human decisions. Evidence: role/quorum matrix. - [ ] E6.7.e Govern draft/review/approve/activate/supersede/deprecate/migrate/ expire with immutable versions and impact preview. Evidence: governance tests. - [ ] E6.7.f Preview exact review plan and fail missing/conflicting/ unversioned requirements. Evidence: review-plan gate. - [ ] E6.8 Build approval locks and invalidation on dependent change. Evidence: source mix or rights change invalidates master/release signoff. - [ ] E6.8.a Build transitive dependency manifest/hash for each approval over exact project/media/score/lyrics/session/mix/master/rights/profile/ release versions. Evidence: lock contract. - [ ] E6.8.b Acquire immutable approval lock at decision with actor/role/ scope/conditions/signature/time and prohibit manifest mutation. Evidence: approval tests. - [ ] E6.8.c Subscribe/reconcile dependency changes and map materiality to stale/invalidate/review-required per approval type. Evidence: invalidation rules. - [ ] E6.8.d Atomically recheck dependencies before render/delivery/release/ takedown execution to close race windows. Evidence: race tests. - [ ] E6.8.e Surface exact invalidating dependency/version/change/affected approval/remediation and notify responsible reviewers safely. Evidence: status tests. - [ ] E6.8.f Verify source mix/media/plugin/profile/rights/consent/splits/ metadata/target change scenarios and immutable prior approvals. Evidence: dependency suite. - [ ] E6.9 Build collaborator invites, guest review links, expiry, watermark, download control, and revocation. Evidence: link security tests. - [ ] E6.9.a Define invite/link identity/purpose/project/review version/ recipient-role/allowed fields-actions/expiry/max uses/device/session and revocation. Evidence: access schema. - [ ] E6.9.b Issue high-entropy signed single/multi-use links with no secret in analytics/referrer/logs, optional identity proof/step-up, and safe landing. Evidence: link tests. - [ ] E6.9.c Apply permission-filtered media/score/lyrics/comment review view, dynamic visible/audible watermark, redacted rights/unreleased metadata, and no project mutation. Evidence: guest view. - [ ] E6.9.d Enforce stream/range/download/original/proxy limits, expiration/ offline caching/print/copy controls, and truthful screenshot limits. Evidence: download tests. - [ ] E6.9.e Revoke immediately across active sessions/cache/CDN/signed media URLs and audit attempts/success without sensitive payload. Evidence: revocation tests. - [ ] E6.9.f Test guessing/replay/forwarding/cross-project/substitution/ expired/revoked/referrer/log/watermark bypass and role change. Evidence: link security suite. - [ ] E6.10 Build notifications with unreleased-content redaction and quiet hours. Evidence: routing fixtures. - [ ] E6.10.a Define event/template/channel/recipient/urgency/dedupe/expiry/ action schema and per-data-class redaction rules. Evidence: notification contracts. - [ ] E6.10.b Resolve current project membership/role/rights access/device/ channel/preferences/locale/time zone before rendering/delivery. Evidence: recipient tests. - [ ] E6.10.c Redact titles/artists/file names/audio/waveforms/lyrics/ contracts/voice/model/release dates and use opaque authenticated deep links as required. Evidence: redaction tests. - [ ] E6.10.d Apply quiet hours/frequency/dedupe/digest with narrowly defined recording/live/safety/release emergency override authority. Evidence: routing tests. - [ ] E6.10.e Deliver idempotently with provider acknowledgment/retry/ suppression/bounce and mark partial/failed honestly. Evidence: delivery tests. - [ ] E6.10.f Test lock-screen/email/push/in-app/webhook/log/analytics projections, role revoke, project archive, and two projects. Evidence: routing fixtures. - [ ] E6.11 Build realtime session health and graceful degradation. Evidence: collaboration outage keeps local work safe. - [ ] E6.11.a Define realtime connection/auth/protocol/peer/leader/clock/ operation queue/ack/lag/presence/quality state and telemetry. Evidence: health contract. - [ ] E6.11.b Measure RTT/jitter/loss/reconnect/operation backlog/ack age/ clock drift/audio dropout and calibrate healthy/degraded/offline thresholds. Evidence: health tests. - [ ] E6.11.c Show persistent accessible connection/sync/leader/unsynced edit/ recording safety state with actionable diagnosis and no false online. Evidence: UI tests. - [ ] E6.11.d Degrade presence/live cursors/synchronized playback/audio monitor first while preserving local edit/record/autosave/export where safe. Evidence: degradation tests. - [ ] E6.11.e Queue local operations/media durably and reauthenticate/ reauthorize/rebase/dedupe/conflict-resolve on reconnect. Evidence: recovery tests. - [ ] E6.11.f Inject service outage/partition/high jitter/protocol skew/leader loss/role revoke/storage pressure and prove local work remains safe. Evidence: outage suite. - [ ] E6.12 Build immutable review and approval audit. Evidence: automation cannot impersonate a named approver. - [ ] E6.12.a Define append-only review/decision/approval/waiver event with actor identity/role/scope/subject manifest/action/reason/evidence/time/ signature. Evidence: audit schema. - [ ] E6.12.b Capture comments/checklists/measurements/changes/conditions/ conflicts/recusals/quorum and exact versions through transactional outbox. Evidence: audit tests. - [ ] E6.12.c Chain/hash/sign events or manifests, preserve ordering/ supersession/revocation, and prohibit update/delete of history. Evidence: tamper tests. - [ ] E6.12.d Build protected/redacted permissioned audit query/export with stable cursor/completeness/version and no contract/voice/media leak. Evidence: projection tests. - [ ] E6.12.e Attempt model/agent/service account/header/DB replay/identity/ role/signature impersonation and prove rejection/no side effect. Evidence: non-impersonation tests. - [ ] E6.12.f Verify backup/restore/replay/version migration/completeness and independent tamper detection. Evidence: integrity report. - [ ] E6.13 Build remote rehearsal/recording and live collaboration with clock/tempo authority, cueing, low-latency monitor versus quality-recording paths, dropout concealment, local capture, upload, alignment, consent, and reconnect. Evidence: network-impairment tests preserve the authoritative recordings. - [ ] E6.13.a Define remote session/participant/role/device/route/clock/ transport/tempo/cue/recording/consent/security and capability profile. Evidence: session contract. - [ ] E6.13.b Enroll/calibrate participant audio/MIDI devices, input levels/ channels/clock/round-trip latency, permissions, and performer consent. Evidence: setup journey. - [ ] E6.13.c Elect/transfer clock-tempo-transport authority and distribute count-in/click/cues/markers/talkback with drift/jitter bounds. Evidence: sync tests. - [ ] E6.13.d Separate low-latency monitor stream from local quality recording, label codec/dropout concealment, and never treat monitor capture as authoritative. Evidence: path tests. - [ ] E6.13.e Record crash-safe local originals with checksums/device/session/ performer provenance, upload resumably, deduplicate, and retain consent scope. Evidence: capture tests. - [ ] E6.13.f Align takes using clocks/cues/correlation/manual correction with confidence, preserving raw timing and dropout/missing spans. Evidence: alignment tests. - [ ] E6.13.g Handle disconnect/reconnect/leader loss/network partition/ device change/role revoke with local continuity and no duplicate or lost takes. Evidence: recovery tests. - [ ] E6.13.h Run latency/jitter/loss/reorder/bandwidth/outage/clock drift/ process crash tests and verify authoritative local recordings. Evidence: impairment report. - [ ] E6.14 Build stage/performance mode for set list, scene/patch changes, stems/click/cues, MIDI/OSC/lighting control where ratified, redundancy, rehearsal, operator lockout, emergency stop, recording, and post-show ingest. Evidence: safe device-control allowlists and offline/failover drills. - [ ] E6.14.a Define locked show/set/song/scene/cue/stem/click/patch/control/ device/operator/revision manifest and performance capability profile. Evidence: show contract. - [ ] E6.14.b Build set-list/scene transition/rehearsal editor with preflight for media/plugins/presets/devices/routes/tempo/timecode/rights and offline package. Evidence: preflight tests. - [ ] E6.14.c Implement sample-accurate stem/click/cue playback and safe quantized/manual scene/patch changes with redundant local media/ transport. Evidence: playback tests. - [ ] E6.14.d Implement allowlisted typed MIDI/OSC/lighting or ratified controls with target/range/rate/state/ack/feedback-loop constraints. Evidence: device control tests. - [ ] E6.14.e Lock operator UI/actions/permissions during show, require step-up for dangerous changes, and provide immediate audio/control emergency stop/manual fallback. Evidence: safety tests. - [ ] E6.14.f Implement primary/backup device/computer/audio/output/clock/ power/network failover with health, rehearsal, switchover, and rollback. Evidence: redundancy drills. - [ ] E6.14.g Record program/stems/MIDI/control/operator/incident timeline locally with consent/provenance and ingest/reconcile post-show. Evidence: recording tests. - [ ] E6.14.h Run offline/device/plugin/media/clock/network/controller/crash/ failover/emergency-stop drills and prove no unauthorized commands. Evidence: stage game-day. ### E7 — Persistence, APIs, rendering, and distribution - [ ] E7.1 Decide authoritative project, media, rights, collaboration, and release stores. Evidence: ownership ADR. - [x] E7.1.a Inventory current local/OPFS/desktop/database/blob/index/cache/ realtime/provider/distributor records and all writers/readers. Evidence: storage inventory. - [ ] E7.1.b Define authoritative aggregate/transaction ownership, immutable/ mutable data, durability/latency class, and offline replica per domain. Evidence: ownership matrix. - [ ] E7.1.c Define media/blob versus project graph, rights/protected records, collaboration operations/checkpoints, and release/delivery boundaries. Evidence: data architecture. - [ ] E7.1.d Define derived waveform/search/read model/cache/distributor projections, freshness/rebuild/reconciliation, and forbidden reverse writes. Evidence: projection contracts. - [ ] E7.1.e Resolve duplicate ownership/migrations/outbox/saga/backups/ recovery/region/encryption and accountable services. Evidence: approved ADR. - [ ] E7.2 Add missing schemas and migrations without duplicating the existing DAW project model. Evidence: old-project migration rehearsal. - [ ] E7.2.a Derive missing durable entities/columns/indexes/constraints from canonical contracts and required queries while reusing existing project aggregate. Evidence: schema diff. - [ ] E7.2.b Define adapter/reference boundaries from normalized service data to embedded DAW project state; prohibit a parallel session graph. Evidence: model review. - [ ] E7.2.c Design expand/backfill/dual-read-write/switch/contract migrations with chunking/checkpoints/idempotency/throttling/rollback. Evidence: migration plan. - [ ] E7.2.d Preserve timing/media hashes/device state/automation/rights/ provenance/history and validate references/state mappings. Evidence: migration tests. - [ ] E7.2.e Rehearse old/large/missing-plugin/offline/concurrent projects on production-equivalent stores and compare semantic/audio goldens. Evidence: rehearsal report. - [ ] E7.2.f Roll out with metrics/reconciliation/stop conditions and remove legacy paths only after browser/desktop/realtime/render compatibility. Evidence: migration gate. - [ ] E7.3 Store large media as immutable checksum-addressed blobs with resumable upload and derived proxies. Evidence: byte rehash and recovery. - [ ] E7.3.a Define blob identity/hash algorithm/tenant/project/data class/ size/type/original filename/source/rights/retention/encryption/region. Evidence: blob schema. - [ ] E7.3.b Implement multipart/chunk resumable upload with content range/ per-chunk and final hash/size/type/quota/idempotency/session expiry. Evidence: upload tests. - [ ] E7.3.c Quarantine/scan/probe originals before available use and commit metadata/reference only after durable complete blob. Evidence: completion tests. - [ ] E7.3.d Generate waveform/proxy/transcode/analysis derivatives with immutable parent/hash/tool/profile/version lineage and independent failure. Evidence: proxy tests. - [ ] E7.3.e Serve authorized range/stream/download via short-lived scoped URLs or service path with no cross-project/cache/path leakage. Evidence: access tests. - [ ] E7.3.f Inject interrupted/duplicate/out-of-order/corrupt upload, process crash, blob/database mismatch, restore, and rehash all bytes. Evidence: recovery suite. - [ ] E7.4 Implement project/session/revision APIs with optimistic concurrency. Evidence: contract suite. - [ ] E7.4.a Define versioned create/read/query/patch/command/transition/ snapshot/diff contracts, errors, idempotency, pagination, and limits. Evidence: API schemas. - [ ] E7.4.b Enforce tenant/project/role/object/field/function/host capability/ maturity authorization and redacted projections. Evidence: auth tests. - [ ] E7.4.c Require expected version/ETag or operation causality for mutation, return structured current/conflict, and prevent silent overwrite. Evidence: concurrency tests. - [ ] E7.4.d Persist immutable revisions/operations/audit/outbox atomically with durable-before-ack and stable media references. Evidence: durability tests. - [ ] E7.4.e Support batch/command transactions and validate timing/routing/ state invariants server-side rather than trusting client. Evidence: invariant tests. - [ ] E7.4.f Test retries/timeout-after-commit/stale/offline replay/mass assignment/cross-project/unknown/oversized/version skew. Evidence: contract suite. - [ ] E7.5 Implement media ingest, analysis, proxy, render, bounce, mix, and master jobs. Evidence: durable job fault tests. - [ ] E7.5.a Define distinct versioned job request/run/attempt/step/result/ artifact contracts pinned to project/media/range/profile/dependencies/ rights. Evidence: job schemas. - [ ] E7.5.b Implement durable queue/lease/heartbeat/timeout/retry/backoff/ cancellation/idempotency/priority/concurrency/resource/budget controls. Evidence: worker tests. - [ ] E7.5.c Implement quarantine ingest/probe/analyze/proxy jobs with immutable source/derivative provenance and safe parser isolation. Evidence: ingest pipeline. - [ ] E7.5.d Implement render/bounce/mix/master jobs with exact graph/plugin/ state/sample-rate/layout/range/tails/profile and deterministic manifest. Evidence: render pipeline. - [ ] E7.5.e Persist progress/logs/measurements/artifacts/cost/terminal state before acknowledgment and verify hashes/format/audio output. Evidence: result tests. - [ ] E7.5.f Inject database/blob/queue/worker/plugin/provider/device/resource/ cancellation/timeout-after-commit faults and recover/replay safely. Evidence: fault suite. - [ ] E7.6 Implement rights, consent, splits, and provenance APIs with property-level authorization. Evidence: protected-field tests. - [ ] E7.6.a Define versioned resource/command/query/review/sign/revoke/ blast-radius contracts and canonical kind/state/value validation. Evidence: API schemas. - [ ] E7.6.b Separate public credits/safe rights projection from protected identity/contact/contracts/voiceprints/signatures/payment fields. Evidence: projection contracts. - [ ] E7.6.c Enforce tenant/project/role/purpose/object/field/function/ territory/state/compartment authorization on read/write/filter/sort/ export. Evidence: property auth tests. - [ ] E7.6.d Implement expected-version/idempotency/immutable revisions/ signatures/audit/outbox and prevent mass assignment or direct approval state. Evidence: mutation tests. - [ ] E7.6.e Emit redacted versioned invalidation/revocation events to project/ job/review/release/catalog consumers. Evidence: integration tests. - [ ] E7.6.f Test BOLA/existence/count/snippet/filter/error/cache/log/batch/ revoked grant/two-project access. Evidence: protected-field suite. - [ ] E7.7 Implement permission-aware project, asset, sample, and catalog search. Evidence: unreleased metadata does not leak. - [ ] E7.7.a Define document/field classification, tenant/project/catalog/ role/right/release/territory/compartment ACL, freshness, locale, and deletion schema. Evidence: search model. - [ ] E7.7.b Index only allowlisted projections from authoritative events with content/version hashes and protected contract/voice/unreleased fields excluded. Evidence: indexing tests. - [ ] E7.7.c Apply authorization before retrieval/aggregation/ranking/ highlighting/vector search and stable cursor pagination. Evidence: query tests. - [ ] E7.7.d Prevent autocomplete/suggestion/snippet/count/facet/timing/cache/ analytics/log leaks of unreleased or cross-project items. Evidence: leakage tests. - [ ] E7.7.e Process role/release/territory/rights/revocation/takedown/delete promptly and reconcile index to source of truth. Evidence: update tests. - [ ] E7.7.f Run two-tenant/project/multi-role/existence-oracle/BOLA/ injection/stale-index/large-catalog adversarial suite. Evidence: search report. - [ ] E7.8 Implement realtime collaboration protocol versioning and recovery. Evidence: version-skew tests. - [ ] E7.8.a Define handshake/protocol/schema/capability/host/client versions, auth/session/project/actor IDs, resume cursor, and support window. Evidence: protocol contract. - [ ] E7.8.b Version operation/event/error/presence/selection/leader/lock/ checkpoint/ack envelopes with unknown-field/type handling. Evidence: message schemas. - [ ] E7.8.c Negotiate compatible subset or fail/read-only/export explicitly; never silently reinterpret musical timing or rights operations. Evidence: negotiation tests. - [ ] E7.8.d Persist/resume operations with ordering/causality/deduplication/ replay/checkpoints/compaction and current authorization. Evidence: recovery tests. - [ ] E7.8.e Rebase/migrate queued old-client/offline operations or surface semantic conflict/copied project without data loss. Evidence: migration tests. - [ ] E7.8.f Test old/new web/desktop/service combinations, rolling deploy, reconnect after history compaction, unknown messages, and role revoke. Evidence: version-skew suite. - [ ] E7.9 Implement deterministic release bundle assembly. Evidence: audio, artwork, metadata, rights, provenance, and delivery hash goldens. - [ ] E7.9.a Create immutable release candidate manifest pinning sequence/ recordings/masters/renditions/artwork/lyrics/credits/metadata/rights/ splits/consent/provenance/profiles/targets. Evidence: candidate schema. - [ ] E7.9.b Resolve target/territory/locale-specific files/metadata/ identifiers/advisories/rights/disclosures and explicit loss/ unsupported state. Evidence: resolution tests. - [ ] E7.9.c Render/copy/package only checksum-verified immutable artifacts with canonical names/paths/order/permissions and no hidden mutable source. Evidence: assembly tests. - [ ] E7.9.d Generate canonical manifest and per-file/package hashes/ signatures/C2PA or ledger references plus tool/config/build versions. Evidence: hash goldens. - [ ] E7.9.e Verify target format/loudness/metadata/artwork/rights/DDEX/ provenance and compare package to locked candidate before approval. Evidence: bundle gate. - [ ] E7.9.f Rebuild from same inputs across workers and compare bytes/hashes or explicitly documented nondeterministic fields. Evidence: determinism tests. - [ ] E7.10 Implement DDEX ERN generation/validation for the ratified profile. Evidence: new release, update, takedown, and territory fixtures. - [ ] E7.10.a Pin DDEX ERN/profile/code-list/namespace/schema/validator/ partner-extension versions and internal mapping owner. Evidence: profile manifest. - [ ] E7.10.b Map parties/contributors/works/recordings/releases/resources/ identifiers/titles/genres/languages/rights/territories/deals/technical details. Evidence: mapping tests. - [ ] E7.10.c Generate deterministic new-release message with stable message/ party/resource/release IDs and target-specific resource files. Evidence: new release golden. - [ ] E7.10.d Generate update/redelivery/metadata correction/audio replacement/ territory addition-removal/takedown lifecycle messages with prior relationships. Evidence: lifecycle goldens. - [ ] E7.10.e Validate schema/profile/cardinality/codes/dates/territories/ identifiers/deals/resources/checksums/rights and safe extensions. Evidence: validator tests. - [ ] E7.10.f Round-trip through sandbox/contract distributor, reconcile acknowledgments/content acceptance, and expose unsupported loss. Evidence: conformance report. - [ ] E7.11 Implement distributor adapters with plan, deliver, acknowledge, reconcile, retry, and compensate. Evidence: partial failure tests. - [ ] E7.11.a Define per-distributor/version/account/territory/target capabilities, credentials, DDEX/API/SFTP transport, limits, schedules, and unsupported operations. Evidence: adapter profiles. - [ ] E7.11.b Build read-only delivery plan from locked bundle with messages/ files/metadata/actions/dependencies/idempotency/expected current state/ costs/loss. Evidence: plan tests. - [ ] E7.11.c Deliver in dependency order with resumable transfer, retries/ backoff/rate, checksums, signed requests, acknowledgments, and durable per-action status. Evidence: delivery tests. - [ ] E7.11.d Parse transport/message/resource/content acknowledgments and errors without treating receipt as release acceptance. Evidence: acknowledgment tests. - [ ] E7.11.e Query/read back catalog/territory/metadata/resource/availability state and semantic-compare to plan. Evidence: reconciliation tests. - [ ] E7.11.f Compensate only safe reversible actions, retain partial release and operator remediation otherwise, with idempotent retry/replay. Evidence: partial failure suite. - [ ] E7.12 Implement read-back/acknowledgement verification per distributor. Evidence: accepted transport without accepted content is not success. - [ ] E7.12.a Define distributor-specific acknowledgment layers/codes/ correlation IDs/status transitions/timing and independent read-back capability. Evidence: verification contracts. - [ ] E7.12.b Correlate transport/file/message/resource/release/deal/territory acknowledgments to exact delivery action and immutable bundle. Evidence: correlation tests. - [ ] E7.12.c Read back identifiers/sequence/titles/contributors/audio/ artwork/metadata/rights/territory/date/advisory/provenance/catalog state. Evidence: content tests. - [ ] E7.12.d Semantic-compare with target-specific transforms/tolerances and classify accepted/processing/partial/rejected/mismatch/unknown. Evidence: comparator tests. - [ ] E7.12.e Keep release/target unresolved until required content/territory state is accepted and verified; expose owner/retry/escalation. Evidence: closure tests. - [ ] E7.12.f Test transport-accepted/content-rejected, delayed processing, contradictory callbacks, stale read-back, rate/auth outage, and manual reconciliation. Evidence: verification suite. - [ ] E7.13 Implement takedown, redelivery, metadata correction, audio replacement, and territory change sagas. Evidence: idempotent recovery. - [ ] E7.13.a Define distinct remedy requests/authority/reason/scope/release/ target/territory/effective time/desired state and immutable plans. Evidence: saga schemas. - [ ] E7.13.b Generate target-specific dependency actions/messages/files/ notices/idempotency keys/preconditions/expected versions and impact. Evidence: plan tests. - [ ] E7.13.c Execute takedown and territory add/remove/restrict with per- target status/history/read-back and no deletion of internal evidence. Evidence: availability tests. - [ ] E7.13.d Execute redelivery/metadata correction/audio replacement with new bundle/version/provenance/QC/rights and prior relationship. Evidence: update tests. - [ ] E7.13.e Handle duplicate/out-of-order/delayed acknowledgments, timeout after commit, partial targets, retries/backoff/cancel/compensation. Evidence: fault tests. - [ ] E7.13.f Replay from durable checkpoints and reconcile distributor/ catalog/search/read models without duplicate delivery or stale resurrection. Evidence: recovery tests. - [ ] E7.14 Implement two-tenant/project isolation across APIs, blobs, search, collaboration, review links, rendering, and distribution. Evidence: integration suite. - [ ] E7.14.a Create two tenants/projects with overlapping IDs/names/media/ rights/roles/plugins/jobs/releases/distributor accounts. Evidence: isolation fixture. - [ ] E7.14.b Test API object/property/function/filter/sort/batch/cache/offline replay and service-account authorization. Evidence: API isolation. - [ ] E7.14.c Test blob upload/range/proxy/waveform/download/signed URL/key/ path/metadata/backup substitution. Evidence: media isolation. - [ ] E7.14.d Test search suggestions/snippets/counts/facets/vectors/timing and collaboration websocket/operations/presence/locks/review links. Evidence: discovery/realtime isolation. - [ ] E7.14.e Test render/provider/plugin/job queue/payload/artifact/log/ metrics/dead-letter/callback project context. Evidence: worker isolation. - [ ] E7.14.f Test distributor accounts/credentials/bundles/messages/ acknowledgments/read-back/takedown and catalog projections. Evidence: delivery isolation. - [ ] E7.14.g Attempt guessed IDs/stale grants/admin/emergency/cache poisoning/ deep links/cross-project relationships. Evidence: integration suite. - [ ] E7.15 Generate API and realtime consumer contracts. Evidence: Studio, service, desktop, and distributor drift gates. - [ ] E7.15.a Generate canonical OpenAPI plus realtime message/state/capability schemas from authoritative route/domain contracts with stable IDs. Evidence: contract artifacts. - [ ] E7.15.b Produce Studio/service/desktop/render-worker/provider/ distributor audience projections without protected internal fields. Evidence: consumer schemas. - [ ] E7.15.c Add requests/responses/errors/events/commands/fixtures and generated clients/types pinned to exact spec/version digest. Evidence: fixtures. - [ ] E7.15.d Run schema lint/breaking-change/server conformance/unknown route- message/unimplemented operation tests. Evidence: provider gate. - [ ] E7.15.e Run web/desktop/service/worker/distributor compile and semantic contract tests across supported version skew. Evidence: consumer gates. - [ ] E7.15.f Fail CI on drift, protected-field exposure, orphan operation, stale generated code, unsafe incompatibility, or unversioned protocol. Evidence: drift gates. ### E8 — Release calendar, catalog, analytics, and operations - [ ] E8.1 Build release calendar for recording, mix, master, rights, artwork, marketing, delivery, embargo, and street date. Evidence: dependency and time-zone tests. - [ ] E8.1.a Define typed calendar item/reference for each named milestone/ window with owner/status/start/end/deadline/time zone/recurrence and exact subject revision. Evidence: calendar schema. - [ ] E8.1.b Build permissioned day/week/month/agenda views with stable project/artist/label/owner/type/status/territory/target filters and unreleased redaction. Evidence: view tests. - [ ] E8.1.c Create/edit/reschedule/assign through owned workflows with dependency/rights/embargo/capacity/target/impact preview, concurrency, and audit. Evidence: action tests. - [ ] E8.1.d Compute critical path/readiness/conflicts/slack/missed window/ escalation without converting the calendar into release authority. Evidence: dependency tests. - [ ] E8.1.e Handle UTC/local/label/distributor/territory time zones, DST, ambiguous/nonexistent times, street-date rules, and embargo events. Evidence: temporal tests. - [ ] E8.1.f Provide agenda/table/forms/non-drag alternatives and run record→ mix→master→rights→delivery→street-date journey. Evidence: accessible E2E. - [ ] E8.2 Build studio, engineer, performer, review, render, and delivery capacity reservations. Evidence: committed slots cannot overbook. - [ ] E8.2.a Define resource/skill/credential/device/room/worker/distributor capacity, calendar/time zone/availability/privacy, and units. Evidence: capacity schema. - [ ] E8.2.b Define tentative/held/committed/released/expired reservation with project/session/review/job/delivery/window/units/priority/dependencies. Evidence: reservation contract. - [ ] E8.2.c Check studio/engineer/performer/equipment/consent/travel/review/ render resource and distributor window constraints. Evidence: eligibility tests. - [ ] E8.2.d Commit atomically under concurrent booking, enforce exclusive/ pooled capacity and prevent double booking or worker oversubscription. Evidence: concurrency tests. - [ ] E8.2.e Reschedule/reassign/cancel/overbook-exception with impact, authority, notifications, cost, and audit. Evidence: operations tests. - [ ] E8.2.f Test cross-time-zone/recurring/partial capacity/outage/role revoke/deadline conflict and release of stale holds. Evidence: capacity suite. - [ ] E8.3 Build album/EP/single/playlist sequencing and versioned curation. Evidence: deterministic catalog bundle. - [ ] E8.3.a Define product/sequence/version/type/disc-side/position/ transition/gap/hidden-bonus/locale/territory/window/state schema. Evidence: curation contract. - [ ] E8.3.b Select exact recording/master/version/ISRC/assets/rights/ metadata and add/remove/reorder/group using drag and equivalent commands. Evidence: editor tests. - [ ] E8.3.c Validate duplicate/identifier/version/territory/rights/advisory/ loudness-gap-continuity/format/target and playlist-specific rules. Evidence: eligibility tests. - [ ] E8.3.d Preview synchronized sequence/transitions/crossfades/gaps/ metadata/artwork/credits and accessible ordered list. Evidence: preview tests. - [ ] E8.3.e Review/approve immutable version with semantic/audio diff and invalidate on track/master/rights/metadata/profile change. Evidence: review tests. - [ ] E8.3.f Assemble repeated builds from same inputs and compare order/ metadata/files/hashes or declared nondeterminism. Evidence: deterministic bundle. - [ ] E8.4 Build catalog search, relation, version, territory, rights, status, takedown, and replacement views. Evidence: permission-aware queries. - [ ] E8.4.a Define permission-filtered catalog read model with work/recording/ release/version/party/identifier/territory/rights/status/remedy/ replacement/freshness fields. Evidence: catalog contract. - [ ] E8.4.b Implement text/identifier/facet/semantic search with stable pagination/sorts/suggestions and unreleased/protected/territory authorization before retrieval. Evidence: search tests. - [ ] E8.4.c Show work↔recording↔version↔release↔product/artist/label/ contributor/sample/provenance relationships with temporal validity. Evidence: relation views. - [ ] E8.4.d Show per-territory/right-type/party/window eligibility, disputes/ expiry/waivers and redacted evidence without collapsing work/master. Evidence: rights views. - [ ] E8.4.e Show per-distributor/target status/ack/read-back/delivery history/ errors plus takedown/correction/replacement lineage. Evidence: status views. - [ ] E8.4.f Test unauthorized titles/counts/snippets/facets/relations, stale index, correction/takedown propagation, large catalog, and semantic accessibility. Evidence: query suite. - [ ] E8.5 Build project/release dashboards around action, gate, schedule, delivery, and incident status. Evidence: no decorative card mosaic. - [ ] E8.5.a Define primary triage questions and live queues for assigned work/ blockers/gate failures/upcoming dependencies/delivery exceptions/ rights incidents with owners/times/severity. Evidence: dashboard contract. - [ ] E8.5.b Compose restrained task-led hierarchy with urgent actionable work first, project/release context and secondary metrics second, no hero or repeated card mosaic. Evidence: design review. - [ ] E8.5.c Implement stable filters/sorts/grouping/URLs/freshness/live updates and permissioned unreleased/rights/cost projections. Evidence: query tests. - [ ] E8.5.d Implement authorized open/claim/assign/remediate/retry/hold/ cancel/escalate/review actions with state/version/impact/reason/ confirmation. Evidence: action tests. - [ ] E8.5.e Render loading/empty/stale/offline/degraded/partial/unauthorized/ fixture/error honestly with accessible recovery. Evidence: state tests. - [ ] E8.5.f Verify wide/compact/single-column, keyboard/screen reader, scale/ live updates, and no sensitive count/title leaks. Evidence: frontend conformance E2E. - [ ] E8.6 Build metadata/localization workflow for title, contributors, lyrics, advisories, artwork, credits, and territory. Evidence: locale and distributor parity. - [ ] E8.6.a Define locale variant pinned to release/work/recording/master/ lyrics/credits/artwork/rights/target/profile revisions. Evidence: locale manifest. - [ ] E8.6.b Edit title/subtitle/version/phonetic/sort/contributor names/roles/ order/credits and identifier display with language/script rules. Evidence: metadata editor tests. - [ ] E8.6.c Translate/transliterate/adapt lyrics with segment/timing/ pronunciation/prosody/meaning/explicit advisory parity and human provenance. Evidence: lyric locale tests. - [ ] E8.6.d Localize artwork/text/advisory/credits/descriptions with rights/ territory/target safe areas and accessibility. Evidence: asset tests. - [ ] E8.6.e Review terminology/names/claims-like factual metadata/rights/ advisories/locale completeness and exact target field transformations. Evidence: locale review. - [ ] E8.6.f Preview/generate/read back DDEX/distributor/catalog locale cells, report unsupported/drop/normalization, and block parity gaps. Evidence: distributor parity suite. - [ ] E8.7 Instrument audio engine, save, collaboration, render, gate, review, delivery, rights, and takedown traces/metrics. Evidence: bounded schema. - [ ] E8.7.a Define versioned allowlisted event/metric/span schemas, units/ dimensions/sampling/retention/access/owner and prohibited audio/lyrics/ rights/identity fields. Evidence: telemetry catalog. - [ ] E8.7.b Instrument audio engine lifecycle/device/buffer/sample rate/xrun/ glitch/latency/CPU safely outside realtime critical work. Evidence: engine telemetry. - [ ] E8.7.c Instrument save/autosave/media upload/durability/offline/recovery and collaboration connection/lag/queue/conflict/convergence. Evidence: editing telemetry. - [ ] E8.7.d Instrument render/bounce/mix/master jobs and gates/reviews/ approvals with versions/progress/resources/cost/outcome/reasons. Evidence: pipeline telemetry. - [ ] E8.7.e Instrument rights/consent/splits/expiry/revocation workload and delivery/ack/read-back/takedown/correction per-target state using opaque IDs. Evidence: release telemetry. - [ ] E8.7.f Propagate trace context through web/desktop/native/service/queue/ worker/provider/distributor without protected payload. Evidence: trace tests. - [ ] E8.7.g Validate known-value metrics/cardinality/overhead/redaction/ deletion/two-tenant access and obtain privacy/audio review. Evidence: bounded schema gate. - [ ] E8.8 Define SLOs for save durability, audio glitches, collaboration, render, master QC, delivery, and catalog correction. Evidence: error-budget policy. - [ ] E8.8.a Define acknowledged-save survival/recovery-loss and media upload/ project revision durability objectives. Evidence: durability SLO. - [ ] E8.8.b Define audio xrun/glitch/dropout/input-monitor/transport objectives by supported host/device/buffer/project scenario. Evidence: audio SLO. - [ ] E8.8.c Define collaboration availability/operation latency/lag/ convergence/reconnect/conflict and local-safety objectives. Evidence: realtime SLO. - [ ] E8.8.d Define render queue/start/completion/failure/resource and master QC evaluator availability/freshness/reproducibility objectives. Evidence: production SLO. - [ ] E8.8.e Define delivery/ack/content read-back and catalog correction/ takedown propagation/closure objectives per target. Evidence: distribution SLO. - [ ] E8.8.f Define windows/denominators/exclusions/slices/data sources/ uncertainty/alerts and quality guardrails. Evidence: measurement policy. - [ ] E8.8.g Define error budgets, stop-the-line, rollout/fallback/disable/ remediation/owner and prohibit throughput from overriding audio/ rights/release correctness. Evidence: error-budget policy. - [ ] E8.9 Build cost attribution for storage, egress, providers, rendering, mastering, collaboration, and distribution. Evidence: reconciliation. - [ ] E8.9.a Define cost event/source/invoice/usage unit/currency/rate/version/ time/tenant/project/job/provider/target and allocation policy. Evidence: cost contract. - [ ] E8.9.b Meter original/proxy/render/archive storage and upload/download/ stream/distributor/provider egress with dedupe/shared allocation. Evidence: infrastructure costs. - [ ] E8.9.c Attribute provider/model/analyzer/mastering/render-worker CPU- GPU/time/licence/token/currency cost to immutable jobs/attempts/outputs. Evidence: job costs. - [ ] E8.9.d Attribute collaboration/realtime/relay/recording and distributor/ delivery/message/territory/transaction costs. Evidence: service costs. - [ ] E8.9.e Show estimated/authorized/accrued/final/late/adjusted/refunded costs with units/currency/FX/date and role-filtered project/release rollups. Evidence: cost views. - [ ] E8.9.f Reconcile usage to provider invoices/accounts/credits with tolerance, unknown/unallocated/duplicate/late charges and auditable corrections. Evidence: reconciliation report. - [ ] E8.10 Build backup/restore for projects, media, rights, audit, and release records. Evidence: consistent restore drill. - [ ] E8.10.a Define protected data/services, cadence/retention/encryption/ immutability/region/key access/recovery order/RPO/RTO and owners. Evidence: backup policy. - [ ] E8.10.b Back up database/project operations/snapshots, immutable media/ proxies/manifests, rights/contracts/signatures, audit, jobs/releases/ delivery state and configuration references. Evidence: backup tests. - [ ] E8.10.c Restore selected point/full/incremental sets into isolated environment with tenant/project/key/identity mapping and no production side effects. Evidence: restore trace. - [ ] E8.10.d Reconcile project graph/media hashes/plugin state/rights/ signatures/audit/search/read models/jobs/catalog/distributor state. Evidence: integrity report. - [ ] E8.10.e Test corrupt/missing/expired key/partial backup/version skew/ legal hold/large media and fallback or explicit unrecoverable state. Evidence: failure tests. - [ ] E8.10.f Measure RPO/RTO, validate playable/renderable/releasable project and no duplicate external delivery, then obtain operations/security approval. Evidence: restore drill. - [ ] E8.11 Publish audio device, plugin, render, rights, delivery, takedown, incident, and recovery runbooks. Evidence: game-day. - [ ] E8.11.a Publish audio device/permission/rate/buffer/glitch/latency/ dropout/clock and recording recovery runbooks. Evidence: audio runbooks. - [ ] E8.11.b Publish plugin scan/licence/missing/crash/quarantine/version/ sandbox/safe-mode and project recovery runbooks. Evidence: plugin runbooks. - [ ] E8.11.c Publish render/job/cost/capacity/output mismatch/determinism/ worker/provider failure runbooks. Evidence: render runbooks. - [ ] E8.11.d Publish rights/consent/split/sample/provenance/voice revocation/ leak/dispute/waiver runbooks with named legal escalation. Evidence: rights runbooks. - [ ] E8.11.e Publish distributor delivery/ack/read-back/correction/ redelivery/takedown/territory and partial failure runbooks. Evidence: delivery runbooks. - [ ] E8.11.f Publish security/privacy/availability/integrity/stage/ collaboration incident and backup/restore/replay runbooks. Evidence: incident/recovery runbooks. - [ ] E8.11.g Run timed cross-role game-days, verify access/contacts, revise unsafe/missing steps, and reapprove. Evidence: game-day report. - [ ] E8.12 Build support-safe diagnostics bundle with protected-data redaction. Evidence: privacy test. - [ ] E8.12.a Define purpose/requester/authorization/project/host/time range/ data classes/bundle schema/retention and user preview/consent policy. Evidence: diagnostics contract. - [ ] E8.12.b Collect app/build/OS/browser/native/audio/MIDI/device/plugin/ capability/config state with paths/serials/accounts/licenses minimized. Evidence: environment diagnostics. - [ ] E8.12.c Collect bounded structured logs/traces/crash/audio-engine/job/ network/storage/quota/realtime/distributor status without audio/lyrics/ contracts/voiceprints/tokens. Evidence: telemetry bundle. - [ ] E8.12.d Include project/media/plugin/rights/release only as opaque IDs, counts/hashes/status and allowlisted problem-specific summaries. Evidence: redaction tests. - [ ] E8.12.e Scan generated bundle for secrets/PII/paths/media/text/contract leakage, encrypt/sign/hash, deliver via expiring audited channel, and delete on expiry. Evidence: delivery tests. - [ ] E8.12.f Test representative roles/tenants/projects/voice/rights/ unreleased/stage/offline failures and manual privacy review. Evidence: privacy report. - [ ] E8.13 Build album/release/program steering overlays for creative, technical, rights, budget, territory, delivery, and cadence constraints. Evidence: tighten-only property tests and impact preview. - [ ] E8.13.a Define versioned overlay identity/scope/priority/effective window/ owner/reviewer and each allowed creative/technical/rights/budget/ territory/delivery/cadence property. Evidence: overlay schema. - [ ] E8.13.b Define code/regulatory/contract/global policy floors and a stricter-versus-weaker partial order per property. Evidence: lattice specification. - [ ] E8.13.c Resolve applicable album/release/program/artist/label/territory/ target overlays deterministically with conflicts explicit. Evidence: resolution tests. - [ ] E8.13.d Preview affected projects/tracks/renders/gates/reviews/rights/ budgets/schedules/deliveries and newly blocked/required actions. Evidence: impact preview. - [ ] E8.13.e Govern draft/review/approve/activate/supersede/rollback/migrate/ expire with separation, immutable versions, and no direct floor edits. Evidence: governance tests. - [ ] E8.13.f Property-test every composition is equal or tighter than floors and cannot relax consent/rights/human approval/safety/target constraints. Evidence: tighten-only suite. - [ ] E8.14 Build UI-governed genre, mood, instrument, role, version, rights, format, territory, and catalog taxonomies over code-owned floors. Evidence: versioned review, alias, deprecation, localization, and distributor-mapping journey. - [ ] E8.14.a Define stable concept/code/set/version/label/definition/parent/ relation/alias/status/locale/external mapping and code-floor schema. Evidence: taxonomy contracts. - [ ] E8.14.b Build authorized draft editor for add/edit/reparent/relate/alias/ merge/split/localize with cycle/duplicate/code/meaning validation. Evidence: editor tests. - [ ] E8.14.c Map rights/format/territory to code-owned contractual/technical floors and map catalog/genre/mood/instrument/role/version to distributor vocabularies with relation/provenance. Evidence: mapping tests. - [ ] E8.14.d Preview impact across projects/assets/search/analytics/rights/ policies/DDEX/distributors/catalog before activation. Evidence: impact analysis. - [ ] E8.14.e Govern review/approve/activate/supersede/deprecate with aliases/ replacements/localization/immutable versions and no floor weakening. Evidence: governance tests. - [ ] E8.14.f Migrate references/indexes/read models/packages/distributor mappings recoverably, preserve historical meaning, and reject orphan/ unknown values. Evidence: migration journey. - [ ] E8.15 Build podcast and audiovisual project profiles for episodes, rundown/script, guests, multitrack recording, edit, music/SFX, video, chapters, transcript/captions, artwork, feed/video renditions, rights, review, schedule, and correction. Evidence: project-to-distribution package journey. - [ ] E8.15.a Define podcast/audiovisual show/season/episode/version/rundown/ script/segment/guest/source/claim/media/release profile contracts. Evidence: profile schemas. - [ ] E8.15.b Build rundown/script authoring with host/guest roles, consent, source/fact-check links, timing, cues, disclosures, and episode continuity. Evidence: preproduction tests. - [ ] E8.15.c Capture/import multitrack audio/video with immutable media, devices/session/guest consent, proxies/sync/timecode, and provenance. Evidence: ingest tests. - [ ] E8.15.d Edit dialogue/music/SFX/video/graphics nondestructively with rights, loudness, aspect/safe-area, source/timecoded anchors, and accessible controls. Evidence: edit tests. - [ ] E8.15.e Create transcript/speakers/chapters/captions/translations/audio descriptions/artwork/metadata with locale and semantic parity. Evidence: accessibility/localization tests. - [ ] E8.15.f Run editorial/fact-check/audio-video/rights/accessibility/label/ target review on exact episode version and invalidate on change. Evidence: review tests. - [ ] E8.15.g Schedule/generate/validate feed/audio/video/article/social renditions/packages and publish/read back through target adapters. Evidence: distribution tests. - [ ] E8.15.h Propagate correction/retraction/replacement through episode/ transcript/captions/clips/feed/video/embed/archive with timecoded notices. Evidence: correction E2E. - [ ] E8.15.i Run complete project→record/edit/review→package→distribution journey including partial target failure. Evidence: profile journey. - [ ] E8.16 Build artist/label marketing operations for campaign brief, assets, approved copy, audience/territory, schedule, links, rights, budget, channel delivery, analytics, and takedown without granting marketing actors mix/master or rights authority. Evidence: separation-of-duties tests. - [ ] E8.16.a Define separate marketing campaign/brief/asset/copy/audience/ schedule/link/channel/budget/delivery/version/state and role boundary. Evidence: campaign schema. - [ ] E8.16.b Create brief pinned to approved release/artist/label/territories/ dates/objectives/disclosures/constraints with no access to protected session/contracts. Evidence: brief tests. - [ ] E8.16.c Select rights-cleared approved artwork/audio/video/snippets/ lyrics/credits and author target copy as proposals with exact release identity. Evidence: content tests. - [ ] E8.16.d Resolve consented audience/territory/locale/channel/quiet/ frequency and build stable campaign links/UTM or equivalent with canonical correction state. Evidence: targeting/link tests. - [ ] E8.16.e Budget/estimate/approve/schedule/preview per-channel jobs and execute through target adapters with acknowledgment/retry/partial state. Evidence: delivery tests. - [ ] E8.16.f Instrument privacy-safe delivery/engagement/conversion/cost and prohibit metrics from changing creative/rights/release approval. Evidence: analytics tests. - [ ] E8.16.g Propagate release delay/correction/takedown/territory/right change to queued/live campaigns, links/assets, and channels with read-back. Evidence: remedy tests. - [ ] E8.16.h Attempt marketing-role mix/master/media source/rights/split/ consent/release/takedown mutations and prove rejection. Evidence: separation-of-duties suite. - [ ] E8.17 Build provider, model, sample-pack, plugin/preset, instrument, and workflow administration for compatibility, license, security scan, evaluation, entitlement, install/update/deprecate/quarantine, dependency impact, and cost. Evidence: untrusted code/content cannot enter an active project silently. - [ ] E8.17.a Define governed catalog item/version/kind/vendor/source/hash/ compatibility/licence/security/evaluation/entitlement/cost/status/ dependency contract. Evidence: admin schema. - [ ] E8.17.b Onboard provider/model with API/data-use/region/retention/ training/operation capabilities, credentials, quotas/cost, and evaluation approval. Evidence: provider tests. - [ ] E8.17.c Onboard sample packs/presets/instruments with immutable content, source/rights/licence/territory/use, metadata, scan, and preview. Evidence: content tests. - [ ] E8.17.d Onboard plugins/code/workflows with signature/build/architecture/ format/dependencies/permissions/sandbox/security scan and malicious tests. Evidence: code tests. - [ ] E8.17.e Run versioned functional/audio/quality/performance/compatibility/ safety/equivalence evaluations per supported host/profile. Evidence: evaluation matrix. - [ ] E8.17.f Govern draft/review/approve/entitle/install/activate/update/ deprecate/quarantine/revoke/rollback with separation and immutable audit. Evidence: lifecycle tests. - [ ] E8.17.g Preview project/preset/render/provider/workflow dependency impact and migration/substitution/loss before update/quarantine/removal. Evidence: impact tests. - [ ] E8.17.h Enforce approved version/entitlement/licence at project open/ scan/load/job/render and block silent untrusted code/content activation. Evidence: enforcement tests. - [ ] E8.17.i Reconcile usage/licence/seats/provider/plugin/storage/egress costs and expose current supported/blocked alternatives. Evidence: cost report. - [ ] E8.18 Expose conservatory/ear-training, discovery, accompaniment, virtuoso/performance, guitar, sacred, and philosophy capabilities only through a ratified production use case or a governed deep link to their separate product surfaces. Evidence: each library has a concrete disposition; none is implied covered by the DAW. - [ ] E8.18.a Inventory each named library/package/route/component/API/data/ audience/current consumer and claimed production capability. Evidence: source ledger. - [ ] E8.18.b Split into atomic capabilities and assess genuine professional production use, consumer/learning/discovery purpose, ownership, security, and dependency fit. Evidence: disposition analysis. - [ ] E8.18.c Ratify retained in-DAW use cases with exact workflow/context/ role/inputs/outputs/rights/quality/accessibility and owned mutation. Evidence: production use cases. - [ ] E8.18.d Assign separate product host/owner/audience for nonproduction capabilities and define compatible identity/entitlement/support. Evidence: host decisions. - [ ] E8.18.e Implement governed deep link/handoff with opaque context, reauthorization/redaction/expiry/return path and no shared unsafe state. Evidence: handoff tests. - [ ] E8.18.f Mark externalized/deprecated/removed/unsupported explicitly in navigation/docs/capability profile instead of implying DAW coverage. Evidence: product UX tests. - [ ] E8.18.g Reconcile every library/capability to one reviewed disposition and fail orphan/duplicate/unreachable/unauthorized rows. Evidence: completeness gate. - [ ] E8.19 Build a DJ/performance profile where ratified for decks, library/ crates, analysis/beat grids, cue/loop, sync, stems, sampler, mixer, effects, transitions, recording, broadcast/stream, set history, hardware, offline media, rights/reporting, and emergency recovery. Evidence: supported controller/format/stream matrix and set-recording provenance; otherwise disposition the DJ workstation as a separate product. - [ ] E8.19.a Decide integrated profile versus separate DJ product from audience/host/audio/device/offline/library/rights/live-safety/ownership analysis and ratify boundary. Evidence: product ADR. - [ ] E8.19.b If retained, define deck/library/crate/track/analysis/grid/cue/ loop/set/history/controller/broadcast/recording state and capability contracts. Evidence: DJ schemas. - [ ] E8.19.c Ingest/search/prepare offline-capable media with waveform/tempo/ key/grid/gain/stems/cues/loops, rights/territory/source, and manual corrections. Evidence: library tests. - [ ] E8.19.d Implement multi-deck playback/sync/pitch/key lock/cue/loop/stem/ sampler/mixer/effects/transitions with sample-accurate clock, latency, and safe gain. Evidence: performance tests. - [ ] E8.19.e Integrate ratified controllers/MIDI/HID/audio interfaces with mappings/feedback/reconnect/redundancy and accessible semantic/ keyboard alternatives. Evidence: controller tests. - [ ] E8.19.f Implement record/broadcast/stream target setup, levels/metadata/ rights/reporting/ack/failover and immutable set/track/action provenance. Evidence: capture/stream tests. - [ ] E8.19.g Implement performance lock, local offline media, device/computer/ audio/clock/network failover, emergency stop, and post-set recovery. Evidence: stage drills. - [ ] E8.19.h Validate supported controller×format×host×stream cells, audio/ timing/performance budgets, rights reports, and set-recording lineage. Evidence: profile matrix. - [ ] E8.19.i If externalized, record separate host/handoff/disposition and remove implied DJ support from DAW profiles/routes/tests. Evidence: exclusion gate. ### E9 — Euterpe verification and launch gates - [ ] E9.1 Run old/current project migration and revision integrity suites. Evidence: corpus report. - [ ] E9.1.a Assemble supported historical/current browser/desktop project/ session/media/plugin/preset/rights/release records with provenance and expected semantics. Evidence: corpus manifest. - [ ] E9.1.b Run stepwise and supported direct migrations with interruption/ retry/rollback/export/downgrade refusal. Evidence: migration matrix. - [ ] E9.1.c Verify timing/tempo/meter/score/MIDI/clips/comp/routing/devices/ automation/media hashes and state recall. Evidence: DAW integrity. - [ ] E9.1.d Verify rights/consent/splits/provenance/review/approval/release/ catalog identity and protected boundaries. Evidence: governance integrity. - [ ] E9.1.e Test missing plugins/media/licences/unknown fields/corrupt/large/ offline/version-skew cases with explicit loss. Evidence: edge suite. - [ ] E9.1.f Compare semantic diffs/audio render goldens/revision hashes and publish supported compatibility results. Evidence: corpus report. - [ ] E9.2 Run deterministic DAW command, timing, routing, automation, comp, render, and undo/redo suites. Evidence: command coverage index. - [ ] E9.2.a Generate complete structured command inventory and map each command to preconditions/effect/inverse/persistence/accessibility/tests. Evidence: coverage index. - [ ] E9.2.b Run sample-accurate tempo/meter/transport/loop/punch/clip/MIDI/ score/session-launch timing goldens. Evidence: timing results. - [ ] E9.2.c Run track/bus/send/sidechain/device/plugin/modular/control routing and latency/tail/bypass/failure signal-flow goldens. Evidence: routing results. - [ ] E9.2.d Run automation/modulation/curve/mode/target/state/realtime- offline deterministic renders. Evidence: control results. - [ ] E9.2.e Run take/comp/warp/ARA/edit/fade/bounce/freeze/stem/null/source- preservation goldens. Evidence: edit/render results. - [ ] E9.2.f Run command→undo→redo→save/reopen semantic/audio equality, collaboration/offline boundaries, and failed transaction recovery. Evidence: undo results. - [ ] E9.2.g Fail any retained command without current deterministic or explicitly nondeterministic coverage and provenance. Evidence: command gate. - [ ] E9.3 Run known-value score, theory, lyric, recording, mix, loudness, peak, format, rights, split, and delivery tests. Evidence: gate registry coverage. - [ ] E9.3.a Freeze expert-reviewed positive/boundary/negative/exception/ unsupported/failure fixtures with expected raw measurements/verdicts. Evidence: known-value corpus. - [ ] E9.3.b Verify score/tuning/theory/rhythm/groove/lyric prosody/rhyme/ pronunciation/time alignment across ratified cultural profiles. Evidence: musical gate results. - [ ] E9.3.c Verify recording signal/format/noise/dropout/phase and mix peak/ headroom/mono/spectrum/dynamics/masking measurements. Evidence: audio gate results. - [ ] E9.3.d Verify BS.1770 loudness/LRA/true peak, target profiles, master/ spatial format, null/stem-sum, and failure states. Evidence: QC results. - [ ] E9.3.e Verify rights kinds/licence/consent/similarity/splits/exact totals/ waivers/provenance/disclosure/release eligibility. Evidence: rights results. - [ ] E9.3.f Verify DDEX/distributor target eligibility/format/metadata/ territory/ack/read-back/correction/takedown gates. Evidence: delivery results. - [ ] E9.3.g Map every retained gate to fixtures/measurement and verdict assertions/remediation/owner/current execution; fail gaps. Evidence: gate registry coverage. - [ ] E9.4 Run calibrated transcription, similarity, AI assist, and generated voice evaluations. Evidence: threshold, subgroup, uncertainty report. - [ ] E9.4.a Pin held-out corpora/splits/labels across task, instrument/voice/ genre/style/tuning/locale/subgroup/risk/adversarial conditions. Evidence: evaluation manifest. - [ ] E9.4.b Pin model/provider/prompt/config/code/index versions and run with input/output/right/consent/cost/latency provenance. Evidence: run records. - [ ] E9.4.c Evaluate audio-to-MIDI/score/chord/lyric transcription accuracy, alignment, calibration, missed important events, and abstention. Evidence: transcription report. - [ ] E9.4.d Evaluate melodic/lyrical/recording/sample similarity precision/ recall/calibration/transforms/common/licensed cases and corpus leakage. Evidence: similarity report. - [ ] E9.4.e Evaluate assist meaning/source preservation/diversity/playability/ artifacts/leakage/rights and per-change acceptance behavior. Evidence: assist report. - [ ] E9.4.f Evaluate voice intelligibility/pronunciation/timing/pitch/ identity drift/artifacts/consent/disclosure/misuse by mode. Evidence: voice report. - [ ] E9.4.g Report confidence intervals/subgroup deltas/severity errors/ thresholds/regressions and obtain named music/voice/rights/safety approval. Evidence: signed evaluation. - [ ] E9.5 Run official/calibrated BS.1770/R128 meter test signals. Evidence: conformance report. - [ ] E9.5.a Pin standard/algorithm/profile/implementation/calibration/ tolerance/channel-layout versions and authoritative test signal source. Evidence: test manifest. - [ ] E9.5.b Verify signal bytes/sample rate/bit depth/channels/duration/hash and independent expected integrated/short/momentary/LRA/true-peak values. Evidence: fixture validation. - [ ] E9.5.c Run mono/stereo/multichannel K-weighting/gating/integrated tests and compare within published tolerances. Evidence: integrated results. - [ ] E9.5.d Run momentary/short-term time series/window/hop and LRA/sufficient duration tests. Evidence: temporal results. - [ ] E9.5.e Run true-peak/oversampling/silence/short/low-level/layout/invalid/ analyzer-failure fixtures. Evidence: edge results. - [ ] E9.5.f Compare supported host/worker implementations and publish current- branch conformance artifacts with all versions. Evidence: report. - [ ] E9.6 Run DDEX ERN golden/conformance validation. Evidence: pinned profile reports. - [ ] E9.6.a Pin ERN/profile/schema/code-list/namespace/validator/partner- extension versions and deterministic generator build. Evidence: conformance manifest. - [ ] E9.6.b Validate new single/album/EP/multidisc/multiterritory release resources/releases/deals/parties/identifiers/technical details. Evidence: new-release goldens. - [ ] E9.6.c Validate metadata update/redelivery/audio replacement/territory add-remove/takedown lifecycle and prior relationships. Evidence: lifecycle goldens. - [ ] E9.6.d Test missing/invalid/duplicate IDs, share/rights/territory/date/ code/cardinality/resource/checksum/unsupported extension cases. Evidence: negative corpus. - [ ] E9.6.e Round-trip through sandbox/contract distributor and distinguish transport/message/resource/content/catalog acceptance. Evidence: interoperability tests. - [ ] E9.6.f Publish current-branch validation/loss/read-back results per supported distributor profile and fail stale/unproven cells. Evidence: profile reports. - [ ] E9.7 Run real-database, blob, search, queue, collaboration, render, and distributor integration tests. Evidence: durable round-trip. - [ ] E9.7.a Provision production-equivalent supported service versions with two tenants/projects, large media, plugins, rights, collaborators, workers, and sandbox targets. Evidence: environment manifest. - [ ] E9.7.b Exercise project edit/save→blob/proxy/analyze→search→collaboration →render/QC→bundle→distributor→catalog/read-back with trace linkage. Evidence: integration trace. - [ ] E9.7.c Verify rights/consent/splits/provenance/property redaction and no cross-project data in indexes/queues/logs/artifacts/targets. Evidence: isolation tests. - [ ] E9.7.d Inject DB/blob/search/queue/realtime/worker/plugin/provider/ distributor timeout/outage/duplicate/order/auth/version faults. Evidence: fault tests. - [ ] E9.7.e Reconcile authoritative records/media hashes/indexes/operations/ jobs/bundles/acknowledgments/catalog after create/update/takedown/ restore. Evidence: reconciliation report. - [ ] E9.7.f Restart/replay/backup/restore and prove acknowledged saves/media/ decisions/deliveries survive without duplicate external effects. Evidence: durable round-trip. - [ ] E9.8 Run full-journey Playwright: concept to arrangement and saved revision. Evidence: live audio engine where browser automation permits. - [ ] E9.8.a Create a real project and capture text/hum-or-fixture audio/MIDI/ chord/reference concepts with provenance/rights prompts. Evidence: concept trace. - [ ] E9.8.b Generate or author multiple arrangement/score/MIDI/lyric candidates, compare synchronously, and record human decision. Evidence: creative trace. - [ ] E9.8.c Edit sections/tracks/clips/MIDI/score/lyrics/devices/automation through pointer and keyboard paths, including undo/redo. Evidence: editing trace. - [ ] E9.8.d Autosave to live store, close/reopen, inspect history/semantic diff, restore as new revision, and verify media/plugin state. Evidence: persistence trace. - [ ] E9.8.e Exercise offline/degraded/provider-not-configured/role/stale/ conflict state and no simulated success. Evidence: resilience tests. - [ ] E9.8.f Use live browser audio engine/virtual devices where automation supports it; otherwise pin deterministic audio fixtures and record exact limitation. Evidence: Playwright report. - [ ] E9.9 Run full-journey Playwright: recording/import to mix/master QC. Evidence: deterministic fixture media. - [ ] E9.9.a Configure virtual/fixture device and calibrate, record or import scanned deterministic multichannel media with take/session provenance. Evidence: capture trace. - [ ] E9.9.b Perform nondestructive waveform/clip/take/comp/fade/stretch/ repair/alignment edits and prove source restore. Evidence: edit trace. - [ ] E9.9.c Build track/bus/send/sidechain/device/plugin/automation mix, render it, and verify deterministic signal-flow/null outputs. Evidence: mix trace. - [ ] E9.9.d Create master candidate with target/reference/profile, process/ render, and run loudness/peak/format/spatial/QC measurements. Evidence: master trace. - [ ] E9.9.e Review accessible values/units/thresholds/history/remediation, fix a failed gate, rerun, and obtain exact-revision human approval. Evidence: QC trace. - [ ] E9.9.f Test missing/crashing plugin, device loss, analyzer failure, cancel/retry, stale source mix, and no nonpass displayed as pass. Evidence: Playwright report. - [ ] E9.10 Run full-journey Playwright: rights/splits to delivery and catalog verification. Evidence: sandbox distributor or contract adapter. - [ ] E9.10.a Register work/master/sample/performer/voice/model/artwork rights and consents with protected projections. Evidence: rights trace. - [ ] E9.10.b Negotiate/sign exact ownership splits, resolve sample clearance, and verify publishing versus master totals independently. Evidence: split/clearance trace. - [ ] E9.10.c Build release sequence/metadata/locales/artwork/territories/ target profiles and lock exact rights/master/provenance candidate. Evidence: release trace. - [ ] E9.10.d Assemble deterministic bundle, validate DDEX/format/QC/ disclosure/rights, approve, and deliver to sandbox/contract distributor. Evidence: delivery trace. - [ ] E9.10.e Correlate acknowledgments and read back catalog audio/metadata/ identifiers/territories/status; reject transport-only success. Evidence: catalog proof. - [ ] E9.10.f Test partial target failure/retry, role/field authorization, protected data nonleakage, and accessible status. Evidence: Playwright report. - [ ] E9.11 Run full-journey Playwright: rights revocation to takedown. Evidence: affected catalog targets reconcile. - [ ] E9.11.a Seed a delivered release using rights/consent/sample/model across project/clips/mix/master/bundle/distributor/catalog. Evidence: baseline. - [ ] E9.11.b Revoke/expire/dispute an exact right or consent and preview the complete read-only blast radius with protected redaction. Evidence: impact trace. - [ ] E9.11.c Approve quarantine/replacement/re-clearance/takedown plan and invalidate active reviews/release/jobs/links. Evidence: remedy plan. - [ ] E9.11.d Execute per-target takedown/restriction/notice saga with duplicate/out-of-order/failure injection and truthful progress. Evidence: saga trace. - [ ] E9.11.e Read back distributor/catalog/search/share states, keep one failed target unresolved, repair/retry, and close only after reconciliation. Evidence: target proof. - [ ] E9.11.f Verify immutable prior artifacts/audit/provenance, no protected leakage, and optional replacement/redelivery lineage. Evidence: Playwright report. - [ ] E9.12 Run WCAG 2.2 AA, keyboard, announcement, non-drag, and semantic DAW parity suites. Evidence: themes/viewports/locales. - [ ] E9.12.a Define critical arrange/session/piano roll/score/mixer/device/ modulation/plugin/review/rights/release route/action matrix across hosts/viewports/themes/locales. Evidence: coverage plan. - [ ] E9.12.b Run automated WCAG/name-role-value/landmark/form/error/contrast/ focus/target/reflow/motion assertions around code-native DAW surfaces. Evidence: automation report. - [ ] E9.12.c Run pointer-free create/edit/record/route/automate/comp/mix/ review/render/release with remapped commands and no traps. Evidence: keyboard report. - [ ] E9.12.d Run non-drag position/range/reorder/connect/curve/scene/device operations with identical validation/undo/audit. Evidence: dragging report. - [ ] E9.12.e Compare visual and semantic timeline/mixer/device/modulation/ automation/graph/quality/compare views for content and operations. Evidence: parity report. - [ ] E9.12.f Assert transport/record/save/conflict/device/job/gate/review/ delivery/takedown announcements without audio/content leakage. Evidence: announcement report. - [ ] E9.12.g Run supported screen-reader/zoom/high-contrast/RTL/long locale/ touch/desktop manual review and close blockers. Evidence: signed matrix. - [ ] E9.13 Run audio glitch, input latency, large project, memory, waveform, mixer, render, autosave, collaboration, and upload performance tests. Evidence: budgets pass. - [ ] E9.13.a Build production-scale fixtures/matrices for hosts/devices/ buffers/rates/tracks/clips/media/plugins/automation/score/collaborators/ rights/jobs. Evidence: load manifest. - [ ] E9.13.b Measure input-to-monitor/control-to-audible/transport timing, audio-thread CPU/xruns/glitches/clicks under increasing load. Evidence: realtime profile. - [ ] E9.13.c Measure project open/save/autosave/recovery, waveform/spectrum/ scroll/zoom, mixer/device UI input/paint and sustained memory. Evidence: editor profile. - [ ] E9.13.d Measure realtime/offline/batch render speed/resources/ determinism, upload/proxy/resume/egress and worker concurrency/cost. Evidence: pipeline profile. - [ ] E9.13.e Measure collaboration operation latency/lag/convergence/ reconnect/conflict with multiple clients and impaired networks. Evidence: realtime profile. - [ ] E9.13.f Capture audio/UI threads/CPU/GPU/memory/disk/network/query/queue/ plugin traces, compare to budgets, trend, and fail regressions. Evidence: performance report. - [ ] E9.14 Run malicious media/project/plugin/preset, prompt injection, voice impersonation, rights fraud, leak, auth, tenant, and distribution adversarial tests. Evidence: zero blockers. - [ ] E9.14.a Test malformed/polyglot/bomb/active audio-project-preset/archive/ metadata/media and unsafe parsers/paths/resources. Evidence: content security report. - [ ] E9.14.b Test malicious/hanging/crashing plugin/module/UI/state/update/ licence/filesystem/network/sandbox escape and safe-mode recovery. Evidence: plugin security report. - [ ] E9.14.c Inject prompts/instructions through audio metadata/lyrics/ presets/projects/references/provider outputs and agent handoffs. Evidence: injection report. - [ ] E9.14.d Attempt voice/performer impersonation, cloned consent/signatures, voiceprint extraction, revoked output/model reuse, and fraud. Evidence: identity report. - [ ] E9.14.e Attempt fabricated/licence/rights/splits/sample/provenance/ similarity/waiver/disclosure manipulation and takedown suppression. Evidence: rights report. - [ ] E9.14.f Probe unreleased media/contracts/identity/voice through UI/API/ search/log/cache/notifications/review links/exports/support/provider/ distributor. Evidence: leakage report. - [ ] E9.14.g Test auth/session/role/BOLA/property/function/tenant/project and mass/replayed distribution/ack/callback/credential attacks. Evidence: authorization/distribution report. - [ ] E9.14.h Require zero blockers, assign regression/owner/mitigation and expiring approved lower-risk exceptions. Evidence: adversarial gate. - [ ] E9.15 Run crash recovery, offline sync, backup/restore, and distribution replay drills. Evidence: RPO/RTO. - [ ] E9.15.a Crash tab/app/audio worklet/native host/plugin/worker during recording/edit/save/upload/render and recover acknowledged project/ local originals/operations. Evidence: crash drills. - [ ] E9.15.b Run offline create/edit/record/render/export, two-client changes, reconnect/rebase/conflict/role revoke/quota/eviction/storage loss. Evidence: offline drills. - [ ] E9.15.c Restore project/media/plugin state/rights/contracts/audit/ release/jobs from selected backups into isolated environment. Evidence: restore trace. - [ ] E9.15.d Reconcile hashes/revisions/routing/timing/rights/signatures/ indexes/catalog/distributor state and prove playable/renderable project. Evidence: integrity report. - [ ] E9.15.e Replay delivery/takedown/correction saga from checkpoints under duplicate/out-of-order/partial prior actions and read back targets. Evidence: replay tests. - [ ] E9.15.f Measure achieved RPO/RTO, record unrecoverable external limits, revise runbooks, and obtain operations/security approval. Evidence: signed drill report. - [ ] E9.16 Produce engineering-readiness evidence. Evidence: requirements map to current proof. - [ ] E9.16.a Define required architecture/contracts/migrations/audio/ compatibility/security/privacy/rights/accessibility/quality/standards/ operations evidence by host/profile. Evidence: readiness matrix. - [ ] E9.16.b Map every retained atomic capability/checklist parent/child to implementation/tests/goldens/evaluations/reports/runbooks/approvals. Evidence: evidence index. - [ ] E9.16.c Verify evidence provenance matches candidate commit/build/ schemas/audio engine/plugins/models/providers/profiles/distributors/ devices. Evidence: provenance check. - [ ] E9.16.d Reconcile route/package/capability/command/gate/device/plugin/ format/target/consumer inventories with no orphan/unknown rows. Evidence: completeness report. - [ ] E9.16.e Classify missing/stale/failed/waived evidence, block required cells, and record exception scope/owner/compensation/expiry. Evidence: readiness gate. - [ ] E9.16.f Publish per-host/profile go/no-go, supported/conditional/ unsupported cells, residual risks, support/rollback. Evidence: readiness packet. - [ ] E9.17 Obtain named music-production, mastering, rights/legal, accessibility, privacy/security, engineering, and product approvals. Evidence: human signoff. - [ ] E9.17.a Define each approver’s scope/criteria/required evidence/ qualification/independence/delegate/expiry and nondelegable decisions. Evidence: approval policy. - [ ] E9.17.b Route immutable creative/production/audio-engine/interchange/ specialized workflow evidence to named music-production reviewers. Evidence: production decision. - [ ] E9.17.c Route loudness/master/spatial/target conformance and delivery evidence to qualified mastering/release reviewers. Evidence: mastering decision. - [ ] E9.17.d Route rights/consent/splits/sample/similarity/voice/model/ provenance/distributor evidence to rights/legal specialists. Evidence: legal decision. - [ ] E9.17.e Route WCAG/blind-producer and privacy/security/threat/ adversarial/source-redaction evidence to named specialists. Evidence: assurance decisions. - [ ] E9.17.f Route architecture/quality/operations/recovery/support and product scope/host/rollout/residual risks. Evidence: engineering/product decisions. - [ ] E9.17.g Record signed approve/reject/request-change/conditional decisions and invalidate on candidate/evidence/profile/model/plugin/target change. Evidence: human signoff. - [ ] E9.18 Obtain launch approval for each supported host and distribution profile. Evidence: human governance record. - [ ] E9.18.a Build exact host×capability×device/plugin/offline/provider and distribution×territory/format/layout/profile candidate matrix. Evidence: launch scope. - [ ] E9.18.b Assemble per-cell current compatibility/performance/audio/ security/accessibility/rights/QC/DDEX/read-back/recovery proof. Evidence: launch packets. - [ ] E9.18.c Verify build/signing/config/feature flags/migrations/models/ plugins/profiles/credentials/runbooks/monitoring/on-call/rollback. Evidence: operational checklist. - [ ] E9.18.d Run final live-backed smoke per supported host and representative distributor profile, including correction/takedown read-back. Evidence: launch smokes. - [ ] E9.18.e Record named go/no-go/conditional decision per cell with scope/ limits/known loss/rollout/conditions/owner/expiry/rollback trigger. Evidence: governance record. - [ ] E9.18.f Fail launch on unproven/stale/unknown supported cell and invalidate approval on candidate/profile/target change. Evidence: launch gate. - [ ] E9.19 Run distinct full journeys for instrument/effect authoring, hardware/MIDI/MPE, culturally diverse tuning/notation, stem separation, inpainting/style transfer, voice conversion/singing/choir, AI composition, local/cloud AI negotiation, modular patching, immersive/spatial mix, remote recording, stage/DJ mode, podcast/video, and marketing handoff. Evidence: no generic DAW smoke test substitutes for specialized proof. - [ ] E9.19.a Run instrument/sampler/synth and effect/signal-chain authoring through state/preset/automation/modulation/freeze/render/missing-device recovery. Evidence: device journey. - [ ] E9.19.b Run hardware audio/MIDI/MIDI 2/MPE/pedal/control/external effect discovery→map/calibrate/record/recall→disconnect/reconnect. Evidence: hardware journey. - [ ] E9.19.c Run culturally diverse/non-12-TET tuning/notation/world-rhythm/ theory/playback/interchange with expert assumptions and loss proof. Evidence: inclusive music journey. - [ ] E9.19.d Run stem separation through source rights/job/stem review/manual correction/recombination/stem-sum/lineage. Evidence: separation journey. - [ ] E9.19.e Run inpainting/continuation/style transfer through exact mask/ condition/reference rights/candidates/audition/comp and untouched-region preservation. Evidence: generative edit journey. - [ ] E9.19.f Run voice conversion, speech/singing/choir/harmony through consent/identity/locale/job/evaluation/disclosure/revocation. Evidence: voice journey. - [ ] E9.19.g Run melody/harmony/rhythm/arrangement/orchestration/text-to-music plan through editable score/MIDI/stem/audio intermediates and part-level decisions. Evidence: composition journey. - [ ] E9.19.h Run local/on-device and cloud execution negotiation through hardware/privacy/rights/cost/quality choice, offline behavior, fallback, and result-equivalence proof. Evidence: AI location journey. - [ ] E9.19.i Run modular patch create/connect/modulate/automate/performance/ save/render with feedback/CPU/crash safety and semantic list parity. Evidence: modular journey. - [ ] E9.19.j Run object/bed/ambisonic spatial mix through layout/automation/ renderer/head tracking/downmix/QC/interchange/target delivery. Evidence: immersive journey. - [ ] E9.19.k Run remote rehearsal/record through device consent/clock/cues/ monitor/local originals/upload/alignment/reconnect under network impairment. Evidence: remote session journey. - [ ] E9.19.l Run stage mode and, if retained, DJ mode through preflight/ offline package/control allowlist/performance lock/record/failover/ emergency stop/post-ingest. Evidence: live performance journeys. - [ ] E9.19.m Run podcast/audiovisual project through rundown/guest consent/ multitrack edit/captions/rights/review/feed-video package/correction. Evidence: podcast/video journey. - [ ] E9.19.n Run marketing handoff through approved release/assets/copy/ audience/budget/channels/analytics/takedown while denying production/ rights mutations. Evidence: marketing journey. - [ ] E9.19.o Verify each journey uses owned live services/host profile, deterministic or calibrated media, roles/rights, failure recovery, trace/audit, and current proof. Evidence: specialized coverage ledger. - [ ] E9.20 Run pairwise conformance across supported browser/native host, audio/MIDI device, plugin/instrument, sample rate/bit depth, channel/ spatial layout, renderer, provider/model, project profile, interchange format, and delivery target. Evidence: unsupported cells are explicit and supported cells have current evidence. - [ ] E9.20.a Build canonical dimension/value/constraint model from ratified hosts/OS/architectures/devices/plugins/formats/rates/layouts/renderers/ models/profiles/targets. Evidence: compatibility model. - [ ] E9.20.b Generate deterministic pairwise cells plus required higher-order audio-risk combinations and label invalid/unsupported cells with rationale. Evidence: coverage set. - [ ] E9.20.c Define per-cell semantic/audio/timing/state/rights/provenance/ accessibility/performance/loss tolerances and required fixture/hardware. Evidence: conformance contract. - [ ] E9.20.d Execute supported cells on exact versioned hosts/devices/ virtual hardware/plugins/models/renderers/formats/targets and retain manifests/goldens. Evidence: conformance results. - [ ] E9.20.e Exercise version skew/capability absence/degradation/fallback/ warnings/refusal/recovery without silent quality/state/rights loss. Evidence: boundary tests. - [ ] E9.20.f Publish current supported/conditional/unsupported matrix with evidence age/known loss/prerequisites/owner/expiry and fail stale or unproven supported cells. Evidence: release gate. - [ ] E9.21 Run full journeys for clip-launch performance/capture, source→target modulation, native/browser plugin scan/load/crash/recovery, ARA/warp/comp, deep interchange round-trips, external sync/control surfaces, offline-first storage/sync, customized accessible workspaces, and batch operations. Evidence: each structural DAW capability has current browser/native proof and fault coverage. - [ ] E9.21.a Run clip/scene launch/quantize/legato/follow/probability/ performance lock/record/capture-to-arrangement with sample-accurate and pointer-free proof. Evidence: session journey. - [ ] E9.21.b Run every modulation source family through typed target routing/ depth/polarity/range/smoothing/cycle safety/visual-semantic control and deterministic render. Evidence: modulation journey. - [ ] E9.21.c Run native VST3/CLAP/AU or ratified and browser WAM scan/ signature/licence/load/state/UI/process/crash/quarantine/recover per supported host. Evidence: plugin journey. - [ ] E9.21.d Run ARA/deep edit and warp/transient/tempo/formant/comp context through save/undo/reopen/render/missing-editor and source-preservation. Evidence: deep-edit journey. - [ ] E9.21.e Run DAWproject/MIDI2/MusicXML/BWF-iXML/AAF-OMF-FCPXML/ADM-BWF or ratified import/export cross-host with complete loss profiles. Evidence: interchange journeys. - [ ] E9.21.f Run Link/MTC/LTC/MIDI clock/MMC/OSC/control surface/headless API authority/drift/feedback/reconnect/unsafe command. Evidence: sync/control journey. - [ ] E9.21.g Run offline-first create/record/edit/undo/render/export/reopen/ quota/eviction/reconnect/merge/storage-loss across PWA and desktop. Evidence: offline journey. - [ ] E9.21.h Run saved multi-window/touch/high-DPI/control-surface/blind- producer workspace across arrange/session/score/mixer/modulation/plugin/ review, including reconnect. Evidence: workspace journey. - [ ] E9.21.i Run mixed-eligibility batch render/export/convert/analyze through preflight/cost/capacity/queue/partial/retry/cancel/output verification/ deterministic manifest. Evidence: batch journey. - [ ] E9.21.j Reconcile each capability to current browser/native proof, device/profile/format cells, fault injection, accessibility, and owned artifacts; fail generic substitution. Evidence: structural DAW gate. - [ ] E9.22 EVE-SEAM-EXIT: require "required Eve reads and writes admitted with source and behavior evidence, or an exact task-0.8 explicit non-goal proves zero operations; a named defer preserves ownership but never passes completion" before this phase exits. Evidence: source-derived totality record and passing verifier. - [ ] E9.22.a Re-run the route, bridge, state-signal, and complete domain-code envelope census; review every changed candidate instead of carrying a stale phase disposition forward. Evidence: current ratchets. - [ ] E9.22.b Bind the exact ratified task-0.8 workflow and requirement set; classify it as a required seam or an exact source-backed non-goal. Evidence: charter-bound disposition set. - [ ] E9.22.c For a required seam, admit both read and write operations with byte-pinned source and behavior evidence. A named defer retains its owner and unblock condition but fails completion. Evidence: operation proofs. - [ ] E9.22.d Permit a zero-operation boundary only for an exact ratified task-0.8 explicit non-goal; absence or unavailability is not a non-goal. Evidence: source-bound non-goal proof. - [ ] E9.22.e Run the totality verifier, every retained gate-case CLI, and the injected durable-candidate control; retain red and green receipts. Evidence: release gate logs. --- ## Phase A — Aja motion-capture operations console Aja is a processing and embodied-instruction subsystem. Its console must manage capture intake, consent, pipeline execution, motion QA, retargeting, annotation, asset curation, and export while preserving the canonical Aja adapter used by Metis and other V1 consumers. ### A0 — Host, boundary, pipeline, and risk decisions - [ ] A0.1 Decide whether the canonical console lives in a new Aja control room or an Oshun Studio operator route. Evidence: host/ownership ADR. - [ ] A0.1.a Inventory current Studio routes/Aja services/operator audiences, identity/project context, deployment, security, and preview ownership. Evidence: host inventory. - [ ] A0.1.b Compare dedicated control room versus Studio route for queue/ worker/live capture/biometric isolation/3D performance/support needs. Evidence: option analysis. - [ ] A0.1.c Decide canonical host, owning team, routes/deep links/shell/data/ mutation boundaries and prohibited duplicate console behavior. Evidence: target architecture. - [ ] A0.1.d Define migration/redirect/session/handoff/rollout/rollback/ monitoring/support consequences. Evidence: delivery plan. - [ ] A0.1.e Obtain product/mocap/architecture/privacy/security/accessibility ratification. Evidence: approved ADR. - [ ] A0.2 Inventory all static Studio routes, Aja services, CLI commands, libraries, contracts, and existing preview/annotation components. Evidence: route-capability matrix. - [x] A0.2.a Enumerate routes/navigation/commands/pages/deep links and current operator/consumer journeys. Evidence: route inventory. - [x] A0.2.b Enumerate services/endpoints/workers/queues/models/stores/blobs/ caches/search/providers and accountable owners. Evidence: service inventory. - [x] A0.2.c Enumerate CLI commands/libraries/contracts/adapters/formats/ preview/annotation/render components and consumers. Evidence: code inventory. - [ ] A0.2.d Map tests/docs/flags/deployments to atomic capabilities and classify live/fixture/local/service/incomplete. Evidence: coverage ledger. - [ ] A0.2.e Reconcile route→capability→owner/host/data class/profile and flag duplicate/orphan/dead/unsafe paths. Evidence: route-capability matrix. - [ ] A0.3 Map all `libs/aja/*` packages to pipeline stages, console capabilities, consumer adapters, or out-of-scope. Evidence: complete ledger. - [x] A0.3.a Inventory every package/export/consumer/runtime/test/documented purpose and dependency direction. Evidence: package inventory. - [ ] A0.3.b Map retained exports to typed pipeline stages, console functions, canonical contracts/adapters, hosts, and owners. Evidence: capability mapping. - [ ] A0.3.c Classify duplicate/legacy/demo/consumer-specific/dead code with keep/merge/migrate/deprecate/remove/out-of-scope disposition. Evidence: disposition ledger. - [ ] A0.3.d Verify each package/export has one reviewed disposition and no private or circular boundary violation. Evidence: completeness gate. - [ ] A0.4 Verify the canonical `@oshun/embodiment-aja` contract boundary. Evidence: console work does not introduce private consumer imports. - [x] A0.4.a Inventory package public exports/schema versions/consumers and all direct/transitive private import paths. Evidence: boundary inventory. - [ ] A0.4.b Define canonical capability/demonstration/overlay/handoff/health/ error contracts and ownership/version policy. Evidence: public contract. - [ ] A0.4.c Refactor or disposition private consumer imports using public adapters without leaking console/internal stage/storage models. Evidence: dependency changes. - [ ] A0.4.d Add architecture/import/lint/build/contract tests that fail private subpath, reverse dependency, duplicate contract, or drift. Evidence: boundary gate. - [ ] A0.4.e Run Metis and other consumer conformance with healthy/degraded/ unsupported states. Evidence: consumer report. - [ ] A0.5 Define operator, capture technician, animator, rigger, QA reviewer, consent officer, privacy reviewer, annotator, producer, publisher, and administrator roles. Evidence: permission matrix. - [ ] A0.5.a Define least-privilege duties/object/field/function rights for every named role across capture→package→recall. Evidence: role definitions. - [ ] A0.5.b Define tenant/project/session/subject/consent compartment/profile/ worker/export scope, delegation, guest, and temporary grants. Evidence: scope policy. - [ ] A0.5.c Define ingest/live-device/configure/run/pause/kill/annotate/ cleanup/map/review/approve/export/recall/admin rights by state. Evidence: permission matrix. - [ ] A0.5.d Define separation/qualification/quorum/recusal for consent/ privacy/QA/vertical specialist/publish and nondelegable human actions. Evidence: SoD policy. - [ ] A0.5.e Verify UI, API, queue, blob, preview, export, and direct command enforcement for positive/negative/revoked/cross-project cases. Evidence: authorization suite. - [ ] A0.6 Ratify the canonical pipeline DAG from ingest through package. Evidence: stages, optional branches, retry boundaries, and artifacts are data. - [x] A0.6.a Inventory current stage implementations/inputs/outputs/models/ configs/resources/caches/failures and profile variations. Evidence: stage ledger. - [ ] A0.6.b Define required ingest/preprocess/estimate/reconstruct/cleanup/ retarget/validate/package stages and typed artifact edges. Evidence: canonical DAG. - [ ] A0.6.c Define modality/profile optional branches, conditions/fan-out-in, required floors, skip rules, and unsupported behavior as data. Evidence: branch matrix. - [ ] A0.6.d Define transaction/retry/checkpoint/cache/cancel/rerun boundaries, non-destructive lineage, and downstream invalidation. Evidence: execution contract. - [ ] A0.6.e Version/review/publish/deprecate templates and validate cycles/ ports/resources/capabilities/consent/export floors. Evidence: ratified DAG. - [ ] A0.7 Define supported input, skeleton, rig, animation, motion, video, calibration, and export formats. Evidence: compatibility matrix. - [x] A0.7.a Inventory format/profile/version/container/codec/schema/vendor/ validator/library/licence and actual import/export consumers. Evidence: format registry. - [ ] A0.7.b Define video/depth/image/calibration/camera/timecode inputs with resolution/rate/color/orientation/clock/metadata limits. Evidence: input matrix. - [ ] A0.7.c Define skeleton/rig/mesh/blend-shape/coordinate/unit/bind-pose/ naming/topology/skin/mapping support. Evidence: rig matrix. - [ ] A0.7.d Define motion/animation/curve/event/contact/root/face/hand/ compression/interchange/export target support. Evidence: motion matrix. - [ ] A0.7.e Define conversion/round-trip/loss diagnostics and supported/ conditional/unsupported format pairs with fixtures/version/owner/expiry. Evidence: compatibility matrix. - [ ] A0.8 Define subject consent, biometric/privacy, data residency, retention, moderation, watermark, and revocation policies. Evidence: legal/privacy review. - [ ] A0.8.a Define biometric/personal/sensitive data classes across raw video/ depth/audio/face/body/hand/gaze/voice/mesh/motion/embeddings/metadata. Evidence: data classification. - [ ] A0.8.b Define informed consent purpose/intended and excluded use/ processing/modalities/models/recipients/territories/term/withdrawal/ evidence. Evidence: consent policy. - [ ] A0.8.c Define collection/minimization/redaction/pseudonymization/ encryption/key/region/provider/device/access/export/analytics controls. Evidence: privacy policy. - [ ] A0.8.d Define retention/deletion/legal hold/backups/derived asset/model/ consumer impact and subject request/revocation response. Evidence: lifecycle policy. - [ ] A0.8.e Define content/safety moderation, watermark/provenance/disclosure, prohibited outputs/claims, and human review by vertical profile. Evidence: safety policy. - [ ] A0.8.f Obtain current legal/privacy/consent/biometric/security review and link policies to enforcement/tests/runbooks. Evidence: signed review. - [ ] A0.9 Threat-model non-consensual capture, biometric leakage, malicious video/assets, model attacks, unsafe anatomical output, worker compromise, cost abuse, export tamper, and adapter spoofing. Evidence: mitigation/test map. - [ ] A0.9.a Map actors/assets/trust/data/control boundaries across devices/ mobile/desktop/upload/API/queue/workers/models/storage/preview/export/ consumers. Evidence: threat diagrams. - [ ] A0.9.b Model hidden/mismatched/revoked subject consent, covert capture, identity swaps, reidentification, secondary use, and prohibited profile claims. Evidence: consent threats. - [ ] A0.9.c Model biometric/raw media leakage through search/log/cache/ preview/annotation/analytics/support/providers/exports/adapters and cross-tenant access. Evidence: privacy threats. - [ ] A0.9.d Model malicious video/depth/rig/archive/project/parser payloads, model poisoning/evasion/prompt attacks, unsafe generated motion, and export tamper. Evidence: content/model threats. - [ ] A0.9.e Model worker/GPU/lease/cache/checkpoint/result spoofing, arbitrary code/model/version, resource/cost abuse, queue starvation, and artifact substitution. Evidence: compute threats. - [ ] A0.9.f Model adapter/deep-link/webhook/SDK impersonation, replay, capability/health spoofing, and consumer misuse. Evidence: integration threats. - [ ] A0.9.g Assign controls/tests/monitoring/owners/residual risks/review cadence to every threat. Evidence: mitigation map. - [ ] A0.10 Define real-time versus batch latency/quality profiles. Evidence: explicit SLO and gate differences. - [ ] A0.10.a Define live preview/feedback/record/handoff and batch processing/QA/package scenarios, users, devices, inputs, and outputs. Evidence: use profiles. - [ ] A0.10.b Set end-to-end/frame/preview/feedback/queue/stage/export latency, jitter/dropout/resource/cost budgets per profile. Evidence: SLOs. - [ ] A0.10.c Define allowed live model/resolution/modality/calibration/ smoothing/quality compromises and clearly label provisional output. Evidence: live capability matrix. - [ ] A0.10.d Define batch model/resolution/iterations/ground-truth/gate/ review/reproducibility floors and no live-preview promotion. Evidence: batch matrix. - [ ] A0.10.e Define profile-specific measurements/thresholds/failure/ fallback/reprocess/approval/export eligibility. Evidence: gate differences. - [ ] A0.10.f Test same inputs across profiles, compare timing/quality/cost/ lineage, and show unsupported/degraded honestly. Evidence: profile report. - [ ] A0.11 Define ground-truth, calibration, and evaluation-corpus governance. Evidence: provenance and access controls. - [ ] A0.11.a Define corpus/dataset/version/purpose/modalities/subjects/ motions/rigs/capture setups/labels/splits/owners and intended profiles. Evidence: corpus schema. - [ ] A0.11.b Verify consent/licence/lawful basis/territory/retention/model- evaluation use/withdrawal and protected biometric access. Evidence: rights register. - [ ] A0.11.c Define ground-truth acquisition/calibration systems/protocols/ synchronization/coordinate mapping/uncertainty/quality and expert qualifications. Evidence: truth protocol. - [ ] A0.11.d Define annotation instructions/tools/inter-rater/adjudication/ versioning/provenance and correction history. Evidence: labeling policy. - [ ] A0.11.e Define subject-safe train/dev/test/eval splits, leakage/ duplicate/contamination/poisoning controls and subgroup minimums. Evidence: split policy. - [ ] A0.11.f Enforce encryption/compartment/access/export/audit/deletion/ revocation/provider controls and approve releases. Evidence: governance review. - [ ] A0.12 Define operational success measures for throughput, queue age, stage failure, quality, manual correction, cache, cost, consent, and export correctness. Evidence: metric spec. - [ ] A0.12.a Define item/frame/duration/profile throughput and queue wait/age/ starvation/SLA by priority without hiding rejected work. Evidence: queue metrics. - [ ] A0.12.b Define per-stage start/runtime/retry/failure/cancel/checkpoint/ recovery/capability mismatch and artifact completeness. Evidence: stage metrics. - [ ] A0.12.c Define calibrated raw quality/verdict/uncertainty/manual correction/adjudication/drift measures by profile and subject-safe cohorts. Evidence: quality metrics. - [ ] A0.12.d Define cache hit/valid/invalid/corrupt/evict/resource savings and compute/storage/egress/model/currency cost attribution. Evidence: efficiency metrics. - [ ] A0.12.e Define consent verified/mismatch/expiry/revocation/enforcement and package/export/adapter semantic read-back correctness. Evidence: governance metrics. - [ ] A0.12.f Define units/denominators/windows/slices/privacy/cardinality/ freshness/alerts/owners/budgets and quality guardrails. Evidence: metric spec. - [ ] A0.13 Author and ratify `V1/AJA_MOCAP_CONSOLE_DESIGN_2026-07-23.md` with current-state, host, pipeline DAG, contracts, data, APIs, queue, UI, consent/privacy, export, migration, rollout, and decision records. Evidence: approved doc and resolved review comments. - [ ] A0.13.a Document current routes/packages/services/CLI/contracts/ adapters/stores/workers/formats/pipelines/tests/backing state and gaps. Evidence: current-state chapter. - [ ] A0.13.b Document host/ownership/roles/boundaries/capability and vertical profiles, canonical DAG/stages/artifacts/resources/caches. Evidence: architecture chapters. - [ ] A0.13.c Document capture/motion/rig/annotation/consent/provenance/package contracts and stores/APIs/events/queue/workers/adapters. Evidence: platform chapters. - [ ] A0.13.d Document consent/privacy/biometric/safety/moderation/threat/ evaluation/export policies and human authority. Evidence: governance chapters. - [ ] A0.13.e Document task-led console/preview/semantic alternatives/ responsive/accessibility/live/offline/performance/error states. Evidence: experience chapter. - [ ] A0.13.f Document migration/compatibility/rollout/rollback/operations/ observability/recovery/verification/evidence/launch criteria. Evidence: delivery chapters. - [ ] A0.13.g Resolve every substantive review comment and obtain named mocap/animation/privacy/safety/security/accessibility/engineering approval. Evidence: ratified design. - [ ] A0.14 Reconcile every Aja service/CLI command, static Studio route, `libs/aja/*` package, canonical/study adapter, contract, format, pipeline, worker, test, and documented feature at atomic-feature level. Evidence: explicit dispositions cover video-to-motion, desktop/mobile live capture, body/hand/face tracking, 2D/3D/mesh recovery, cleanup, retargeting, quality, formats, vertical pipelines, reference video, avatars/rigs, batch/queue, SDK/webhooks, privacy/consent, and delivery. - [x] A0.14.a Inventory code/routes/CLI/services/packages/contracts/adapters/ formats/stages/workers/tests/docs/flags/deployments. Evidence: reconciliation inputs. - [ ] A0.14.b Split each source item into atomic user/operator/system capabilities with host/audience/owner/profile/state/dependencies/data class. Evidence: atomic ledger. - [ ] A0.14.c Cover live/mobile/body-hand-face/multi-person/video-to-motion/ 2D-3D-mesh/cleanup/retarget/quality/reference/avatars explicitly. Evidence: motion coverage. - [ ] A0.14.d Cover formats/verticals/batch-queue/SDK-CLI/webhooks/privacy- consent/package-delivery/consumer adapters explicitly. Evidence: operations coverage. - [ ] A0.14.e Assign keep/consolidate/migrate/replace/deprecate/remove/ externalize with target owner/host/profile/dependencies/delivery/expiry. Evidence: disposition ledger. - [ ] A0.14.f Reconcile ledger to routes/packages/contracts/stores/tests and fail orphan/duplicate/unknown/unreviewed capabilities. Evidence: completeness gate. - [ ] A0.15 Ratify separate capability and safety profiles for yoga, fitness, dance, martial arts, sports, medical/rehabilitation, film/VFX, gaming, and other current domain pipelines. Evidence: each profile has authorized audiences, intended-use limitations, capture requirements, stages, models, quality thresholds, reviewers, outputs, and prohibited claims. - [ ] A0.15.a Define profile identity/version/owner/audience/intended and excluded use/disclaimer/jurisdiction for each named vertical. Evidence: profile registry. - [ ] A0.15.b Define required capture devices/views/calibration/reference/ subject/consent/modalities/motion vocabulary and data classification. Evidence: capture matrix. - [ ] A0.15.c Define canonical required/optional stages/models/configuration/ resources and unsupported behavior per vertical. Evidence: DAG profiles. - [ ] A0.15.d Define raw measurements/quality floors/uncertainty/human reviewer qualifications/quorum/adjudication/export conditions. Evidence: quality profiles. - [ ] A0.15.e Define output projection/fields/format/watermark/provenance/ consumer handoff and prohibited medical/coaching/performance claims. Evidence: output policy. - [ ] A0.15.f Validate independent known-value/privacy/safety fixtures and obtain named domain review for every profile; no inherited proof. Evidence: ratified matrix. - [ ] A0.16 Define the boundary among capture-device UI, processing operator console, animator/rigger cleanup, clinician/coach/educator consumer applications, developer SDK/CLI, and platform administration. Evidence: no console preview is misrepresented as medical, coaching, or performance advice. - [ ] A0.16.a Define audience/trust/data/action/responsibility boundaries for each named surface and authoritative owner of every mutation. Evidence: surface matrix. - [ ] A0.16.b Define capture-device responsibilities for consent/status/ guidance/record/buffer/upload only, with no unqualified interpretation. Evidence: device boundary. - [ ] A0.16.c Define console versus animator/rigger cleanup responsibilities, exact handoff artifacts/revisions/locks, and quality/approval boundary. Evidence: production boundary. - [ ] A0.16.d Define consumer projections with intended-use labels, qualified review, redacted biometric data, and no console preview as advice. Evidence: consumer contracts. - [ ] A0.16.e Define SDK/CLI and platform admin credentials/scopes/audit/ capabilities without content/consent authority expansion. Evidence: developer/operator boundary. - [ ] A0.16.f Test signed/deep-link/API/adapter handoffs, reauthorization/ redaction/expiry/return, and cross-surface mutation attempts. Evidence: boundary suite. ### A1 — Capture, stage, motion, rig, and consent contracts - [ ] A1.1 Define capture project, session, take, camera, calibration, subject, consent ref, input asset, and capture metadata. Evidence: schema. - [ ] A1.1.a Define stable tenant/project/session/take identity, lifecycle/ revision/times/operator/profile/purpose/location and authorization scope. Evidence: capture schemas. - [ ] A1.1.b Define camera/sensor/device/lens/stream/channel/frame-rate/ resolution/orientation/clock/timecode/capability metadata. Evidence: device schema. - [ ] A1.1.c Define calibration/version/coordinate/units/intrinsic/extrinsic/ distortion/volume/scale/error/reference relationships. Evidence: calibration schema. - [ ] A1.1.d Define pseudonymous subject/role/take assignment/multi-person ID separately from protected identity/biometrics and exact consent reference. Evidence: subject boundary. - [ ] A1.1.e Define immutable input assets/checksums/kinds/channels/time ranges/ capture/import provenance/privacy class/retention/rights. Evidence: asset schema. - [ ] A1.1.f Enforce cross-project/reference/state/version/missing/unknown/ archive invariants with representative fixtures. Evidence: schema tests. - [ ] A1.2 Define pipeline template as a versioned DAG with stage IDs, dependencies, input/output kinds, configuration schema, capability, resources, timeout, retry, and cache policy. Evidence: DAG validation. - [ ] A1.2.a Define immutable template/version/owner/profile/status/parent/ effective window and stage/edge order-independent serialization. Evidence: template schema. - [ ] A1.2.b Define stable stage ID/type/adapter version/typed ports/ dependencies/conditions/optional-required floor and fan-out/in semantics. Evidence: DAG contract. - [ ] A1.2.c Define versioned configuration schema/defaults/validation/secrets/ migrations and output-affecting field declaration. Evidence: config contract. - [ ] A1.2.d Define host/model/GPU/CPU-memory/storage/network/licence/consent/ modality capability requirements and reservations. Evidence: capability schema. - [ ] A1.2.e Define timeout/heartbeat/retry/backoff/checkpoint/cancel/skip/ failure/cache key/read-write-expiry/quarantine policy. Evidence: execution policy. - [ ] A1.2.f Validate acyclic graph/ports/kinds/reachability/required stages/ resource feasibility/export floors. Evidence: DAG validation suite. - [ ] A1.3 Define job, stage run, attempt, lease, checkpoint, measurement, log ref, resource use, cost, and output refs. Evidence: durable-job schema. - [ ] A1.3.a Define immutable job request/template/profile/input/config/ consent/policy/priority/budget/owner/status/version/idempotency. Evidence: job schema. - [ ] A1.3.b Define per-stage run/dependency/status/current attempt/cache/ worker/capability/input-output and downstream invalidation. Evidence: stage schema. - [ ] A1.3.c Define attempt/lease/worker/heartbeat/start-end/exit/failure/ retry/cancel/preemption and fencing token. Evidence: lease schema. - [ ] A1.3.d Define checkpoint/version/progress/cursor/shard/state/artifact/ checksum/resume compatibility and expiry. Evidence: checkpoint schema. - [ ] A1.3.e Define measurement/log ref/resource usage/cost units/provider/ time/confidence/protected redaction and raw-versus-verdict relationship. Evidence: telemetry schema. - [ ] A1.3.f Define output artifact/ref/kind/version/hash/lineage/privacy/ quality/consent/release state and durable-before-terminal invariants. Evidence: job fixtures. - [ ] A1.4 Define skeleton, joint, hierarchy, coordinate system, units, bind pose, rig, mapping, and retarget profile. Evidence: contract fixtures. - [ ] A1.4.a Define skeleton/version/joint stable IDs/names/aliases/parent/ order/root/end effectors/semantics and modality. Evidence: skeleton schema. - [ ] A1.4.b Define coordinate handedness/up-forward axes/origin/rotation order/quaternion convention/linear-angular units/scale and transforms. Evidence: coordinate contract. - [ ] A1.4.c Define bind/rest/reference pose/local-global transforms/bone lengths/orientations/joint limits and confidence/provenance. Evidence: pose fixtures. - [ ] A1.4.d Define rig controls/deform skeleton/mesh/skin/blend shapes/ constraints/spaces/IK chains/version/host/format. Evidence: rig schema. - [ ] A1.4.e Define source-target mapping/strategy/offset/scale/axis/retarget chains/root/contact/twist/finger/face settings and version. Evidence: mapping schema. - [ ] A1.4.f Validate cycles/duplicates/missing parents/axes/units/bind/ correspondence and round-trip fixtures. Evidence: contract suite. - [ ] A1.5 Define motion clip, frame range, sample rate, root motion, contacts, events, curves, blend shapes, and source lineage. Evidence: round-trip. - [ ] A1.5.a Define motion clip/version/skeleton/rig/timebase/start/end/frame count/sample rate/variable timestamps/interpolation and coordinate context. Evidence: clip schema. - [ ] A1.5.b Define per-frame joint/body/hand/face transforms/confidence/ occlusion/tracking state and sparse/dense storage. Evidence: motion samples. - [ ] A1.5.c Define root/global trajectory/in-place extraction/ground plane/ scale and local versus world motion. Evidence: root schema. - [ ] A1.5.d Define contacts/events/markers/segments/labels and scalar/vector/ quaternion/blend-shape/custom curves with exact anchors. Evidence: event/curve schema. - [ ] A1.5.e Define immutable source takes/model/stages/cleanup/generated ranges/mappings/retarget/render/export lineage. Evidence: provenance chain. - [ ] A1.5.f Round-trip supported formats/sample rates/coordinates/contacts/ curves/face/hand data with loss diagnostics. Evidence: motion goldens. - [ ] A1.6 Define annotation layer, segment, frame/time anchor, label, reviewer, status, and provenance. Evidence: schema. - [ ] A1.6.a Define annotation set/layer/version/purpose/schema/taxonomy/ subject motion revision/visibility/owner and immutable parentage. Evidence: annotation contract. - [ ] A1.6.b Define frame/time/musical/segment/joint/body/hand/face/object/ region anchors with context and mapping/orphan semantics. Evidence: anchor schema. - [ ] A1.6.c Define label/value/type/units/confidence/uncertainty/source/ intended profile and free-text restrictions. Evidence: label schema. - [ ] A1.6.d Define draft/submitted/reviewed/accepted/rejected/adjudicated/ superseded state, reviewer qualification, disagreement, and decisions. Evidence: state machine. - [ ] A1.6.e Record creator/reviewer/tool/model/version/evidence/time/edit/ import/export provenance and protected subject projection. Evidence: provenance tests. - [ ] A1.6.f Validate overlaps/required labels/taxonomy version/anchor survival/ cross-project/access and representative fixtures. Evidence: schema tests. - [ ] A1.7 Define technical measurement separately from validation verdict. Evidence: policy can recompute without reprocessing. - [ ] A1.7.a Define immutable measurement with subject/input/artifact/frame- joint-range, values/units/evidence/confidence/evaluator/model/calibration versions/time. Evidence: measurement schema. - [ ] A1.7.b Define separate verdict with measurement references/profile/ rules/thresholds/outcome/reason/remediation/exception/time. Evidence: verdict schema. - [ ] A1.7.c Prevent verdict mutation/denormalization of raw values and prevent missing/error/unsupported data from defaulting to pass. Evidence: invariants. - [ ] A1.7.d Recompute new verdicts from retained valid measurements after policy/profile threshold changes without rerunning stages. Evidence: recomputation tests. - [ ] A1.7.e Rerun measurement only on subject/artifact/evaluator/calibration invalidation and retain full historical lineage. Evidence: lifecycle tests. - [ ] A1.8 Define consent with subject, collector, purpose, allowed uses, territories, recipients, biometric processing, retention, expiry, revocation, and evidence. Evidence: invariants. - [ ] A1.8.a Define protected subject/representative/minor capacity and collector identity/authority/relationship/collection context. Evidence: identity schema. - [ ] A1.8.b Define purpose/intended-excluded use/profile/project/session/ modalities/body-hand-face-gaze-mesh/model processing and claims. Evidence: purpose schema. - [ ] A1.8.c Define allowed outputs/uses/recipients/providers/consumers/ territories/regions/transfers/exports/publication/model training. Evidence: scope schema. - [ ] A1.8.d Define retention/deletion/withdrawal/revocation/effective-expiry/ legal hold/derived artifact/model impact and contact path. Evidence: lifecycle schema. - [ ] A1.8.e Define informed notice/version/locale/accessibility, affirmative signature/intent/time/document hash/witness/guardian and evidence. Evidence: consent proof. - [ ] A1.8.f Enforce subject/session/purpose/modality/recipient/territory/time match, no scope inheritance, and conflict/unknown invariants. Evidence: consent tests. - [ ] A1.9 Define privacy transformations and redacted derivatives. Evidence: derivative lineage points to protected source without exposing it. - [ ] A1.9.a Define transform kind/version/config/purpose/authorized input class/output class/irreversibility/risk and approval. Evidence: privacy transform registry. - [ ] A1.9.b Define face/body/background/object/license-plate/screen/audio/ metadata redaction, crop/blur/mask/avatar/skeleton-only derivatives and quality tradeoffs. Evidence: transform fixtures. - [ ] A1.9.c Generate immutable derivative with input/output hashes, exact ranges/regions/tool/model/version/operator and protected opaque link. Evidence: lineage tests. - [ ] A1.9.d Define authorized role/profile/consumer/search/preview/export/ retention for derivative and prohibit reverse lookup or source leakage. Evidence: projection tests. - [ ] A1.9.e Evaluate residual reidentification/utility/quality/temporal consistency and require human privacy review at thresholds. Evidence: privacy evaluation. - [ ] A1.9.f Propagate source revocation/deletion/hold/correction through derivatives/providers/caches/consumers with audit. Evidence: lifecycle tests. - [ ] A1.10 Define watermark and provenance records for every derived motion asset. Evidence: transformation chain fixture. - [ ] A1.10.a Define provenance ingredient/action/tool/model/stage/config/ subject consent/rights/output identity/hash/version/time DAG. Evidence: provenance schema. - [ ] A1.10.b Define watermark kind/payload/key/algorithm/strength/placement/ target/detection/confidence/removal policy without biometric secrets. Evidence: watermark schema. - [ ] A1.10.c Record ingest/estimate/reconstruct/mesh/cleanup/generate/retarget/ annotate/validate/convert/package transformations and edited ranges. Evidence: action lineage. - [ ] A1.10.d Bind watermark/provenance to exact motion/skeleton/rig/mesh/ package formats and preserve/reapply or diagnose loss on conversion. Evidence: format tests. - [ ] A1.10.e Validate hash/signature/watermark/tamper/stripped/unknown/ untrusted state and permissioned semantic inspector. Evidence: integrity tests. - [ ] A1.10.f Run complete protected source→redacted input→motion→cleanup→ retarget→package transformation chain fixture. Evidence: provenance golden. - [ ] A1.11 Define export package, target format, target rig, mappings, measurements, gates, consent lock, watermark, and manifest. Evidence: schema. - [ ] A1.11.a Define immutable package/candidate/version/owner/project/profile/ target/territory/consumer/status and exact source motion revision. Evidence: package schema. - [ ] A1.11.b Define target format/profile/version/rig/skeleton/coordinate/ unit/rate/mapping/retarget/config and compatibility/loss. Evidence: target contract. - [ ] A1.11.c Pin output motion/mesh/curves/events/annotations/previews/source assets plus hashes and transformation provenance. Evidence: artifact manifest. - [ ] A1.11.d Pin raw measurements/verdicts/profile/evaluator/calibration/ reviewer approvals and unresolved/waived findings. Evidence: quality manifest. - [ ] A1.11.e Pin consent/subject/use/modality/recipient/territory/expiry/ privacy derivative/watermark/provenance lock and recheck at dispatch. Evidence: consent lock. - [ ] A1.11.f Define canonical serialized manifest/hash/signature/read-back/ supersession/recall and invalidation on dependency change. Evidence: package tests. - [ ] A1.12 Define immutable revisions and diffs for config, mapping, annotation, cleanup, validation, and package. Evidence: golden diffs. - [ ] A1.12.a Define common immutable revision/parent(s)/subject/schema/tool/ actor/cause/time/hash/approval lineage and branch/merge semantics. Evidence: revision contract. - [ ] A1.12.b Define config/template/stage parameter diff with defaults/ secrets redaction/output-affecting/material classification. Evidence: config goldens. - [ ] A1.12.c Define skeleton/rig mapping diff by stable source-target joints/ offsets/strategies/chains and compatibility impact. Evidence: mapping goldens. - [ ] A1.12.d Define annotation diff by layer/anchor/label/status/reviewer and cleanup motion diff by exact frames/joints/curves/generated ranges. Evidence: edit goldens. - [ ] A1.12.e Define validation diff by raw measurements/verdict/profile/ waiver and package diff by artifacts/rig/format/consent/watermark/ manifest. Evidence: release goldens. - [ ] A1.12.f Test add/delete/move/split/merge/restore/concurrent/schema/ opaque loss and protected projections. Evidence: semantic diff suite. - [ ] A1.13 Define consumer adapter health/capability projections from actual service state. Evidence: healthy/degraded/unhealthy fixtures. - [ ] A1.13.a Define versioned adapter capability IDs/operations/modalities/ profiles/formats/limits/prerequisites and unsupported reasons. Evidence: capability schema. - [ ] A1.13.b Define actual dependency health from API/queue/workers/models/ GPU/storage/cache/consent/gates/export versions and freshness. Evidence: health inputs. - [ ] A1.13.c Compute per-capability available/degraded/unavailable/ unsupported/not-configured/unknown, reason, safe alternatives, and expected impact. Evidence: projection logic. - [ ] A1.13.d Redact project/subject/biometric/worker/security/cost details and prevent global healthy status from masking failed capability. Evidence: privacy tests. - [ ] A1.13.e Test healthy/partial/degraded/stale/outage/version-skew/ permission/consent/config fixtures in Metis and other consumers. Evidence: health contract suite. - [ ] A1.14 Define contract compatibility and format-version negotiation. Evidence: old fixture migration and unsupported refusal. - [ ] A1.14.a Inventory deployed capture/motion/rig/annotation/consent/job/ package/adapter/format versions and historical edge fixtures. Evidence: version corpus. - [ ] A1.14.b Define support window and reader/writer/migrate/export/rollback behavior per contract and format. Evidence: compatibility matrix. - [ ] A1.14.c Define handshake/Accept or equivalent version/capability/profile/ format negotiation with deterministic compatible selection. Evidence: negotiation tests. - [ ] A1.14.d Implement migrations/adapters for renamed/split/merged/ coordinate/unit/skeleton/consent fields with explicit loss. Evidence: migration tests. - [ ] A1.14.e Refuse unsupported/unsafe/ambiguous combinations with required upgrade/convert/export alternatives; never default consent/quality. Evidence: refusal tests. - [ ] A1.14.f Round-trip old/current fixtures across console/service/worker/ SDK/adapter/format and document irreversible steps. Evidence: compatibility report. - [ ] A1.15 Define body, joint, hand/finger, face/landmark, gaze, expression, blend-shape, confidence, occlusion, contact, multi-person identity, and tracking-loss contracts separately. Evidence: modality-specific privacy, consent, quality, and absence/unsupported semantics. - [ ] A1.15.a Define body/root/joint hierarchy/pose/global-local transforms/ visibility/confidence/occlusion/tracking state and source modality. Evidence: body schema. - [ ] A1.15.b Define hand/finger side/joints/curls/spread/contact/gesture/ confidence/occlusion and per-hand supported/absent state. Evidence: hand schema. - [ ] A1.15.c Define face/landmark/topology/expression/blend shape/ coefficients/identity-independent versus identity-bearing fields. Evidence: face schema. - [ ] A1.15.d Define gaze origin/direction/target/confidence/calibration and avoid inferring attention/emotion/health beyond intended use. Evidence: gaze schema. - [ ] A1.15.e Define contacts with body parts/surface/point/normal/start-end/ confidence and multi-person stable track identity/associations. Evidence: contact/identity schemas. - [ ] A1.15.f Define tracking loss/partial/occluded/not-observed/ unsupported/not-requested/consent-blocked distinctly from zero/neutral. Evidence: absence semantics. - [ ] A1.15.g Map consent/privacy/retention/redaction/quality/evaluator/profile independently per modality and test round-trips. Evidence: modality matrix. - [ ] A1.16 Define live-capture device, stream, sensor, clock, frame, network, calibration, preview, recording, buffer, dropout, reconnect, edge/cloud processing, and session-handoff contracts. Evidence: desktop/mobile and multi-device compatibility fixtures. - [ ] A1.16.a Define device/app/OS/model/sensor/camera/depth/IMU/audio/ capability/permission/thermal/battery/storage identity and state. Evidence: device schema. - [ ] A1.16.b Define stream/modality/codec/resolution/rate/orientation/ timestamps/clock/timecode/synchronization/calibration/frame metadata. Evidence: stream schema. - [ ] A1.16.c Define live frame/payload/order/drop/duplicate/late/confidence/ tracking state and preview redaction/latency/quality warning. Evidence: frame contract. - [ ] A1.16.d Define immutable local recording/chunks/checksums/buffer/quota/ encryption/upload cursor/dropout markers/recovery. Evidence: recording schema. - [ ] A1.16.e Define edge versus cloud stage selection, model/version/ hardware/privacy/rights/latency/fallback and no silent data transfer. Evidence: processing profile. - [ ] A1.16.f Define disconnect/reconnect/resume/deduplication/clock reset/ calibration invalidation and signed session/operator handoff. Evidence: handoff contract. - [ ] A1.16.g Validate desktop/mobile/multi-device/device-loss/network/ interruption/version/clock fixtures. Evidence: compatibility suite. - [ ] A1.17 Define vertical-pipeline profile, intended use, excluded use, motion vocabulary, reference protocol, required annotations, evaluator, quality floor, human qualification, output projection, and disclaimer. Evidence: profile schema prevents a film/gaming result from masquerading as a clinical or coaching result. - [ ] A1.17.a Define stable profile/version/owner/jurisdiction/audience/ intended use/excluded use/prohibited claims/disclaimer and review cadence. Evidence: profile schema. - [ ] A1.17.b Define motion vocabulary/taxonomy/actions/phases/body regions/ expected variability/cultural or domain sources and aliases. Evidence: vocabulary contract. - [ ] A1.17.c Define capture/reference protocol/devices/views/calibration/ subjects/consent/modalities/environment/instructions. Evidence: protocol schema. - [ ] A1.17.d Define required DAG stages/models/configs/resources/annotations/ raw measurements/evaluator versions/quality floors/uncertainty. Evidence: processing contract. - [ ] A1.17.e Define human reviewer qualifications/independence/adjudication/ approval/waiver and consumer output fields/redaction/format/watermark. Evidence: governance contract. - [ ] A1.17.f Bind every output/package/adapter projection to profile ID/ intended-use warning/disclaimer and reject cross-profile substitution. Evidence: boundary tests. - [ ] A1.17.g Validate independent known-value/privacy/consent/safety/ handoff fixtures for every ratified vertical. Evidence: profile suite. ### A2 — Intake, consent, calibration, and preprocessing - [ ] A2.1 Build project/session/take capture and bulk ingest. Evidence: keyboard and resumable-upload journey. - [ ] A2.1.a Create/select authorized project/profile/purpose and capture session with devices/subjects/consent/calibration/time/location/owner. Evidence: setup tests. - [ ] A2.1.b Create takes with slate/action/performers/cameras/range/markers/ notes and immutable local/remote input placeholders. Evidence: take tests. - [ ] A2.1.c Build multi-file/folder/archive manifest preview with detected kind/size/hash/associations/duplicates/consent/expected mappings. Evidence: bulk preview. - [ ] A2.1.d Upload resumably with progress/pause/resume/retry/cancel/quota/ checksum and partial per-item state. Evidence: upload tests. - [ ] A2.1.e Finalize only after quarantine/validation/metadata assignment and durable blob/reference, preserving rejected/orphan cleanup. Evidence: ingest tests. - [ ] A2.1.f Run pointer-free/screen-reader single and mixed bulk ingest, interruption/reload/duplicate/permission/recovery. Evidence: E2E. - [ ] A2.2 Quarantine uploaded video, depth, calibration, skeleton, rig, and project archives. Evidence: malicious corpus. - [ ] A2.2.a Store every untrusted item in isolated non-executable quarantine before preview/parse/index/model/worker use. Evidence: boundary tests. - [ ] A2.2.b Verify signature/type/codec/schema/size/count/nesting and scan malware/polyglot/active content/unsafe metadata. Evidence: file corpus. - [ ] A2.2.c Enforce archive path/symlink/device-file/nesting/member/ratio/ decompressed-size limits and scan each member. Evidence: archive corpus. - [ ] A2.2.d Parse video/depth/calibration/skeleton/rig/project using sandboxed bounded parsers without loading scripts/plugins/external resources. Evidence: parser tests. - [ ] A2.2.e Record scanner/parser/signature/policy versions and release/ reject/manual-review decision, rescan on update. Evidence: audit. - [ ] A2.2.f Test crash/timeout/oversize/encrypted/corrupt/unknown/false- positive override and prove no unscanned escape. Evidence: malicious suite. - [ ] A2.3 Validate media container, codec, resolution, frame rate, timestamps, duration, orientation, color, audio, and corruption. Evidence: fixture matrix. - [ ] A2.3.a Probe actual container/streams/codecs/profiles/levels/bit-depth/ dimensions/pixel formats and compare extension/MIME/declared metadata. Evidence: format tests. - [ ] A2.3.b Validate resolution/aspect/crop/rotation/orientation/interlace/ anamorphic/pixel geometry and profile requirements. Evidence: image tests. - [ ] A2.3.c Validate nominal/average/variable frame rate, time base, PTS/DTS/ monotonicity/gaps/duplicates/duration/start offset and audio sync. Evidence: timing tests. - [ ] A2.3.d Validate color primaries/transfer/matrix/range/HDR metadata and depth/disparity/calibration channel relationships. Evidence: color/depth tests. - [ ] A2.3.e Validate audio channels/rate/codec/duration only where captured and never infer consent from presence. Evidence: audio tests. - [ ] A2.3.f Decode representative/full sampled frames, detect corruption/ truncation/errors, and emit pass/fail/unsupported/partial with evidence. Evidence: fixture matrix. - [ ] A2.4 Validate multi-view synchronization and camera identity. Evidence: aligned, drifted, dropped-frame, and swapped-camera fixtures. - [ ] A2.4.a Resolve expected camera/sensor IDs, serial/position/stream/ calibration assignment and protect identifying metadata. Evidence: identity tests. - [ ] A2.4.b Compare trusted timecode/hardware clock/timestamps/audio/visual sync events with offsets/jitter/drift/confidence and clock resets. Evidence: sync measurements. - [ ] A2.4.c Detect missing/duplicate/dropped/late/out-of-order frames and variable rate per camera with aligned frame availability. Evidence: frame tests. - [ ] A2.4.d Detect swapped/mislabeled/duplicate cameras using calibration/ visual/fingerprint evidence and require human correction. Evidence: swap tests. - [ ] A2.4.e Persist raw offset/drift/identity evidence separately from profile tolerance verdict and remediation/resync plan. Evidence: result tests. - [ ] A2.4.f Run aligned/drifted/dropped/swapped/clock-reset/partial-view fixtures. Evidence: synchronization suite. - [ ] A2.5 Validate calibration completeness, reprojection error, lens, scale, coordinate frame, and capture volume. Evidence: known values. - [ ] A2.5.a Verify required cameras/sensors/intrinsics/extrinsics/distortion/ image size/reference observations/board or volume metadata and versions. Evidence: completeness tests. - [ ] A2.5.b Recompute per-camera/global reprojection residuals/distributions/ outliers/coverage/confidence from pinned observations. Evidence: reprojection tests. - [ ] A2.5.c Validate lens model/parameters/ranges/focus-zoom state/ rolling-shutter where applicable and image-stream match. Evidence: lens tests. - [ ] A2.5.d Validate scale/reference distance/units/handedness/up-forward/ origin/world-camera transforms and round-trip closure. Evidence: coordinate tests. - [ ] A2.5.e Validate capture volume bounds/overlap/triangulation geometry/ blind zones/ground plane and expected subject coverage. Evidence: volume tests. - [ ] A2.5.f Persist raw values separately from profile verdict and run known calibrated/error/missing/stale fixtures. Evidence: known-value suite. - [ ] A2.6 Capture subject consent before biometric processing. Evidence: missing or mismatched consent blocks stage dispatch. - [ ] A2.6.a Identify each subject/representative and exact project/session/ take/profile/modalities/purpose/collector before processing. Evidence: consent request. - [ ] A2.6.b Present current accessible localized notice with biometric/ model/recipient/territory/retention/revocation/excluded-use details. Evidence: notice tests. - [ ] A2.6.c Record affirmative verified identity/authority/intent/signature/ time/document hash/evidence and allow decline/partial modality. Evidence: consent capture. - [ ] A2.6.d Bind consent reference/version to subject tracks and every raw input with protected ordinary projection. Evidence: binding tests. - [ ] A2.6.e Enforce current exact match at queue dispatch and worker start/ commit; block missing/mismatched/expired/revoked state. Evidence: dispatch race tests. - [ ] A2.7 Verify consent scope against project purpose and intended exports. Evidence: purpose/territory/recipient mismatch tests. - [ ] A2.7.a Resolve exact project/profile intended use/modalities/stages/ models/providers and proposed output/package/export/consumer plan. Evidence: scope inputs. - [ ] A2.7.b Compare subject consent purpose/uses/excluded uses/modalities/ biometric processing/model training/derivatives. Evidence: purpose tests. - [ ] A2.7.c Compare territory/region/recipient/provider/consumer/host/ publication/transfer and data residency. Evidence: recipient tests. - [ ] A2.7.d Compare term/expiry/retention/revocation/status and allowed watermark/redaction/output format/intended claims. Evidence: temporal/ output tests. - [ ] A2.7.e Return eligible/blocked/partial/manual-review with exact mismatch, safe alternatives, and no automatic scope expansion. Evidence: result contract. - [ ] A2.7.f Recheck on project/pipeline/export/recipient/territory/consent change and test mismatch matrix. Evidence: lifecycle tests. - [ ] A2.8 Run input content moderation and privacy classification. Evidence: versioned results and manual-review state. - [ ] A2.8.a Define profile/jurisdiction/modality-specific categories, prohibited/restricted/review thresholds, human qualifications, and privacy classes. Evidence: policy registry. - [ ] A2.8.b Analyze pinned redacted or protected video/depth/audio/metadata/ rig/project inputs for unsafe content, minors/vulnerability/nudity/ violence/identifiers/background/sensitive setting. Evidence: analyzer tests. - [ ] A2.8.c Persist raw findings/ranges/regions/confidence/model/policy/ corpus versions separately from moderation/privacy verdict. Evidence: result schema. - [ ] A2.8.d Route uncertain/high-risk/disagreement to authorized protected manual review with minimization and no ordinary thumbnail/log leakage. Evidence: review tests. - [ ] A2.8.e Apply accept/restrict/redact/quarantine/reject/escalate decision and allowed downstream stage/role/export projections. Evidence: enforcement tests. - [ ] A2.8.f Recompute/invalidate on input/model/policy/profile change and evaluate calibrated subgroup/privacy errors. Evidence: versioned report. - [ ] A2.9 Build face/background/identifier redaction options before wider access. Evidence: role projections use the derivative. - [ ] A2.9.a Define redaction request pinned to source/ranges/subjects/profile/ purpose and face/background/identifier types with authorized reviewer. Evidence: request schema. - [ ] A2.9.b Detect/track faces, bodies/people, background regions, screens/ plates/documents/logos/location/device identifiers with confidence. Evidence: detection tests. - [ ] A2.9.c Allow protected human adjust/add/remove tracks/masks/regions and choose blur/pixelate/mask/crop/replace/avatar/metadata strip settings. Evidence: editor tests. - [ ] A2.9.d Render immutable temporally consistent derivative with exact source link, tool/model/settings/ranges/hashes and residual-risk measurements. Evidence: render tests. - [ ] A2.9.e Map ordinary roles/search/preview/annotation/model/export to derivative only and block raw fallback when derivative fails. Evidence: projection tests. - [ ] A2.9.f Test occlusion/reentry/motion blur/profile/edge frames/audio/ metadata/cache/download and role revoke. Evidence: redaction suite. - [ ] A2.10 Build capture quality preview with exposure, blur, occlusion, framing, dropped frames, and coverage. Evidence: known clips. - [ ] A2.10.a Generate permission-filtered synchronized low-risk previews/ thumbnails/overlays from exact take/calibration with source time. Evidence: preview contract. - [ ] A2.10.b Measure exposure/clipping/dynamic range/color/blur/shutter/ focus/noise per camera/time with confidence. Evidence: image tests. - [ ] A2.10.c Measure subject/body-part visibility/occlusion/truncation/ framing/scale/angle/capture-volume and modality coverage. Evidence: coverage tests. - [ ] A2.10.d Show dropped/duplicate/late frames, sync/drift/calibration/ camera identity issues and affected ranges/views. Evidence: temporal tests. - [ ] A2.10.e Present raw values/units/profile thresholds/unknowns/ recommendations separately from intake decision, with semantic tables. Evidence: UI tests. - [ ] A2.10.f Validate known good/bad/borderline/multiview/multi-person/ protected clips and no unredacted preview leak. Evidence: known clip suite. - [ ] A2.11 Build take grouping, slate, performer, action, marker, and notes. Evidence: metadata schema and search. - [ ] A2.11.a Define take group/set/version/order/relationship for repeated actions, multi-camera parts, calibration, sessions, and variants. Evidence: grouping schema. - [ ] A2.11.b Edit slate/scene-shot-take/action/motion class/profile/date/ location/operator/device labels with governed vocabularies. Evidence: metadata tests. - [ ] A2.11.c Assign pseudonymous performer/subject tracks and consent status without exposing protected identity. Evidence: performer tests. - [ ] A2.11.d Add time/frame markers/ranges/cues/events/notes with anchors, visibility, authorship, revision, and protected fields. Evidence: annotation tests. - [ ] A2.11.e Support bulk edit/reorder/merge/split/duplicate handling with impact/concurrency/undo/audit and immutable input lineage. Evidence: operation tests. - [ ] A2.11.f Index safe metadata for permission-aware search/facets and test protected title/count/snippet leakage. Evidence: search tests. - [ ] A2.12 Build duplicate and near-duplicate detection. Evidence: exact hash and perceptual similarity remain distinct. - [ ] A2.12.a Compute/verify cryptographic content hashes and classify exact byte duplicates independently of metadata/path/name. Evidence: exact dedupe tests. - [ ] A2.12.b Compute versioned video/depth/motion/audio perceptual fingerprints/features on authorized derivatives with range/alignment. Evidence: near-dedupe tests. - [ ] A2.12.c Generate candidates with exact versus perceptual reason, aligned ranges, transformations, score/confidence, corpus/index version. Evidence: candidate contract. - [ ] A2.12.d Present protected-aware compare and let human keep/link/replace/ merge metadata/mark-not-duplicate; never delete automatically. Evidence: review tests. - [ ] A2.12.e Preserve distinct captures/consent/provenance/calibration even when bytes/content match and enforce cross-project isolation. Evidence: integrity tests. - [ ] A2.12.f Evaluate precision/recall/transforms/partial overlaps/multi-view/ identity leakage and stale index. Evidence: dedupe report. - [ ] A2.13 Build resumable ingest with checksum and orphan cleanup. Evidence: interruption/retry test. - [ ] A2.13.a Define upload session/file/chunk/offset/size/hash/tenant/project/ quota/expiry/idempotency and intended asset metadata. Evidence: upload contract. - [ ] A2.13.b Upload chunks with range/order/duplicate/retry validation, per-chunk hashes, pause/resume/cancel, and bounded concurrency. Evidence: transfer tests. - [ ] A2.13.c Finalize only after complete size/hash/type/quarantine scan and durable blob/reference transaction; handle timeout after commit. Evidence: completion tests. - [ ] A2.13.d Resume after network/browser/app/worker restart with current authorization and no duplicate bytes/assets. Evidence: recovery tests. - [ ] A2.13.e Track abandoned/expired/cancelled/unreferenced chunks/blobs and clean after safe retention, active lease, legal hold, and reconciliation. Evidence: cleanup tests. - [ ] A2.13.f Inject interruption/out-of-order/corruption/quota/role revoke/ process crash/DB-blob mismatch and verify checksums/orphan cleanup. Evidence: ingest fault suite. - [ ] A2.14 Build intake decision records for accept, reject, recapture, quarantine, or redact. Evidence: rationale and affected files. - [ ] A2.14.a Define immutable decision identity/type/actor-role/time/profile/ project/session/take/affected asset revisions and input findings. Evidence: decision schema. - [ ] A2.14.b Require rationale/evidence/quality/consent/privacy/moderation/ technical considerations, uncertainty, and conditions. Evidence: validation tests. - [ ] A2.14.c For accept, create eligible intake revision without asserting downstream quality; for reject, retain evidence/retention disposition. Evidence: disposition tests. - [ ] A2.14.d For recapture, record exact deficiencies/protocol/settings/ deadline/assignment and link replacement take. Evidence: recapture tests. - [ ] A2.14.e For quarantine/redact, restrict access/stages, create protected review or derivative workflow, and preserve source. Evidence: enforcement tests. - [ ] A2.14.f Enforce role/consent/concurrency and immutable reversals/new decisions with audit/notifications. Evidence: authority tests. - [ ] A2.15 Build desktop live capture with camera/sensor discovery, permission, preview, device settings, calibration, clock/sync, subject/ consent match, recording, pause, reconnect, local buffer, upload, and operator handoff. Evidence: device and network fault journeys. - [ ] A2.15.a Discover/identify/capability-probe/hot-plug cameras/depth/IMU/ audio/sync devices with stable aliases and privacy-safe metadata. Evidence: discovery tests. - [ ] A2.15.b Request/revoke OS permissions and configure device/source/ resolution/rate/exposure/focus/orientation/depth/audio/clock with unsupported state. Evidence: device tests. - [ ] A2.15.c Show low-latency redacted synchronized preview, framing/ exposure/blur/occlusion/coverage/drop/sync/thermal/storage/network quality warnings. Evidence: preview tests. - [ ] A2.15.d Capture/validate calibration and exact subject-track/consent/ profile/purpose/modalities match before arm/processing. Evidence: preflight tests. - [ ] A2.15.e Implement record/pause/resume/stop/slate/marker/countdown/ emergency stop with monotonic clocks and immutable crash-safe local chunks. Evidence: recording tests. - [ ] A2.15.f Handle device/clock/network/process loss with visible state, local buffer/quota, dropout markers, reconnect/recalibration, and no false continuity. Evidence: fault tests. - [ ] A2.15.g Upload resumably with checksums/deduplication/encryption/ consent scope and reconcile authoritative session/take/assets. Evidence: upload tests. - [ ] A2.15.h Hand off signed exact session/take/device/calibration/subject/ consent/quality/upload context to authorized operator and run complete fault journeys. Evidence: desktop live E2E. - [ ] A2.16 Build mobile live capture with supported camera/depth/IMU inputs, orientation, thermal/battery/storage/network state, consent, guidance, quality feedback, encrypted local buffering, background/interruption recovery, and session handoff. Evidence: applicable mobile automation and lost-device/privacy tests. - [ ] A2.16.a Define supported device/OS/app/camera/depth/IMU/audio/ orientation/profile combinations and capability negotiation. Evidence: mobile matrix. - [ ] A2.16.b Request least-privilege permissions and configure capture rate/ resolution/orientation/lens/depth/IMU sync while handling rotation/ sensor changes. Evidence: setup tests. - [ ] A2.16.c Present accessible localized consent/profile/purpose/modalities/ privacy/retention notice and bind each subject before capture. Evidence: consent tests. - [ ] A2.16.d Provide framing/distance/lighting/occlusion/coverage/motion/ calibration guidance and real-time warnings without medical/coaching claims. Evidence: guidance tests. - [ ] A2.16.e Monitor thermal/battery/storage/quota/network/background/ interruption and adapt or stop with explicit quality impact. Evidence: resource tests. - [ ] A2.16.f Record encrypted crash-safe local chunks/metadata/checksums with pause/resume/background-call-lock-screen recovery and dropout markers. Evidence: recording tests. - [ ] A2.16.g Upload resumably/reconcile/deduplicate, delete by policy after durable receipt, and hand off signed session/consent/quality context. Evidence: handoff tests. - [ ] A2.16.h Run mobile automation for orientation/background/interruption/ low battery/thermal/storage/network/lost-stolen device/remote revoke/ privacy. Evidence: mobile E2E. - [ ] A2.17 Build multi-person take identity and tracking assignment with consent per subject, occlusion/crossing review, split/merge correction, and protected biometrics. Evidence: identity swaps cannot silently enter downstream motion. - [ ] A2.17.a Define pseudonymous subject/track/take identity, protected biometric/reference features, consent link, and noninferable ordinary labels. Evidence: identity schema. - [ ] A2.17.b Initialize/associate subjects across cameras/modalities/time using authorized evidence/confidence and require consent before biometric matching. Evidence: assignment tests. - [ ] A2.17.c Detect occlusion/entry-exit/crossing/identity-switch/fragment/ merge ambiguity with affected frames/views/confidence. Evidence: tracking tests. - [ ] A2.17.d Provide synchronized protected review with candidate tracks/ source views and human confirm/reassign/split/merge/unknown controls. Evidence: review tests. - [ ] A2.17.e Apply corrections as versioned mapping operations, propagate to body/hand/face/mesh/annotations/consent, and invalidate downstream stages/gates. Evidence: correction tests. - [ ] A2.17.f Enforce per-subject modality/purpose/recipient consent throughout multi-person outputs; block unconsented track rather than empty it silently. Evidence: consent tests. - [ ] A2.17.g Exclude biometrics from ordinary previews/search/logs/cache/ exports and test two tenants/roles/revocation. Evidence: privacy tests. - [ ] A2.17.h Run crossing/occlusion/clothing-similar/exit-reentry/swapped camera/partial consent fixtures and prove no silent identity swap. Evidence: identity safety suite. ### A3 — Pipeline templates, execution, and stage control - [ ] A3.1 Build pipeline-template registry and lifecycle. Evidence: draft, review, publish, deprecate, and archive journey. - [ ] A3.1.a Build permissioned registry/search/filter/view for template ID/ version/profile/owner/status/capabilities/formats/models/freshness. Evidence: registry tests. - [ ] A3.1.b Create/clone/import/edit immutable draft versions with DAG/config/ resource/cache/consent/gate/export metadata validation. Evidence: draft tests. - [ ] A3.1.c Route review comments/changes/domain-privacy-safety-engineering approvals on exact version with semantic diff. Evidence: review tests. - [ ] A3.1.d Publish/activate with effective window/compatibility/migration/ rollback, prohibit mutation, and dispatch only approved versions. Evidence: publish tests. - [ ] A3.1.e Deprecate/supersede/archive with dependent project/job/profile/ SDK impact, migration alternatives, and immutable history. Evidence: lifecycle journey. - [ ] A3.2 Build DAG editor with typed ports, cycle prevention, required-stage floors, keyboard editing, and semantic list parity. Evidence: a11y and validation tests. - [ ] A3.2.a Render versioned stage catalog and DAG nodes/ports/edges/ conditions/resources/status with stable selection and schema-driven configuration. Evidence: editor tests. - [ ] A3.2.b Add/remove/duplicate/configure/connect/disconnect/reorder/group stages with typed kind/cardinality/version/capability validation. Evidence: graph operation tests. - [ ] A3.2.c Detect cycles/unreachable outputs/missing required input/ incompatible optional branch/fan-in/resource/export path. Evidence: DAG validation. - [ ] A3.2.d Enforce profile/code-owned ingest/consent/privacy/validation/ package floors that template edits cannot bypass. Evidence: floor tests. - [ ] A3.2.e Provide source/target/port forms, ordered stage list/dependency table, before-after moves, complete keyboard/screen-reader/non-drag parity. Evidence: semantic tests. - [ ] A3.2.f Support undo/redo/diff/concurrent draft conflict/large graph performance and fail invalid publish. Evidence: editor suite. - [ ] A3.3 Build per-stage configuration forms from versioned schemas. Evidence: unknown properties and incompatible versions fail. - [ ] A3.3.a Resolve exact stage type/adapter/config schema/UI schema/default/ capability/profile version and migration. Evidence: schema resolver. - [ ] A3.3.b Render accessible typed controls for scalar/enum/range/unit/file/ artifact/model/rig/mapping/secret/conditional/repeated fields. Evidence: form tests. - [ ] A3.3.c Validate required/type/range/unit/cross-field/port/resource/ consent/profile/format constraints client and server. Evidence: validation tests. - [ ] A3.3.d Store explicit values separately from defaults/secrets, canonical serialize/hash, show output-affecting change and downstream cache impact. Evidence: persistence tests. - [ ] A3.3.e Migrate supported older configs with semantic diff; reject unknown properties/incompatible schema/adapter versions without defaulting. Evidence: compatibility tests. - [ ] A3.4 Implement ingest and preprocessing stage adapters. Evidence: exact input/output contracts. - [ ] A3.4.a Define typed accepted quarantined input assets/calibration/ metadata/consent/privacy and normalized output kinds/version. Evidence: adapter contract. - [ ] A3.4.b Implement decode/extract/orient/color/depth/timebase/frame/audio/ metadata normalization without altering immutable originals. Evidence: processing tests. - [ ] A3.4.c Implement resize/crop/redaction/sync/resample/frame selection/ segmentation-ready derivatives with exact transformation lineage. Evidence: derivative tests. - [ ] A3.4.d Emit per-view/range quality/availability/dropped/corrupt/ unsupported findings and never fabricate missing frames. Evidence: output tests. - [ ] A3.4.e Pin tool/library/config/hardware/input-output hashes, resource/ cost, logs, and deterministic cache/replay eligibility. Evidence: provenance tests. - [ ] A3.4.f Inject malformed/partial/missing calibration/consent revoke/ parser/worker/storage faults. Evidence: adapter fault suite. - [ ] A3.5 Implement 2D pose-estimation stage adapter. Evidence: provider/model provenance and confidence output. - [ ] A3.5.a Define accepted image/video views/ranges/subjects/profile/ modality/model/crop/calibration/consent and 2D output schema. Evidence: adapter contract. - [ ] A3.5.b Negotiate eligible local/provider model/version/body-hand-face/ multi-person capabilities, resources, privacy, and budget. Evidence: capability tests. - [ ] A3.5.c Execute inference with deterministic preprocessing/batching/ coordinate transform and emit landmarks/joints/tracks/confidence/ visibility/occlusion/tracking loss. Evidence: output tests. - [ ] A3.5.d Map outputs back to exact source camera/frame/pixel-normalized coordinates and subject identities with uncertainty. Evidence: alignment tests. - [ ] A3.5.e Persist provider/model/weights/config/hardware/corpus/input-output hashes/resource/cost and attributed proposal state. Evidence: provenance tests. - [ ] A3.5.f Test no-person/multi-person/occlusion/crop/rotation/low quality/ missing modality/provider failure/consent block. Evidence: adapter suite. - [ ] A3.6 Implement pose-lifting/3D reconstruction stage adapter. Evidence: coordinate and scale contract. - [ ] A3.6.a Define accepted synchronized 2D/multiview/depth/calibration/ skeleton/subject inputs and 3D joint/trajectory/confidence outputs. Evidence: adapter contract. - [ ] A3.6.b Negotiate monocular/multiview/depth/model/profile capabilities, coordinate/scale recovery assumptions, resources, and consent. Evidence: capability tests. - [ ] A3.6.c Execute triangulation/lifting/optimization with exact camera/ calibration/time associations and uncertainty propagation. Evidence: reconstruction tests. - [ ] A3.6.d Transform to canonical coordinate/units/ground/root frame and retain ambiguity/scale confidence rather than inventing absolute scale. Evidence: coordinate tests. - [ ] A3.6.e Persist model/config/calibration/input-output hashes/measurements/ resources/cost and proposal lineage. Evidence: provenance tests. - [ ] A3.6.f Test known 3D/calibration error/single-view/occlusion/drift/ swapped camera/low-confidence/failure fixtures. Evidence: adapter suite. - [ ] A3.7 Implement human-mesh-recovery stage adapter. Evidence: topology and subject privacy controls. - [ ] A3.7.a Define accepted images/video/2D-3D pose/calibration/subject/ profile/consent/model inputs and mesh/body-parameter/texture outputs. Evidence: adapter contract. - [ ] A3.7.b Negotiate approved topology/model/version/modality/hardware/ privacy/output use and block face/body detail outside consent. Evidence: capability tests. - [ ] A3.7.c Execute recovery with canonical coordinate/scale/frame alignment, stable topology/vertex-joint correspondence, confidence/occlusion. Evidence: mesh tests. - [ ] A3.7.d Generate redacted/identity-minimized mesh derivatives or suppress texture/shape fields by role/profile; keep protected source separated. Evidence: privacy tests. - [ ] A3.7.e Persist model/weights/config/input-output hashes/topology version/ resources/cost/provenance and generated disclosure. Evidence: lineage tests. - [ ] A3.7.f Test topology mismatch/partial body/loose clothing/multi-person/ privacy restriction/consent revoke/failure. Evidence: adapter suite. - [ ] A3.8 Implement skeleton mapping and retargeting stage adapters. Evidence: canonical, neural, semantic, and proportional strategy fixtures. - [ ] A3.8.a Define source/target skeleton-rig/motion/bind/coordinate/unit/ mapping/profile/strategy inputs and retargeted output contract. Evidence: adapter schemas. - [ ] A3.8.b Implement explicit canonical joint-name mapping with hierarchy/ parent/end-effector/root/twist/finger/face validation. Evidence: canonical fixtures. - [ ] A3.8.c Implement semantic candidate mapping with confidence/evidence and human-confirmed ambiguous/unmapped joints. Evidence: semantic fixtures. - [ ] A3.8.d Implement proportional retarget with bone lengths/scale/offset/ orientation/pose/contact/root constraints and disclosed assumptions. Evidence: proportional fixtures. - [ ] A3.8.e Implement neural mapping/retarget only through approved model/ training domain/consent/capability with attributed proposal output. Evidence: neural fixtures. - [ ] A3.8.f Preserve source and version mapping/output lineage; run quality measures, missing-joint/coordinate/version/failure tests. Evidence: strategy suite. - [ ] A3.9 Implement IK/cleanup, contact, jitter, interpolation, and root-motion stage adapters. Evidence: non-destructive revision links. - [ ] A3.9.a Define distinct stage variants with exact source motion/ranges/ joints/contacts/constraints/config/profile and preserved original. Evidence: stage contracts. - [ ] A3.9.b Implement IK/end-effector/contact constraints with chain/pole/ limits/weights/iterations, residuals, and failure/overconstraint. Evidence: IK tests. - [ ] A3.9.c Implement jitter/noise filtering with cutoff/window/adaptive/ confidence handling and no unintended timing/pose drift. Evidence: smoothing tests. - [ ] A3.9.d Implement gap interpolation for missing frames/joints using bounded duration/method/context/confidence and disclose generated ranges. Evidence: interpolation tests. - [ ] A3.9.e Implement root extraction/in-place/world trajectory/ground/ orientation/contact preservation and coordinate-unit consistency. Evidence: root tests. - [ ] A3.9.f Emit immutable new revision with per-frame/joint operation lineage; verify unchanged ranges stable, undo/compare, and quality measurements. Evidence: cleanup suite. - [ ] A3.10 Implement blend-shape/facial retargeting only under valid consent. Evidence: scope test. - [ ] A3.10.a Resolve source face/landmark/expression/blend-shape tracks, subject identity, exact consent modalities/uses/target/territory/expiry, and privacy profile. Evidence: preflight tests. - [ ] A3.10.b Define source-target face topology/landmark/blend-shape/neutral/ range/sign/scale mapping with confidence and version. Evidence: mapping contract. - [ ] A3.10.c Retarget curves/poses with calibration/smoothing/limits/ temporal alignment and preserve tracking loss/occlusion. Evidence: output tests. - [ ] A3.10.d Emit redacted identity-minimized motion where required, exact model/tool/config/source-output lineage, watermark, and disclosure. Evidence: privacy/provenance tests. - [ ] A3.10.e Recheck consent at dispatch/commit/package, cancel/quarantine/ invalidate on revoke, and test purpose/recipient/territory mismatch. Evidence: scope suite. - [ ] A3.11 Implement validation and packaging stages as explicit DAG nodes. Evidence: export cannot bypass them. - [ ] A3.11.a Define typed validation node consuming exact motion/rig/mapping/ profile/ground truth and producing raw measurements plus versioned verdicts. Evidence: validation contract. - [ ] A3.11.b Define review/waiver/adjudication prerequisites and block packaging on nonpass/stale/unavailable/low-confidence according to profile. Evidence: gate tests. - [ ] A3.11.c Define packaging node consuming validated approved revision, target format/rig/mapping/consent/watermark/provenance and outputs. Evidence: package contract. - [ ] A3.11.d Enforce DAG reachability/required-stage floors and server/worker authorization so export APIs cannot skip nodes or forge results. Evidence: bypass tests. - [ ] A3.11.e Recheck all dependencies/consent/gate versions atomically before package commit and invalidate downstream on change. Evidence: race tests. - [ ] A3.11.f Test direct API/CLI/worker/cache/imported artifact/export target bypass and preserve immutable audit. Evidence: enforcement suite. - [ ] A3.12 Implement honest `unavailable` for missing GPU, model, reference, rig, host, or calibration. Evidence: no placeholder output. - [ ] A3.12.a Define required capability/dependency resolution and distinct missing/not-configured/unsupported/unauthorized/offline/degraded/ unavailable reason codes. Evidence: state contract. - [ ] A3.12.b Check worker GPU/CPU/memory/architecture/model/licence/version/ host/profile capability before enqueue and lease. Evidence: compute tests. - [ ] A3.12.c Check required source/reference/calibration/skeleton/rig/mapping/ consent/rights/artifacts and exact versions. Evidence: dependency tests. - [ ] A3.12.d Return no synthetic/empty/identity/placeholder artifact; retain safe diagnostics, alternatives, remediation, and retry eligibility. Evidence: output tests. - [ ] A3.12.e Propagate unavailable to stage/job/batch/console/adapter/package without displaying success/healthy. Evidence: projection tests. - [ ] A3.12.f Exercise every missing combination plus resource loss after enqueue/lease and verify no placeholder output. Evidence: state suite. - [ ] A3.13 Implement enqueue, priority, dependency, pause, resume, cancel, retry, skip-if-optional, and rerun-from-stage. Evidence: state-machine tests. - [ ] A3.13.a Define canonical job/stage/attempt control state machine, actor/ authorization/idempotency/expected version and legal transitions. Evidence: state contract. - [ ] A3.13.b Enqueue exact template/input/config/consent/profile/budget with dependency readiness and bounded priority/fairness. Evidence: enqueue tests. - [ ] A3.13.c Pause/resume at safe stage/checkpoint boundaries with lease/ partial artifact/local state preservation and dependency revalidation. Evidence: pause tests. - [ ] A3.13.d Cancel queued/running/worker/provider/commit phases with requested-versus-completed state, fencing, cleanup, and partial outputs. Evidence: cancel tests. - [ ] A3.13.e Retry failed attempts under policy and allow skip only for declared optional stage with explicit downstream impact. Evidence: retry/skip tests. - [ ] A3.13.f Rerun from selected stage with new immutable config/input/ versions, cache/downstream invalidation, cost preview, and no history rewrite. Evidence: state-machine suite. - [ ] A3.14 Implement stage cache keys over every output-affecting input, version, model, and policy. Evidence: cache invalidation tests. - [ ] A3.14.a Enumerate all output-affecting input artifact hashes/ranges/ configs/defaults/calibration/skeleton/rig/mapping/reference/profile/ consent-privacy policy fields. Evidence: key manifest. - [ ] A3.14.b Include stage/adapter/code/container/model/weights/library/ hardware-sensitive/runtime/policy/evaluator/format versions and seed. Evidence: version key tests. - [ ] A3.14.c Canonical serialize/normalize order/units/defaults without secrets and hash with versioned algorithm/namespace/tenant/privacy boundary. Evidence: key tests. - [ ] A3.14.d Validate cached artifact manifest/hash/completeness/lineage/ consent/access/profile/expiry before hit; quarantine mismatch. Evidence: read tests. - [ ] A3.14.e Invalidate on any dependency/revocation/policy/version change and propagate to downstream stage/results/gates/packages. Evidence: invalidation tests. - [ ] A3.14.f Mutate each key dimension individually plus ordering/no-op fields and run collision/cross-tenant/corrupt cache tests. Evidence: cache suite. - [ ] A3.15 Implement checkpoint/recovery for long stages. Evidence: worker restart test. - [ ] A3.15.a Define checkpointable stage boundaries/state/shard/range/ progress/model/runtime/random state/artifacts/version and safe frequency. Evidence: checkpoint contract. - [ ] A3.15.b Write checkpoints atomically with hashes/fencing/job-stage- attempt identity and durable artifact references before acknowledging. Evidence: persistence tests. - [ ] A3.15.c On worker restart/loss, validate current lease/input/config/ model/policy/consent and resume compatible checkpoint or restart safely. Evidence: recovery tests. - [ ] A3.15.d Deduplicate/reconcile partial outputs/logs/measurements/resource usage/cost and prevent stale worker commit after reassignment. Evidence: fencing tests. - [ ] A3.15.e Expire/clean checkpoints only after terminal retention/active lease/legal hold/replay rules; quarantine corrupt state. Evidence: cleanup tests. - [ ] A3.15.f Kill workers at every boundary and verify final output/order/ lineage/equivalence or disclosed nondeterminism. Evidence: restart suite. - [ ] A3.16 Implement deterministic replay eligibility. Evidence: missing dependency is explicit. - [ ] A3.16.a Define determinism profile per stage covering code/model/runtime/ hardware/seed/parallelism/libraries/external provider/input/config. Evidence: replay contract. - [ ] A3.16.b Verify all immutable input/output-affecting dependencies and artifacts remain available, authorized, consent-valid, and hash-verified. Evidence: eligibility tests. - [ ] A3.16.c Classify exact deterministic/tolerance deterministic/ nondeterministic/nonreplayable with reason and expected comparison method. Evidence: classification. - [ ] A3.16.d Replay in isolated namespace using pinned dependencies, prevent cache masking when auditing, and record substitutions. Evidence: replay tests. - [ ] A3.16.e Compare outputs/measurements/events semantically and numerically within declared tolerances; preserve both versions. Evidence: comparison report. - [ ] A3.16.f Expose missing model/weight/runtime/calibration/input/seed/ licence/consent/provider as explicit blocker, never approximate silently. Evidence: failure tests. - [ ] A3.17 Implement resource/cost estimates and reservations per stage. Evidence: over-budget prevents dispatch. - [ ] A3.17.a Define resource estimator inputs and outputs for CPU/GPU type/ memory/storage/network/time/energy/provider units/currency/uncertainty. Evidence: estimate schema. - [ ] A3.17.b Estimate from stage/model/input frames-duration-resolution/ modalities/batch/worker history with model/version and confidence. Evidence: estimator tests. - [ ] A3.17.c Aggregate critical-path and parallel DAG estimates including cache likelihood, retries, fan-out/in, artifacts/egress, and target. Evidence: plan estimate. - [ ] A3.17.d Authorize budget/quotas/priority and reserve capacity/currency/ storage against owner/project/tenant with expiry and idempotency. Evidence: reservation tests. - [ ] A3.17.e Recheck before dispatch/lease/scale-up; block over-budget or insufficient capacity and require scoped reapproval. Evidence: dispatch tests. - [ ] A3.17.f Reconcile estimate/reservation/actual/release/refund/overrun and calibrate estimators without leaking subject data. Evidence: cost report. - [ ] A3.18 Implement batch submission and fan-out/fan-in. Evidence: partial failure and cancellation semantics. - [ ] A3.18.a Define batch/item identity/template/profile/input/config/ priority/budget/consent/idempotency/dependency and aggregate state. Evidence: batch schema. - [ ] A3.18.b Preflight each item independently for formats/consent/ capabilities/resources/cache/gates and show eligible/blocked/degraded/ cost. Evidence: preview tests. - [ ] A3.18.c Fan out jobs/stages/shards with bounded concurrency/fairness/ capacity/priority and preserve item/subject isolation. Evidence: dispatch tests. - [ ] A3.18.d Fan in only required successful compatible outputs with deterministic order/deduplication/aggregation and explicit missing/ partial inputs. Evidence: aggregation tests. - [ ] A3.18.e Cancel whole batch/selected items/queued or running fan-out with truthful partial completion and retained successful artifacts. Evidence: cancellation tests. - [ ] A3.18.f Retry safe failed items/stages, never rerun successes by default, and report aggregate partial/failed/complete without false success. Evidence: partial failure suite. - [ ] A3.19 Implement explicit full-body, hand/finger, face/landmark, gaze/expression, and multi-person tracking stages with capability negotiation. Evidence: missing modality/model/consent yields an honest unsupported or blocked state rather than empty tracks. - [ ] A3.19.a Define separate typed stage contracts/capability IDs for body, hand/finger, face/landmark, gaze/expression, and multi-person identity/ association. Evidence: modality registry. - [ ] A3.19.b Resolve requested input sensors/views/calibration/subject tracks/ profile/model/hardware/privacy/consent per modality before dispatch. Evidence: negotiation tests. - [ ] A3.19.c Execute body and hand stages with skeleton/joint/side/contact/ confidence/occlusion/tracking-loss outputs and source-frame alignment. Evidence: body/hand tests. - [ ] A3.19.d Execute face/expression/blend-shape and gaze stages only under exact biometric scope, with identity-minimized output where required. Evidence: face/gaze tests. - [ ] A3.19.e Execute multi-person detection/tracking/association across views with protected IDs, crossing/occlusion ambiguity, and correction proposals. Evidence: multi-person tests. - [ ] A3.19.f Persist independent model/config/input-output/provenance/quality/ cost per modality and never infer one modality from empty another. Evidence: lineage tests. - [ ] A3.19.g Emit unsupported/not-configured/consent-blocked/no-observation/ tracking-lost/low-confidence distinctly, not empty successful tracks. Evidence: absence tests. - [ ] A3.19.h Run modality combinations, partial consent, missing sensor/model/ GPU, multi-person crossings, revocation, and privacy projections. Evidence: capability suite. - [ ] A3.20 Implement video-analysis stages for action/segment/event detection, camera motion, occlusion, contacts, tracking confidence, and review proposals. Evidence: model output remains attributed and correctable. - [ ] A3.20.a Define separate stage/output contracts for temporal segments/ actions/events/camera motion/occlusion/contacts/tracking-quality proposals. Evidence: analysis registry. - [ ] A3.20.b Pin source take/views/ranges/profile/taxonomy/reference/model/ calibration/subjects/consent and exclude prohibited inferences. Evidence: request tests. - [ ] A3.20.c Detect action/phase/segment/event candidates with start/end/ label/confidence/alternatives and exact source locators. Evidence: temporal tests. - [ ] A3.20.d Estimate camera motion/shots and subject/joint visibility/ occlusion/contact/tracking confidence with raw measurements. Evidence: geometry tests. - [ ] A3.20.e Persist model/weights/config/taxonomy/corpus/input-output hashes/ uncertainty/cost and proposal-only status. Evidence: provenance tests. - [ ] A3.20.f Provide synchronized preview/table review and human accept/edit/ split/merge/relabel/reject/unknown with versioned annotations. Evidence: review tests. - [ ] A3.20.g Evaluate known actions/segments/events/camera/occlusion/contact/ tracking fixtures, subgroup/profile slices, and false claims. Evidence: calibrated report. - [ ] A3.21 Implement motion enhancement, generative completion, animation blending, retiming, gap filling, segmentation, and IK as non-destructive stage variants with exact edited ranges and source lineage. Evidence: unchanged frames remain stable and generated ranges are disclosed. - [ ] A3.21.a Define distinct operation stage contracts with exact source clip/ranges/joints/curves/masks/context/constraints/model/seed/profile and allowed output. Evidence: operation registry. - [ ] A3.21.b Implement filtering/enhancement and segmentation as versioned proposals with raw measurements, boundaries, and no destructive source edit. Evidence: enhancement tests. - [ ] A3.21.c Implement gap filling/generative completion with bounded missing frames/joints, context/contact/environment constraints, alternatives, and uncertainty. Evidence: completion tests. - [ ] A3.21.d Implement blend/transition between motions with alignment/ contact/root/phase/duration masks and seam measurements. Evidence: blending tests. - [ ] A3.21.e Implement retiming/time warp with source-destination map, contact/event preservation, derivative curves, and monotonicity. Evidence: retiming tests. - [ ] A3.21.f Implement IK constraint correction with chain/joint limits/ end-effectors/contacts/iterations/residuals and overconstraint failure. Evidence: IK tests. - [ ] A3.21.g Produce immutable candidates with per-frame/joint generated/ changed/unchanged labels, model/tool/config/seed/source lineage and disclosure. Evidence: provenance tests. - [ ] A3.21.h Audition/compare/accept-edit-reject exact ranges and verify promised unchanged frames/curves stable within zero or declared tolerance. Evidence: preservation suite. - [ ] A3.22 Implement profile-specific DAG templates for yoga, fitness, dance, martial arts, sports, medical/rehabilitation, film/VFX, and gaming. Evidence: each template satisfies A0.15 requirements and has independent known-value fixtures; shared stages do not imply profile proof. - [ ] A3.22.a Define the common template contract for version, capture protocol, intended/prohibited use, stages/models, annotations, evaluators/floors, qualified reviewer, outputs, warnings, and handoff. Evidence: template schema. - [ ] A3.22.b Ratify yoga and fitness templates with distinct pose/exercise vocabulary, repetitions/holds, reference measures, safety boundaries, and reviewer qualifications. Evidence: independent fixtures. - [ ] A3.22.c Ratify dance and martial-arts templates with distinct choreography/technique, rhythm/phase, partner/contact, weapon/safety, and performance-review semantics. Evidence: independent fixtures. - [ ] A3.22.d Ratify sport-specific templates without collapsing sports into one profile; declare event/technique measures, equipment/environment, prohibited claims, and qualified review. Evidence: sport registry and independent fixtures. - [ ] A3.22.e Ratify medical and rehabilitation templates with approved protocol, intended use, contraindication/escalation, measurement validity, privacy, and qualified clinical review. Evidence: independent protected fixtures. - [ ] A3.22.f Ratify film/VFX and gaming templates with distinct shot/runtime constraints, retarget/loop/root-motion needs, deliverables, and creative versus technical approval. Evidence: independent fixtures. - [ ] A3.22.g Prove every profile selects only compatible stages/models and cannot inherit another profile's thresholds, claims, review, or release evidence. Evidence: cross-profile negative suite. - [ ] A3.23 Implement format conversion among every ratified video, mocap, skeleton, animation, and engine/DCC package with loss preview, coordinate/unit mapping, embedded metadata, and round-trip diagnostics. Evidence: per-format-pair compatibility matrix. - [ ] A3.23.a Register each source/target format and profile version with parse/write capabilities, extensions/MIME, limits, and unsupported constructs. Evidence: conversion registry. - [ ] A3.23.b Parse and normalize source time base, coordinate system, units, skeleton/rig, animation channels, markers, metadata, and embedded media without discarding unknown data silently. Evidence: parse goldens. - [ ] A3.23.c Define explicit video, mocap, skeleton, animation, and engine/DCC source-target mappings, including required intermediate representations. Evidence: pairwise mapping matrix. - [ ] A3.23.d Preview dropped, approximated, baked, resampled, renamed, or synthesized data and require acceptance when the target is lossy. Evidence: loss-decision records. - [ ] A3.23.e Convert with deterministic settings and embed source, mapping, tool/version, checksum, rights/consent, and transformation provenance. Evidence: package inspection. - [ ] A3.23.f Read back every supported target and compare timing, hierarchy, transforms, curves, contacts, metadata, and declared loss against the source. Evidence: per-pair round-trip suite. - [ ] A3.24 Implement video-to-CG replacement for actor segmentation, tracking, pose/face/hand transfer, target avatar/rig, occlusion, lighting/shadow, rendering, compositing, temporal quality, review, and delivery through governed Isis/Yemaya/Bellona seams. Evidence: subject consent, source/ derivative provenance, generated-region disclosure, and per-shot replacement tests. - [ ] A3.24.a Register the source clip, shot ranges, subjects, consent scope, intended use, target project, and protected-source handling before analysis. Evidence: admissibility tests. - [ ] A3.24.b Segment and track each authorized actor with stable IDs, confidence, occlusion states, masks, and reviewer corrections. Evidence: tracking fixtures. - [ ] A3.24.c Select a rights-cleared target avatar/rig and verify body, face, hand, clothing, material, and output compatibility. Evidence: compatibility gate. - [ ] A3.24.d Transfer body, face, and hand motion as separately attributable stages with source ranges, mappings, confidence, corrections, and unchanged-region guarantees. Evidence: transfer tests. - [ ] A3.24.e Reconstruct occlusion, camera, lighting, contact shadows, and scene interactions with explicit observed versus generated regions. Evidence: per-shot scene report. - [ ] A3.24.f Render through the governed Bellona/Yemaya boundary and composite through the governed Isis/Yemaya boundary without granting Aja foreign mutation authority. Evidence: seam contracts. - [ ] A3.24.g Measure temporal identity, mask, edge, motion, lighting, shadow, occlusion, and source-background continuity across every shot. Evidence: known-value and perceptual gates. - [ ] A3.24.h Review, revise, approve, package, deliver, and read back exact shots with subject/derivative provenance, generated-region disclosure, rights/consent state, and recall hooks. Evidence: replacement journey. - [ ] A3.25 Implement text/reference-to-motion and physics-aware generative animation as proposal stages with motion intent, duration, skeleton, contacts, environment constraints, seed/model, alternatives, validation, and human acceptance. Evidence: generated frames are attributable and cannot bypass consent, quality, intended-use, or export gates. - [ ] A3.25.a Define separate text, image/video reference, pose/keyframe, trajectory, and mixed-conditioning request contracts. Evidence: typed input schemas. - [ ] A3.25.b Resolve motion intent, duration, motion class, skeleton/rig, coordinate/time basis, environment, contacts, obstacles, forces, and prohibited uses before generation. Evidence: constraint plan. - [ ] A3.25.c Enforce reference rights/consent and detect requests that would reproduce a protected performer or unsupported medical/performance claim. Evidence: admissibility suite. - [ ] A3.25.d Generate multiple immutable candidates with model/version, configuration, seed, inputs, constraints, nondeterminism, and per-frame/joint generation provenance. Evidence: candidate manifests. - [ ] A3.25.e Validate kinematics, contacts, collisions, balance, dynamics, skeleton compatibility, temporal continuity, and profile-specific quality without rewriting a failed candidate. Evidence: gate suite. - [ ] A3.25.f Let an authorized human compare, annotate, accept, edit, or reject candidates while preserving the original proposal and decision rationale. Evidence: review journey. - [ ] A3.25.g Recompute consent, intended-use, quality, compatibility, and export gates on the accepted revision and disclose generated ranges in every derivative/package. Evidence: fail-closed release test. ### A4 — Motion quality, validation, and calibrated evaluation - [ ] A4.1 Define versioned gate profiles by motion type, consumer, and export target. Evidence: every publishable format has a profile. - [ ] A4.1.a Define the gate-profile schema for motion class, intended use, consumer, target, applicable measurements, evaluator versions, thresholds, human-review bands, and failure policy. Evidence: schema tests. - [ ] A4.1.b Register a separately owned profile for every publishable motion-type/consumer/export combination. Evidence: coverage matrix. - [ ] A4.1.c Version, approve, activate, retire, and migrate profiles without rewriting historical verdicts. Evidence: lifecycle tests. - [ ] A4.1.d Reject validation or release when no current compatible profile exists. Evidence: missing-profile negative test. - [ ] A4.2 Implement skeleton hierarchy, joint naming, bind pose, unit, axis, and frame-rate validation. Evidence: broken fixtures. - [ ] A4.2.a Validate hierarchy topology, unique joints, parentage, roots, and required bones against the selected skeleton profile. Evidence: hierarchy fixtures. - [ ] A4.2.b Validate canonical/aliased joint names and surface unknown, duplicate, missing, or ambiguous mappings. Evidence: naming fixtures. - [ ] A4.2.c Validate bind/rest pose, transforms, orientation, scale, units, axes/handedness, and coordinate metadata. Evidence: transform fixtures. - [ ] A4.2.d Validate source and declared frame rate/time base without silently resampling. Evidence: timing fixtures. - [ ] A4.3 Implement missing, duplicate, discontinuous, and non-monotonic frame checks. Evidence: crafted clips. - [ ] A4.3.a Parse expected and observed frame/sample indices and timestamps. Evidence: frame-ledger fixture. - [ ] A4.3.b Detect missing and duplicate frames/samples with exact ranges and counts. Evidence: gap/duplicate fixtures. - [ ] A4.3.c Detect non-monotonic timestamps, discontinuities, resets, and inconsistent time steps. Evidence: temporal fixtures. - [ ] A4.3.d Separate raw findings from profile verdict and proposed repair. Evidence: policy-recompute test. - [ ] A4.4 Implement foot/hand contact and sliding measurements. Evidence: independently derived fixture values. - [ ] A4.4.a Detect or ingest foot/hand contact events with side, effector, frame range, confidence, and ground/object reference. Evidence: contact fixtures. - [ ] A4.4.b Measure contact-point displacement, velocity, rotation, and penetration in the declared coordinate/time basis. Evidence: independently calculated values. - [ ] A4.4.c Classify planted, transitioning, airborne, supported, and unknown intervals without treating uncertainty as pass. Evidence: state tests. - [ ] A4.4.d Apply motion/profile-specific sliding thresholds and retain raw event measurements for review. Evidence: verdict tests. - [ ] A4.5 Implement jitter/noise and temporal smoothness measurements. Evidence: synthetic signal fixtures. - [ ] A4.5.a Define joint/channel/range-specific position, rotation, velocity, acceleration, jerk, and frequency-domain signals. Evidence: measurement spec. - [ ] A4.5.b Compute signals at the declared sample rate with explicit unwrap, boundary, missing-data, and filter behavior. Evidence: synthetic goldens. - [ ] A4.5.c Detect local spikes, sustained noise, discontinuities, and over-smoothed loss of intended motion separately. Evidence: crafted fixtures. - [ ] A4.5.d Report exact offending joints/ranges and raw values before profile thresholds determine verdict. Evidence: diagnostic tests. - [ ] A4.6 Implement bone-length and joint-limit consistency. Evidence: anatomical fixtures. - [ ] A4.6.a Resolve skeleton-specific reference bone lengths, tolerances, scale rules, and joint-limit definitions. Evidence: profile fixtures. - [ ] A4.6.b Measure per-frame bone-length drift and distinguish scale or mapping errors from subject-independent anatomical assumptions. Evidence: known-value tests. - [ ] A4.6.c Detect angular, translational, twist, and hyperextension limit violations with exact joints/ranges. Evidence: limit fixtures. - [ ] A4.6.d Mark unsupported anatomy/profile combinations unavailable rather than inferring clinical validity. Evidence: negative tests. - [ ] A4.7 Implement balance, center-of-mass, ground penetration, velocity, acceleration, and physics plausibility diagnostics. Evidence: known motion corpus. - [ ] A4.7.a Resolve mass model, support contacts/polygon, ground plane, gravity, environment, time basis, and intended-use assumptions. Evidence: diagnostic manifest. - [ ] A4.7.b Compute center of mass, support margin, penetration, velocity, acceleration, momentum, and discontinuity signals with uncertainty. Evidence: analytical fixtures. - [ ] A4.7.c Detect incompatible contact, collision, ballistic, force, and balance behavior by motion phase. Evidence: known-motion corpus. - [ ] A4.7.d Separate animation plausibility warnings from medical, biomechanical, or safety claims requiring qualified validation. Evidence: claim-boundary tests. - [ ] A4.8 Implement pose, trajectory, contact, and timing fidelity against ground truth when available. Evidence: calibrated dataset. - [ ] A4.8.a Admit ground truth only with source, rights/consent, coordinate, skeleton, timing, annotation, and calibration provenance. Evidence: dataset gate. - [ ] A4.8.b Align prediction and reference across coordinate system, scale, skeleton mapping, temporal offset, and valid comparison ranges. Evidence: alignment goldens. - [ ] A4.8.c Compute pose, joint, trajectory, contact-event, duration, phase, and timing metrics with missing/occluded labels handled explicitly. Evidence: independently derived values. - [ ] A4.8.d Report per-sequence/per-joint/per-phase results, uncertainty, and calibration limitations before verdict. Evidence: calibrated report. - [ ] A4.9 Implement retarget fidelity for end effectors, root, silhouette, contacts, and joint rotations. Evidence: source/target fixture pairs. - [ ] A4.9.a Lock source motion, target rig, mapping, rest poses, scale, retarget settings, and comparison coordinate/time basis. Evidence: retarget manifest. - [ ] A4.9.b Measure end-effector, root trajectory/orientation, joint rotation, contact, and silhouette deviations separately. Evidence: pairwise goldens. - [ ] A4.9.c Detect target-limit violations, foot/hand drift, self- intersection, and proportion-induced unsupported comparisons. Evidence: retarget fixtures. - [ ] A4.9.d Preserve raw source-target measurements and profile-specific verdicts for exact frame review. Evidence: diagnostic report. - [ ] A4.10 Implement perceptual quality evaluation with model/version, uncertainty, and human-review band. Evidence: calibrated report. - [ ] A4.10.a Define the evaluation corpus, labels, sampling, consent, motion and demographic cohorts, exclusions, and human adjudication protocol. Evidence: approved dataset card. - [ ] A4.10.b Register evaluator model/version, preprocessing, configuration, input/output schema, and deterministic or stochastic behavior. Evidence: evaluator manifest. - [ ] A4.10.c Calibrate scores and uncertainty against held-out human ratings by supported cohort and intended use. Evidence: calibration report. - [ ] A4.10.d Set pass, fail, and mandatory-human-review bands without using low-confidence or out-of-distribution scores as pass. Evidence: threshold tests. - [ ] A4.10.e Monitor drift, subgroup error, calibration expiry, and model replacement with historical replay. Evidence: evaluator release gate. - [ ] A4.11 Implement motion-loop seam and blend compatibility checks. Evidence: loop fixtures. - [ ] A4.11.a Resolve loop endpoints or blend windows, phase/contact state, root-motion policy, and channels included in comparison. Evidence: seam manifest. - [ ] A4.11.b Measure pose, rotation, velocity, acceleration, root, contact, curve, and event discontinuity across the seam. Evidence: analytical loop fixtures. - [ ] A4.11.c Evaluate pairwise blend compatibility over permitted alignment, duration, contact, and phase choices. Evidence: blend matrix. - [ ] A4.11.d Report exact incompatible channels/ranges and avoid silently applying a destructive repair. Evidence: failure journey. - [ ] A4.12 Implement blend-shape/facial quality gates under consent. Evidence: protected evaluation. - [ ] A4.12.a Admit facial source, labels, and evaluation only under current subject consent, purpose, retention, and reviewer authorization. Evidence: protected-data gate. - [ ] A4.12.b Validate blend-shape names, ranges, exclusivity/coactivation, neutral pose, temporal completeness, and rig compatibility. Evidence: facial fixtures. - [ ] A4.12.c Measure facial landmark/expression fidelity, jitter, popping, lip/eye timing, symmetry where applicable, and uncertainty. Evidence: protected known values. - [ ] A4.12.d Revoke, restrict, or recompute facial evidence when consent, model, rig, or policy changes. Evidence: revocation test. - [ ] A4.13 Implement export-format conformance and round-trip checks. Evidence: per-format goldens. - [ ] A4.13.a Select the exact target format/profile/toolchain version and required metadata, hierarchy, timing, naming, and packaging rules. Evidence: conformance registry. - [ ] A4.13.b Validate the emitted bytes/package against official and pinned custom validators. Evidence: conformance goldens. - [ ] A4.13.c Re-import/read back through an independent target reader and compare motion, rig, curves, timing, contacts, metadata, and files. Evidence: round-trip suite. - [ ] A4.13.d Surface unsupported/lossy features and fail release when loss exceeds the accepted target profile. Evidence: loss tests. - [ ] A4.14 Persist raw metrics separately from verdicts. Evidence: policy recompute. - [ ] A4.14.a Store immutable measurement identity, inputs, units, ranges, algorithm/version, configuration, and raw values. Evidence: metric schema. - [ ] A4.14.b Store verdict identity, profile/version, thresholds, policy inputs, status, reason, and reviewer action separately. Evidence: verdict schema. - [ ] A4.14.c Recompute a new verdict from unchanged raw metrics under a new policy without rewriting historical results. Evidence: recompute test. - [ ] A4.15 Version algorithms, models, ground truth, calibration, thresholds, and profile. Evidence: result provenance. - [ ] A4.15.a Assign immutable versions and checksums to evaluator code, model, ground truth, calibration, threshold set, and gate profile. Evidence: registry. - [ ] A4.15.b Persist the complete version tuple and runtime environment on each measurement and verdict. Evidence: provenance query. - [ ] A4.15.c Detect stale, revoked, incompatible, or expired dependencies and identify affected assets/runs/releases. Evidence: impact test. - [ ] A4.16 Add unavailable, insufficient-ground-truth, low-confidence, and evaluator-failure states. Evidence: none renders as pass. - [ ] A4.16.a Define typed non-pass states with reason codes, diagnostic detail, retryability, owner, and permitted next action. Evidence: state contract. - [ ] A4.16.b Emit unavailable when a required evaluator, model, profile, dependency, or environment cannot run. Evidence: outage test. - [ ] A4.16.c Emit insufficient-ground-truth and low-confidence when required comparison or calibration support is absent. Evidence: boundary tests. - [ ] A4.16.d Emit evaluator-failure separately from domain-quality failure and prevent all non-pass states from satisfying release. Evidence: fail-closed UI/API tests. - [ ] A4.17 Build manual QA sampling and adjudication. Evidence: reviewer decisions link to exact frames and measurements. - [ ] A4.17.a Define risk-weighted, random, drift-triggered, disagreement, and mandatory-review sampling rules. Evidence: sampling policy. - [ ] A4.17.b Create immutable review assignments with qualified reviewer, conflict rules, due state, exact asset/revision, and blinded context where required. Evidence: assignment tests. - [ ] A4.17.c Capture decisions, reason codes, annotations, exact frames/ joints/measurements, confidence, and requested remediation. Evidence: adjudication record. - [ ] A4.17.d Escalate disagreement and update calibration/threshold evidence without overwriting original machine or human decisions. Evidence: adjudication journey. - [ ] A4.18 Build drift monitoring by capture setup, subject-safe cohort, motion class, model, rig, and version. Evidence: privacy-approved report. - [ ] A4.18.a Define privacy-safe dimensions, minimum cohort size, baselines, windows, statistical tests, and alert thresholds. Evidence: approved monitoring spec. - [ ] A4.18.b Aggregate quality, failure, uncertainty, and reviewer outcomes by capture setup, safe cohort, motion class, model, rig, and version. Evidence: bounded metrics. - [ ] A4.18.c Suppress or combine sparse cohorts and exclude subject identity or raw biometric/media data. Evidence: privacy tests. - [ ] A4.18.d Investigate alerts through versioned slices and link confirmed drift to model/profile rollback, recalibration, or review expansion. Evidence: drift drill. ### A5 — Preview, cleanup, retargeting, annotation, and library - [ ] A5.1 Build synchronized source video, 2D pose, 3D skeleton, mesh, and retarget preview. Evidence: deterministic time alignment. - [ ] A5.1.a Define the shared time basis, offsets, rates, dropped/missing samples, coordinate transforms, and stream availability contract. Evidence: synchronization schema. - [ ] A5.1.b Load authorized source video and derived 2D pose without exposing protected media to unauthorized viewers. Evidence: access tests. - [ ] A5.1.c Render 3D skeleton, mesh, and retarget streams at the same selected source instant with explicit interpolation behavior. Evidence: alignment goldens. - [ ] A5.1.d Keep transport, seek, range, loop, and selected subject/joint synchronized across every available view. Evidence: Playwright journey. - [ ] A5.1.e Surface missing, stale, offset, low-confidence, and unavailable streams without fabricating visual alignment. Evidence: state matrix. - [ ] A5.2 Build before/after and multi-run comparison with synchronized camera, transport, speed, loop, and overlays. Evidence: accessible comparison. - [ ] A5.2.a Select immutable source/run/artifact revisions and validate skeleton, timing, and view compatibility. Evidence: selection tests. - [ ] A5.2.b Synchronize camera, transport, speed, range, loop, subject, skeleton, and overlay settings across compared revisions. Evidence: interaction tests. - [ ] A5.2.c Support side-by-side, overlay, difference, and A/B switching without losing revision identity. Evidence: comparison journey. - [ ] A5.2.d Provide a semantic difference table, keyboard controls, and announced current revision/value for non-visual review. Evidence: accessibility suite. - [ ] A5.3 Build joint/contact/error heatmaps with semantic table parity. Evidence: non-visual access to exact values. - [ ] A5.3.a Define color-independent scales, units, thresholds, missing/ unavailable states, and selected measure/profile/version. Evidence: legend tests. - [ ] A5.3.b Map per-frame/joint/contact/error values to the visual skeleton and timeline without aggregating away critical failures. Evidence: mapping goldens. - [ ] A5.3.c Provide a sortable/filterable semantic table with exact joint, range, raw value, unit, threshold, status, and source measure. Evidence: parity tests. - [ ] A5.3.d Keep visual and table focus/selection synchronized by keyboard and assistive technology. Evidence: Playwright accessibility journey. - [ ] A5.4 Build frame/time/joint-range annotation. Evidence: anchors survive unrelated revisions. - [ ] A5.4.a Define annotation anchors for artifact revision, source time/ frame range, subject, joint/channel, coordinate basis, and selected measurements. Evidence: anchor schema. - [ ] A5.4.b Create, edit, reply, resolve, reopen, and delete annotations with authorization, audit, and concurrency control. Evidence: API/UI tests. - [ ] A5.4.c Rebase anchors only through explicit mapping when a related revision changes timing or skeleton; mark ambiguous/orphaned anchors. Evidence: revision fixtures. - [ ] A5.4.d Verify unrelated revisions do not move or mutate existing annotation anchors. Evidence: stability test. - [ ] A5.5 Build cleanup operations as versioned commands, never destructive source edits. Evidence: undo/redo and lineage. - [ ] A5.5.a Register typed cleanup commands with exact input revision, target ranges/joints/channels, parameters, preconditions, and impact preview. Evidence: command registry. - [ ] A5.5.b Execute each command into a new immutable revision with operator, tool/version, settings, changed ranges, and source lineage. Evidence: mutation tests. - [ ] A5.5.c Implement undo/redo as revision navigation or compensating commands rather than source mutation. Evidence: history journey. - [ ] A5.5.d Compare and validate the resulting revision before it can replace a selected candidate. Evidence: acceptance gate. - [ ] A5.6 Build skeleton and bone mapping editor with source/target validation. Evidence: keyboard and list parity. - [ ] A5.6.a Load immutable source/target skeleton revisions, naming aliases, required joints, rest poses, units, and mapping constraints. Evidence: editor contract. - [ ] A5.6.b Create, remove, remap, mirror, and auto-propose mappings without accepting ambiguous or incompatible suggestions silently. Evidence: mapping tests. - [ ] A5.6.c Validate completeness, uniqueness, hierarchy, orientation, scale, unmapped influence, and target-limit compatibility. Evidence: validation fixtures. - [ ] A5.6.d Provide keyboard/list operations and semantic source-to-target status equivalent to the visual mapping view. Evidence: accessibility journey. - [ ] A5.6.e Save a versioned mapping draft and require explicit review/ promotion before production use. Evidence: lifecycle test. - [ ] A5.7 Build retarget profile compare and decision record. Evidence: selected mapping remains linked. - [ ] A5.7.a Select compatible source motion, target rig, mapping, retarget profiles, evaluator profile, and exact revisions. Evidence: setup tests. - [ ] A5.7.b Run and display comparable outputs, raw fidelity metrics, warnings, limitations, and cost for each profile. Evidence: comparison fixture. - [ ] A5.7.c Capture the selected profile/mapping/revisions, reviewer, rationale, rejected alternatives, and intended consumer. Evidence: decision record. - [ ] A5.7.d Detect stale decisions when any linked mapping, rig, profile, or motion revision changes. Evidence: invalidation test. - [ ] A5.8 Build avatar/rig library search, compatibility, preview, rights, and version selection. Evidence: ineligible rig reasons. - [ ] A5.8.a Index only authorized avatar/rig metadata, versions, skeleton, features, formats, rights, license, consent constraints, and lifecycle state. Evidence: search policy tests. - [ ] A5.8.b Filter and rank by current project, motion, pipeline, target, and rights/compatibility requirements. Evidence: eligibility fixtures. - [ ] A5.8.c Preview authorized geometry, skeleton, materials, blend shapes, motions, limitations, and provenance at an exact version. Evidence: preview tests. - [ ] A5.8.d Explain each ineligible, quarantined, revoked, incompatible, or unavailable rig without leaking protected metadata. Evidence: reason matrix. - [ ] A5.8.e Lock the selected rig revision and recheck it at execution and export. Evidence: race test. - [ ] A5.9 Build motion asset library with tags, motion class, skeleton, quality, consent, watermark, lineage, and release status. Evidence: permission-aware search. - [ ] A5.9.a Define the motion-asset projection from authoritative artifact, skeleton, quality, consent, rights, watermark, lineage, and release records. Evidence: projection contract. - [ ] A5.9.b Index approved searchable fields while excluding protected subject/source identity and unauthorized media-derived metadata. Evidence: index tests. - [ ] A5.9.c Filter and facet by governed tags, motion class, skeleton, compatibility, quality freshness, consent/use, watermark, lineage, and release state. Evidence: search fixtures. - [ ] A5.9.d Show exact version, eligibility reasons, dependencies, preview availability, and current recall state before selection. Evidence: library journey. - [ ] A5.9.e Reconcile index/library state after supersession, consent change, quarantine, unpublish, or recall. Evidence: propagation test. - [ ] A5.10 Build exact and perceptual dedupe with merge/keep decisions. Evidence: no automatic destructive merge. - [ ] A5.10.a Compute exact identity from normalized bytes/checksums while preserving distinct ownership and provenance records. Evidence: exact duplicate fixtures. - [ ] A5.10.b Compute versioned perceptual candidates from authorized motion features with score, uncertainty, and compatible skeleton/time basis. Evidence: near-duplicate fixtures. - [ ] A5.10.c Present source, rights/consent, quality, versions, dependencies, and exact differences for reviewer comparison. Evidence: review journey. - [ ] A5.10.d Record keep-both, relate, consolidate-reference, or reject decisions without deleting source artifacts or lineage. Evidence: non-destructive tests. - [ ] A5.11 Build collections, sets, variants, related motions, and retirement through curation bundles. Evidence: no direct production writes. - [ ] A5.11.a Define versioned curation-bundle operations for collection/set membership, variant groups, relationships, metadata, and retirement. Evidence: bundle schema. - [ ] A5.11.b Validate referenced asset versions, permissions, lifecycle, rights/consent, compatibility, and dependency impact. Evidence: preflight tests. - [ ] A5.11.c Review, approve, apply, reject, or rollback a bundle with idempotency, concurrency, and audit. Evidence: workflow tests. - [ ] A5.11.d Prohibit direct production mutation outside the approved bundle applier and verify read-back. Evidence: authorization test. - [ ] A5.12 Build reference video library with protected-source controls. Evidence: subject identity and raw media do not leak. - [ ] A5.12.a Register reference videos with subject/owner, consent purpose, retention, geography, access compartment, checksums, and lineage. Evidence: protected-source schema. - [ ] A5.12.b Produce privacy-minimized searchable projections that omit subject identity, raw frames, biometrics, and sensitive inferred metadata. Evidence: index inspection. - [ ] A5.12.c Enforce object/property authorization, watermarking, bounded preview, download restrictions, and audited access. Evidence: access tests. - [ ] A5.12.d Revoke, expire, quarantine, retain under hold, or delete source and derived previews according to policy. Evidence: lifecycle drill. - [ ] A5.13 Build consent expiry/revocation impact view per asset. Evidence: released and derived assets appear. - [ ] A5.13.a Traverse from consent grant/subject/source to every capture, artifact, derivative, library entry, package, release, consumer, and retained copy. Evidence: dependency graph test. - [ ] A5.13.b Distinguish current, expiring, expired, revoked, disputed, unknown, and legally held states with effective times. Evidence: state matrix. - [ ] A5.13.c Show affected revisions, release status, downstream reach, remediation owner, deadline, and unavailable dependencies without leaking protected data. Evidence: impact-view tests. - [ ] A5.13.d Launch authorized quarantine/recall workflows only after an exact impact preview and confirm closure by consumer read-back. Evidence: revocation journey. - [ ] A5.14 Build accessible non-3D alternatives for preview and QA. Evidence: screen-reader/keyboard review journey. - [ ] A5.14.a Define semantic representations for time, skeleton hierarchy, pose/channel values, contacts, annotations, errors, and comparison differences. Evidence: parity specification. - [ ] A5.14.b Implement keyboard-operable timeline/range/joint selection and synchronized structured tables. Evidence: keyboard suite. - [ ] A5.14.c Announce transport, selection, validation, loading, stale, and failure state changes without excessive verbosity. Evidence: screen- reader tests. - [ ] A5.14.d Prove every QA decision possible in 3D has a non-visual path to the same raw evidence and action. Evidence: parity journey. - [ ] A5.15 Build UI-governed motion, action, skeleton, rig, capture, quality, consent, format, and catalog taxonomies over code-owned floors. Evidence: versioned review, alias, deprecation, and migration journey. - [ ] A5.15.a Define separate schemas, code-owned invariants, ownership, and allowed relationships for each taxonomy. Evidence: taxonomy registry. - [ ] A5.15.b Create draft terms with canonical IDs, labels/locales, definitions, aliases, parent/mapping relations, and usage constraints. Evidence: authoring tests. - [ ] A5.15.c Review, approve, publish, deprecate, supersede, and retire versioned terms without reinterpreting historical records. Evidence: lifecycle journey. - [ ] A5.15.d Reject collisions, cycles, invalid mappings, floor violations, and destructive deletion of referenced terms. Evidence: validation suite. - [ ] A5.15.e Migrate references through previewed, authorized, resumable jobs with per-record results and rollback/compensation. Evidence: migration journey. - [ ] A5.16 Build taxonomy change impact over pipeline templates, search, assets, gates, exports, adapters, and collections. Evidence: read-only preview precedes an authorized migration job. - [ ] A5.16.a Build a complete reference index from taxonomy terms/versions to templates, assets, search documents, gates, exports, adapters, and collections. Evidence: zero-orphan fixture. - [ ] A5.16.b Preview affected objects, incompatible mappings, search changes, gate/profile changes, release risk, and migration cost read-only. Evidence: impact report. - [ ] A5.16.c Require authorized approval of the exact taxonomy and impact revisions before queuing migration. Evidence: stale-preview test. - [ ] A5.16.d Execute, checkpoint, resume, partially fail, compensate, and read back migrations without hidden direct writes. Evidence: job tests. - [ ] A5.17 Build avatar customization and governed marketplace intake for body/ proportions, skeleton, blend shapes, materials, clothing, rig/format compatibility, rights, license, version, security scan, preview, project use, dependency impact, update, quarantine, and takedown. Evidence: marketplace assets cannot enter capture/retarget/export without current compatibility and rights evidence. - [ ] A5.17.a Define separately governed customization parameters, bounds, dependencies, compatibility rules, and immutable output revisions for body, skeleton, face, materials, and clothing. Evidence: customization schema. - [ ] A5.17.b Preview customization across representative poses/motions and validate deformation, collision, rig, blend-shape, material, clothing, and target-format compatibility. Evidence: preview fixtures. - [ ] A5.17.c Ingest marketplace submissions with publisher identity, source, files/checksums, rights/license, versions, dependencies, supported rigs/formats, and declared limitations. Evidence: intake contract. - [ ] A5.17.d Scan archives, code/plugins, geometry, textures, materials, metadata, dependencies, and licenses in quarantine. Evidence: security and policy suite. - [ ] A5.17.e Review and promote an exact marketplace version with current compatibility, rights, security, quality, and intended-use evidence. Evidence: promotion journey. - [ ] A5.17.f Lock eligible versions on project use and recompute evidence at capture, retarget, package, and export boundaries. Evidence: stale- eligibility tests. - [ ] A5.17.g Preview dependency impact and propagate update, quarantine, revocation, takedown, and recall to every project/package/consumer. Evidence: marketplace lifecycle drill. ### A6 — Persistence, APIs, queue, workers, and security - [ ] A6.1 Decide authoritative stores for capture, jobs, runs, artifacts, rigs, mappings, annotations, validation, consent, and packages. Evidence: ownership ADR. - [x] A6.1.a Inventory every current table, blob, index, cache, event, file, and in-memory record for each named entity. Evidence: storage map. - [ ] A6.1.b Assign one authoritative store and owner per entity/property, plus projections, retention, consistency, and mutation boundaries. Evidence: ownership matrix. - [ ] A6.1.c Resolve duplicate or conflicting authorities and define migration and compatibility windows. Evidence: approved ADR. - [ ] A6.1.d Trace create, update, read, delete/retain, audit, recovery, and downstream propagation for each authority. Evidence: lifecycle review. - [ ] A6.2 Add missing explicit-column schemas and safe migrations. Evidence: production-size rehearsal. - [ ] A6.2.a Specify normalized tables, explicit columns/types, keys, constraints, indexes, tenancy, audit fields, and state invariants. Evidence: schema review. - [ ] A6.2.b Write additive expand migrations and backfills that are bounded, resumable, observable, and safe under concurrent traffic. Evidence: migration tests. - [ ] A6.2.c Dual-read/write or translate during the compatibility window and verify old/new representation parity. Evidence: compatibility suite. - [ ] A6.2.d Rehearse production-size backfill, rollback/roll-forward, lock duration, failure recovery, and contract cleanup. Evidence: rehearsal report. - [ ] A6.3 Implement immutable blob refs, checksums, encryption, retention, legal hold, and derived privacy variants. Evidence: byte rehash. - [ ] A6.3.a Define immutable content-addressed refs with tenant/project, media type, size, checksum algorithm/value, encryption key version, source lineage, and lifecycle class. Evidence: blob contract. - [ ] A6.3.b Upload through staging, validate size/type/checksum/malware, and atomically promote without permitting ref overwrite. Evidence: ingest tests. - [ ] A6.3.c Encrypt in transit/at rest, authorize object and variant access, rotate keys, and prevent cross-tenant ref inference. Evidence: security suite. - [ ] A6.3.d Apply retention, expiry, deletion, legal hold, consent freeze, and tombstone behavior to originals and derivatives. Evidence: lifecycle tests. - [ ] A6.3.e Generate privacy-minimized preview/analysis variants with their own checksums and source/policy lineage. Evidence: variant tests. - [ ] A6.3.f Stream/read back and independently rehash stored bytes before release use. Evidence: corruption fixture. - [ ] A6.4 Implement capture/job/stage/artifact/rig/annotation/consent APIs with object/property authorization. Evidence: contract suite. - [ ] A6.4.a Define resource, list/filter, create, mutation, transition, revision, error, pagination, and idempotency contracts per API. Evidence: OpenAPI review. - [ ] A6.4.b Enforce identity, tenant/project scope, role/capability, object, property, consent compartment, and current revision on every operation. Evidence: authorization matrix. - [ ] A6.4.c Implement optimistic concurrency, idempotency, transition invariants, immutable lineage, and transactional outbox/audit behavior. Evidence: race tests. - [ ] A6.4.d Filter lists, errors, expansions, fields, counts, and related resources so unauthorized existence cannot leak. Evidence: negative contract suite. - [ ] A6.5 Implement durable queue, distributed worker leases, heartbeats, checkpoint, retry, dead-letter, and cancel. Evidence: fault injection. - [ ] A6.5.a Persist queue item identity, stage/run revision, requirements, priority, availability, attempt, deadline, idempotency, and state. Evidence: queue schema. - [ ] A6.5.b Claim work with capability-aware atomic leases, fencing tokens, expiry, and duplicate-delivery tolerance. Evidence: contention tests. - [ ] A6.5.c Heartbeat and checkpoint resumable progress without allowing a stale worker to commit after lease loss. Evidence: fencing test. - [ ] A6.5.d Classify retryable/permanent/cancelled failures, apply bounded backoff/jitter/budgets, and retain attempt lineage. Evidence: retry tests. - [ ] A6.5.e Dead-letter exhausted work with diagnostics and authorized replay from an exact revision/configuration. Evidence: replay journey. - [ ] A6.5.f Propagate cancel cooperatively, terminate within policy, clean partial outputs, and record late results without publishing them. Evidence: cancellation fault injection. - [ ] A6.6 Implement worker capability, version, model, GPU, load, and health registration. Evidence: incompatible work never dispatches. - [ ] A6.6.a Define signed worker identity and heartbeat schema for runtime, adapter, tool/model versions, CPU/GPU/memory/storage, capabilities, locality, load, and health. Evidence: registration contract. - [ ] A6.6.b Authenticate and authorize registration, rotation, drain, quarantine, and removal without trusting self-asserted privilege. Evidence: spoof tests. - [ ] A6.6.c Match exact stage requirements, compatibility ranges, resources, data locality, consent constraints, and health before lease grant. Evidence: scheduler fixtures. - [ ] A6.6.d Expire stale workers and reconcile leased work without double commit. Evidence: heartbeat-loss test. - [ ] A6.7 Implement queue fairness, priority, capacity, and backpressure. Evidence: load tests. - [ ] A6.7.a Define tenant/project/class quotas, weights, priorities, aging, reservations, concurrency, and starvation limits. Evidence: scheduling policy. - [ ] A6.7.b Reserve worker/GPU/memory/storage/license capacity atomically before dispatch and release it on every terminal path. Evidence: reservation tests. - [ ] A6.7.c Enforce ingest, queue-depth, cost, deadline, and downstream pressure limits with explicit reject/defer states. Evidence: backpressure fixtures. - [ ] A6.7.d Prove urgent work progresses without starving ordinary tenants and noisy tenants cannot monopolize capacity. Evidence: load report. - [ ] A6.8 Implement pipeline-cache read/write/invalidate/quarantine. Evidence: corrupt cache test. - [ ] A6.8.a Define complete cache keys from input bytes/revisions, stage/ adapter/model/tool/config versions, profile, environment, and relevant policy/consent state. Evidence: key tests. - [ ] A6.8.b Write immutable entries only after successful validation with checksums, output manifest, creation lineage, TTL, and eligibility. Evidence: write tests. - [ ] A6.8.c Read only compatible, current, authorized, checksum-valid entries and record cache-hit provenance on the run. Evidence: read tests. - [ ] A6.8.d Invalidate by dependency/version/policy/consent/recall impact without deleting evidence needed for historical reconstruction. Evidence: invalidation graph test. - [ ] A6.8.e Quarantine corruption or suspicious entries, prevent further hits, and recompute safely. Evidence: poison/corruption test. - [ ] A6.9 Implement validation and gate APIs with stale-policy semantics. Evidence: old pass cannot release. - [ ] A6.9.a Expose immutable raw measurements, evaluator provenance, verdict profile/version, freshness, non-pass state, and exact input revision. Evidence: response contracts. - [ ] A6.9.b Authorize measurement access, validation requests, manual review, waiver, and profile administration separately. Evidence: permission tests. - [ ] A6.9.c Detect stale inputs, algorithms/models, calibration, thresholds, profile, consent, rights, or target and return typed reasons. Evidence: staleness matrix. - [ ] A6.9.d Require recomputation/review under the current release profile; never translate an old pass into current pass. Evidence: release race test. - [ ] A6.10 Implement package/export APIs with idempotency and current consent lock. Evidence: revocation race test. - [ ] A6.10.a Define package/export request, preview, eligibility, target, mapping, watermark, dependency lock, idempotency, and status contracts. Evidence: OpenAPI fixtures. - [ ] A6.10.b Preview exact included/skipped assets, versions, gates, consent/ rights, losses, cost, and target limitations without mutation. Evidence: preflight tests. - [ ] A6.10.c Acquire fenced locks on exact revisions and current consent/ rights/gate state immediately before producing output. Evidence: concurrency tests. - [ ] A6.10.d Produce one immutable package/result per idempotency key and reject mismatched retries. Evidence: duplicate-request test. - [ ] A6.10.e Verify target read-back, sign manifest/provenance, publish atomically, and release locks on every outcome. Evidence: export journey. - [ ] A6.10.f Abort or recall when consent changes during assembly/publication and prove no eligible-looking partial output remains. Evidence: revocation race test. - [ ] A6.11 Implement canonical embodied-instruction adapter projections. Evidence: capability, demonstration, overlay, and handoff contract tests. - [ ] A6.11.a Implement the canonical health/capability projection with supported motion/profile/input/output/version/latency/limit detail. Evidence: capability contract. - [ ] A6.11.b Implement demonstration lookup/request projection with current consent, rights, quality, compatibility, and disclosure eligibility. Evidence: demonstration tests. - [ ] A6.11.c Implement coaching-overlay projection with bounded semantic measures/annotations and no protected raw media or unsupported claim. Evidence: overlay contract. - [ ] A6.11.d Implement asynchronous handoff/status/result/cancel projection with stable correlation, idempotency, degraded health, and provenance. Evidence: handoff journey. - [ ] A6.11.e Map internal evolution behind versioned adapter contracts and fail closed on unsupported negotiation. Evidence: compatibility tests. - [ ] A6.12 Implement permission-aware search and analytics. Evidence: biometric/protected metadata exclusion. - [ ] A6.12.a Define approved searchable/aggregatable fields and prohibited raw media, biometric, subject identity, consent detail, and protected metadata per role/purpose. Evidence: field policy. - [ ] A6.12.b Build tenant/project/consent-compartment filtered projections from authoritative events with deletion/recall reconciliation. Evidence: index contract. - [ ] A6.12.c Enforce authorization before query, filtering, facets, counts, suggestions, snippets, exports, and analytics dimensions. Evidence: inference tests. - [ ] A6.12.d Apply minimum cohorts, suppression/noise where required, bounded cardinality, retention, and audit to analytics. Evidence: privacy suite. - [ ] A6.13 Implement two-tenant/project/consent-compartment isolation across API, blob, search, jobs, cache, preview, and export. Evidence: integration suite. - [ ] A6.13.a Create fixtures with colliding IDs, names, hashes, tags, models, and resources across two tenants/projects/consent compartments. Evidence: isolation corpus. - [ ] A6.13.b Prove CRUD, list, filter, expansion, error, count, and audit isolation in every API. Evidence: API suite. - [ ] A6.13.c Prove blob/ref, signed URL, preview, search/index, cache key/hit, queue/worker, log/trace, and webhook isolation. Evidence: service suite. - [ ] A6.13.d Prove package/export, recall, backup/restore, and administrative operations cannot cross boundaries without explicit governed authority. Evidence: adversarial integration test. - [ ] A6.14 Generate OpenAPI and worker/adapter consumer contracts. Evidence: drift gate. - [ ] A6.14.a Generate OpenAPI from the authoritative API definitions with stable operation IDs, schemas, errors, auth, pagination, idempotency, and examples. Evidence: spec validation. - [ ] A6.14.b Generate worker protocol and canonical adapter contracts with versions, capabilities, events, commands, and compatibility rules. Evidence: protocol artifacts. - [ ] A6.14.c Generate client/server fixtures or SDK types and compile representative producers/consumers. Evidence: contract build. - [ ] A6.14.d Diff checked-in/generated artifacts and block breaking or undocumented drift. Evidence: CI gate. - [ ] A6.15 Implement webhook subscription, signed delivery, filtering, retries, replay protection, dead-letter, disable, and audit for job, stage, output, consent, quality, package, and recall events. Evidence: external subscriber conformance and secret-rotation tests. - [ ] A6.15.a Create authorized subscriptions with tenant/project scope, event/filter selection, HTTPS endpoint policy, secret ownership, rate limits, and verification handshake. Evidence: subscription tests. - [ ] A6.15.b Emit versioned minimal event envelopes from the transactional outbox with stable event/resource IDs, revisions, time, trace, and no protected payload. Evidence: event contract. - [ ] A6.15.c Sign timestamped deliveries and verify SSRF protections, DNS/IP policy, TLS, body checksum, secret version, and bounded response. Evidence: security suite. - [ ] A6.15.d Apply ordered/unordered semantics explicitly, retry with bounded backoff, prevent replay, and dead-letter exhausted delivery. Evidence: fault tests. - [ ] A6.15.e Support secret overlap/rotation, pause/disable, replay from an authorized range, and immutable delivery audit. Evidence: lifecycle journey. - [ ] A6.15.f Prove an external subscriber handles job, stage, output, consent, quality, package, and recall events compatibly. Evidence: conformance suite. - [ ] A6.16 Complete TypeScript/Python SDK and CLI parity for capability/format discovery, ingest/live-session handoff, job operations, batch, preview refs, annotations, rigs, validation, export, webhooks, and audit-safe inspection. Evidence: generated public-contract matrix and end-to-end external-client tests. - [ ] A6.16.a Generate or implement shared authentication, endpoint, pagination, retries, timeouts, idempotency, errors, version negotiation, and observability consistently in both SDKs and CLI. Evidence: core parity tests. - [ ] A6.16.b Implement capability/format/profile discovery and ingest/live- session handoff in TypeScript, Python, and CLI. Evidence: discovery/ intake client tests. - [ ] A6.16.c Implement job/stage status, batch, retry/cancel, wait/stream, preview refs, and result retrieval in all clients. Evidence: job parity tests. - [ ] A6.16.d Implement annotation, rig/mapping, validation/review, export/ package, webhook, and audit-safe inspection operations in all clients. Evidence: operation matrix. - [ ] A6.16.e Keep protected content out of default logs/output, expose machine-readable CLI modes, and handle partial/degraded states. Evidence: privacy and UX tests. - [ ] A6.16.f Run end-to-end external TypeScript, Python, and CLI journeys against the same server contract and compare observable behavior. Evidence: parity report. - [ ] A6.17 Implement video chunking, multi-GPU/stage pipeline parallelism, model compilation/optimization, distributed result aggregation, conflict/quality selection, and final assembly with deterministic boundaries or explicit nondeterminism. Evidence: chunk seam, ordering, duplicate, worker loss, heterogeneous model/version, and aggregation tests. - [ ] A6.17.a Plan chunks from immutable media/time base with overlap, keyframe/contact/shot boundaries, context, order, checksums, and deterministic plan identity. Evidence: chunk-plan tests. - [ ] A6.17.b Register compiled/optimized model artifacts by source model, compiler/runtime/hardware/profile versions, checksum, validation, and compatibility. Evidence: model registry. - [ ] A6.17.c Reserve compatible multi-GPU or stage-pipeline resources and dispatch chunks/stages with fenced leases, bounded concurrency, and backpressure. Evidence: scheduler tests. - [ ] A6.17.d Persist idempotent chunk outputs with input/worker/model/tool/ seed provenance, overlap context, raw quality, and attempt lineage. Evidence: duplicate/worker-loss tests. - [ ] A6.17.e Aggregate in canonical order, reconcile overlap/conflicts with versioned selection policy, and mark heterogeneous/incomparable results. Evidence: aggregation goldens. - [ ] A6.17.f Assemble final timing, tracks, metadata, and provenance; validate seams/completeness/quality and disclose any nondeterminism. Evidence: final-assembly tests. - [ ] A6.17.g Recover from chunk/stage/worker/GPU loss without gaps, duplicates, stale commits, or hidden partial success. Evidence: distributed fault suite. ### A7 — Console, batch operations, export, and scheduling - [ ] A7.1 Build operator hub around intake, queue, stage failures, QA, consent, worker health, cost, and export readiness. Evidence: utility-first design review. - [ ] A7.1.a Define operator questions, critical states, next actions, role visibility, and drill-down routes before layout. Evidence: task map. - [ ] A7.1.b Project live intake, queue, failed-stage, QA, consent, worker, cost, and export-readiness summaries from authoritative APIs. Evidence: data contract tests. - [ ] A7.1.c Compose a restrained task-led workspace with one clear queue/ incident focus and no decorative hero or undifferentiated card mosaic. Evidence: frontend review. - [ ] A7.1.d Preserve filters/time window/tenant/project context through drill-down and back navigation. Evidence: navigation journey. - [ ] A7.1.e Render loading, empty, stale, partial, unavailable, and failed summaries honestly. Evidence: state matrix. - [ ] A7.2 Build intake, job, pipeline, QA, annotation, library, rigs, consent, workers, batch, schedule, and export routes. Evidence: route integrity. - [ ] A7.2.a Define route IDs, hierarchy, parameters, loaders, permissions, breadcrumbs, titles, and canonical deep links. Evidence: route registry. - [ ] A7.2.b Implement intake/job/pipeline/QA/annotation routes with exact object and revision context. Evidence: route tests. - [ ] A7.2.c Implement library/rig/consent routes with protected-data and eligibility boundaries. Evidence: authorization tests. - [ ] A7.2.d Implement worker/batch/schedule/export routes with operation and step-up controls. Evidence: workflow tests. - [ ] A7.2.e Verify direct load, refresh, forward/back, not-found, forbidden, signed-link, and permission-change behavior for every route. Evidence: Playwright route suite. - [ ] A7.3 Build live per-job DAG with exact stage state, attempts, metrics, cache, resource, cost, logs, and output. Evidence: live fault journey. - [ ] A7.3.a Load immutable job/run definition and subscribe to ordered, resumable state updates with snapshot reconciliation. Evidence: live-data tests. - [ ] A7.3.b Render stage/dependency state, attempt, worker/resource, cache, progress, cost, timing, and output without inventing missing links. Evidence: DAG fixture. - [ ] A7.3.c Inspect a selected stage's exact configuration, inputs, logs, measurements, attempts, outputs, failure, and lineage. Evidence: inspector journey. - [ ] A7.3.d Provide an equivalent ordered/dependency semantic table and keyboard selection instead of requiring graph interaction. Evidence: accessibility parity. - [ ] A7.3.e Reconcile disconnect, duplicate/out-of-order events, retry, cancellation, worker loss, and late output. Evidence: live fault journey. - [ ] A7.4 Build stage configuration and rerun-from-stage with impact preview. Evidence: downstream invalidation. - [ ] A7.4.a Load the versioned stage schema, defaults, current configuration, allowed overrides, and permissions. Evidence: form-schema tests. - [ ] A7.4.b Validate model/tool/profile/adapter/resource compatibility and show changed versus inherited values before save. Evidence: validation tests. - [ ] A7.4.c Preview rerun start point, reusable upstream outputs, invalidated downstream stages/cache/reviews/packages, cost, capacity, and consent impact. Evidence: impact fixture. - [ ] A7.4.d Require explicit authorization of the exact job/run/config/ impact revisions and enqueue idempotently. Evidence: stale-preview and duplicate tests. - [ ] A7.4.e Track the new run separately and preserve comparison/lineage to every prior attempt. Evidence: rerun journey. - [ ] A7.5 Build queue and worker console with drain, retry, quarantine, pause, backfill, and kill controls. Evidence: step-up authorization. - [ ] A7.5.a Project queue depth/age/class/tenant/priority/backpressure and worker identity/capability/version/resource/load/health/lease state. Evidence: console contract. - [ ] A7.5.b Inspect exact queued/running work, requirements, attempts, reservations, checkpoints, and dispatch eligibility. Evidence: inspection journey. - [ ] A7.5.c Preview scope and impact for drain, retry, quarantine, pause, resume, reprioritize, backfill, and kill operations. Evidence: impact tests. - [ ] A7.5.d Enforce operation-specific step-up, reason, concurrency, idempotency, audit, and protected-tenant boundaries. Evidence: authorization suite. - [ ] A7.5.e Display partial execution, late results, compensation, and read-back rather than optimistic success. Evidence: fault journey. - [ ] A7.6 Build batch preview with eligible/skipped items, cost, capacity, gates, consent, and schedule. Evidence: mixed-result journey. - [ ] A7.6.a Resolve a stable item set/query snapshot, requested operation, configuration, target, and caller authority. Evidence: batch request contract. - [ ] A7.6.b Evaluate per-item compatibility, gate freshness, consent/rights, lifecycle, dependency, quota, and schedule eligibility. Evidence: eligibility fixtures. - [ ] A7.6.c Show included/skipped/blocked items with exact reasons plus cost, resources, capacity window, duration, and downstream impact. Evidence: preview tests. - [ ] A7.6.d Authorize the exact preview revision and execute idempotently with per-item progress, retry/cancel, partial result, and audit. Evidence: mixed-result journey. - [ ] A7.7 Build committed GPU/worker/capture/reviewer windows in the calendar. Evidence: capacity conflict tests. - [ ] A7.7.a Model resource pools, skills/capabilities, locations, operating windows, maintenance, quotas, and time zones. Evidence: capacity schema. - [ ] A7.7.b Create tentative holds and committed reservations for GPU, worker, capture, and reviewer resources with exact demand and owner. Evidence: reservation tests. - [ ] A7.7.c Detect overlap, capability, quota, travel/setup, dependency, and downstream schedule conflicts transactionally. Evidence: conflict fixtures. - [ ] A7.7.d Reschedule, cancel, expire, or compensate reservations and propagate impact to queued/batch/live work. Evidence: lifecycle journey. - [ ] A7.7.e Provide list/agenda and keyboard alternatives to drag-based calendar manipulation. Evidence: accessibility tests. - [ ] A7.8 Build export target selection, mapping, validation, package, watermark, provenance, and read-back verification. Evidence: golden target journeys. - [ ] A7.8.a Select an exact artifact revision, consumer/target/profile/ version, mapping, package options, watermark, and delivery destination. Evidence: target-selection tests. - [ ] A7.8.b Explain compatibility, loss, current quality/consent/rights/ release gates, dependencies, costs, and target availability. Evidence: preflight journey. - [ ] A7.8.c Preview package files/manifest, mappings, generated regions, watermark placement, provenance, and excluded items. Evidence: package preview. - [ ] A7.8.d Authorize and monitor immutable export assembly under revision/ consent locks with idempotent retry and explicit partial/failure state. Evidence: operation tests. - [ ] A7.8.e Independently read back the target, compare expected contents, signatures, motion/metadata, and record verified delivery. Evidence: golden target journey. - [ ] A7.9 Build supersession, revoke, unpublish, quarantine, and recall. Evidence: downstream library/consumer state. - [ ] A7.9.a Define distinct eligibility, visibility, execution, distribution, and remediation effects for each lifecycle action. Evidence: transition specification. - [ ] A7.9.b Compute the exact asset/revision, derivatives, packages, libraries, projects, consumers, cached copies, and active jobs affected. Evidence: dependency preview. - [ ] A7.9.c Require action-specific authority, step-up, reason, effective time, replacement where applicable, and exact impact revision. Evidence: authorization tests. - [ ] A7.9.d Execute the propagation saga with checkpoints, per-consumer results, retry/compensation, and no hidden partial completion. Evidence: recall drill. - [ ] A7.9.e Verify downstream state by read-back and keep unresolved recipients visible until closure. Evidence: reconciliation report. - [ ] A7.10 Build signed deep links from Metis/Studio consumers to authorized Aja job/asset context. Evidence: expiry, tenant, permission, and replay. - [ ] A7.10.a Define allowed destination routes/context fields and omit protected source, subject, biometric, secret, or authority-bearing data. Evidence: deep-link contract. - [ ] A7.10.b Mint bounded audience/tenant/object/revision/purpose/expiry/ nonce links with key version and return location. Evidence: signing tests. - [ ] A7.10.c Validate signature, audience, current authorization, tenant, expiry, nonce/replay, object existence/revision, and lifecycle on open. Evidence: negative suite. - [ ] A7.10.d Land on an honest forbidden/expired/missing/stale state without leaking object existence and preserve a safe return path. Evidence: Playwright journey. - [ ] A7.11 Build responsive tablet/mobile incident, review, consent, and approve mode. Evidence: no full 3D edit requirement. - [ ] A7.11.a Prioritize incident triage, assignment, evidence review, annotation, consent decision, approval/rejection, and emergency control for compact viewports. Evidence: mobile task map. - [ ] A7.11.b Provide semantic thumbnails, measurements, tables, source-safe media, and deep links so no full 3D editor is required. Evidence: compact review journey. - [ ] A7.11.c Implement touch/keyboard targets, reflow, zoom, orientation, reduced motion, safe-area, offline/reconnect, and interruption resilience. Evidence: responsive accessibility suite. - [ ] A7.11.d Enforce step-up, exact revision, reason, confirmation, and read-back for consent, approve/reject, terminate, or recall actions. Evidence: mobile authorization tests. - [ ] A7.12 Build semantic alternatives and non-drag controls for DAG, timeline, mapping, preview, and graphs. Evidence: WCAG 2.2 journeys. - [ ] A7.12.a Inventory every visual datum, relationship, selection, and operation in DAG, timeline, mapping, preview, and graph surfaces. Evidence: parity inventory. - [ ] A7.12.b Provide structured tables/lists/trees with labels, ordering, dependencies, exact values, units, statuses, and diagnostics. Evidence: semantic snapshots. - [ ] A7.12.c Provide keyboard/button/menu inputs for pan/zoom/select, connect/map, range edit, reorder, resize, and other drag interactions. Evidence: non-drag tests. - [ ] A7.12.d Synchronize focus, selection, filters, and actions between visual and semantic views. Evidence: parity journey. - [ ] A7.12.e Test screen-reader announcement, focus recovery, zoom/reflow, color independence, reduced motion, and error recovery. Evidence: WCAG suite. - [ ] A7.13 Build honest fixture, missing-GPU/model/rig/host, offline, stale, partial, degraded, and failed states. Evidence: state matrix. - [ ] A7.13.a Define each state, source signal, reason code, precedence, permitted action, retryability, owner, and release effect. Evidence: state contract. - [ ] A7.13.b Render fixture/demo data with persistent labeling and prohibit production-affecting actions. Evidence: fixture tests. - [ ] A7.13.c Render each missing dependency and offline/degraded condition with last-known time, affected scope, and safe next step. Evidence: outage matrix. - [ ] A7.13.d Distinguish stale and partial data from empty/success and expose mixed per-item/per-stage outcomes. Evidence: partial-state tests. - [ ] A7.13.e Preserve diagnostics and retry/recovery state for failures without showing optimistic completion. Evidence: fault journey. - [ ] A7.14 Register permission-filtered Studio/control-room navigation and command palette. Evidence: route/role parity. - [ ] A7.14.a Register canonical route and command IDs, labels, keywords, hierarchy, required capabilities, target resolver, and feature availability. Evidence: navigation registry. - [ ] A7.14.b Filter server- and client-side navigation, search, recent, shortcuts, and command results by current authorization and context. Evidence: role tests. - [ ] A7.14.c Reauthorize and validate the resolved object/revision at route load or command execution rather than trusting visibility. Evidence: stale-permission test. - [ ] A7.14.d Prove every authorized route/action is reachable and every unauthorized route/action is absent and non-executable. Evidence: route/role parity matrix. - [ ] A7.15 Build searchable job/result operations with filters, saved views, queue statistics, bulk retry/cancel/reprioritize, webhook status, and export diagnostics. Evidence: bulk impact preview, partial-result, authorization, and undo/compensation behavior. - [ ] A7.15.a Define permission-aware job/result fields, full-text terms, filters/facets, sort, pagination, and bounded queue statistics. Evidence: query contract. - [ ] A7.15.b Build shareable saved views with owner/scope, versioned query, columns, defaults, permissions, and safe deletion. Evidence: saved-view tests. - [ ] A7.15.c Expose webhook delivery and export diagnostic projections linked to exact job/result revisions without leaking secrets or protected payloads. Evidence: diagnostic tests. - [ ] A7.15.d Resolve bulk selection as a stable snapshot and preview per-item retry/cancel/reprioritize eligibility and downstream impact. Evidence: bulk preview. - [ ] A7.15.e Execute authorized operations idempotently with per-item progress/result, partial failures, retry, and compensation/undo where valid. Evidence: mixed-result journey. - [ ] A7.16 Build live-capture supervision for device/session health, subject/ consent, calibration, preview, buffer/upload, tracking modalities, quality warnings, handoff, and emergency stop. Evidence: desktop and mobile session fault journeys. - [ ] A7.16.a Load live device/session identity, operator, location, subject- safe consent state, selected protocol/modalities, and immutable configuration. Evidence: supervision contract. - [ ] A7.16.b Monitor device/stream/clock/network/buffer/upload/worker health and calibration validity with bounded live updates. Evidence: telemetry tests. - [ ] A7.16.c Show privacy-governed preview, tracking modality/confidence, dropped data, quality warnings, and unavailable states. Evidence: live preview fixtures. - [ ] A7.16.d Gate record/start/resume/handoff on current subject consent, calibration, storage/capacity, protocol, and operator authority. Evidence: precondition tests. - [ ] A7.16.e Implement step-up emergency stop that halts capture/upload/ processing, preserves admissible evidence, and reports late data. Evidence: stop drill. - [ ] A7.16.f Recover from device/network/app interruption and reconcile buffers, uploads, stages, and handoff without duplicate or hidden gaps. Evidence: desktop/mobile fault journeys. - [ ] A7.17 Build profile-specific review projections for all ratified vertical pipelines, including intended-use warning, protocol, reference, measures, annotations, qualified reviewer, and consumer handoff. Evidence: role and profile boundaries prevent unsupported medical/performance claims. - [ ] A7.17.a Define a common projection contract while keeping profile- specific vocabulary, measures, thresholds, warnings, and decisions in their owned versions. Evidence: projection schema. - [ ] A7.17.b Render the exact profile/protocol/intended and prohibited use, input/reference provenance, measurements, uncertainty, annotations, and validation freshness. Evidence: profile fixtures. - [ ] A7.17.c Enforce profile-specific qualified-reviewer roles, conflicts, required evidence, decision authority, and escalation. Evidence: role matrix. - [ ] A7.17.d Produce only the approved consumer handoff fields, disclosures, limitations, and claim boundaries for the exact profile. Evidence: handoff contract tests. - [ ] A7.17.e Prove yoga, fitness, dance, martial arts, sports, medical/ rehabilitation, film/VFX, and gaming projections cannot inherit one another's claims, review, or approval. Evidence: cross-profile negative suite. ### A8 — Aja observability, verification, and launch - [ ] A8.1 Instrument capture, upload, queue, stage, cache, validation, review, export, adapter, consent, and recall traces/metrics. Evidence: bounded schema. - [ ] A8.1.a Define bounded event/span/metric names, attributes, units, cardinality limits, sampling, retention, and ownership per subsystem. Evidence: telemetry registry. - [ ] A8.1.b Propagate tenant-safe trace/run/job/stage/artifact correlation across capture, services, queues, workers, adapters, and consumers. Evidence: traced fixture. - [ ] A8.1.c Instrument success, latency, load, retries, backpressure, partial results, typed failures, validation/review, consent blocks, and recall closure. Evidence: signal tests. - [ ] A8.1.d Redact raw media, biometric/subject data, secrets, signed URLs, free text, and unbounded identifiers from telemetry. Evidence: privacy scan. - [ ] A8.2 Define SLOs for ingest, queue age, stage runtime, worker health, validation, preview, export, adapter health, and consent enforcement. Evidence: error-budget policy. - [ ] A8.2.a Define user-visible service indicators, populations, exclusions, windows, data sources, and measurement quality for each named surface. Evidence: SLI catalog. - [ ] A8.2.b Ratify latency, availability, freshness, correctness, durability, and enforcement objectives by profile/tier where genuinely distinct. Evidence: approved targets. - [ ] A8.2.c Create dashboards and multi-window burn alerts with actionable ownership and protected-data-safe drill-down. Evidence: alert tests. - [ ] A8.2.d Define error-budget consumption, release freeze, exception, recovery, and retrospective policy. Evidence: policy exercise. - [ ] A8.3 Run contract and migration compatibility suites. Evidence: input, rig, motion, consent, package, and adapter fixtures. - [ ] A8.3.a Test supported prior/current API, event, worker, adapter, file, and package contract versions against consumer fixtures. Evidence: compatibility matrix. - [ ] A8.3.b Test input, rig, motion, consent, validation, lineage, and package schema round-trips including unknown/optional fields. Evidence: contract goldens. - [ ] A8.3.c Test migration upgrade, backfill, mixed-version operation, rollback/roll-forward, and cleanup at representative scale. Evidence: migration report. - [ ] A8.3.d Block undocumented breaking drift and expired compatibility windows. Evidence: release gate. - [ ] A8.4 Run known-value calibration, sync, skeleton, frame, contact, slide, jitter, anatomy, ground-truth, retarget, loop, and format tests. Evidence: gate registry coverage. - [ ] A8.4.a Register independent analytical or externally verified fixtures with source, generator, expected values/tolerances, rights, and checksum. Evidence: fixture registry. - [ ] A8.4.b Cover calibration/sync/skeleton/frame and contact/slide/jitter measures with positive, boundary, and broken cases. Evidence: known- value report. - [ ] A8.4.c Cover anatomy/physics, ground-truth fidelity, retarget, loop/ blend, facial where consented, and format round-trip separately. Evidence: gate matrix. - [ ] A8.4.d Prove every production gate/profile/version maps to current known-value evidence and unavailable gates cannot pass. Evidence: registry audit. - [ ] A8.5 Run calibrated perceptual/model gate evaluations. Evidence: threshold, subgroup, uncertainty, and drift report. - [ ] A8.5.a Freeze evaluator/model/config, consented evaluation corpus, labels/adjudication, splits, cohorts, and baselines. Evidence: eval manifest. - [ ] A8.5.b Measure task performance, calibration, uncertainty, abstention, subgroup error, out-of-distribution behavior, and human disagreement. Evidence: evaluation report. - [ ] A8.5.c Select pass/fail/review thresholds from declared costs and prove them on held-out data without tuning leakage. Evidence: threshold rationale. - [ ] A8.5.d Compare candidate to current model, replay affected historical cases, monitor drift, and document limitations/expiry. Evidence: model release gate. - [ ] A8.6 Run real-database, blob, queue, worker, cache, search, preview, and export integration tests. Evidence: durable round-trip. - [ ] A8.6.a Stand up production-like database, object store, queue, workers, cache, search, and target adapters with isolated fixtures. Evidence: integration environment. - [ ] A8.6.b Exercise capture/ingest through persisted job/stages/artifacts, cache/index, preview, validation, package/export, and target read-back. Evidence: durable round-trip. - [ ] A8.6.c Exercise retries, duplicate delivery, concurrency, stale cache/ index, restart, partial result, and cleanup. Evidence: fault cases. - [ ] A8.6.d Verify tenant/consent isolation, checksums, lineage, audit, and reconciliation at every storage boundary. Evidence: invariant report. - [ ] A8.7 Run full-journey Playwright: ingest/consent through validated export. Evidence: deterministic fixture clip and read-back. - [ ] A8.7.a Create a deterministic rights-cleared clip, capture metadata, subject consent, rig/profile, known gate values, and target fixture. Evidence: fixture manifest. - [ ] A8.7.b Ingest, validate admissibility, configure/run stages, and inspect synchronized preview/lineage through the browser. Evidence: Playwright trace. - [ ] A8.7.c Review raw measurements, annotations, consent, and current gates; approve the exact eligible revision. Evidence: decision assertions. - [ ] A8.7.d Export/package and independently read back target bytes/metadata/ motion/provenance, asserting UI and API final state. Evidence: journey report. - [ ] A8.8 Run full-journey Playwright: failed stage, rerun, compare, annotate, approve, package. Evidence: exact state. - [ ] A8.8.a Inject a deterministic stage failure and assert job DAG, attempt, diagnostics, downstream block, and non-success announcement. Evidence: failure trace. - [ ] A8.8.b Change a permitted configuration, preview invalidation/cost, and rerun from the failed stage. Evidence: rerun assertions. - [ ] A8.8.c Compare exact old/new revisions, create durable frame/joint annotations, and resolve review. Evidence: comparison trace. - [ ] A8.8.d Approve/package only the new eligible revision and assert the failed/stale output cannot release. Evidence: exact-state report. - [ ] A8.9 Run full-journey adapter tests for Metis demonstration, coaching overlay, and handoff. Evidence: health/degraded behavior. - [ ] A8.9.a Negotiate adapter version/capabilities and test healthy, degraded, unavailable, incompatible, and stale health projections. Evidence: health matrix. - [ ] A8.9.b Request and consume an eligible demonstration with consent, rights, quality, compatibility, provenance, and revocation assertions. Evidence: demonstration journey. - [ ] A8.9.c Request a coaching overlay and assert bounded semantic measures, uncertainty, claim limitations, and protected-data exclusion. Evidence: overlay journey. - [ ] A8.9.d Submit/status/cancel/complete an asynchronous handoff with idempotency, correlation, retry, late-result, and failure behavior. Evidence: handoff journey. - [ ] A8.10 Run WCAG 2.2 AA, keyboard, announcement, non-drag, and semantic preview parity suites. Evidence: report matrix. - [ ] A8.10.a Run automated WCAG checks across authenticated routes, roles, themes, locales, and wide/compact/single-column viewports. Evidence: accessibility report. - [ ] A8.10.b Complete keyboard-only intake, job/DAG, compare, mapping, annotation, review, batch, schedule, and export journeys. Evidence: keyboard traces. - [ ] A8.10.c Verify names/roles/values, focus order/restoration, live announcements, errors, loading, stale/partial/failure, and step-up dialogs. Evidence: assistive-technology matrix. - [ ] A8.10.d Verify non-drag controls, 200–400% zoom/reflow, touch targets, color independence, reduced motion, and semantic 3D/graph parity. Evidence: manual/automated results. - [ ] A8.11 Run upload, queue, batch, worker, preview, large motion, search, and export performance/load tests. Evidence: backpressure and budgets. - [ ] A8.11.a Define representative and worst-supported datasets, concurrency, resource limits, warm/cold state, budgets, and success/failure criteria. Evidence: load plan. - [ ] A8.11.b Measure upload/ingest, queue fairness/age, dispatch, stage/ worker, cache, and batch behavior under sustained and burst load. Evidence: service report. - [ ] A8.11.c Measure first/useful preview, timeline/skeleton/large-motion interaction, search, and export/package/read-back performance. Evidence: user-performance report. - [ ] A8.11.d Verify quotas, backpressure, degradation, cancellation, recovery, data correctness, cost, and no tenant starvation. Evidence: overload report. - [ ] A8.12 Run malicious media/archive/rig, consent bypass, biometric leak, model attack, worker spoof, cache poison, auth, tenant, and export tamper tests. Evidence: zero blockers. - [ ] A8.12.a Test malformed/oversized/polyglot media, archives, rigs, paths, metadata, parsers, decompression, and dependency resolution in quarantine. Evidence: content security suite. - [ ] A8.12.b Test consent/rights expiry, revocation races, purpose confusion, protected preview/search/log leaks, and biometric inference/exfiltration. Evidence: privacy suite. - [ ] A8.12.c Test adversarial model inputs/outputs, prompt/reference abuse, unsafe deserialization, model substitution, and generated-content disclosure bypass. Evidence: model security report. - [ ] A8.12.d Test worker identity/capability spoof, lease theft, stale commit, cache poison, artifact tamper, and supply-chain compromise. Evidence: compute security suite. - [ ] A8.12.e Test authentication, object/property authorization, tenant/ project isolation, step-up, export/package/signature, and recall bypass. Evidence: adversarial matrix with zero release blockers. - [ ] A8.13 Run worker loss, GPU loss, queue replay, cache loss, backup/restore, consent revocation, and recall drills. Evidence: RPO/RTO. - [ ] A8.13.a Inject worker process/host/network and GPU reset/exhaustion loss during queued, running, checkpointing, and committing states. Evidence: compute recovery report. - [ ] A8.13.b Replay, duplicate, reorder, pause, and partially lose queue/ event delivery; verify fencing, idempotency, and reconciliation. Evidence: messaging drill. - [ ] A8.13.c Lose/corrupt cache entries and prove safe miss, quarantine, recomputation, and no invalid release. Evidence: cache drill. - [ ] A8.13.d Restore database/blobs/config/keys/indexes from backup and reconcile checksums, queues, jobs, search, audit, and targets. Evidence: restore report. - [ ] A8.13.e Revoke consent and recall during processing/export/distribution; verify bounded stop and downstream closure. Evidence: recall drill. - [ ] A8.13.f Measure and compare achieved RPO/RTO/data loss/duplicate work to ratified objectives. Evidence: recovery scorecard. - [ ] A8.14 Publish capture, consent, pipeline, worker, QA, export, incident, privacy, and recovery runbooks. Evidence: game-day. - [ ] A8.14.a Assign owner, audience, prerequisites, triggers, authority, commands/UI paths, diagnostics, safety checks, escalation, and rollback to each runbook. Evidence: runbook template audit. - [ ] A8.14.b Write capture/consent and pipeline/worker operational runbooks with protected-data and emergency-stop handling. Evidence: reviewed docs. - [ ] A8.14.c Write QA/export and privacy/security incident runbooks with gate, quarantine, revocation, and recall procedures. Evidence: reviewed docs. - [ ] A8.14.d Write backup/restore/disaster recovery and dependency-outage runbooks with RPO/RTO validation. Evidence: reviewed docs. - [ ] A8.14.e Execute representative game-days, record deviations, remediate, and revalidate runbook commands/links. Evidence: exercise report. - [ ] A8.15 Produce engineering-readiness evidence. Evidence: all requirements map to proof. - [ ] A8.15.a Build a bidirectional requirement-to-design/code/test/operation/ owner/evidence index with immutable evidence refs. Evidence: zero- orphan audit. - [ ] A8.15.b Record contract/migration, quality/calibration, security/privacy, accessibility, performance/SLO, recovery, and runbook results with exact versions. Evidence: readiness packet. - [ ] A8.15.c Surface failed, stale, waived, unavailable, or missing evidence explicitly and block readiness on unresolved mandatory proof. Evidence: readiness gate. - [ ] A8.15.d Reproduce the packet from repository and approved external evidence and verify links/checksums. Evidence: clean-room generation. - [ ] A8.16 Obtain named motion/animation, privacy/consent, safety, accessibility, security, engineering, and product approvals. Evidence: human signoff. - [ ] A8.16.a Define each approver's scope, competence, independence/conflict rules, required evidence, decision options, and expiry. Evidence: approval policy. - [ ] A8.16.b Present the exact release candidate, readiness packet, limitations, risks, waivers, and unresolved items. Evidence: review bundle. - [ ] A8.16.c Capture named approve/reject/conditional decisions with role, time, revision, rationale, conditions, and signature/audit. Evidence: signoff records. - [ ] A8.16.d Invalidate or renew approvals when candidate, evidence, policy, model/profile, consent posture, or material risk changes. Evidence: staleness test. - [ ] A8.17 Run distinct full journeys for desktop live capture, mobile live capture, multi-person/body/hand/face tracking, video analysis, generative cleanup/blending, format conversion, SDK/CLI, and webhooks. Evidence: no generic batch-ingest journey substitutes for live or modality-specific proof. - [ ] A8.17.a Run separate desktop and mobile live-capture journeys through device enrollment, calibration, consent, interruption, handoff, and emergency stop. Evidence: live traces. - [ ] A8.17.b Run separate multi-person, body, hand, and consented face tracking journeys with identity, occlusion, confidence, modality loss, and protected-data assertions. Evidence: modality matrix. - [ ] A8.17.c Run video-analysis and generative cleanup/blending journeys with exact edited/generated ranges, alternatives, validation, and human acceptance. Evidence: provenance traces. - [ ] A8.17.d Run every supported format-conversion pair through loss preview, conversion, validation, package, and read-back. Evidence: conversion matrix. - [ ] A8.17.e Run external TypeScript SDK, Python SDK, CLI, and webhook journeys including auth, version negotiation, retry, partial failure, secret rotation, and recall. Evidence: client matrix. - [ ] A8.18 Run independent contract, known-value, calibrated-quality, accessibility, privacy/consent, performance, and consumer-handoff gates for yoga, fitness, dance, martial arts, sports, medical/rehabilitation, film/VFX, and gaming profiles. Evidence: no vertical inherits another vertical's release evidence. - [ ] A8.18.a Register one release-evidence bundle per exact vertical profile/ version with owners, intended/prohibited use, fixtures, consumers, and expiry. Evidence: profile registry. - [ ] A8.18.b Run profile-specific contract and independent known-value/ calibrated-quality gates against its own protocol, measures, thresholds, and reviewer population. Evidence: quality matrix. - [ ] A8.18.c Run profile-specific accessibility, privacy/consent, safety/ claim-boundary, performance, and consumer-handoff tests. Evidence: assurance matrix. - [ ] A8.18.d Cover yoga, fitness, dance, martial arts, each ratified sport, medical/rehabilitation, film/VFX, and gaming with declared unavailable cells rather than inherited proof. Evidence: coverage audit. - [ ] A8.18.e Block profile release when any required bundle is missing, stale, failed, or belongs to another profile/version. Evidence: independence test. - [ ] A8.19 Run full journeys for CG replacement, text/reference-to-motion, avatar customization/marketplace, chunked/parallel inference, optimized model rollout, distributed aggregation, and final package assembly. Evidence: specialized lineage, consent, compatibility, failure, and quality assertions. - [ ] A8.19.a Run video-to-CG per-shot segmentation/tracking/transfer/render/ composite/review/delivery with consent, generated-region, temporal quality, seam, and recall assertions. Evidence: CG journey. - [ ] A8.19.b Run text and protected-reference-to-motion through constraints, candidate generation, physics/quality validation, human acceptance, export, and disclosure. Evidence: generation journeys. - [ ] A8.19.c Run avatar customization and marketplace submit/scan/review/ promote/use/update/quarantine/takedown with compatibility and rights propagation. Evidence: marketplace journey. - [ ] A8.19.d Run chunked multi-GPU/stage-parallel inference through overlap, duplicate, ordering, worker/GPU loss, retry, and deterministic or disclosed-nondeterministic aggregation. Evidence: distributed trace. - [ ] A8.19.e Roll out a compiled/optimized model through compatibility, known-value/calibrated comparison, canary, rollback, and historical result provenance. Evidence: model rollout journey. - [ ] A8.19.f Assemble, validate, sign, publish, and independently read back the final package while preserving all specialized lineage, consent, rights, quality, compatibility, and failure evidence. Evidence: package journey. - [ ] A8.20 EVE-SEAM-EXIT: require "required Eve reads and writes admitted with source and behavior evidence, or an exact task-0.8 explicit non-goal proves zero operations; a named defer preserves ownership but never passes completion" before this phase exits. Evidence: source-derived totality record and passing verifier. - [ ] A8.20.a Re-run the route, bridge, state-signal, and complete domain-code envelope census; review every changed candidate instead of carrying a stale phase disposition forward. Evidence: current ratchets. - [ ] A8.20.b Bind the exact ratified task-0.8 workflow and requirement set; classify it as a required seam or an exact source-backed non-goal. Evidence: charter-bound disposition set. - [ ] A8.20.c For a required seam, admit both read and write operations with byte-pinned source and behavior evidence. A named defer retains its owner and unblock condition but fails completion. Evidence: operation proofs. - [ ] A8.20.d Permit a zero-operation boundary only for an exact ratified task-0.8 explicit non-goal; absence or unavailability is not a non-goal. Evidence: source-bound non-goal proof. - [ ] A8.20.e Run the totality verifier, every retained gate-case CLI, and the injected durable-candidate control; retain red and green receipts. Evidence: release gate logs. --- ## Phase B — Bellona DCC bridge and interchange console Bellona is a Studio-only substrate with an existing `apps/bellona/control-room`. The work is to unify that control room with the bridge hosts, build/render services, OpenUSD interchange, consistency checks, artifact store, release evidence, and governed Studio entry point without creating a duplicate console. ### B0 — Host, bridge matrix, ownership, and threat model - [ ] B0.1 Ratify `apps/bellona/control-room` as the canonical operator console or record the replacement and migration. Evidence: host ADR. - [ ] B0.1.a Inventory current Bellona control-room ownership, users, routes, mutations, deployments, data sources, and operational dependencies. Evidence: current-state map. - [ ] B0.1.b Compare retain/refactor and replacement options against authority, migration, accessibility, operations, cost, and duplication criteria. Evidence: option record. - [ ] B0.1.c Ratify one canonical console and its governed Studio projection, with named owner and prohibited duplicate surfaces. Evidence: approved ADR. - [ ] B0.1.d If replaced, define route/data/permission/operation/test rollout, coexistence, rollback, and retirement milestones. Evidence: migration plan. - [ ] B0.2 Inventory control-room routes/components/tests, static Studio routes, bridge apps, gateways, hosts, build/render services, CLI, and libraries. Evidence: route-capability matrix. - [x] B0.2.a Enumerate control-room and Studio routes, components, loaders, actions, tests, flags, permissions, and data dependencies. Evidence: UI inventory. - [x] B0.2.b Enumerate bridge/remote/gateway/host/build/render apps and their protocols, commands, state, deployment, and owner. Evidence: runtime inventory. - [x] B0.2.c Enumerate CLI commands and Bellona libraries with public contracts, consumers, persistence, jobs/events, and test coverage. Evidence: code inventory. - [ ] B0.2.d Map every discovered item to one capability/disposition and flag duplicates, orphans, stubs, fixtures, and dead paths. Evidence: route-capability matrix. - [ ] B0.3 Map all `libs/bellona/*` packages to console capabilities, bridge runtime, SDK, consumer integration, or out-of-scope. Evidence: ledger. - [x] B0.3.a Enumerate each package's entry points, exports, schemas, runtime side effects, dependencies, consumers, owners, and tests. Evidence: package census. - [ ] B0.3.b Classify every public symbol by canonical console, bridge runtime, SDK, consumer seam, shared substrate, migration-only, or out-of-scope ownership. Evidence: symbol ledger. - [ ] B0.3.c Resolve overlapping implementations and undocumented cross- domain authority. Evidence: disposition decisions. - [ ] B0.3.d Verify build/dependency graph and consumer imports agree with approved boundaries. Evidence: boundary tests. - [ ] B0.4 Define the governed Oshun Studio entry/facade and deep-link boundary. Evidence: Bellona never becomes a customer-domain route. - [ ] B0.4.a Define the Studio audience, permitted summary fields/actions, canonical Bellona destinations, and prohibited bridge/admin detail. Evidence: facade contract. - [ ] B0.4.b Define signed link context, audience, tenant/project, object/ revision, expiry, nonce, and return behavior. Evidence: link schema. - [ ] B0.4.c Reauthorize at Bellona route load and prevent the Studio facade from proxying canonical mutation authority. Evidence: boundary tests. - [ ] B0.4.d Verify navigation, route ownership, analytics, support docs, and command palette never expose Bellona as a customer-domain route. Evidence: route audit. - [ ] B0.5 Define operator, DCC artist, technical artist, pipeline engineer, build engineer, reviewer, release manager, security operator, and administrator roles. Evidence: permission matrix. - [ ] B0.5.a Define job duties, least-privilege capabilities, tenant/project/ host scope, separation-of-duties, and prohibited actions for each role. Evidence: role definitions. - [ ] B0.5.b Map view, command, transfer, configure, approve, waive, release, revoke, quarantine, and emergency actions to object/property authority. Evidence: permission matrix. - [ ] B0.5.c Define step-up, dual control, break-glass, conflict, expiry, and delegation rules for privileged operations. Evidence: control policy. - [ ] B0.5.d Test every role across console, API, bridge, CLI/SDK, Studio facade, and in-host UI. Evidence: cross-surface authorization suite. - [ ] B0.6 Define supported DCC/engine hosts and versions for Blender, Maya, Houdini, 3ds Max, Unreal, Unity, Godot, and ratified extensions. Evidence: compatibility matrix. - [ ] B0.6.a Define host/plugin/OS/architecture/server/protocol version tuple, support tier, lifecycle, owner, and test environment. Evidence: host registry. - [ ] B0.6.b Ratify Blender, Maya, Houdini, 3ds Max, Unreal, Unity, and Godot tuples independently with install/update and vendor-support constraints. Evidence: approved rows. - [ ] B0.6.c Register extensions only with capability, trust, packaging, compatibility, security, and release proof separate from the base host. Evidence: extension records. - [ ] B0.6.d Define compatibility windows, deprecation/expiry, unavailable cells, and upgrade/downgrade behavior. Evidence: lifecycle matrix. - [ ] B0.7 Define source and target formats, OpenUSD profiles, schemas, resolver rules, units, axes, color, material, animation, rig, and package expectations. Evidence: interchange profile. - [ ] B0.7.a Register each source/target format/profile/version, reader/ writer, host support, limits, and unsupported constructs. Evidence: format registry. - [ ] B0.7.b Ratify OpenUSD core/extensions, schema/API versions, layer/ composition policy, resolver contexts, package layout, and validation. Evidence: USD profile. - [ ] B0.7.c Define geometry/topology, transforms/units/axes, color, material/ texture, animation/time, rig/skinning, camera/light, metadata, and dependency mappings. Evidence: semantic mapping spec. - [ ] B0.7.d Define deterministic handling and disclosure for unknown, lossy, approximated, baked, remapped, or synthesized features. Evidence: loss policy. - [ ] B0.8 Define local, remote, cloud, and on-box UE host trust boundaries. Evidence: network/auth architecture. - [ ] B0.8.a Diagram actors, processes, devices, networks, stores, secrets, data/command flows, and tenancy for each deployment mode. Evidence: trust diagrams. - [ ] B0.8.b Define host/device identity, enrollment, attestation, mutual authentication, authorization grants, key storage/rotation, and revoke. Evidence: identity architecture. - [ ] B0.8.c Define inbound/outbound network policy, discovery, relays, firewall/proxy/NAT, SSRF controls, and offline behavior. Evidence: network architecture. - [ ] B0.8.d Define additional isolation and command/file safeguards for remote/cloud and on-box Unreal execution. Evidence: deployment threat review. - [ ] B0.9 Define artifact retention, cache, legal hold, licensing, provenance, release evidence, and deletion policy. Evidence: data lifecycle. - [ ] B0.9.a Classify source, intermediate, cache, log, preview, build, package, release, and evidence artifacts by sensitivity and authority. Evidence: data catalog. - [ ] B0.9.b Define retention, expiry, cache eviction, archive, deletion, tombstone, backup, and restoration per class. Evidence: lifecycle schedule. - [ ] B0.9.c Define legal hold and licensing/redistribution constraints, conflicts, and authorized release/deletion behavior. Evidence: policy matrix. - [ ] B0.9.d Define immutable source/transformation/dependency/tool/host/ operator provenance and evidence retention beyond artifact deletion. Evidence: provenance contract. - [ ] B0.9.e Prove expiry, deletion, hold, quarantine, recall, and read-back reconciliation across stores/caches/targets. Evidence: lifecycle tests. - [ ] B0.10 Threat-model remote command injection, bridge impersonation, compromised plugins/hosts, malicious assets/USD, path traversal, SSRF, credential theft, artifact tamper, supply chain, and build exfiltration. Evidence: mitigation/test map. - [ ] B0.10.a Enumerate assets, actors, entry points, trust transitions, attacker capabilities, abuse cases, and consequences per deployment/ host profile. Evidence: threat inventory. - [ ] B0.10.b Model command injection/confusion, bridge/host/plugin identity spoofing, stale grants, and compromised execution. Evidence: command threat scenarios. - [ ] B0.10.c Model malicious files/USD/archives/dependencies, parser abuse, path/resolver traversal, SSRF, and artifact tamper. Evidence: content threat scenarios. - [ ] B0.10.d Model credential/secret theft, supply-chain substitution, worker/build compromise, cross-tenant access, and build exfiltration. Evidence: platform threat scenarios. - [ ] B0.10.e Map each threat to preventive/detective/recovery control, owner, residual risk, adversarial test, and release gate. Evidence: approved mitigation matrix. - [ ] B0.11 Define emergency controls for host revoke, session terminate, command stop, artifact quarantine, template revoke, and release recall. Evidence: authority/blast-radius matrix. - [ ] B0.11.a Define trigger, authority, step-up/dual control, scope selector, confirmation, and immutable audit for each emergency action. Evidence: control contracts. - [ ] B0.11.b Compute active sessions/commands/transfers/jobs/builds, artifacts, templates, releases, targets, and consumers in blast radius. Evidence: impact preview. - [ ] B0.11.c Specify immediate stop/fencing behavior, late-result handling, quarantine, downstream propagation, and degraded operation. Evidence: response design. - [ ] B0.11.d Define recovery/re-enrollment/unquarantine/re-release authority and proof requirements. Evidence: recovery policy. - [ ] B0.11.e Exercise each control and verify target/consumer read-back to closure. Evidence: emergency drill. - [ ] B0.12 Define success measures for connection, transfer, conversion, fidelity, queue, build, cache, host availability, cost, and release verification. Evidence: metric spec. - [ ] B0.12.a Define each measure's user outcome, numerator/denominator, population, unit, source, window, exclusions, and owner. Evidence: metric catalog. - [ ] B0.12.b Define latency/reliability/correctness/fidelity/capacity/cost targets by supported host/profile/tier where warranted. Evidence: target matrix. - [ ] B0.12.c Define bounded privacy-safe dimensions and prohibit secret, asset-content, path, free-text, and high-cardinality labels. Evidence: telemetry policy. - [ ] B0.12.d Link measures to dashboards, alerts, error budgets, release gates, and corrective decisions. Evidence: operational trace. - [ ] B0.13 Author and ratify `V1/BELLONA_DCC_CONSOLE_DESIGN_2026-07-23.md` with current-state, host, bridge trust, OpenUSD spine, contracts, data, APIs, fleet, UI, release, migration, rollout, and decision records. Evidence: approved doc and resolved review comments. - [ ] B0.13.a Draft current-state findings, scope/boundaries, personas/ permissions, host/version matrix, and trust/threat architecture. Evidence: reviewed design sections. - [ ] B0.13.b Draft OpenUSD/interchange, canonical data, protocol/API/events, persistence/artifact, queue/fleet, and consumer contracts. Evidence: reviewed technical sections. - [ ] B0.13.c Draft task-led console/in-host/Studio experiences, accessibility, honest states, operations, verification, and release. Evidence: reviewed experience sections. - [ ] B0.13.d Draft migration/compatibility/rollout/rollback/retirement, risks, open decisions, ownership, and milestones. Evidence: reviewed delivery sections. - [ ] B0.13.e Obtain named cross-functional review, resolve every comment or record a decision, and ratify an immutable version. Evidence: approval log. - [ ] B0.14 Reconcile every Bellona control-room/Studio route, bridge/remote/ build/render app, CLI/SDK command, `libs/bellona/*` package, protocol, host plugin, workflow, test, and documented feature at atomic-feature level. Evidence: explicit dispositions cover bridges/interchange/builds, render, gameplay, virtual production, XR, mocap, MetaHuman, Resolve/ Houdini, audio/video, text-to-3D/creative flows, agent/MCP control, cross-domain ingestion, events, and release evidence. - [x] B0.14.a Build a normalized inventory of every named code, route, contract, command, feature claim, workflow, test, and release artifact with stable IDs and owners. Evidence: atomic inventory. - [ ] B0.14.b Decompose compound claims into independently classifiable host, interchange, build, render, runtime, VP, XR, mocap, character, editorial/procedural, media, generative, agent, integration, event, and evidence capabilities. Evidence: feature ledger. - [ ] B0.14.c Assign each item retain/refactor/migrate/replace/merge/remove/ external-owner/defer decisions with rationale, destination, dependency, proof, and target milestone. Evidence: disposition audit. - [ ] B0.14.d Map inventory to ledger and ledger back to authoritative or explicitly net-new scope; resolve duplicates/orphans. Evidence: bidirectional zero-orphan check. - [ ] B0.14.e Obtain domain-owner review of every unresolved, conflicting, or high-risk disposition. Evidence: signed reconciliation. - [ ] B0.15 Define the boundary among control-room operations, in-host artist plugin UI, governed Studio facade, remote/cloud administration, build/release automation, virtual-production stage control, gameplay/XR validation, and developer SDK/CLI. Evidence: every capability has one authoritative mutation surface and consistent projections elsewhere. - [ ] B0.15.a Catalog read and mutation capabilities for each surface and identify duplicated or missing authority. Evidence: surface matrix. - [ ] B0.15.b Assign one authoritative mutation surface/service per capability with role, context, audit, and consistency contract. Evidence: authority registry. - [ ] B0.15.c Define read-only projections, signed deep links, request/ approval seams, and event reconciliation for non-authoritative surfaces. Evidence: projection contracts. - [ ] B0.15.d Test conflicting concurrent actions, stale projections, permission changes, offline hosts, and partial propagation across surfaces. Evidence: boundary suite. - [ ] B0.16 Ratify specialized compatibility profiles for asset interchange, engine project/runtime, render, virtual production, XR device, mocap, MetaHuman, Resolve editorial, Houdini procedural, and cross-domain compilation. Evidence: each profile names hosts/versions, commands, assets, measurements, gates, safety controls, and release targets. - [ ] B0.16.a Define the common profile schema and lifecycle for exact hosts/ versions, commands, assets, mappings, measurements, validators/gates, safety controls, targets, owners, evidence, and limitations. Evidence: schema tests. - [ ] B0.16.b Ratify separate asset-interchange, engine-runtime, and render profiles with no inherited target proof. Evidence: profile records. - [ ] B0.16.c Ratify separate virtual-production, XR-device, mocap, and MetaHuman profiles with device/stage/performer safety boundaries. Evidence: profile records. - [ ] B0.16.d Ratify separate Resolve editorial, Houdini procedural, and cross-domain compilation profiles with source/target authority and deterministic evidence rules. Evidence: profile records. - [ ] B0.16.e Reject execution or release under missing, stale, incompatible, or cross-profile evidence. Evidence: independence suite. ### B1 — Session, command, artifact, interchange, and release contracts - [ ] B1.1 Define host registration with DCC/engine, version, plugin, platform, capabilities, identity, attestation, health, load, and maintenance. Evidence: schema. - [ ] B1.1.a Define immutable host/device identity, owner/tenant, enrollment, certificate/key version, attestation, and revocation fields. Evidence: identity schema. - [ ] B1.1.b Define host/DCC/engine/plugin/OS/architecture/protocol versions and typed capability/limit declarations. Evidence: compatibility schema. - [ ] B1.1.c Define heartbeat time, health components, resource/load/license state, network locality, and freshness semantics. Evidence: liveness schema. - [ ] B1.1.d Define maintenance/drain/quarantine/disabled lifecycle, concurrency rules, and audit invariants. Evidence: state tests. - [ ] B1.2 Define bridge session with host, actor, project, workspace, purpose, grants, expiry, heartbeat, status, and termination. Evidence: invariants. - [ ] B1.2.a Define session identity, enrolled host revision, authenticated actor, tenant/project/workspace, client, purpose, and trace. Evidence: session schema. - [ ] B1.2.b Define least-privilege typed grants with resource/path scope, command capabilities, limits, issue/expiry/revoke times, and approver. Evidence: grant schema. - [ ] B1.2.c Define connect/active/degraded/draining/expired/terminating/ terminated states, heartbeat, reconnect, and concurrent-session rules. Evidence: state machine. - [ ] B1.2.d Define user, host, administrator, timeout, revoke, and emergency termination semantics with fenced late commands. Evidence: invariants. - [ ] B1.3 Define command envelope with version, capability, target, arguments, idempotency, deadline, expected revision, authorization, and correlation. Evidence: contract tests. - [ ] B1.3.a Define command/protocol version, registry capability/action, session/host/project target, and typed argument schema reference. Evidence: envelope schema. - [ ] B1.3.b Define command/idempotency/correlation/causation IDs, requested time, deadline, priority, and retry budget. Evidence: identity tests. - [ ] B1.3.c Define expected object/scene/file revisions, preconditions, resource/path scopes, dry-run/impact-preview reference, and actor grant. Evidence: concurrency contract. - [ ] B1.3.d Sign/authenticate the immutable envelope and reject unknown, malformed, expired, replayed, stale, or unauthorized commands. Evidence: negative contract suite. - [ ] B1.4 Define command result with status, output refs, diagnostics, logs, measurements, partial state, and retry semantics. Evidence: schema. - [ ] B1.4.a Define accepted/running/succeeded/failed/cancelled/expired/ rejected/partial/unknown statuses and legal transitions. Evidence: result state machine. - [ ] B1.4.b Define attempt/host/tool versions, start/end, progress, checkpoints, output artifact refs/checksums, changed-object revisions, and target read-back. Evidence: result schema. - [ ] B1.4.c Define typed diagnostics, bounded redacted logs, raw measurements, warnings, limitations, and unsupported-feature detail. Evidence: diagnostic fixtures. - [ ] B1.4.d Define retryability, safe retry point, compensation/undo, irreversible side effects, partial outputs, and late-result semantics. Evidence: fault contract tests. - [ ] B1.5 Define interchange job and stage DAG from source ingest through canonical USD and targets. Evidence: DAG validation. - [ ] B1.5.a Define immutable job identity, source artifact/revision/profile, requested targets, configuration, priority, deadline, and actor. Evidence: job schema. - [ ] B1.5.b Define typed ingest/inspect/normalize/USD-author/resolve/validate/ convert/package/read-back stages with inputs, outputs, requirements, and failure policy. Evidence: stage registry. - [ ] B1.5.c Validate dependency acyclicity, input/output compatibility, required stages, target/profile coverage, and terminal gates. Evidence: DAG validator. - [ ] B1.5.d Define attempts, checkpoints, cache keys, rerun/invalidation, cancellation, partial target results, and immutable lineage. Evidence: execution invariants. - [ ] B1.6 Define artifact, representation, version, layer, dependency, resolver context, checksum, size, rights, provenance, and retention. Evidence: schema. - [ ] B1.6.a Define logical artifact identity, immutable version, asset type, lifecycle, owner/tenant/project, rights/license, sensitivity, and retention class. Evidence: artifact schema. - [ ] B1.6.b Define each representation's format/profile, blob ref, checksum, size, media type, tool/host, coordinate/color/time basis, and validation. Evidence: representation schema. - [ ] B1.6.c Define USD layer identity/role/order/muting, composition arcs, resolver context, variants, payloads, and package membership. Evidence: layer fixtures. - [ ] B1.6.d Define typed dependency edges with exact version/checksum, optionality, resolver rule, license/rights propagation, and cycle policy. Evidence: dependency tests. - [ ] B1.6.e Define source/command/transformation/operator/tool provenance, supersession/quarantine/recall, and retention/legal-hold invariants. Evidence: lifecycle fixtures. - [ ] B1.7 Define geometry, topology, transform, unit, axis, material, texture, rig, animation, camera, light, metadata, and scene measurements. Evidence: typed measure registry. - [ ] B1.7.a Define common measurement identity, subject/path, component, algorithm/version/config, unit, coordinate/time basis, raw value/range, uncertainty, and source revision. Evidence: measure schema. - [ ] B1.7.b Register geometry/topology and transform/unit/axis measures with applicability and independent known values. Evidence: registry rows. - [ ] B1.7.c Register material/texture/color and rig/skinning/animation measures with applicability and independent known values. Evidence: registry rows. - [ ] B1.7.d Register camera/light/timecode and metadata/scene/dependency measures with applicability and independent known values. Evidence: registry rows. - [ ] B1.7.e Define missing, unavailable, unsupported, invalid-input, and evaluator-failure states distinct from numeric results. Evidence: state tests. - [ ] B1.8 Define consistency result separately from raw measurements. Evidence: policy recomputation. - [ ] B1.8.a Define immutable raw measurement sets independent of thresholds and release decision. Evidence: measurement persistence schema. - [ ] B1.8.b Define verdict identity, profile/version, exact measurements, thresholds/rules, pass/fail/review/non-pass status, and reasons. Evidence: consistency schema. - [ ] B1.8.c Define human review/waiver identity, authority, scope, rationale, expiry, and prohibited waivers. Evidence: review schema. - [ ] B1.8.d Recompute a new verdict under new policy without mutating prior measurements or verdicts. Evidence: policy-recompute fixture. - [ ] B1.9 Define build template, parameter schema, target, toolchain, dependency lock, environment, resources, gates, and lifecycle. Evidence: schema. - [ ] B1.9.a Define template identity/version/owner/purpose, supported profiles/targets, typed parameters/defaults/constraints, and secrets references. Evidence: template schema. - [ ] B1.9.b Define exact toolchain/container/host SDK/runtime/compiler/ plugin versions, dependency lock/checksums, and environment policy. Evidence: reproducibility schema. - [ ] B1.9.c Define CPU/GPU/memory/storage/license/device/network/resource requirements, capacity class, timeout, checkpoint, and cost model. Evidence: execution schema. - [ ] B1.9.d Define required input/intermediate/output gates, approvals, target validation/read-back, package/signing, and evidence outputs. Evidence: gate contract. - [ ] B1.9.e Define draft/review/approved/deprecated/revoked lifecycle, compatibility windows, impact preview, and immutable historical use. Evidence: lifecycle tests. - [ ] B1.10 Define release candidate and evidence with source revisions, commands, artifacts, checksums, validators, gates, approvals, toolchain, target, and read-back. Evidence: integrity invariants. - [ ] B1.10.a Lock candidate identity to exact source/dependency/template/ configuration/command/artifact revisions and checksums. Evidence: candidate schema. - [ ] B1.10.b Record toolchain/host/worker/environment, validator/profile/ calibration/threshold versions, raw measures, verdicts, and limitations. Evidence: technical evidence schema. - [ ] B1.10.c Record named approvals/waivers, roles, scopes, conditions, expiry, signatures, and staleness dependencies. Evidence: governance schema. - [ ] B1.10.d Record target/package/deployment identity, manifest/signatures, delivery result, and independent read-back measurements/checksums. Evidence: target evidence schema. - [ ] B1.10.e Verify no release evidence can be reused after any locked revision, gate, approval, rights, or target state changes. Evidence: integrity tests. - [ ] B1.11 Define immutable revisions/diffs for layers, dependencies, settings, templates, mappings, and evidence. Evidence: golden fixtures. - [ ] B1.11.a Define canonical serialization, stable identity, parent/base revision, author/time/reason, checksum, and optimistic-concurrency invariants. Evidence: revision schema. - [ ] B1.11.b Define semantic layer and dependency diffs including add/ remove/change/reorder/mute/resolver/version/license effects. Evidence: diff goldens. - [ ] B1.11.c Define settings/template/mapping diffs with defaults, normalization, secret redaction, compatibility, and downstream impact. Evidence: diff goldens. - [ ] B1.11.d Define evidence diffs for measurements, policies, verdicts, approvals, limitations, and target read-back without rewriting history. Evidence: diff goldens. - [ ] B1.12 Define protocol and contract version negotiation. Evidence: version skew and unsupported-client tests. - [ ] B1.12.a Advertise supported protocol/contract/capability versions and constraints for server, gateway, host/plugin, SDK, and consumer. Evidence: negotiation schema. - [ ] B1.12.b Select the highest mutually approved version deterministically and bind it to the session/command/job. Evidence: selection tests. - [ ] B1.12.c Define backward/forward compatibility, optional/unknown fields, capability downgrade, deprecation, and expiry semantics. Evidence: compatibility policy. - [ ] B1.12.d Fail closed with actionable unsupported/incompatible states rather than guessing or silently coercing. Evidence: version-skew suite. - [ ] B1.13 Define session/command audit projections with sensitive argument redaction. Evidence: traceability without secret leakage. - [ ] B1.13.a Define immutable audit events for enrollment, grant, session, command, result, artifact, approval, release, revoke, and emergency action. Evidence: audit schema. - [ ] B1.13.b Record actor/host/tenant/project, action, object/revision, decision, time, correlation, and evidence refs without raw protected payloads. Evidence: trace fixture. - [ ] B1.13.c Apply typed allowlist/redaction/hashing/tokenization to command arguments, paths, URLs, secrets, content, and DCC logs. Evidence: redaction tests. - [ ] B1.13.d Provide role-filtered investigations that reconstruct sequence and causation while preserving compartment boundaries. Evidence: audit journey. - [ ] B1.14 Define SDK and remote-extension consumer compatibility. Evidence: public-contract fixtures. - [ ] B1.14.a Define supported SDK language/version/runtime and remote- extension platform/version matrices. Evidence: consumer registry. - [ ] B1.14.b Define public discovery, enrollment/session, typed command, artifact/job/result, event, error, auth, retry, and cancellation contracts. Evidence: public API spec. - [ ] B1.14.c Define compatibility windows, negotiation, feature detection, generated clients/types, and deprecation behavior. Evidence: version fixtures. - [ ] B1.14.d Compile and run representative external consumers against current and supported prior server versions. Evidence: consumer suite. - [ ] B1.15 Define render job, scene/camera/layer, frame/range, renderer, settings, color/OCIO, output/pass, resource, license, checkpoint, artifact, measurement, and review contracts. Evidence: still/sequence and multi-pass fixtures. - [ ] B1.15.a Define immutable render source scene/USD, camera, layer/variant, frame/range/handles, resolution/aspect, renderer/version, and settings. Evidence: render request schema. - [ ] B1.15.b Define OCIO/config/display/view/look, input/output color spaces, tone/exposure, and color-provenance lock. Evidence: color contract. - [ ] B1.15.c Define beauty/AOV/pass/output naming, format/profile, channels, compression, destination, checksum, and package relationships. Evidence: output schema. - [ ] B1.15.d Define compute/storage/license requirements, chunking, checkpoint/resume, retries, partial frames/passes, cancellation, and cost. Evidence: execution contract. - [ ] B1.15.e Define per-frame/sequence measurements, visual review, approvals, artifact lineage, and read-back for still, sequence, and multi-pass outputs. Evidence: render fixtures. - [ ] B1.16 Define virtual-production stage/session, camera tracking, calibration, lens, LED wall, frustum, genlock, timecode, ICVFX layer, playback, recording, safety, and incident contracts. Evidence: device/clock/fail-safe invariants. - [ ] B1.16.a Define stage/session identity, location, schedule, personnel/ roles, project/shot, device inventory, topology, and operating mode. Evidence: stage schema. - [ ] B1.16.b Define camera tracker/calibration/lens/distortion/focus/zoom, coordinate transforms, uncertainty, validity window, and drift. Evidence: camera fixtures. - [ ] B1.16.c Define LED wall/processors/panels, color/calibration, frustum, ICVFX layers, content versions, playback, and target state. Evidence: display contract. - [ ] B1.16.d Define genlock/timecode/reference clock, sync quality, discontinuity, recording/media, take identity, and read-back. Evidence: clock/recording fixtures. - [ ] B1.16.e Define device-safe command limits, interlocks, emergency stop, degraded/fallback states, incident capture, and restart authority. Evidence: fail-safe invariants. - [ ] B1.17 Define XR target/device, runtime, input, interaction, comfort, performance, spatial asset, entitlement, package, deployment, and validation contracts; define mocap stream/skeleton/retarget/recording and MetaHuman identity/rig/Live Link contracts separately. Evidence: platform-specific fixtures and consent/privacy mapping. - [ ] B1.17.a Define XR target/device/OS/runtime versions, capabilities, entitlement, input/interaction mappings, spatial permissions/assets, and deployment/package identity. Evidence: XR platform schema. - [ ] B1.17.b Define XR frame timing/latency, rendering, memory/thermal, tracking, locomotion/comfort, accessibility, safety, and validation measures. Evidence: XR quality contract. - [ ] B1.17.c Define mocap device/stream protocol, clock, subjects/consent, skeleton/channels, calibration, confidence, retarget mapping, recording, dropout, and lineage. Evidence: mocap schema. - [ ] B1.17.d Define MetaHuman identity/rights, asset/rig/DNA versions, animation/face channels, Live Link source/timecode, Unreal compatibility, and protected-data handling. Evidence: MetaHuman schema. - [ ] B1.17.e Keep XR, mocap, and MetaHuman execution, permissions, quality, release, and evidence independently versioned. Evidence: boundary fixtures. - [ ] B1.18 Define gameplay input/action, save schema, inventory, combat, behavior/AI, navigation, state, test scenario, telemetry, migration, and build contracts. Evidence: versioned runtime/save compatibility and no unsafe arbitrary-script command. - [ ] B1.18.a Define versioned input devices/actions/bindings/contexts, accessibility remapping, network authority, and replayable input fixtures. Evidence: input contract. - [ ] B1.18.b Define save/profile/checkpoint/world-state schema, version, integrity, privacy, migration, rollback, and forward/backward behavior. Evidence: save fixtures. - [ ] B1.18.c Define inventory/economy, combat/damage/abilities, behavior/AI, navigation, quest/state-machine, and deterministic scenario contracts. Evidence: gameplay schemas. - [ ] B1.18.d Define typed test setup/action/assertion/cleanup commands from an allowlist; prohibit arbitrary scripts or console execution. Evidence: command security tests. - [ ] B1.18.e Define bounded gameplay/performance telemetry, expected outcomes, build/package versions, target deployment, and result evidence. Evidence: scenario fixtures. ### B2 — Host enrollment, liveness, sessions, and remote security - [ ] B2.1 Build host enrollment with operator approval and cryptographic identity. Evidence: unapproved host cannot connect. - [ ] B2.1.a Issue a one-time bounded enrollment challenge tied to tenant, environment, expected host, requester, expiry, and nonce. Evidence: challenge tests. - [ ] B2.1.b Collect host/DCC/plugin/platform identity, key proof, attestation, capabilities, owner, and requested scopes without trusting claims. Evidence: enrollment request. - [ ] B2.1.c Verify policy, compatibility, attestation/signatures, duplicate identity, and operator authority before approval. Evidence: review tests. - [ ] B2.1.d Issue environment-bound cryptographic identity and persist approval/rejection/audit; deny every unapproved or replayed request. Evidence: connection negative suite. - [ ] B2.2 Build short-lived mutual authentication and key rotation. Evidence: expired, revoked, replayed, and wrong-environment credentials fail. - [ ] B2.2.a Establish mutual TLS or equivalent proof from enrolled host and environment-specific server identities. Evidence: handshake tests. - [ ] B2.2.b Mint short-lived session credentials with audience, tenant, host, capability scope, issue/expiry, nonce, and key version. Evidence: token inspection. - [ ] B2.2.c Rotate host/server keys with bounded overlap, proof of possession, atomic activation, rollback, and audit. Evidence: rotation journey. - [ ] B2.2.d Revoke credentials/keys immediately and reject expired, replayed, wrong-host/audience/environment, or downgraded authentication. Evidence: adversarial suite. - [ ] B2.3 Build capability/version negotiation. Evidence: unsupported command is rejected before session creation. - [ ] B2.3.a Exchange server/host/plugin protocol and typed capability/version/ limit declarations after authentication. Evidence: negotiation trace. - [ ] B2.3.b Intersect declarations with the approved host compatibility profile and current policy. Evidence: selection tests. - [ ] B2.3.c Bind the negotiated versions/capabilities to the session grant and expose explicit downgraded/unavailable reasons. Evidence: session contract. - [ ] B2.3.d Reject session creation when required versions/capabilities are absent and reject later unnegotiated commands. Evidence: negative tests. - [ ] B2.4 Build liveness, latency, load, DCC state, project state, and maintenance probes. Evidence: health rollup fixtures. - [ ] B2.4.a Collect signed heartbeat sequence/time, round-trip latency, clock skew, process/plugin connectivity, and protocol health. Evidence: liveness fixtures. - [ ] B2.4.b Collect bounded CPU/GPU/memory/storage/license/queue load and capacity without secret/path/content leakage. Evidence: load fixtures. - [ ] B2.4.c Collect typed DCC busy/modal/render/dirty-scene state and active project/workspace/revision compatibility. Evidence: host-state fixtures. - [ ] B2.4.d Collect maintenance/drain/quarantine/update state and freshness. Evidence: maintenance fixtures. - [ ] B2.4.e Compute healthy/degraded/unavailable/incompatible/stale rollups with component reasons and no false healthy state. Evidence: health matrix. - [ ] B2.5 Build session open with scoped project, commands, paths, expiry, resources, and actor. Evidence: least-privilege tests. - [ ] B2.5.a Authenticate the actor and enrolled host, resolve tenant/project/ workspace/purpose, and load current compatibility/health. Evidence: precondition tests. - [ ] B2.5.b Intersect requested commands, virtual paths, objects, targets, resources, duration, and limits with role/policy/host capabilities. Evidence: scope tests. - [ ] B2.5.c Require step-up or approval for sensitive scopes and record exact grant rationale/approver. Evidence: grant journey. - [ ] B2.5.d Open an immutable expiring session with negotiated versions, fencing epoch, actor, scopes, resource reservations, and audit. Evidence: session fixture. - [ ] B2.5.e Prove ungranted property, path, command, project, resource, and time use fails server- and host-side. Evidence: least-privilege suite. - [ ] B2.6 Build heartbeat, reconnect, suspend, resume, drain, expiry, and close. Evidence: clock-controlled session tests. - [ ] B2.6.a Heartbeat with monotonic sequence, observed session epoch, host/ project state, in-flight command refs, and bounded health data. Evidence: heartbeat tests. - [ ] B2.6.b Mark degraded/disconnected after controlled thresholds and fence commands after lease/session expiry. Evidence: clock tests. - [ ] B2.6.c Reconnect through reauthentication, state reconciliation, and same-or-new epoch without duplicate command execution. Evidence: reconnect tests. - [ ] B2.6.d Suspend/resume or drain with explicit admission behavior, in-flight completion/cancellation policy, and deadline. Evidence: lifecycle tests. - [ ] B2.6.e Close or expire idempotently, release reservations/grants, retain audit, and classify late host results. Evidence: terminal-state tests. - [ ] B2.7 Build remote command allowlist with typed schemas and property authorization. Evidence: arbitrary command/argument tests fail. - [ ] B2.7.a Register each command with stable ID/version, supported hosts, typed arguments/results, defaults/bounds, side effects, prerequisites, permissions, and compensation. Evidence: command registry. - [ ] B2.7.b Validate envelope/schema/unknown fields, negotiated capability, host/project/object/path scope, expected revision, and deadline before dispatch. Evidence: validation suite. - [ ] B2.7.c Authorize sensitive argument properties and resulting object/ file mutations independently of command visibility. Evidence: property tests. - [ ] B2.7.d Translate only to a fixed host API/plugin operation; prohibit arbitrary shell, script, eval, console, path, or network execution. Evidence: injection tests. - [ ] B2.7.e Audit normalized redacted arguments, authorization decision, host operation/version, result, and changed revisions. Evidence: audit fixture. - [ ] B2.8 Build safe path mapping and virtual roots. Evidence: traversal, symlink, case collision, UNC/device path, and Unicode tests. - [ ] B2.8.a Configure named virtual roots by tenant/project/host/purpose with local canonical root, read/write policy, formats, quotas, and lifetime. Evidence: root registry. - [ ] B2.8.b Parse and normalize separators, dot segments, percent/Unicode encoding, normalization form, case semantics, drive/UNC/device prefixes, and reserved names. Evidence: path corpus. - [ ] B2.8.c Resolve components without following unauthorized symlinks/ junctions/mounts and verify the final canonical target remains within its root. Evidence: traversal tests. - [ ] B2.8.d Open/create with race-safe primitives, file type/size/permission checks, collision policy, and atomic write/rename. Evidence: TOCTOU tests. - [ ] B2.8.e Return only virtual paths outside the host and redact local user/ secret path components from logs/errors. Evidence: disclosure tests. - [ ] B2.9 Build network destination allowlists for host-side fetches. Evidence: SSRF/DNS-rebinding/redirect tests. - [ ] B2.9.a Define destination profiles by scheme, exact domain, port, path, method, purpose, size/type, TLS policy, credentials, and tenant. Evidence: allowlist schema. - [ ] B2.9.b Resolve DNS and reject loopback, link-local, private, metadata, multicast, reserved, unexpected IP families, and disallowed address changes. Evidence: SSRF fixtures. - [ ] B2.9.c Validate every redirect and connection against the profile, pinning/rechecking resolution to resist DNS rebinding. Evidence: redirect/rebinding tests. - [ ] B2.9.d Bound time, bytes, decompression, responses, retries, and credentials; quarantine fetched content before host use. Evidence: fetch safety suite. - [ ] B2.10 Build command deadlines, cancellation, idempotency, and late-result handling. Evidence: race tests. - [ ] B2.10.a Enforce admission and execution deadlines using synchronized or duration-based clocks and typed expiry states. Evidence: clock tests. - [ ] B2.10.b Deduplicate command IDs/idempotency keys and reject the same key with a different normalized request. Evidence: duplicate tests. - [ ] B2.10.c Propagate cooperative cancellation, host abort, checkpoint/ cleanup, and compensation according to command contract. Evidence: cancellation tests. - [ ] B2.10.d Fence result commit by session/command epoch and classify late output without publishing it as success. Evidence: race suite. - [ ] B2.10.e Reconcile timeout/cancel/result uncertainty through host state and changed-object read-back. Evidence: unknown-outcome journey. - [ ] B2.11 Build bounded output/log streaming with backpressure and redaction. Evidence: oversize and secret-leak tests. - [ ] B2.11.a Define typed progress/log/diagnostic/output chunk envelopes with sequence, command/attempt, time, level, media type, size, and terminal semantics. Evidence: stream schema. - [ ] B2.11.b Enforce per-event/rate/total/buffer/retention/cardinality bounds and spill authorized artifacts rather than unbounded inline data. Evidence: limit tests. - [ ] B2.11.c Apply structured allowlisting and secret/token/path/content/PII redaction at the host before transport and again on ingest. Evidence: redaction suite. - [ ] B2.11.d Implement acknowledgement/backpressure, resumable cursor, duplicate/out-of-order handling, disconnect, and dropped-event markers. Evidence: streaming fault tests. - [ ] B2.12 Build host quarantine and emergency session termination. Evidence: in-flight work enters explicit safe state. - [ ] B2.12.a Authorize and record host quarantine with reason, evidence, scope, effective time, step-up, and optional fleet profile impact. Evidence: control tests. - [ ] B2.12.b Immediately block new authentication/sessions/commands, invalidate credentials/grants, and fence host results. Evidence: quarantine tests. - [ ] B2.12.c Terminate active sessions/commands according to safe-stop contracts and mark jobs/artifacts/releases explicit partial/unknown/ quarantined states. Evidence: in-flight fault test. - [ ] B2.12.d Trace downstream artifacts/builds/releases made by the host and launch impact review/recall where required. Evidence: blast-radius test. - [ ] B2.12.e Require remediation, re-attestation, approval, key rotation, and verification before unquarantine. Evidence: recovery journey. - [ ] B2.13 Build plugin/extension version, signature, and update policy. Evidence: unsigned/downgrade tests. - [ ] B2.13.a Register approved package identity/version, publisher/signing keys, host/platform ranges, files/checksums, permissions, dependencies, and lifecycle. Evidence: package registry. - [ ] B2.13.b Verify signatures, provenance/attestation, checksums, archive/ path safety, malware, dependency lock, and policy before install. Evidence: supply-chain suite. - [ ] B2.13.c Stage, install, activate, health-check, rollback, and report updates atomically without corrupting the host plugin. Evidence: update journey. - [ ] B2.13.d Reject unsigned, tampered, revoked, wrong-host/environment, unapproved downgrade, dependency-confused, or expired packages. Evidence: negative tests. - [ ] B2.13.e Reconcile fleet versions and quarantine vulnerable/incompatible hosts with controlled compatibility windows. Evidence: fleet policy. - [ ] B2.14 Build audited break-glass access. Evidence: step-up, time limit, reason, notification, and review. - [ ] B2.14.a Define eligible incidents, permitted emergency capabilities, prohibited actions, maximum duration, approver/reviewer, and automatic expiry. Evidence: break-glass policy. - [ ] B2.14.b Require strong step-up, incident/ticket, justification, exact host/project/resource scope, and dual approval where required. Evidence: activation tests. - [ ] B2.14.c Mint isolated short-lived grants, visibly label their use, notify security/owners, and record every view/mutation. Evidence: access journey. - [ ] B2.14.d Auto-expire/revoke, terminate dependent sessions, rotate exposed secrets if needed, and require independent post-use review. Evidence: closure tests. - [ ] B2.15 Build allowlisted screen/frame/viewport capture and host-state observation for preview, agent planning, diagnostics, and support with explicit user/session grant, visible capture state, window/region scope, frame/rate/size limits, protected-region redaction, retention, and revoke. Evidence: no hidden desktop surveillance or capture outside the granted host/project context. - [ ] B2.15.a Define distinct preview, planning, diagnostic, and support capture purposes with allowed host windows/viewports, fields, viewers, processing, retention, and prohibited use. Evidence: purpose policy. - [ ] B2.15.b Require an explicit current user/session grant for exact application/window/viewport/region, duration, frame/rate/size, and destination. Evidence: consent tests. - [ ] B2.15.c Display persistent host-side capture indicator, scope, consumer, and stop control that the remote operator cannot hide. Evidence: host UI test. - [ ] B2.15.d Capture only allowlisted pixels/state; mask protected windows/ regions, notifications, credentials, other projects, and desktop surroundings before egress. Evidence: redaction fixtures. - [ ] B2.15.e Enforce bandwidth/frame/rate/resolution/time bounds, secure transport/storage, viewer authorization, watermark, and audit. Evidence: limit/access suite. - [ ] B2.15.f Revoke or expire immediately, stop collection/streaming, reconcile buffered frames, apply retention/deletion, and prove no capture outside scope. Evidence: surveillance negative test. ### B3 — Ingest, OpenUSD interchange, conversion, and dependency handling - [ ] B3.1 Build asset intake from upload, artifact store, DCC pull, project reference, and previous release. Evidence: provenance per path. - [ ] B3.1.a Define a common intake manifest for actor, tenant/project, purpose, source kind, source identity/revision, expected format/profile, rights/license, and idempotency. Evidence: manifest schema. - [ ] B3.1.b Implement bounded resumable upload and existing artifact-store reference with checksum/authorization validation. Evidence: intake tests. - [ ] B3.1.c Implement DCC pull through an enrolled scoped session and project reference through an approved resolver context. Evidence: host/ resolver tests. - [ ] B3.1.d Implement previous-release selection by immutable manifest/ checksum without mutating or treating it as source authority. Evidence: release-input test. - [ ] B3.1.e Normalize all paths into one quarantined source artifact while retaining path-specific actor/command/source provenance. Evidence: lineage matrix. - [ ] B3.2 Quarantine and scan files, archives, USD packages, scripts, plugins, and metadata. Evidence: malicious corpus. - [ ] B3.2.a Store intake bytes in an isolated non-executable quarantine with immutable checksum, type claim, size limits, and no resolver/network access. Evidence: quarantine tests. - [ ] B3.2.b Safely enumerate archives/packages with entry/count/depth/ratio/ total-size bounds and reject traversal, links, devices, collisions, and nested bombs. Evidence: archive corpus. - [ ] B3.2.c Detect actual media/file types and scan content, scripts, plugins/binaries, macros, metadata, and known malware/suspicious constructs. Evidence: scanner matrix. - [ ] B3.2.d Parse USD in a sandbox with resolver disabled or constrained and inspect layers, assets, schemas, paths, code-bearing fields, and external references. Evidence: malicious USD corpus. - [ ] B3.2.e Emit signed per-file findings and promote only policy-approved bytes; preserve rejected/quarantined state and reviewer workflow. Evidence: promotion tests. - [ ] B3.3 Detect format, version, units, axes, color, dependencies, and encryption. Evidence: fixture matrix. - [ ] B3.3.a Determine format/profile/version from bytes and structure, compare extensions/MIME/claims, and report ambiguity or unsupported variants. Evidence: detection fixtures. - [ ] B3.3.b Detect scene/asset units, scale, up/forward axes, handedness, coordinate basis, time codes, and frame rates with source locations. Evidence: transform metadata fixtures. - [ ] B3.3.c Detect embedded/declared color spaces, OCIO context, texture interpretations, and missing/ambiguous color metadata. Evidence: color fixtures. - [ ] B3.3.d Enumerate embedded/external dependencies and resolver/path requirements without fetching them. Evidence: dependency fixtures. - [ ] B3.3.e Detect container/file encryption, compression, password/key requirements, and unsupported opaque regions; never guess secrets. Evidence: encrypted fixtures. - [ ] B3.4 Build canonical OpenUSD stage creation with pinned profile and schema set. Evidence: deterministic golden. - [ ] B3.4.a Select exact OpenUSD runtime/profile/schema/plugin versions, resolver policy, meters-per-unit, axes, time codes, and layer strategy. Evidence: stage plan. - [ ] B3.4.b Create root/session/sublayers with deterministic identifiers, ordering, default prim, metadata, namespaces, and canonical formatting. Evidence: stage golden. - [ ] B3.4.c Author only allowed schemas/APIs and record source-to-prim/ property mapping plus unsupported data. Evidence: schema validation. - [ ] B3.4.d Serialize deterministically where promised and attribute unavoidable nondeterministic fields explicitly. Evidence: repeated- build checksum test. - [ ] B3.4.e Reopen with an independent/pinned reader and verify composition, metadata, checksums, and provenance. Evidence: read-back test. - [ ] B3.5 Build layer, variant set, reference, payload, inherit, specialize, and composition inspection. Evidence: composition fixtures. - [ ] B3.5.a Enumerate layer stack, identifiers, roles, permissions, offsets, muting, sublayers, edit target, and resolver context. Evidence: layer fixture. - [ ] B3.5.b Enumerate variant sets/selections/opinions and compare declared, authored, and composed selections. Evidence: variant fixtures. - [ ] B3.5.c Enumerate references/payloads with target prim, layer offsets, load state, resolution, and dependency identity. Evidence: arc fixtures. - [ ] B3.5.d Enumerate inherits/specializes and composition strength/order, cycles, conflicts, blocked values, and provenance. Evidence: composition fixtures. - [ ] B3.5.e Provide composed-value-to-authoring-layer/source tracing and a semantic non-graph representation. Evidence: inspection journey. - [ ] B3.6 Build resolver context and dependency capture without environment- implicit paths. Evidence: portable package test. - [ ] B3.6.a Define versioned resolver-context inputs, virtual roots, search/ mapping rules, credentials references, case semantics, and network policy. Evidence: resolver schema. - [ ] B3.6.b Resolve every dependency under the explicit context and record requested path, canonical identity/version/checksum, selected rule, and resolution diagnostics. Evidence: resolver trace. - [ ] B3.6.c Reject undeclared environment variables, current directories, user-home paths, ambient search paths, or network fallback. Evidence: hermeticity tests. - [ ] B3.6.d Capture or package permitted dependencies with rewritten virtual/ relative refs and license/rights/provenance. Evidence: dependency manifest. - [ ] B3.6.e Resolve and open the package on a clean environment/OS fixture with no original path context. Evidence: portable package test. - [ ] B3.7 Build missing, cyclic, duplicate, ambiguous, and external dependency detection. Evidence: broken-package corpus. - [ ] B3.7.a Build a typed dependency graph from authored and discovered refs, including layer/prim/property source and optional/load behavior. Evidence: graph fixture. - [ ] B3.7.b Detect missing/unreadable/version-mismatched/checksum-mismatched dependencies with exact referrers. Evidence: missing fixtures. - [ ] B3.7.c Detect cycles and composition/resolver recursion with cycle path and affected objects. Evidence: cyclic fixtures. - [ ] B3.7.d Detect duplicate logical identities/content, case/Unicode path collisions, and ambiguous multi-candidate resolution. Evidence: ambiguity fixtures. - [ ] B3.7.e Classify external network/local absolute/out-of-root dependencies and enforce capture, exception, or rejection policy. Evidence: external dependency tests. - [ ] B3.8 Build geometry/topology conversion and preservation. Evidence: known mesh round-trips. - [ ] B3.8.a Inventory source primitives, points, faces/indices, orientation, normals/tangents, subdivision, creases, holes, UV/color/primvars, and instances. Evidence: source measure report. - [ ] B3.8.b Map each supported geometry/topology construct to canonical USD with explicit interpolation, indexing, precision, and naming. Evidence: mapping registry. - [ ] B3.8.c Triangulate/tessellate/bake/approximate only when target profile requires it and record source-to-output correspondence/loss. Evidence: conversion fixtures. - [ ] B3.8.d Measure counts, bounds, topology equivalence, orientation, normals, UVs/primvars, subdivision, instances, and geometric deviation. Evidence: independently known values. - [ ] B3.8.e Round-trip representative and adversarial meshes through every supported target adapter. Evidence: mesh compatibility matrix. - [ ] B3.9 Build transform, unit, axis, pivot, hierarchy, and instancing conversion. Evidence: independently derived fixtures. - [ ] B3.9.a Parse local/world transforms, operation order, pivots, inherit/ reset behavior, hierarchy, units, axes/handedness, and instance prototypes. Evidence: source fixtures. - [ ] B3.9.b Compute explicit basis/unit conversions and operation mappings with precision, decomposition, negative scale, shear, and rotation-order policy. Evidence: analytical goldens. - [ ] B3.9.c Preserve hierarchy and instancing where supported or disclose flattening/baking/prototype splitting and dependency impact. Evidence: loss fixtures. - [ ] B3.9.d Compare local/world transforms, pivots, bounds, hierarchy, and instance identity after target read-back. Evidence: round-trip matrix. - [ ] B3.10 Build material, texture, shader, color-space, UDIM, and fallback mapping, including MaterialX where supported. Evidence: per-target compatibility fixtures. - [ ] B3.10.a Inventory material graphs, shader nodes/versions/connections/ parameters, assignments/subsets, textures/samplers/UDIMs, and color metadata. Evidence: material manifest. - [ ] B3.10.b Map supported native constructs to pinned USD Shade/MaterialX profiles with explicit units, color transforms, and texture resolver paths. Evidence: mapping fixtures. - [ ] B3.10.c Detect unsupported nodes/features and preview substitute, approximate, bake, fallback, or fail choices with visible semantic/ visual loss. Evidence: loss decisions. - [ ] B3.10.d Package textures/UDIM tiles with checksums, dedupe, rights/ license, path portability, and missing-tile diagnostics. Evidence: texture tests. - [ ] B3.10.e Read back in each target and compare graph semantics, assignments, parameters, texture/color interpretation, and reference renders where calibrated. Evidence: compatibility matrix. - [ ] B3.11 Build skeleton, skinning, blend-shape, animation, constraint, and camera conversion. Evidence: round-trip fixtures. - [ ] B3.11.a Convert skeleton hierarchy/names/rest/bind transforms and skinning influences/weights with unit/axis/precision and limit policy. Evidence: rig fixtures. - [ ] B3.11.b Convert blend-shape targets/in-betweens/normals/weights and animation channels, interpolation, layers, clips, events, and time base. Evidence: deformation/animation fixtures. - [ ] B3.11.c Map constraints/controllers/drivers to supported target constructs or preview explicit bake/approximation/unsupported behavior. Evidence: constraint fixtures. - [ ] B3.11.d Convert camera projection, aperture/sensor, focal length, lens/ clipping/focus, transforms, and animation. Evidence: camera goldens. - [ ] B3.11.e Read back and measure hierarchy, rest/bind, deformation, weights, curves/timing, constraints/bakes, and camera framing per target. Evidence: round-trip matrix. - [ ] B3.12 Build metadata, naming, custom property, and namespace policy. Evidence: loss/rename diagnostics. - [ ] B3.12.a Define canonical identifier, display-name, path, namespace, casing, Unicode, reserved word, length, collision, and stability rules. Evidence: naming spec. - [ ] B3.12.b Classify standard, custom, sensitive, internal, target-specific, code-bearing, and unsupported metadata/properties with type and retention rules. Evidence: metadata registry. - [ ] B3.12.c Map names/properties deterministically with source/output lookup, collision resolution, type/range conversion, and reverse mapping. Evidence: mapping tests. - [ ] B3.12.d Strip/redact/quarantine prohibited metadata and report every rename, drop, coercion, or namespace change. Evidence: diagnostics. - [ ] B3.12.e Verify target read-back and mapping reversibility within the declared profile. Evidence: metadata round-trip. - [ ] B3.13 Build target adapters for ratified DCCs/engines through public bridge interfaces. Evidence: no target-specific logic in generic core. - [ ] B3.13.a Define the public adapter interface for capability discovery, plan, import/export, inspect, validate, cancel, result, and read-back. Evidence: adapter contract. - [ ] B3.13.b Implement per-host adapters against typed bridge commands and exact host/plugin/version profiles. Evidence: adapter fixtures. - [ ] B3.13.c Keep host-specific formats, defaults, paths, command mappings, limitations, and workarounds inside the adapter package. Evidence: dependency boundary test. - [ ] B3.13.d Run a shared conformance suite plus host-specific known-value, unsupported, authorization, cancellation, and failure cases. Evidence: adapter matrix. - [ ] B3.13.e Reject incompatible/unavailable adapter selection rather than falling through generic assumptions. Evidence: selection tests. - [ ] B3.14 Run `usdchecker` plus pinned custom validators. Evidence: exact report and validator versions. - [ ] B3.14.a Pin `usdchecker`/OpenUSD and every custom validator code/config/ dependency version with checksum and supported profile. Evidence: validator registry. - [ ] B3.14.b Run validators in a sandbox against exact stage/package bytes and explicit resolver context. Evidence: execution manifest. - [ ] B3.14.c Parse raw output into typed findings while retaining the unmodified bounded report artifact. Evidence: parser goldens. - [ ] B3.14.d Distinguish tool unavailable/crash/timeout/invalid input from a valid validation failure. Evidence: state tests. - [ ] B3.14.e Persist validator versions/config/checksums/findings and link them to policy verdict/release evidence. Evidence: provenance query. - [ ] B3.15 Build incremental conversion and cache eligibility. Evidence: cache key covers source, dependencies, adapter, toolchain, policy, and target. - [ ] B3.15.a Compute semantic change sets from source layer/property/ dependency revisions and identify affected conversion stages/targets. Evidence: invalidation fixtures. - [ ] B3.15.b Define cache keys from exact source/dependency bytes, resolver context, adapter/toolchain/profile/config/policy/target/environment versions. Evidence: key coverage tests. - [ ] B3.15.c Reuse only checksum-valid, compatible, authorized, non- quarantined entries whose stage supports incremental execution. Evidence: eligibility tests. - [ ] B3.15.d Recompute affected outputs, preserve unaffected immutable refs, and rebuild aggregate manifests/validation. Evidence: incremental conversion tests. - [ ] B3.15.e Quarantine corrupt or conflicting entries and prove a full rebuild matches declared deterministic output. Evidence: cache fault test. - [ ] B3.16 Build conversion plan preview with expected losses, substitutions, unsupported features, cost, host, and duration. Evidence: user must accept material losses. - [ ] B3.16.a Resolve exact source/dependencies, target/profile/adapter/ toolchain, compatible host/resources, policy, and current measurements. Evidence: plan inputs. - [ ] B3.16.b Produce ordered stages with per-stage inputs/outputs/cache, host/resource/license, estimated duration/cost, and failure/cancel semantics. Evidence: plan schema. - [ ] B3.16.c Enumerate preserved, renamed, converted, substituted, approximated, baked, dropped, and unsupported features with affected objects/properties. Evidence: semantic loss report. - [ ] B3.16.d Preview validation/review/release consequences and safer target/ configuration alternatives. Evidence: decision view. - [ ] B3.16.e Require explicit authorized acceptance of the exact material losses and stale the acceptance when inputs/plan/policy change. Evidence: acceptance tests. - [ ] B3.17 Build durable interchange jobs with checkpoint, retry, cancel, and resume. Evidence: host/worker loss test. - [ ] B3.17.a Persist job/DAG/stage/attempt state, exact revisions/plan, requirements, reservations, idempotency, deadlines, and lineage. Evidence: job persistence tests. - [ ] B3.17.b Lease stages to compatible hosts/workers with fencing, heartbeat, bounded progress, and duplicate-delivery tolerance. Evidence: lease tests. - [ ] B3.17.c Checkpoint resumable inputs/outputs/tool state atomically and validate before reuse. Evidence: checkpoint fixtures. - [ ] B3.17.d Retry only classified safe stages under budget/backoff; retain attempts and dead-letter permanent/exhausted failures. Evidence: retry suite. - [ ] B3.17.e Cancel cooperatively and reconcile partial outputs/host side effects/late results explicitly. Evidence: cancel tests. - [ ] B3.17.f Resume after service/worker/host loss from the last valid fence without duplicate mutations or hidden gaps. Evidence: recovery journey. - [ ] B3.18 Build deterministic or explicitly non-deterministic replay classification. Evidence: environment dependencies recorded. - [ ] B3.18.a Classify each stage deterministic, conditionally deterministic, or nondeterministic with sources of time/randomness/threading/host/ renderer/external/environment variation. Evidence: stage registry. - [ ] B3.18.b Record all reproducibility inputs: bytes/checksums, versions, configs, seeds, locale/time zone, hardware/runtime, environment, and external dependency snapshots. Evidence: replay manifest. - [ ] B3.18.c Re-execute deterministic stages and compare canonical bytes/ semantic measurements to zero or declared tolerance. Evidence: replay tests. - [ ] B3.18.d For nondeterministic stages, disclose variation, retain candidates/selection, and compare bounded quality/integrity invariants. Evidence: nondeterministic replay report. ### B4 — Cross-DCC fidelity, validation, preview, and diff - [ ] B4.1 Define versioned fidelity profiles by source, target, asset type, and release purpose. Evidence: complete profile registry. - [ ] B4.1.a Define profile schema for source/target formats, host/tool versions, asset type, release purpose, applicable measures, tolerances, validators, review/waiver rules, and limitations. Evidence: schema. - [ ] B4.1.b Register every supported source-target-asset-purpose combination with independently owned thresholds and evidence. Evidence: coverage matrix. - [ ] B4.1.c Version, approve, activate, deprecate, retire, and migrate profiles without rewriting historical results. Evidence: lifecycle tests. - [ ] B4.1.d Reject validation/release when no exact current compatible profile exists. Evidence: missing-profile tests. - [ ] B4.2 Implement geometry position, normal, topology, UV, and bounds measurements. Evidence: known fixtures. - [ ] B4.2.a Align source/target geometry by stable mapping, instance, coordinate/unit basis, precision, and comparable primitive scope. Evidence: alignment fixtures. - [ ] B4.2.b Measure point/surface position distance, normal/tangent angular deviation, and object/world bounds error. Evidence: analytical goldens. - [ ] B4.2.c Compare topology counts/connectivity/orientation/subdivision/ holes and distinguish declared tessellation or remeshing. Evidence: topology fixtures. - [ ] B4.2.d Compare UV/primvar sets, interpolation/indexing, seams, orientation, range, and per-element deviation. Evidence: UV fixtures. - [ ] B4.2.e Report exact objects/elements and raw values before profile verdict. Evidence: diagnostic tests. - [ ] B4.3 Implement transform, unit, axis, pivot, hierarchy, and instance measurements. Evidence: known fixtures. - [ ] B4.3.a Resolve source/target mapping and normalize declared unit/axis/ handedness/time basis without hiding conversion errors. Evidence: normalization tests. - [ ] B4.3.b Measure local/world translation, rotation, scale, shear, operation order, and pivot deviations. Evidence: analytical fixtures. - [ ] B4.3.c Compare hierarchy parentage/order, reset/inherit behavior, visibility, purpose, and instance/prototype identity/count. Evidence: scene fixtures. - [ ] B4.3.d Detect unmapped, duplicated, flattened, expanded, or ambiguous nodes/instances and report raw impact. Evidence: structure tests. - [ ] B4.4 Implement material parameter, texture, color-space, shader, and render-difference measurements. Evidence: target fixture corpus. - [ ] B4.4.a Compare material assignments, shader/node types/versions, connections, parameter types/values/units, and unsupported mappings. Evidence: graph fixtures. - [ ] B4.4.b Compare texture identity/checksum, channels, resolution, sampler/wrap/filter, UDIM tiles, paths, and missing/substituted assets. Evidence: texture fixtures. - [ ] B4.4.c Compare declared/decoded color spaces, OCIO transforms, linear/ display interpretation, alpha, and precision. Evidence: color goldens. - [ ] B4.4.d Render under pinned scene/camera/light/renderer/OCIO/settings and compute calibrated pixel/perceptual differences with masks. Evidence: target corpus. - [ ] B4.4.e Separate structural/material loss from renderer nondeterminism and threshold verdict. Evidence: diagnostic report. - [ ] B4.5 Implement skeleton hierarchy, skin weight, bind pose, blend shape, and deformation measurements. Evidence: rig pairs. - [ ] B4.5.a Map source/target joints and compare hierarchy, names/aliases, rest/bind transforms, inverse binds, units/axes, and required bones. Evidence: skeleton fixtures. - [ ] B4.5.b Compare per-vertex joint influences/weights, normalization, truncation/remapping, and weighted deformation impact. Evidence: skinning goldens. - [ ] B4.5.c Compare blend-shape targets/in-betweens/deltas/normals, assignments, weights, ranges, and combination behavior. Evidence: blend-shape fixtures. - [ ] B4.5.d Evaluate deformed geometry under a pinned representative pose/ expression corpus and report per-vertex/surface error. Evidence: rig pair report. - [ ] B4.6 Implement animation curve, key, timing, interpolation, root motion, and event measurements. Evidence: animation pairs. - [ ] B4.6.a Align clips/tracks/channels by mapping, time codes, rates, ranges, offsets, loops, layers, and coordinate basis. Evidence: alignment fixtures. - [ ] B4.6.b Compare key times/values/tangents/weights/interpolation, resampling, infinity/extrapolation, and baked versus authored behavior. Evidence: curve goldens. - [ ] B4.6.c Measure sampled position/rotation/scale and derivative error over time with discontinuity and precision handling. Evidence: sample fixtures. - [ ] B4.6.d Compare root trajectory/orientation, contacts, markers/events, clip metadata, duration, and loop seams. Evidence: motion pairs. - [ ] B4.6.e Report exact channels/ranges and declared bake/loss separately from verdict. Evidence: animation diagnostics. - [ ] B4.7 Implement camera, light, scene, variant, metadata, and dependency preservation measurements. Evidence: scene fixtures. - [ ] B4.7.a Compare camera projection, filmback/aperture, focal/lens/ clipping/focus, transform, framing, and animation. Evidence: camera fixtures. - [ ] B4.7.b Compare light type, transform, intensity/exposure, color/ temperature, shape, shadow, linking, and unsupported attributes. Evidence: light fixtures. - [ ] B4.7.c Compare scene hierarchy, purpose/visibility, collections, variants/selections, layer composition, and default state. Evidence: scene fixtures. - [ ] B4.7.d Compare governed metadata/custom properties/namespaces with rename/coercion/drop diagnostics. Evidence: metadata fixtures. - [ ] B4.7.e Compare dependency identities/versions/checksums/resolution, optionality, packaging, and license/rights propagation. Evidence: dependency fixtures. - [ ] B4.8 Implement target build/import/runtime smoke validation. Evidence: asset opens and loads in supported target version. - [ ] B4.8.a Provision the exact supported target host/runtime/toolchain/ plugin version and isolated project fixture. Evidence: environment manifest. - [ ] B4.8.b Import/open the exact artifact/package through the public adapter and capture warnings/errors, duration, and created object refs. Evidence: import trace. - [ ] B4.8.c Build/cook/package where required and launch/load in the target runtime with bounded health/crash/log checks. Evidence: runtime trace. - [ ] B4.8.d Inspect expected objects, dependencies, materials, animation, scripts/assets, and entry scene/state after load. Evidence: smoke assertions. - [ ] B4.8.e Classify unavailable/incompatible versus asset/build/runtime failure and clean the fixture. Evidence: state matrix. - [ ] B4.9 Implement round-trip comparison through source→USD→target→USD where supported. Evidence: target matrix. - [ ] B4.9.a Lock source bytes/revision, source adapter, USD profile, target adapter/host, mappings, configuration, and declared loss. Evidence: round-trip manifest. - [ ] B4.9.b Convert source to canonical USD, import/write target state, and export/read back to a separately identified canonical USD stage. Evidence: execution trace. - [ ] B4.9.c Compare source, first USD, target inspection, and returned USD across every applicable typed measure. Evidence: four-way report. - [ ] B4.9.d Attribute deviations to source conversion, target import, target export, declared loss, or nondeterminism where possible. Evidence: diagnostic attribution. - [ ] B4.9.e Publish supported/unavailable/unsupported pair cells and prevent one target's evidence from satisfying another. Evidence: target matrix. - [ ] B4.10 Persist raw measures separately from threshold verdicts. Evidence: policy recomputation. - [ ] B4.10.a Persist immutable measure set with exact source/target revisions, algorithm/version/config, units/basis, raw values, ranges, uncertainty, and artifact report. Evidence: measure schema. - [ ] B4.10.b Persist verdict with exact profile/version, thresholds/rules, measurement refs, status/reasons, freshness, and reviewer/waiver refs. Evidence: verdict schema. - [ ] B4.10.c Re-evaluate unchanged measures under new policy and retain both historical and current verdicts. Evidence: recomputation test. - [ ] B4.11 Version adapters, DCC/engine versions, validators, profiles, thresholds, render settings, and corpus. Evidence: result provenance. - [ ] B4.11.a Register immutable version/checksum/compatibility records for every adapter, host/plugin, validator, profile, threshold set, render configuration, and fixture corpus. Evidence: registries. - [ ] B4.11.b Persist the complete version tuple, runtime/environment, and selected fixture/ground-truth revisions on results. Evidence: provenance query. - [ ] B4.11.c Detect revoked, stale, expired, unsupported, or mutually incompatible dependencies and enumerate affected evidence/releases. Evidence: impact tests. - [ ] B4.12 Add unavailable-host, unsupported-feature, low-confidence, insufficient-comparison, and validator-failure states. Evidence: none renders as pass. - [ ] B4.12.a Define typed non-pass statuses, reason codes, diagnostic fields, retryability, owner, permitted action, and release effect. Evidence: state contract. - [ ] B4.12.b Emit unavailable-host and validator-failure for infrastructure/ tool inability rather than asset quality failure. Evidence: outage tests. - [ ] B4.12.c Emit unsupported-feature, insufficient-comparison, and low- confidence with exact affected features/measurements. Evidence: applicability tests. - [ ] B4.12.d Prove API, UI, automation, waiver, and release paths never coerce a non-pass state to pass. Evidence: fail-closed suite. - [ ] B4.13 Build representation preview with synchronized source/USD/target camera and selection. Evidence: accessible comparison. - [ ] B4.13.a Load authorized immutable source/USD/target representations and resolve comparable object mappings, cameras, units/axes, and time. Evidence: preview contract. - [ ] B4.13.b Synchronize camera, framing, transport/time, variant/layer, object/component selection, isolation, and overlays across views. Evidence: interaction tests. - [ ] B4.13.c Support side-by-side, overlay/difference, A/B, and target switching while retaining exact revision/profile identity. Evidence: comparison journey. - [ ] B4.13.d Provide semantic hierarchy/property/measurement/difference tables and keyboard controls equivalent to visual selection. Evidence: accessibility parity. - [ ] B4.13.e Surface unavailable renderer/host, loading, stale mapping, partial assets, and unsupported previews honestly. Evidence: state matrix. - [ ] B4.14 Build layer/dependency/metadata/measurement diffs with semantic tables. Evidence: non-visual parity. - [ ] B4.14.a Select exact comparable revisions and compute stable path/ identity mappings with ambiguity surfaced. Evidence: diff setup tests. - [ ] B4.14.b Diff layer stack/opinions/composition/variants and dependency add/remove/change/resolve/license state. Evidence: structural fixtures. - [ ] B4.14.c Diff names/namespaces/metadata/custom properties and typed raw measurement sets/verdicts. Evidence: property fixtures. - [ ] B4.14.d Present filterable add/remove/change/move/rename/conflict/ unavailable rows with before/after, source, impact, and exact location. Evidence: semantic table. - [ ] B4.14.e Synchronize table focus with visual object/property/layer and prove every visual difference is represented non-visually. Evidence: parity journey. - [ ] B4.15 Build image/render diff with calibrated settings and explicit nondeterminism. Evidence: known render corpus. - [ ] B4.15.a Lock scene/artifact/camera/frame, renderer/version, hardware, OCIO, resolution, sampling, lights, random seeds, and output transforms. Evidence: render manifest. - [ ] B4.15.b Render source/reference and target with deterministic settings where supported and record stochastic/runtime variation otherwise. Evidence: repeated-render study. - [ ] B4.15.c Align images and compute raw absolute/relative/color/perceptual/ edge/region metrics with masks and uncertainty. Evidence: analytical image fixtures. - [ ] B4.15.d Calibrate tolerances against the known corpus and distinguish structural conversion loss from renderer noise. Evidence: calibration report. - [ ] B4.15.e Provide accessible image descriptions/region tables and exact settings/limitations with verdict. Evidence: comparison report. - [ ] B4.16 Build exception/waiver with exact loss, scope, target, expiry, and approver. Evidence: incompatible release cannot reuse waiver. - [ ] B4.16.a Define waivable and prohibited gates/losses plus required role, independent approver, rationale, mitigation, expiry, and evidence. Evidence: waiver policy. - [ ] B4.16.b Bind a request to exact source/target/artifact/profile/measure/ verdict/loss/target-purpose revisions and bounded objects/features. Evidence: waiver schema. - [ ] B4.16.c Review, approve/reject/condition, sign, audit, notify, and surface the exception in preview/package/release evidence. Evidence: workflow test. - [ ] B4.16.d Invalidate on any material input, target/version, measurement, policy, scope, purpose, or expiry change. Evidence: reuse negative test. ### B5 — Artifact library, builds, evidence, and release - [ ] B5.1 Build artifact library search by asset type, representation, version, source/target, rights, quality, lineage, status, project, and owner. Evidence: permission-aware query tests. - [ ] B5.1.a Define the searchable projection and approved fields from authoritative artifact/representation/rights/quality/lineage/lifecycle records. Evidence: index contract. - [ ] B5.1.b Enforce tenant/project/object/property/rights authorization before query, facets, counts, suggestions, snippets, and previews. Evidence: inference tests. - [ ] B5.1.c Implement exact/full-text search, filters, facets, sort, pagination, and version/source-target/dependency queries. Evidence: query fixtures. - [ ] B5.1.d Reconcile index state after new version, supersession, quarantine, revoke, retirement, restore, and deletion. Evidence: lifecycle tests. - [ ] B5.2 Build exact and structural dedupe with non-destructive merge decisions. Evidence: retained aliases and lineage. - [ ] B5.2.a Detect exact duplicates from normalized bytes/checksums while preserving distinct ownership, rights, and source records. Evidence: exact fixtures. - [ ] B5.2.b Detect structural candidates from versioned hierarchy/geometry/ material/rig/dependency signatures with compatibility and uncertainty. Evidence: structural fixtures. - [ ] B5.2.c Compare representations, versions, rights/licenses, quality, lineage, dependencies, releases, and exact differences. Evidence: review journey. - [ ] B5.2.d Record keep-both, relate, alias, or consolidate-reference decisions without deleting immutable artifacts or provenance. Evidence: non-destructive tests. - [ ] B5.3 Build artifact version, branch, supersession, deprecation, quarantine, retirement, and restore. Evidence: lifecycle tests. - [ ] B5.3.a Define immutable versions, mutable branch pointers, parent/ ancestry, merge provenance, semantic diff, and optimistic concurrency. Evidence: version fixtures. - [ ] B5.3.b Define distinct superseded/deprecated/quarantined/retired/ deleted/restored effects on visibility, selection, execution, release, dependencies, and retention. Evidence: state machine. - [ ] B5.3.c Authorize transitions with reason, effective time, replacement, impact preview, audit, and downstream propagation. Evidence: transition tests. - [ ] B5.3.d Restore only eligible retained bytes/metadata into a new current revision/state and revalidate dependencies/rights/quality. Evidence: restore journey. - [ ] B5.4 Build collections, kits, dependencies, related assets, and release sets through versioned curation. Evidence: bundle golden. - [ ] B5.4.a Define typed versioned curation operations for membership, ordering, roles, kits, dependency pins, related edges, metadata, and release-set state. Evidence: bundle schema. - [ ] B5.4.b Validate refs/versions, cycles, compatibility, rights/license, quality, lifecycle, permissions, and release completeness. Evidence: preflight tests. - [ ] B5.4.c Review and apply an exact bundle atomically/idempotently with concurrency, per-operation result, audit, and compensation. Evidence: bundle golden. - [ ] B5.4.d Read back collection/kit/dependency/release projections and prohibit direct production writes outside the applier. Evidence: authority tests. - [ ] B5.5 Build build-template registry, typed parameters, lifecycle, and compatibility. Evidence: template tests. - [ ] B5.5.a Register immutable template versions with owner/purpose, target/ profile ranges, toolchain/dependency locks, typed parameters, resources, stages, gates, and output contracts. Evidence: registry tests. - [ ] B5.5.b Validate defaults/bounds/conditional parameters, secret refs, command allowlists, host/target compatibility, and reproducibility. Evidence: schema fixtures. - [ ] B5.5.c Review, approve, activate, deprecate, supersede, revoke, and migrate templates with immutable historical use. Evidence: lifecycle journey. - [ ] B5.5.d Compute affected builds/releases and block selection of incompatible, revoked, or stale templates. Evidence: impact tests. - [ ] B5.6 Build batch/build scheduling with host, worker, license, storage, render, and reviewer capacity. Evidence: reservation conflict tests. - [ ] B5.6.a Model resource pools/capabilities/locality, calendars/ maintenance, quotas, licenses/tokens, storage/egress, reviewers, and time zones. Evidence: capacity schema. - [ ] B5.6.b Estimate exact per-stage demand, duration, dependencies, affinity, deadlines, cost, and alternative compatible resources. Evidence: scheduling inputs. - [ ] B5.6.c Create tentative holds and committed fenced reservations transactionally across all required resource types. Evidence: reservation tests. - [ ] B5.6.d Detect overlap, version/capability, quota, license, storage, dependency, setup, and reviewer conflicts. Evidence: conflict matrix. - [ ] B5.6.e Reschedule/cancel/expire/release reservations and reconcile queued/running work without leaks or double allocation. Evidence: lifecycle tests. - [ ] B5.7 Build batch preview with eligibility, losses, cost, capacity, dependencies, and gates. Evidence: mixed-result journey. - [ ] B5.7.a Resolve a stable artifact/query snapshot, requested template/ parameters/targets, caller authority, and current policy. Evidence: batch contract. - [ ] B5.7.b Evaluate per-item version/rights/lifecycle/dependency/format/ host/profile/gate compatibility and expected semantic loss. Evidence: eligibility fixtures. - [ ] B5.7.c Estimate per-item and aggregate stage/resource/license/storage/ duration/cost/capacity with uncertainty. Evidence: estimate tests. - [ ] B5.7.d Present included/skipped/blocked/warning items with exact reasons, dependencies, losses, gates, and schedule options. Evidence: preview journey. - [ ] B5.7.e Execute only an explicitly approved exact preview and report per-item progress/partial/failure/compensation. Evidence: mixed-result test. - [ ] B5.8 Build release candidate locked to exact artifact, layer, dependency, template, toolchain, host, adapter, validator, gate, and approval versions. Evidence: mutation invalidation. - [ ] B5.8.a Resolve and lock the full transitive artifact/layer/dependency/ mapping/template/parameter graph with versions/checksums. Evidence: candidate manifest. - [ ] B5.8.b Lock toolchain/environment/host/plugin/adapter/validator/profile/ threshold/render/build target versions. Evidence: execution lock. - [ ] B5.8.c Lock raw measurements/verdicts, rights/licenses, security/SBOM, approvals/waivers, limitations, and target plan. Evidence: assurance lock. - [ ] B5.8.d Detect any changed, stale, revoked, expired, missing, quarantined, or incompatible lock dependency and invalidate readiness. Evidence: mutation tests. - [ ] B5.8.e Rebuild a new candidate rather than updating a locked one. Evidence: immutability test. - [ ] B5.9 Build tamper-evident release-evidence assembly. Evidence: deterministic hash and signature validation. - [ ] B5.9.a Define canonical manifest ordering/serialization and include candidate locks, artifacts, commands, builds, gates, approvals, limitations, targets, and read-back. Evidence: manifest schema. - [ ] B5.9.b Resolve every evidence ref to immutable bytes/checksum or signed external record and reject missing/ambiguous refs. Evidence: assembly tests. - [ ] B5.9.c Build deterministically, compute manifest/Merkle or equivalent integrity hashes, sign with authorized release key, and timestamp. Evidence: repeated-build hash test. - [ ] B5.9.d Independently verify schema, refs/checksums, signature/key status, authorization, and candidate identity. Evidence: verifier suite. - [ ] B5.9.e Preserve superseded/revoked evidence and publish status without allowing artifact replacement under the same ref. Evidence: tamper tests. - [ ] B5.10 Build target export/deploy with plan, execute, read-back, and compensate. Evidence: partial failure recovery. - [ ] B5.10.a Build a read-only target plan with exact candidate, destination, files/objects/actions, prerequisites, permissions, conflicts, cost, downtime, and rollback/compensation. Evidence: plan fixture. - [ ] B5.10.b Revalidate candidate/target/credentials/capacity immediately before execution and authorize the exact plan revision. Evidence: stale-plan tests. - [ ] B5.10.c Execute typed idempotent steps with checkpoints, target revisions, bounded logs, progress, cancel, and immutable attempt audit. Evidence: deployment tests. - [ ] B5.10.d Read back target objects/files/versions/checksums/state through an independent inspection path. Evidence: verification report. - [ ] B5.10.e On partial failure, stop safely and retry/roll back/compensate per step while exposing unresolved target state. Evidence: recovery journey. - [ ] B5.11 Build target-specific post-deploy smoke and fidelity checks. Evidence: transport success alone cannot release. - [ ] B5.11.a Select the exact target/version/profile and its required import/ load/build/runtime/scenario/fidelity check registry. Evidence: target test plan. - [ ] B5.11.b Execute target-native open/import/load and dependency/ configuration/entry-state smoke checks. Evidence: smoke results. - [ ] B5.11.c Execute target-specific structural, semantic, visual/runtime, performance, and security checks with raw measurements. Evidence: fidelity results. - [ ] B5.11.d Distinguish unavailable infrastructure from deployment or artifact failure and prevent transport-only success from release. Evidence: state tests. - [ ] B5.11.e Attach exact target read-back and current verdicts to release evidence. Evidence: evidence linkage. - [ ] B5.12 Build rollback, supersession, revoke, quarantine, and recall. Evidence: dependent projects and targets reconcile. - [ ] B5.12.a Define distinct source/library/build/release/target/consumer effects, authorities, prerequisites, and terminal criteria for each action. Evidence: lifecycle policy. - [ ] B5.12.b Traverse exact artifacts/versions/dependencies/builds/packages/ deployments/projects/targets/consumers and preview blast radius. Evidence: impact graph. - [ ] B5.12.c Execute the authorized saga with fencing, checkpoints, per- dependency result, retry/compensation, notifications, and audit. Evidence: propagation tests. - [ ] B5.12.d Verify target and dependent-project state by read-back and keep partial/unreachable recipients unresolved. Evidence: reconciliation report. - [ ] B5.12.e Restore or supersede only through a new validated candidate and approval path. Evidence: recovery tests. - [ ] B5.13 Build artifact retention and purge with dependency/legal-hold preview. Evidence: referenced artifacts remain. - [ ] B5.13.a Calculate retention/expiry eligibility from artifact class, project/rights/license, release/evidence policy, deletion request, and legal hold. Evidence: policy tests. - [ ] B5.13.b Traverse versions, branches, dependencies, packages, releases, targets, caches, backups, and audit/evidence refs before purge. Evidence: dependency preview. - [ ] B5.13.c Classify deletable, retained, tombstoned, anonymized, blocked, and separately approved objects with exact reasons. Evidence: purge plan. - [ ] B5.13.d Execute authorized bounded purge with checkpoints, per-store confirmation, immutable tombstone/evidence, and retry. Evidence: purge journey. - [ ] B5.13.e Prove referenced or legally held bytes remain and unreferenced eligible bytes become inaccessible across active stores/caches. Evidence: read-back tests. - [ ] B5.14 Build release notifications and audit export with safe redaction. Evidence: authorization tests. - [ ] B5.14.a Define notification event types, minimal payloads, recipients/ subscriptions, severity, locale, dedupe, and escalation. Evidence: notification contract. - [ ] B5.14.b Deliver release/failed/revoked/recalled/partial state through governed channels with retries, preference/policy handling, and audit. Evidence: delivery tests. - [ ] B5.14.c Define audit export scope, query filters, exact time/object refs, schema/version, pagination/chunking, signature, retention, and purpose. Evidence: export contract. - [ ] B5.14.d Authorize object/property visibility and redact secrets, credentials, local paths, content, sensitive metadata, and unauthorized existence. Evidence: redaction matrix. - [ ] B5.14.e Verify recipient/download identity, expiry, checksums, and reproducible query manifest. Evidence: authorization tests. - [ ] B5.15 Build UI-governed asset, representation, schema, material, rig, animation, target, build, fidelity, and catalog taxonomies over code-owned floors. Evidence: versioned review, alias, deprecation, and migration journey. - [ ] B5.15.a Define independent taxonomy schemas, owners, code-owned invariants/floors, allowed relations, and consumers. Evidence: registry. - [ ] B5.15.b Author draft terms with stable IDs, localized labels/ definitions, aliases, mappings, constraints, and migration notes. Evidence: authoring tests. - [ ] B5.15.c Review, approve, publish, deprecate, supersede, retire, and restore versions without reinterpreting historical records. Evidence: lifecycle journey. - [ ] B5.15.d Reject collisions, cycles, incompatible mappings, floor violations, and referenced-term deletion. Evidence: validation suite. - [ ] B5.15.e Migrate refs only through previewed, authorized, resumable jobs with per-record result and rollback/compensation. Evidence: migration tests. - [ ] B5.16 Build taxonomy/profile impact over templates, sessions, artifacts, validators, search, builds, targets, and releases. Evidence: read-only preview precedes an authorized migration job. - [ ] B5.16.a Build a complete versioned reference index from taxonomy/profile concepts to templates, active sessions, artifacts, validators, search, builds, targets, releases, docs, and clients. Evidence: reference audit. - [ ] B5.16.b Preview changed eligibility/mapping/validation/search/runtime/ release behavior, incompatible refs, active-operation risk, and cost without mutation. Evidence: impact report. - [ ] B5.16.c Require authorized approval of exact source/destination versions and preview revision before scheduling. Evidence: stale-preview test. - [ ] B5.16.d Execute/checkpoint/resume/retry/partially fail/compensate the migration and read back all projections. Evidence: migration journey. ### B5A — Specialized production, runtime, and automation operations - [ ] B5A.1 Complete per-host typed command registries for Blender, Maya, Houdini, 3ds Max, Unreal, Unity, Godot, and DaVinci, including selection, scene/entity, asset/import/export, material, rig/animation, camera/light, render/build, undo/transaction, diagnostics, capability, and version behavior. Evidence: no generic "bridge works" proof substitutes for command-by-command host conformance. - [ ] B5A.1.a Define the shared command-definition/conformance schema with exact host/plugin versions, typed inputs/results, prerequisites, permissions, side effects, undo/compensation, limits, and diagnostics. Evidence: registry schema. - [ ] B5A.1.b Complete and validate Blender and Maya command registries across every named command category. Evidence: independent host matrices. - [ ] B5A.1.c Complete and validate Houdini and 3ds Max command registries across every named command category. Evidence: independent host matrices. - [ ] B5A.1.d Complete and validate Unreal and Unity command registries across every named command category. Evidence: independent host matrices. - [ ] B5A.1.e Complete and validate Godot and DaVinci command registries across applicable command categories with explicit unsupported cells. Evidence: independent host matrices. - [ ] B5A.1.f Test each host-command-version row for success, invalid input, unsupported capability, authorization, stale revision, idempotency, cancellation, compensation, crash/reconnect, and audit. Evidence: command-by-command conformance. - [ ] B5A.1.g Prohibit generic bridge health from satisfying any untested command row. Evidence: release coverage gate. - [ ] B5A.2 Build GPU render-queue operations for scene/version intake, renderer/profile, frame ranges, passes, dependencies, color, resources, licenses, priority/fairness, preview, cost, progress, pause/cancel/retry, checkpoint, output QC, review, and publish. Evidence: partial-frame and worker/host-loss recovery. - [ ] B5A.2.a Lock scene/camera/layer/variant/dependency revisions and select renderer/version/profile, frame/range/handles, passes, outputs, OCIO, and destination. Evidence: render manifest. - [ ] B5A.2.b Validate dependencies, rights, renderer/plugin compatibility, target/output rules, and pre-render scene/color gates. Evidence: preflight suite. - [ ] B5A.2.c Estimate and preview frames/tasks, GPU/CPU/memory/storage/ bandwidth/licenses, priority/fairness, schedule, duration, and cost. Evidence: queue plan. - [ ] B5A.2.d Reserve capacity and dispatch idempotent frame/pass tasks with fenced leases, checkpoint/resume, bounded retries, and backpressure. Evidence: scheduler tests. - [ ] B5A.2.e Stream bounded progress/thumbnails/logs and support authorized pause/resume/cancel/retry/reprioritize without hidden late output. Evidence: operations journey. - [ ] B5A.2.f Aggregate ordered frames/passes, detect missing/duplicate/corrupt output, verify color/naming/format/checksums, and run calibrated QC. Evidence: output-quality suite. - [ ] B5A.2.g Review/approve/publish exact outputs with artifact lineage and target read-back. Evidence: release journey. - [ ] B5A.2.h Recover worker/host/GPU/license/storage loss and partial frames/ passes without false completion. Evidence: fault drill. - [ ] B5A.3 Build gameplay-system operations for input/action maps, save/load schemas and migrations, inventory/items, combat/damage, AI behavior/ navigation, validation scenarios, target builds, runtime telemetry, and rollback. Evidence: deterministic or explicitly stochastic engine tests for every supported target/version. - [ ] B5A.3.a Register versioned gameplay schemas/configuration for input/ actions, saves, inventory/items, combat/damage, behavior/AI, navigation, and state with one authoritative source. Evidence: gameplay registry. - [ ] B5A.3.b Author changes through typed commands with exact project/object revisions, semantic diff, validation, authorization, and undo/ compensation. Evidence: mutation tests. - [ ] B5A.3.c Implement save upgrade/downgrade/rollback fixtures and validate integrity, compatibility, data preservation, and failure recovery. Evidence: save migration matrix. - [ ] B5A.3.d Define allowlisted deterministic test scenarios with seeded or explicitly stochastic setup, actions, timing, assertions, cleanup, and telemetry. Evidence: scenario schema. - [ ] B5A.3.e Build/package/deploy every supported engine target/version and execute input, save, inventory, combat, AI, navigation, and state scenarios independently. Evidence: target matrix. - [ ] B5A.3.f Capture bounded runtime correctness/performance telemetry and target read-back tied to source/build revisions. Evidence: result manifests. - [ ] B5A.3.g Roll back build/config/save migrations and prove prior target state remains viable. Evidence: rollback drill. - [ ] B5A.4 Build virtual-production operations for camera/lens tracking, calibration, LED-wall configuration, ICVFX layers/frusta, genlock/ timecode, playback, take/recording, health, latency, color, failover, emergency stop, and dailies handoff. Evidence: stage-safe simulation and supported-device/host matrix. - [ ] B5A.4.a Enroll and map stage, camera/tracker/lens, wall/processor, render nodes, clocks, recording, and safety devices to supported profiles. Evidence: device inventory. - [ ] B5A.4.b Calibrate camera/tracker/lens/world/wall/color systems with versioned measurements, uncertainty, validity, drift, and approval. Evidence: calibration suite. - [ ] B5A.4.c Configure and preview exact content/layer/variant, camera, frustum, wall/color, genlock/timecode, playback, recording, and resource plan. Evidence: session plan. - [ ] B5A.4.d Start/supervise/stop playback and takes with synchronized state, health/latency/color/sync warnings, bounded controls, and immutable take identity. Evidence: supervision journey. - [ ] B5A.4.e Enforce device-safe interlocks, failover/fallback, emergency stop, late command fencing, and incident evidence. Evidence: stage-safe simulation. - [ ] B5A.4.f Package recorded media/metadata/calibration/timecode/content lineage and hand off dailies through governed editorial seams. Evidence: dailies read-back. - [ ] B5A.4.g Validate each supported device/host/version combination independently with unavailable cells explicit. Evidence: matrix. - [ ] B5A.5 Build XR operations for shared capabilities plus visionOS, Meta Quest, and every ratified platform: project settings, spatial assets, interactions/input, comfort/accessibility, device/runtime compatibility, performance budgets, package/sign, install, launch, smoke, telemetry, and rollback. Evidence: platform-specific validation; no inherited desktop build proof. - [ ] B5A.5.a Register each XR platform/device/OS/runtime/SDK profile, capabilities, entitlements, project/package/signing requirements, performance/comfort/accessibility budgets, and test devices. Evidence: XR registry. - [ ] B5A.5.b Validate and configure project settings, render path, permissions, spatial assets/anchors, input/actions, interaction/locomotion, and accessibility per exact profile. Evidence: project tests. - [ ] B5A.5.c Preview device/runtime compatibility, unsupported features, entitlements, assets, build settings, secrets/signing, cost, and target limitations. Evidence: deployment plan. - [ ] B5A.5.d Build/sign/package, install, launch, and inspect exact versions on visionOS, Meta Quest, and every other ratified platform separately. Evidence: platform journeys. - [ ] B5A.5.e Run platform-native input/tracking/spatial/interaction, comfort, accessibility, frame-time/memory/thermal, lifecycle, and offline smoke scenarios. Evidence: validation matrix. - [ ] B5A.5.f Collect bounded telemetry/read-back and roll back/uninstall/ restore prior target state. Evidence: rollback tests. - [ ] B5A.5.g Prohibit desktop or another XR platform's evidence from satisfying an untested profile. Evidence: independence gate. - [ ] B5A.6 Build motion-capture operations for vendor streams, clocks, skeleton mapping, subject/consent refs, retargeting, recording/playback, format conversion, animation export, health, dropouts, and Aja handoff. Evidence: consent/provenance and live network fault journeys. - [ ] B5A.6.a Register vendor/device/firmware/protocol/plugin profiles, modalities, skeleton/channel schemas, clock/sync, capability, and network/security requirements. Evidence: mocap registry. - [ ] B5A.6.b Enroll session/devices/subjects with current consent/purpose, operator, location, calibration, skeleton mapping, target rig, and Aja handoff scope. Evidence: admissibility tests. - [ ] B5A.6.c Connect and monitor signed streams, clock skew, packet order/ loss, latency, confidence, health, dropouts, reconnect, and modality degradation. Evidence: live supervision suite. - [ ] B5A.6.d Record immutable raw and normalized streams with timecode, subject-safe refs, configuration, mappings, checksums, and interruption markers; support synchronized playback. Evidence: recording tests. - [ ] B5A.6.e Retarget/convert/export through versioned mappings and formats with loss preview, quality/consent gates, provenance, and read-back. Evidence: conversion journey. - [ ] B5A.6.f Handoff to Aja only through its canonical contract with idempotency, health/degraded states, ownership, and recall propagation. Evidence: seam tests. - [ ] B5A.6.g Inject network/device/clock/host loss, consent revocation, and late packets; prove explicit partial state and safe recovery. Evidence: fault journeys. - [ ] B5A.7 Build MetaHuman operations for mesh/identity import, face rig, body/customization, skeleton/material compatibility, Live Link, animation, rights/likeness, versioning, performance, package, and Unreal validation. Evidence: identity/consent and supported-Unreal-version gates. - [ ] B5A.7.a Register supported Unreal/MetaHuman/plugin/DNA/rig/Live Link versions and exact host/tool compatibility. Evidence: profile registry. - [ ] B5A.7.b Admit mesh/identity/reference sources only with current rights, likeness/subject consent, intended use, retention, and protected-data controls. Evidence: identity gate. - [ ] B5A.7.c Import/create immutable MetaHuman identity, mesh, DNA, face/body rig, skeleton, materials, clothing/customization, and dependency versions with lineage. Evidence: asset manifest. - [ ] B5A.7.d Validate geometry/deformation, skeleton/animation/blend shapes, material/clothing, target platform, and current Unreal compatibility. Evidence: compatibility suite. - [ ] B5A.7.e Configure/supervise Live Link identity/source/subjects, channels/timecode, confidence, recording, animation transfer, dropouts, and revoke. Evidence: live journey. - [ ] B5A.7.f Measure editor/runtime frame time, memory, LOD, animation/ rendering quality, and target budgets. Evidence: performance report. - [ ] B5A.7.g Package/build/open/read back in every supported Unreal version and propagate rights/consent/version quarantine or recall. Evidence: release gates. - [ ] B5A.8 Build DaVinci operations for project/timeline exchange, media/ proxy, edit/conform, color/OCIO, markers, audio, render/deliver, relink, version, and round-trip diagnostics. Evidence: locked timeline and media-hash fixtures. - [ ] B5A.8.a Register supported Resolve/version/platform/project/timeline/ interchange/color/audio/render profiles and plugin capabilities. Evidence: compatibility registry. - [ ] B5A.8.b Lock project/timeline/bin/clip/media revisions, hashes, timecode/rates, proxies, edit decisions, markers, audio, and OCIO/color context before exchange. Evidence: timeline manifest. - [ ] B5A.8.c Import/export/conform through typed commands with mapping, handles, transitions/effects, speed changes, multicam, grades, audio, and unsupported-loss preview. Evidence: conform fixtures. - [ ] B5A.8.d Relink originals/proxies by approved identity/hash/path mapping and reject ambiguous, missing, or changed media. Evidence: relink tests. - [ ] B5A.8.e Render/deliver exact timeline/ranges/presets with color/audio/ subtitle/data-level metadata, checksums, review, and read-back. Evidence: delivery journey. - [ ] B5A.8.f Round-trip and compare timeline structure, timing, media hashes, markers, color/OCIO, audio, and declared loss. Evidence: diagnostic matrix. - [ ] B5A.9 Build Houdini operations for HDA definition/version/parameter, dependency, cook/cache, geometry/USD, simulation, output, farm execution, diagnostics, and round-trip. Evidence: deterministic seed/toolchain or explicit nondeterminism and license/capacity handling. - [ ] B5A.9.a Register Houdini/Engine/plugin/renderer/HDA versions, platforms, licenses, farm/runtime compatibility, and supported node/format capabilities. Evidence: profile registry. - [ ] B5A.9.b Ingest and verify HDA definition/library/version/signature, typed parameters/defaults/expressions, dependencies, permissions, and source provenance. Evidence: HDA contract. - [ ] B5A.9.c Plan cook/simulation with exact input geometry/USD, parameter revision, frames, seeds, caches, environment/toolchain, resources, licenses, outputs, cost, and nondeterminism. Evidence: cook plan. - [ ] B5A.9.d Execute locally or on farm with fenced work items, checkpoint/ cache, progress, pause/cancel/retry, worker loss, and license backpressure. Evidence: execution tests. - [ ] B5A.9.e Validate output geometry/USD/simulation fields, dependencies, frames, checksums, known values, diagnostics, and declared variation. Evidence: output QC. - [ ] B5A.9.f Round-trip supported inputs/outputs and prove deterministic replay by checksum/measure or document bounded nondeterminism. Evidence: replay report. - [ ] B5A.10 Build audio/video asset operations for ingest, transcode, proxy, color/audio metadata, sync/timecode, renditions, engine/DCC attachment, review, package, and target validation. Evidence: A/V fidelity and rights lineage survive conversions. - [ ] B5A.10.a Ingest immutable A/V bytes with type/profile, checksum, source, rights/license/consent, streams, timecode, language, and provenance. Evidence: intake tests. - [ ] B5A.10.b Inspect codec/container/profile, resolution/rate/color/HDR, audio channels/rate/loudness/layout, captions/metadata, duration, and corruption. Evidence: media report. - [ ] B5A.10.c Plan and execute versioned transcode/proxy/rendition operations with exact tools/config, sync/timecode policy, color/audio transforms, loss, resources, and lineage. Evidence: conversion fixtures. - [ ] B5A.10.d Attach exact renditions to engine/DCC scene/timeline/assets through portable dependencies and typed commands. Evidence: attachment tests. - [ ] B5A.10.e Review synchronized picture/audio/captions/timecode and raw fidelity measurements with accessible alternatives. Evidence: review journey. - [ ] B5A.10.f Package and read back in each target, verifying bytes/streams/ metadata/sync/color/audio and rights lineage. Evidence: target matrix. - [ ] B5A.11 Build automatic cross-domain ingestion and lore-to-engine/ text-to-3D compilation for Yemaya, Isis, Aja, Hathor, and other ratified producers through public contracts. Evidence: source entities, generated ingredients, consent/rights, compiler/toolchain, mapping decisions, artifacts, and target read-back remain traceable. - [ ] B5A.11.a Register each producer contract/version/capability, authoritative source entities/revisions, artifact types, rights/consent/canon fields, events, and ownership boundary. Evidence: producer matrix. - [ ] B5A.11.b Admit signed authorized immutable manifests idempotently and reject stale, revoked, unsupported, cross-tenant, or incomplete inputs. Evidence: intake contract tests. - [ ] B5A.11.c Normalize source entities and generated ingredients into versioned intermediate/target mappings with explicit alternatives, omissions, defaults, and human decisions. Evidence: mapping records. - [ ] B5A.11.d Compile through pinned compiler/toolchain/templates/adapters/ models with seeds/config/environment, staged outputs, validation, and deterministic or disclosed-nondeterministic lineage. Evidence: compilation trace. - [ ] B5A.11.e Package/deploy and read back target entities/assets/state while retaining source IDs/revisions, canon, rights/consent, generated regions, mappings, and artifact checksums. Evidence: target journey. - [ ] B5A.11.f Propagate producer correction/revocation/recall and reconcile every compiled derivative/target. Evidence: downstream closure test. - [ ] B5A.12 Build governed agent/MCP remote-control planning with natural-language intent translated into typed allowlisted commands, exact target/revision, dry-run diff, risk/cost/blast radius, required approval, least-privilege session, step execution, stop conditions, and immutable tool-call evidence. Evidence: there is no raw shell or unreviewed autonomous destructive path. - [ ] B5A.12.a Define supported agent/MCP identities, clients, model/tool versions, scopes, tenants, budgets, data policy, and prohibited capabilities. Evidence: agent policy. - [ ] B5A.12.b Parse intent into an immutable structured goal, assumptions, exact target/object/revision, constraints, success criteria, and uncertainty; require clarification on material ambiguity. Evidence: intent tests. - [ ] B5A.12.c Compile only to versioned typed allowlisted commands with explicit dependencies, expected revisions, permissions, idempotency, deadlines, compensation, and no shell/eval escape. Evidence: planner contract. - [ ] B5A.12.d Dry-run every step and present semantic diff, affected objects/ paths, fidelity/security/release risk, cost/spend, capacity, blast radius, irreversible effects, and alternatives. Evidence: plan preview. - [ ] B5A.12.e Determine required human approvals/step-up/dual control and bind them to the exact immutable plan revision. Evidence: approval tests. - [ ] B5A.12.f Open a time/resource/command/object/path-bounded least- privilege host session and revalidate preconditions before each step. Evidence: grant tests. - [ ] B5A.12.g Execute sequential/parallel steps under declared dependencies, budgets, stop conditions, live status, cancellation, fencing, and human redirect checkpoints. Evidence: execution journey. - [ ] B5A.12.h Persist intent, plan/revisions, model/tool versions, approvals, normalized tool calls/results, diffs, costs, decisions, and final read- back with redaction. Evidence: immutable audit. - [ ] B5A.13 Build agent pause, redirect, cancel, budget/spend kill, organization policy, host quarantine, replay, and partial-result reconciliation. Evidence: agents cannot waive fidelity/security/release gates or disguise a failed/partial command as complete. - [ ] B5A.13.a Define control authority and semantics for pause/resume, redirect/replan, cancel, spend kill, policy stop, and host quarantine. Evidence: control state machine. - [ ] B5A.13.b Enforce organization/tenant/project/model/tool/host/data/ network/time/token/cost policies on plan admission and before each step. Evidence: policy tests. - [ ] B5A.13.c Pause at safe boundaries, redirect only through a new diff/ risk/approval plan revision, and cancel with typed compensation/unknown outcomes. Evidence: intervention tests. - [ ] B5A.13.d Stop dispatch immediately on budget/spend limit or quarantine, fence late results, release reservations, and surface incurred cost/ side effects. Evidence: kill-switch tests. - [ ] B5A.13.e Replay only eligible idempotent steps from locked evidence and require new approval when inputs/policy/risk changed. Evidence: replay tests. - [ ] B5A.13.f Reconcile every step/target by read-back and report succeeded, failed, cancelled, skipped, compensated, partial, or unknown separately. Evidence: partial-result journey. - [ ] B5A.13.g Enforce fidelity/security/rights/release gates outside agent authority and reject attempts to waive or relabel them. Evidence: adversarial suite. - [ ] B5A.14 Complete package-builder and export operations for engine/DCC/XR/ VP targets, native dependencies, plugins, content, configuration, licenses, SBOM, provenance, signatures, install/upgrade/uninstall, target smoke, and rollback. Evidence: reproducible release-evidence bundle per supported target. - [ ] B5A.14.a Register target-specific package formats/layouts, toolchains, native/runtime dependencies, plugins, content/config, permissions, signing/notarization, install lifecycle, and validators. Evidence: target profiles. - [ ] B5A.14.b Resolve and lock exact source artifacts, generated/native dependencies, plugins, configs, licenses, rights, target, toolchain, and build environment. Evidence: dependency manifest. - [ ] B5A.14.c Scan/validate components and generate normalized licenses/ notices, SBOM, vulnerability results, provenance attestations, and policy verdicts. Evidence: supply-chain bundle. - [ ] B5A.14.d Build/package reproducibly where supported, compute per-file/ package checksums, sign/notarize, and independently verify signatures. Evidence: reproducibility test. - [ ] B5A.14.e Install fresh, upgrade supported prior versions, preserve/ migrate state, repair, uninstall cleanly, and handle dependency/ permission failures. Evidence: lifecycle matrix. - [ ] B5A.14.f Launch/open and run target-specific smoke/fidelity/performance/ security checks with read-back. Evidence: target journey. - [ ] B5A.14.g Roll back failed install/upgrade/release and prove prior target viability with no orphaned partial state. Evidence: rollback drill. - [ ] B5A.14.h Assemble one immutable release-evidence bundle per exact target profile/version; prohibit inherited proof. Evidence: coverage gate. - [ ] B5A.15 Complete event-handler/publisher operations for asset, session, command, interchange, render, build, deployment, runtime, and recall events with schema/version registry, subscriptions, replay, dead letter, redaction, and consumer status. Evidence: cross-domain event conformance and no duplicate side effects. - [ ] B5A.15.a Register versioned minimal event schemas with stable event/ aggregate IDs, revisions, ordering key, time, tenant, trace/causation, data classification, and compatibility. Evidence: event registry. - [ ] B5A.15.b Publish asset/session/command/interchange/render/build/ deployment/runtime/recall events transactionally from authoritative state with no protected payload. Evidence: outbox tests. - [ ] B5A.15.c Create authorized subscriptions with event/filter/tenant scope, endpoint/topic, secret, delivery ordering, rate, retention, and lifecycle. Evidence: subscription tests. - [ ] B5A.15.d Sign and deliver with backoff, replay protection, idempotency, bounded payload/logging, secret rotation, and explicit consumer acknowledgement/status. Evidence: delivery suite. - [ ] B5A.15.e Dead-letter exhausted/invalid events with diagnostics and authorize bounded replay by exact range/version while preserving event identity. Evidence: replay journey. - [ ] B5A.15.f Reconcile consumer projections and prove duplicates/reordering/ retries do not duplicate commands, builds, deployments, releases, or recalls. Evidence: conformance matrix. - [ ] B5A.16 Complete TypeScript, Python, C++, CLI, remote-extension, and host plugin developer surfaces for capability discovery, auth/session, commands, assets, jobs, events, examples, diagnostics, compatibility, versioning, and deprecation. Evidence: generated public contracts and external-client conformance. - [ ] B5A.16.a Generate shared schemas/types and implement consistent endpoint, authentication, session, version negotiation, timeout/retry, idempotency, error, logging/redaction, and telemetry foundations. Evidence: core parity tests. - [ ] B5A.16.b Implement capability/format/host discovery and auth/enrollment/ session lifecycle across TypeScript, Python, C++, CLI, remote extension, and host plugin. Evidence: discovery/session matrix. - [ ] B5A.16.c Implement typed command plan/execute/status/cancel/result, artifact transfer, job/batch, validation/release, and event subscription across applicable surfaces. Evidence: operation matrix. - [ ] B5A.16.d Provide executable examples for connect, inspect, interchange, build/render, release/read-back, failure recovery, and revoke without embedded secrets or unsafe commands. Evidence: example tests. - [ ] B5A.16.e Provide bounded diagnostics, support bundle, compatibility inspection, feature detection, and honest unsupported/degraded states. Evidence: diagnostic tests. - [ ] B5A.16.f Publish versions/changelogs/migration guides/deprecation notices and enforce compatibility windows in clients/servers. Evidence: lifecycle tests. - [ ] B5A.16.g Run external conformance clients for every supported language/ surface and compare observable behavior against generated contracts. Evidence: public-client report. ### B6 — Persistence, APIs, fleet, workers, and integration - [ ] B6.1 Decide authoritative stores for hosts, sessions, commands, jobs, artifacts, checks, templates, builds, and releases. Evidence: ownership ADR. - [ ] B6.1.a Inventory current databases, artifact/evidence stores, indexes, caches, queues, logs, files, and target state for every named entity. Evidence: storage map. - [ ] B6.1.b Assign one authoritative store/owner per entity/property plus projections, consistency, retention, mutation, and recovery boundaries. Evidence: ownership matrix. - [ ] B6.1.c Resolve duplicate/shadow authorities, especially artifact bytes/ metadata and release evidence, with migration/compatibility plan. Evidence: decision record. - [ ] B6.1.d Trace complete lifecycle and downstream reconciliation for each authority. Evidence: approved ADR. - [ ] B6.2 Add missing schemas and safe migrations without shadowing artifact store or release-evidence data. Evidence: rehearsal. - [ ] B6.2.a Specify explicit normalized tables/columns/types, keys, constraints, indexes, tenancy, state invariants, audit/outbox refs, and external artifact/evidence refs. Evidence: schema review. - [ ] B6.2.b Write additive expand migrations and bounded resumable backfills safe under concurrent service/host traffic. Evidence: migration tests. - [ ] B6.2.c Operate old/new versions through explicit translation or dual behavior without copying authoritative artifact/evidence bytes into shadow stores. Evidence: compatibility suite. - [ ] B6.2.d Rehearse production-size upgrade, backfill, lock/latency impact, interruption, rollback/roll-forward, and contract cleanup. Evidence: rehearsal report. - [ ] B6.3 Implement immutable artifacts/checksums and transaction-bound metadata/audit/outbox writes. Evidence: rollback tests. - [ ] B6.3.a Stage artifact bytes, verify size/type/security/checksum, and atomically promote a content-addressed immutable ref. Evidence: blob tests. - [ ] B6.3.b Persist metadata/version/dependency/provenance/lifecycle records with exact artifact refs and prohibit ref content replacement. Evidence: immutability tests. - [ ] B6.3.c Write state mutation, immutable audit event, and transactional outbox event in one database transaction. Evidence: atomicity tests. - [ ] B6.3.d Reconcile staged/promoted orphan bytes and outbox retries after rollback/crash without phantom metadata or duplicate side effects. Evidence: fault tests. - [ ] B6.3.e Independently rehash artifact bytes at validation/release/read- back boundaries. Evidence: corruption test. - [ ] B6.4 Implement host/session/command APIs with mutual auth, idempotency, authorization, deadline, and audit. Evidence: contract suite. - [ ] B6.4.a Implement enrollment/host identity, capability/health, maintenance/drain/quarantine, and revoke endpoints with mutual authentication. Evidence: host API tests. - [ ] B6.4.b Implement session open/heartbeat/reconnect/suspend/resume/close/ terminate endpoints with scoped grants and fencing epochs. Evidence: session API tests. - [ ] B6.4.c Implement typed command preview/submit/status/stream/cancel/ reconcile endpoints against the command registry. Evidence: command API tests. - [ ] B6.4.d Enforce tenant/actor/host/object/property/path/capability authorization, expected revision, idempotency, and deadlines on every path. Evidence: negative matrix. - [ ] B6.4.e Persist redacted audit/outbox events and filter lists/errors/ expansions so unauthorized existence cannot leak. Evidence: contract suite. - [ ] B6.5 Implement interchange/job/check/build/release APIs with optimistic concurrency. Evidence: stale revision tests. - [ ] B6.5.a Implement interchange plan/create/configure/run/status/rerun/ cancel/result endpoints with immutable job/DAG revisions. Evidence: interchange contracts. - [ ] B6.5.b Implement measurement/check/verdict/review/waiver endpoints with raw-result separation and freshness. Evidence: check contracts. - [ ] B6.5.c Implement template/build preview/run/status/cancel/artifact and release candidate/evidence/approve/deploy/recall endpoints. Evidence: build/release contracts. - [ ] B6.5.d Require expected revision/ETag and idempotency on mutations and return typed conflict/stale/partial/unavailable errors. Evidence: concurrency suite. - [ ] B6.5.e Authorize object/property/target/approval authority and emit transactional audit/outbox state. Evidence: security tests. - [ ] B6.6 Implement remote gateway backpressure, connection limits, and circuit breakers. Evidence: load/fault tests. - [ ] B6.6.a Define per-environment/tenant/host/IP/session limits for handshakes, connections, streams, commands, bytes, rates, buffers, and idle/duration. Evidence: gateway policy. - [ ] B6.6.b Enforce bounded admission queues, token/leaky-bucket limits, prioritization, fair sharing, and explicit retry-after/degraded states. Evidence: load tests. - [ ] B6.6.c Propagate streaming backpressure end-to-end and terminate abusive or non-reading peers without unbounded memory. Evidence: slow-peer tests. - [ ] B6.6.d Trip half-open/closed circuit breakers by dependency/host/profile with jittered recovery and no cross-tenant cascade. Evidence: fault tests. - [ ] B6.6.e Expose bounded saturation/rejection/breaker telemetry and preserve in-flight command reconciliation. Evidence: overload drill. - [ ] B6.7 Implement worker/host capability scheduling and anti-starvation. Evidence: queue tests. - [ ] B6.7.a Persist exact work requirements for host/DCC/plugin/tool/model/ target versions, capabilities, resources/licenses, locality, deadlines, affinity, and safety scope. Evidence: requirement schema. - [ ] B6.7.b Match only live compatible enrolled workers/hosts and reserve CPU/GPU/memory/storage/license/session capacity atomically. Evidence: matching tests. - [ ] B6.7.c Apply tenant/class weights, priorities, aging, quotas, concurrency, reservations, and starvation bounds. Evidence: fairness policy. - [ ] B6.7.d Dispatch with fenced lease/heartbeat and reconcile loss, capability change, maintenance, quarantine, or late completion. Evidence: lifecycle tests. - [ ] B6.7.e Prove urgent work progresses without starving ordinary work and incompatible work never dispatches. Evidence: queue report. - [ ] B6.8 Implement artifact upload/download with resumable transfer, checksum, range, authorization, and egress limits. Evidence: interruption and abuse tests. - [ ] B6.8.a Create an authorized transfer session bound to tenant/project, artifact/version or upload intent, size/type/checksum, purpose, expiry, rate/egress quota, and idempotency. Evidence: transfer schema. - [ ] B6.8.b Upload numbered checksum-protected chunks with overlap/gap/order/ duplicate handling, bounded storage, expiry, and resume cursor. Evidence: upload interruption tests. - [ ] B6.8.c Assemble, rehash, scan, and atomically promote only exact complete content; clean abandoned/invalid sessions. Evidence: completion tests. - [ ] B6.8.d Download authorized immutable ranges/chunks with signed short- lived grants, conditional revision/checksum, bandwidth/egress limits, and resume. Evidence: download tests. - [ ] B6.8.e Reject cross-tenant refs, enumeration, range abuse, checksum/ size/type mismatch, replay, quota bypass, and revoked artifacts. Evidence: abuse suite. - [ ] B6.9 Implement permission-aware artifact, host, command, and release search. Evidence: secrets/paths/unreleased names do not leak. - [ ] B6.9.a Define separate approved index projections and searchable fields for artifacts, hosts, commands, and releases. Evidence: field registry. - [ ] B6.9.b Exclude secrets/credentials, raw command arguments/log content, local paths, protected metadata, and unauthorized unreleased names. Evidence: index inspection. - [ ] B6.9.c Enforce tenant/project/host/object/property/rights/release authorization before query, suggestions, filters, facets, counts, and snippets. Evidence: inference tests. - [ ] B6.9.d Reconcile indexes on permission/lifecycle/version/quarantine/ recall/deletion changes. Evidence: propagation tests. - [ ] B6.10 Implement signed deep links between Oshun Studio, Bellona control room, Yemaya, and target systems. Evidence: tenant/expiry/replay tests. - [ ] B6.10.a Register allowed source-destination route/context pairs, audiences, purposes, return paths, and prohibited embedded data/ authority. Evidence: link registry. - [ ] B6.10.b Mint signed bounded tenant/project/object/revision/action-hint/ expiry/nonce links with issuer/audience/key version. Evidence: signing tests. - [ ] B6.10.c Validate signature/audience/tenant/expiry/replay/current authorization/object existence/revision/lifecycle at destination. Evidence: negative suite. - [ ] B6.10.d Render safe forbidden/expired/missing/stale states without existence leakage and never execute a mutation from link context alone. Evidence: route journey. - [ ] B6.11 Implement target adapter health/capability probes. Evidence: UI uses live state. - [ ] B6.11.a Define bounded probe contracts for adapter/service/target identity/version, auth, reachability, capabilities/limits, dependencies, capacity/license, latency, and freshness. Evidence: probe schema. - [ ] B6.11.b Run least-privilege non-mutating probes with timeouts/rate limits/circuit breakers and safe credentials. Evidence: probe tests. - [ ] B6.11.c Compute healthy/degraded/unavailable/incompatible/ unauthenticated/stale states with component reasons. Evidence: state fixtures. - [ ] B6.11.d Cache only within declared freshness, emit bounded telemetry, and drive scheduler/API/UI eligibility from the same projection. Evidence: live-state integration test. - [ ] B6.12 Implement two-tenant/project/host isolation across API, gateway, artifact, search, queue, logs, and export. Evidence: integration suite. - [ ] B6.12.a Create colliding tenant/project/host IDs, names, checksums, paths, artifacts, commands, jobs, and releases in isolated fixtures. Evidence: isolation corpus. - [ ] B6.12.b Prove API/list/error/gateway/session/command authorization and connection/resource isolation. Evidence: control-plane suite. - [ ] B6.12.c Prove artifact/ref/signed URL/cache/search/queue/worker/log/ telemetry/event isolation including count and timing inference. Evidence: data-plane suite. - [ ] B6.12.d Prove build/export/release/recall/backup/restore/admin operations cannot cross boundaries without explicit governed authority. Evidence: integration suite. - [ ] B6.13 Generate OpenAPI, remote protocol, SDK, and host consumer contracts. Evidence: drift gate. - [ ] B6.13.a Generate OpenAPI with stable operations, schemas/errors, auth, pagination, idempotency/concurrency, events, examples, and deprecations. Evidence: spec validation. - [ ] B6.13.b Generate remote gateway/host protocol message and state-machine contracts with negotiation/capability versions. Evidence: protocol artifacts. - [ ] B6.13.c Generate SDK types/clients and host plugin/extension consumer types/fixtures for every supported language/surface. Evidence: consumer builds. - [ ] B6.13.d Compare generated/checked-in server and consumer artifacts and block undocumented breaking drift. Evidence: CI drift gate. - [ ] B6.14 Implement compatibility telemetry for host/plugin/adapter/target versions. Evidence: unsupported or expiring versions visible. - [ ] B6.14.a Emit bounded version/capability/support-window observations from enrollment, session, command, job, build, and target probes. Evidence: telemetry schema. - [ ] B6.14.b Join observations to the approved compatibility registry without logging host secrets, local paths, project names, or unbounded versions. Evidence: privacy tests. - [ ] B6.14.c Surface supported/degraded/expiring/deprecated/incompatible/ unknown distributions and affected operations/releases. Evidence: compatibility views. - [ ] B6.14.d Alert owners before expiry and link to upgrade/drain/quarantine/ exception workflows with outcome tracking. Evidence: expiry drill. ### B7 — Control-room and Studio experience - [ ] B7.1 Refactor the existing control-room hub around sessions, host health, interchange failures, consistency gates, builds, cost, and releases. Evidence: live-data design review. - [ ] B7.1.a Define operator questions, critical states, prioritized actions, role visibility, and canonical drill-down routes. Evidence: task map. - [ ] B7.1.b Replace fixture/duplicated summaries with authorized live projections for sessions, hosts, interchange/gates, builds, cost, and releases. Evidence: data contract tests. - [ ] B7.1.c Compose a restrained task-led workspace with one operational focus, clear hierarchy, and no decorative hero or generic card mosaic. Evidence: frontend review. - [ ] B7.1.d Preserve tenant/project/time/filter context through drill-down and render loading/empty/stale/partial/unavailable/failed states. Evidence: Playwright journey. - [ ] B7.2 Build host fleet, session, command, ingest, interchange, artifact, QA, template, batch, schedule, release, and audit routes. Evidence: route integrity. - [ ] B7.2.a Define canonical route IDs/hierarchy/params/loaders/permissions/ breadcrumbs/titles/deep links and ownership. Evidence: route registry. - [ ] B7.2.b Implement host/session/command routes with exact enrolled host, grant, revision, and live-state context. Evidence: control route tests. - [ ] B7.2.c Implement ingest/interchange/artifact/QA routes with immutable source/job/output/measurement context. Evidence: asset route tests. - [ ] B7.2.d Implement template/batch/schedule/release/audit routes with operation authority and protected evidence boundaries. Evidence: operations route tests. - [ ] B7.2.e Verify direct load/refresh/history, signed link, not-found, forbidden, stale revision, and permission change on every route. Evidence: Playwright integrity suite. - [ ] B7.3 Build live bridge-session view with identity, DCC state, grants, heartbeat, latency, load, command history, and termination. Evidence: fault journey. - [ ] B7.3.a Load immutable session/host/actor/project/purpose/grant/ negotiated-version identity and subscribe to resumable live updates. Evidence: session view contract. - [ ] B7.3.b Display heartbeat/freshness, latency/clock, DCC/project/modal/ dirty state, resources/load/licenses, and maintenance/quarantine. Evidence: live-state fixtures. - [ ] B7.3.c Show exact grants, expiry, permitted command/path/resource scope, active reservations, and redacted command/attempt/result history. Evidence: least-privilege view. - [ ] B7.3.d Preview and authorize suspend/drain/terminate/quarantine actions with in-flight blast radius and step-up. Evidence: control journey. - [ ] B7.3.e Reconcile disconnect/reconnect, event loss/reorder, expiry, command uncertainty, and late result without false healthy/success. Evidence: fault journey. - [ ] B7.4 Build interchange DAG with stage status, host/worker, attempts, logs, artifacts, measurements, cache, cost, and rerun. Evidence: live job journey. - [ ] B7.4.a Load immutable job/DAG/plan and subscribe to ordered resumable stage/attempt updates with snapshot reconciliation. Evidence: live-data tests. - [ ] B7.4.b Render dependencies, stage/attempt state, host/worker/resources, progress/timing, cache, cost, artifacts, measures, and target results. Evidence: DAG fixtures. - [ ] B7.4.c Inspect exact inputs/config/toolchain/logs/checkpoints/findings/ outputs/failure/lineage for a selected stage. Evidence: inspector journey. - [ ] B7.4.d Provide equivalent ordered/dependency semantic table and keyboard selection; do not require graph manipulation. Evidence: accessibility parity. - [ ] B7.4.e Preview downstream invalidation/loss/cost/capacity and enqueue an authorized exact rerun revision. Evidence: rerun journey. - [ ] B7.5 Build safe command composer only for allowlisted typed commands. Evidence: raw command shell is absent. - [ ] B7.5.a Filter commands by current host/plugin/version, negotiated capabilities, session grants, actor authority, project/object context, and host state. Evidence: command eligibility tests. - [ ] B7.5.b Generate forms from typed schemas with units/bounds/enums/object pickers/path virtual roots/defaults and property-level authorization. Evidence: form tests. - [ ] B7.5.c Resolve exact target/revision and preview normalized command, semantic diff, dependencies, side effects, cost/risk, reversibility, and required approval. Evidence: dry-run journey. - [ ] B7.5.d Require step-up/approval where defined and submit idempotently with deadline, expected revision, and immutable audit. Evidence: execution tests. - [ ] B7.5.e Display progress/result/partial/unknown/cancel/compensation and target read-back. Evidence: command fault journey. - [ ] B7.5.f Prove no raw shell, script, eval, console, unbounded argument, or arbitrary path/network field exists. Evidence: security assertion. - [ ] B7.6 Build source/USD/target preview and diff with semantic parity. Evidence: keyboard/screen-reader journey. - [ ] B7.6.a Load authorized exact source/USD/target representations and map comparable hierarchy/objects/properties/cameras/time. Evidence: preview setup tests. - [ ] B7.6.b Synchronize camera/framing, variant/layer, selection/isolation, transport, and overlays across available visual previews. Evidence: interaction journey. - [ ] B7.6.c Display structural, material, rig, animation, metadata, dependency, measurement, and calibrated image differences at exact locations. Evidence: diff fixtures. - [ ] B7.6.d Provide tree/table/list alternatives with before/after values, units, sources, status, and keyboard focus synchronized to visuals. Evidence: semantic parity. - [ ] B7.6.e Render unavailable host/renderer, unsupported preview, stale mapping, partial data, and nondeterminism honestly. Evidence: state matrix. - [ ] B7.7 Build consistency gate panel with raw measures, policy, freshness, remediation, rerun, and authorized waiver. Evidence: state matrix. - [ ] B7.7.a Show exact source/target revisions, fidelity profile/version, validators, raw measures/units/ranges/uncertainty, and artifact reports. Evidence: evidence view. - [ ] B7.7.b Show separate policy rules/thresholds/verdict/reasons, freshness/staleness dependencies, limitations, and non-pass states. Evidence: verdict fixtures. - [ ] B7.7.c Link failures to exact objects/properties/frames/files and allowlisted remediation or rerun plan with impact preview. Evidence: remediation journey. - [ ] B7.7.d Request/review/approve/reject eligible waivers with exact scope, loss, target, purpose, mitigation, expiry, and approver. Evidence: waiver tests. - [ ] B7.7.e Prove stale/unavailable/unsupported/low-confidence/validator- failure or expired waiver never renders or releases as pass. Evidence: state matrix. - [ ] B7.8 Build artifact lineage and dependency inspector. Evidence: impact preview supports quarantine/retire. - [ ] B7.8.a Traverse authoritative source/version/representation/layer/ dependency/command/job/build/release/target/consumer edges with exact revisions. Evidence: lineage query. - [ ] B7.8.b Present upstream/downstream hierarchy/graph plus semantic table, edge types, checksums, rights/license, validation, lifecycle, and unresolved refs. Evidence: inspector parity. - [ ] B7.8.c Filter by relation/depth/status/target and inspect path-level transformation/evidence without leaking unauthorized nodes. Evidence: authorization tests. - [ ] B7.8.d Preview quarantine/retire/supersede/revoke/recall blast radius, active work, releases, targets, blocked actions, and remediation. Evidence: impact journey. - [ ] B7.9 Build batch/build/release operations with preview, progress, partial result, retry, cancel, and read-back. Evidence: mixed-result journey. - [ ] B7.9.a Resolve a stable selected/query item set, exact template/ parameters/targets, caller authority, and current policy. Evidence: operation contract. - [ ] B7.9.b Preview per-item eligibility/loss/dependency/gates and aggregate resources/licenses/capacity/schedule/cost/target impact. Evidence: preview tests. - [ ] B7.9.c Authorize the exact preview revision and execute idempotently with per-item/stage progress, attempts, artifacts, and audit. Evidence: execution tests. - [ ] B7.9.d Pause/cancel/retry only eligible scope and show succeeded/failed/ skipped/cancelled/partial/unknown/compensated separately. Evidence: mixed-result journey. - [ ] B7.9.e Read back builds/packages/targets/releases and keep unresolved partial state visible. Evidence: reconciliation report. - [ ] B7.10 Build mobile/tablet incident, session terminate, review, approve, and release supervision. Evidence: step-up controls. - [ ] B7.10.a Prioritize incident queue, host/session health, command/job failure, evidence review, approve/reject, terminate/quarantine, and release/recall tasks for compact viewports. Evidence: mobile task map. - [ ] B7.10.b Provide semantic summaries/tables/thumbnails and exact evidence links without requiring dense graph/3D/full-scene editing. Evidence: compact journey. - [ ] B7.10.c Implement touch/keyboard targets, reflow/zoom/orientation/safe areas, reduced motion, interruption, offline/reconnect, and focus recovery. Evidence: responsive accessibility suite. - [ ] B7.10.d Enforce exact revision/impact, step-up/dual control, reason, confirmation, immutable audit, and read-back for critical actions. Evidence: mobile security tests. - [ ] B7.11 Build governed Studio facade showing permitted summaries and deep links, not a duplicate console. Evidence: parity/ownership test. - [ ] B7.11.a Define permitted summary fields/states/actions and prohibited host command, secret, path, raw log, protected artifact, and admin data. Evidence: facade contract. - [ ] B7.11.b Project authorized live job/release/target summaries with source owner, freshness, limitations, and canonical Bellona identity. Evidence: projection tests. - [ ] B7.11.c Route detailed inspection/mutation through signed expiring deep links and reauthorize in the control room. Evidence: link journey. - [ ] B7.11.d Prove no duplicate mutation endpoints/state or divergent status exists in Studio and parity reconciles from authoritative events. Evidence: ownership test. - [ ] B7.12 Build command palette and saved views filtered by role. Evidence: unauthorized commands never appear or execute. - [ ] B7.12.a Register stable navigation/operation IDs, keywords, context requirements, route/target resolvers, capabilities, step-up, and availability. Evidence: command registry. - [ ] B7.12.b Filter palette, shortcuts, recent items, suggestions, and saved view content by current role/tenant/project/host/object authority. Evidence: visibility tests. - [ ] B7.12.c Create/update/share/delete saved queries/layouts with owner/ scope/version/permissions and safe defaults. Evidence: saved-view tests. - [ ] B7.12.d Reauthorize resolved target/revision at navigation or execution and reject stale permission/context. Evidence: execution negative suite. - [ ] B7.13 Build honest disconnected-host, incompatible-version, missing-DCC, unavailable-validator, stale, partial, fixture, and failed states. Evidence: state matrix. - [ ] B7.13.a Define each state, source signal, precedence, reason code, diagnostic detail, owner, permitted action, retryability, and release effect. Evidence: state contract. - [ ] B7.13.b Render disconnected/missing/incompatible host dependencies and unavailable validators with last-known time and safe remediation. Evidence: dependency matrix. - [ ] B7.13.c Distinguish stale/partial data and mixed per-item/per-stage/ target outcomes from empty/success. Evidence: partial-state tests. - [ ] B7.13.d Persistently label fixtures/demos and prohibit production mutation or evidence claims. Evidence: fixture tests. - [ ] B7.13.e Preserve typed failure diagnostics, retry/compensation, and unknown/late result without optimistic completion. Evidence: fault journey. - [ ] B7.14 Apply existing theming/i18n/mobile/accessibility work without introducing decorative dashboard clutter. Evidence: frontend conformance review. - [ ] B7.14.a Inventory/reuse existing design tokens, components, themes, locale/formatting infrastructure, responsive patterns, and accessibility primitives. Evidence: reuse map. - [ ] B7.14.b Implement restrained visual hierarchy, typography, spacing, color, motion, and operational density around task priority rather than ornamental cards/gradients/hero copy. Evidence: design review. - [ ] B7.14.c Externalize/localize strings and test expansion, plural/ date/number/time-zone formatting, RTL where supported, and technical identifiers. Evidence: i18n suite. - [ ] B7.14.d Validate wide, compact, and single-column layouts, touch/ keyboard, zoom/reflow, themes/contrast, reduced motion, and semantic alternatives. Evidence: Playwright conformance suite. - [ ] B7.15 Add permission-filtered control-room routes or governed deep links for render, gameplay, virtual production, XR, mocap, MetaHuman, DaVinci, Houdini, audio/video, cross-domain compilation, agent/MCP plans, package-builder, events, and developer compatibility. Evidence: every retained specialized capability is reachable by its authorized audience and no duplicate mutation UI exists. - [ ] B7.15.a Map each specialized capability to its authoritative existing or new control-room route, permitted facade/deep-link entry, owner, and required roles. Evidence: reachability matrix. - [ ] B7.15.b Add task-led routes for render/gameplay/VP/XR/mocap/MetaHuman operations with profile-specific states/evidence and no generic inheritance. Evidence: route journeys. - [ ] B7.15.c Add task-led routes for DaVinci/Houdini/A-V/cross-domain compilation/package operations with exact source-target lineage. Evidence: route journeys. - [ ] B7.15.d Add task-led agent-plan/event/developer compatibility routes with risk/approval, delivery status, and version matrices. Evidence: route journeys. - [ ] B7.15.e Filter navigation/routes/data/actions by authorization and feature/profile availability; reauthorize on load/action. Evidence: role tests. - [ ] B7.15.f Prove every authorized capability is reachable and every mutation has exactly one authoritative UI/service surface. Evidence: zero-orphan/duplication audit. ### B8 — Per-host compatibility and release matrix - [ ] B8.1 Validate Blender host install, auth, session, pull, push, import, export, round-trip, and revoke. Evidence: supported-version matrix. - [ ] B8.1.a Install/upgrade/rollback/uninstall the signed Bellona plugin on every supported Blender/OS version and verify files/preferences/ dependency cleanup. Evidence: install matrix. - [ ] B8.1.b Enroll/authenticate/rotate/revoke the Blender host and exercise scoped session open/heartbeat/reconnect/close. Evidence: security journey. - [ ] B8.1.c Pull/push/import/export representative Blender scenes/assets through typed commands with authorization, cancellation, undo, and crash recovery. Evidence: command traces. - [ ] B8.1.d Round-trip Blender geometry/material/rig/animation/camera/ dependencies and compare known fidelity values/declared loss. Evidence: version matrix. - [ ] B8.2 Validate Maya host install, auth, session, pull, push, import, export, round-trip, and revoke. Evidence: supported-version matrix. - [ ] B8.2.a Install/upgrade/rollback/uninstall the signed Bellona plugin on every supported Maya/OS version and verify modules/preferences/ dependency cleanup. Evidence: install matrix. - [ ] B8.2.b Enroll/authenticate/rotate/revoke the Maya host and exercise scoped session open/heartbeat/reconnect/close. Evidence: security journey. - [ ] B8.2.c Pull/push/import/export representative Maya scenes/assets through typed commands with authorization, cancellation, undo, and crash recovery. Evidence: command traces. - [ ] B8.2.d Round-trip Maya geometry/material/rig/animation/camera/ dependencies and compare known fidelity values/declared loss. Evidence: version matrix. - [ ] B8.3 Validate Houdini host install, auth, session, pull, push, import, export, round-trip, and revoke. Evidence: supported-version matrix. - [ ] B8.3.a Install/upgrade/rollback/uninstall the signed Bellona package on every supported Houdini/OS version and verify package paths/assets/ dependency cleanup. Evidence: install matrix. - [ ] B8.3.b Enroll/authenticate/rotate/revoke the Houdini host and exercise scoped session open/heartbeat/reconnect/close. Evidence: security journey. - [ ] B8.3.c Pull/push/import/export and cook representative Houdini scenes/ HDAs/USD through typed commands with cancel/checkpoint/license/crash recovery. Evidence: command traces. - [ ] B8.3.d Round-trip geometry/material/rig/animation/camera/dependencies/ HDA outputs and compare fidelity/nondeterminism. Evidence: version matrix. - [ ] B8.4 Validate 3ds Max host install, auth, session, pull, push, import, export, round-trip, and revoke. Evidence: supported-version matrix. - [ ] B8.4.a Install/upgrade/rollback/uninstall the signed Bellona plugin on every supported 3ds Max/Windows version and verify files/settings/ dependency cleanup. Evidence: install matrix. - [ ] B8.4.b Enroll/authenticate/rotate/revoke the 3ds Max host and exercise scoped session open/heartbeat/reconnect/close. Evidence: security journey. - [ ] B8.4.c Pull/push/import/export representative 3ds Max scenes/assets through typed commands with authorization, cancellation, undo, and crash recovery. Evidence: command traces. - [ ] B8.4.d Round-trip 3ds Max geometry/material/rig/animation/camera/ dependencies and compare known fidelity values/declared loss. Evidence: version matrix. - [ ] B8.5 Validate Unreal host install, auth, session, pull, push, import, export, round-trip, and revoke using the local UE5 path where applicable. Evidence: supported-version matrix. - [ ] B8.5.a Build/install/enable/upgrade/rollback/uninstall the signed Bellona plugin on every supported Unreal/platform version, including local UE 5.5 where applicable. Evidence: install matrix. - [ ] B8.5.b Enroll/authenticate/rotate/revoke editor/on-box hosts and exercise scoped session open/heartbeat/reconnect/close without editor deadlock. Evidence: security journey. - [ ] B8.5.c Pull/push/import/export/cook representative Unreal assets/maps through typed commands with transactions, cancel, compile, and crash recovery. Evidence: command traces. - [ ] B8.5.d Round-trip Unreal geometry/material/skeleton/animation/camera/ metadata/dependencies and validate editor/runtime load. Evidence: version matrix. - [ ] B8.6 Validate Unity host install, auth, session, pull, push, import, export, round-trip, and revoke. Evidence: supported-version matrix. - [ ] B8.6.a Install/upgrade/rollback/uninstall the signed Bellona package on every supported Unity/platform version and verify package/project/ dependency cleanup. Evidence: install matrix. - [ ] B8.6.b Enroll/authenticate/rotate/revoke the Unity host and exercise scoped session open/heartbeat/reconnect/close across domain reload. Evidence: security journey. - [ ] B8.6.c Pull/push/import/export/build representative Unity assets/scenes through typed commands with undo, cancel, compile, and crash recovery. Evidence: command traces. - [ ] B8.6.d Round-trip geometry/material/rig/animation/camera/metadata/ dependencies and validate editor/player load. Evidence: version matrix. - [ ] B8.7 Validate Godot host install, auth, session, pull, push, import, export, round-trip, and revoke. Evidence: supported-version matrix. - [ ] B8.7.a Install/upgrade/rollback/uninstall the signed Bellona add-on on every supported Godot/platform version and verify project/settings/ dependency cleanup. Evidence: install matrix. - [ ] B8.7.b Enroll/authenticate/rotate/revoke the Godot host and exercise scoped session open/heartbeat/reconnect/close. Evidence: security journey. - [ ] B8.7.c Pull/push/import/export/build representative Godot resources/ scenes through typed commands with undo, cancel, reimport, and crash recovery. Evidence: command traces. - [ ] B8.7.d Round-trip Godot geometry/material/skeleton/animation/camera/ metadata/dependencies and validate editor/runtime load. Evidence: version matrix. - [ ] B8.8 Validate host offline/reconnect without duplicate commands or partial hidden state. Evidence: network fault tests. - [ ] B8.8.a Inject disconnect before dispatch, after acceptance, during execution/streaming/commit, and after host completion before receipt. Evidence: fault matrix. - [ ] B8.8.b Assert gateway/session liveness, command uncertainty, user state, reservations, and downstream job state become explicit. Evidence: state tests. - [ ] B8.8.c Reauthenticate and reconcile session epoch, command IDs/results, host object revisions, artifacts, and checkpoints on reconnect. Evidence: reconciliation tests. - [ ] B8.8.d Retry/resume/compensate only safe work and prove no duplicate command side effect or hidden partial state. Evidence: network fault report. - [ ] B8.9 Validate DCC crash and restart recovery. Evidence: session/job state reconciles. - [ ] B8.9.a Crash each supported host during idle, dirty scene, import/ export, mutation, save, render/build, and result commit. Evidence: crash matrix. - [ ] B8.9.b Assert session/command/job/lease state, checkpoints, temp files, artifact promotion, and user-visible diagnostics are safe. Evidence: invariant tests. - [ ] B8.9.c Restart host/plugin, reauthenticate, inspect project/object/file state, and correlate recovered command journals/checkpoints. Evidence: restart journey. - [ ] B8.9.d Resume/retry/compensate or require human resolution according to command contract with no false success. Evidence: reconciliation report. - [ ] B8.10 Validate plugin upgrade/downgrade and server version skew. Evidence: compatibility behavior. - [ ] B8.10.a Test every supported plugin/server/protocol/host version combination and boundary outside the compatibility window. Evidence: skew matrix. - [ ] B8.10.b Upgrade with active/idle sessions and verify drain, state preservation, negotiation, health, and rollback. Evidence: upgrade journey. - [ ] B8.10.c Downgrade only where approved and verify schema/state/config/ artifact compatibility or explicit rejection. Evidence: downgrade tests. - [ ] B8.10.d Surface degraded/expiring/incompatible status before command dispatch and never silently select an unsafe protocol. Evidence: compatibility behavior. - [ ] B8.11 Validate unit, axis, color, material, rig, animation, camera, metadata, and unsupported-feature behavior for every supported pair. Evidence: pairwise coverage matrix. - [ ] B8.11.a Generate the exact supported source-host/version to target-host/ version/profile pair matrix with declared unsupported cells. Evidence: coverage registry. - [ ] B8.11.b Run analytical unit/axis/transform/hierarchy/camera and known color/OCIO fixtures per pair. Evidence: foundational results. - [ ] B8.11.c Run material/texture/shader and skeleton/skinning/blend-shape/ animation fixtures per pair. Evidence: asset results. - [ ] B8.11.d Run metadata/naming/dependency/variant/scene and target import/ runtime fixtures per pair. Evidence: scene results. - [ ] B8.11.e Assert every unsupported/lossy/substituted feature produces exact diagnostics, preview/acceptance, and never silent pass. Evidence: behavior matrix. - [ ] B8.12 Validate large asset, large scene, many dependencies, and slow link. Evidence: performance and backpressure. - [ ] B8.12.a Define representative maximum-supported bytes, geometry/ texture/animation, object/layer count, dependency fan-out/depth, and network latency/bandwidth/loss fixtures. Evidence: workload plan. - [ ] B8.12.b Measure ingest/scan/resolve/convert/validate/preview/transfer/ import/build/read-back latency, throughput, memory, storage, and cost. Evidence: performance report. - [ ] B8.12.c Exercise resumable chunking, incremental conversion, caching, pagination/lazy preview, scheduling, quotas, and end-to-end backpressure. Evidence: behavior tests. - [ ] B8.12.d Inject interruption/cancel/resource exhaustion and prove bounded memory/storage, cleanup, recovery, fairness, and no corrupt partial release. Evidence: overload report. - [ ] B8.13 Validate path/resolver behavior across supported operating systems. Evidence: portable package fixtures. - [ ] B8.13.a Cover Windows drives/UNC/device/reserved names/case, macOS case/ Unicode, and Linux roots/symlinks/case with supported host combinations. Evidence: OS path corpus. - [ ] B8.13.b Test separators/dot segments/encoding/normalization/length/ collisions/symlinks/junctions/mounts and virtual-root containment. Evidence: security results. - [ ] B8.13.c Test resolver contexts, environment independence, relative/ virtual mappings, external refs, packages, and dependency checksums on every OS. Evidence: resolver matrix. - [ ] B8.13.d Move packages among clean supported OS/host environments and prove resolution/read-back without source-machine paths. Evidence: portability fixtures. - [ ] B8.14 Publish known limitations and loss profiles per host/target pair. Evidence: UI and generated documentation derive from the same registry. - [ ] B8.14.a Record each pair's unsupported/partial/substituted/baked/ nondeterministic features, bounds, symptoms, mitigation, and affected versions in the compatibility registry. Evidence: limitation rows. - [ ] B8.14.b Link each limitation to source tests, raw measurements, adapter/ host issue, owner, status, and expiry/review date. Evidence: provenance audit. - [ ] B8.14.c Generate user documentation, conversion preview diagnostics, API/SDK discovery, and control-room explanations from the same versioned data. Evidence: generation parity. - [ ] B8.14.d Block unacknowledged material loss and test that docs/UI update with registry changes. Evidence: stale-content gate. - [ ] B8.15 Validate the complete typed command registry for each supported host/version/plugin rather than only connect/pull/push. Evidence: command-capability matrix includes success, unsupported, authorization, invalid revision, cancellation, undo/compensation, crash, and audit. - [ ] B8.15.a Enumerate every command ID/version/category and every supported host/version/plugin tuple; declare required, optional, and unsupported cells. Evidence: command-capability matrix. - [ ] B8.15.b Generate schema-valid boundary and invalid argument cases for each supported command, including path/object/property/resource limits. Evidence: command fixtures. - [ ] B8.15.c Test success/idempotent replay/result/read-back and explicit unsupported/incompatible behavior per cell. Evidence: functional conformance. - [ ] B8.15.d Test unauthorized property/scope, stale revision/precondition, deadline/cancel, duplicate, session expiry, and host quarantine per applicable cell. Evidence: control conformance. - [ ] B8.15.e Test undo/compensation/partial/unknown outcome and host/plugin crash/reconnect reconciliation per mutating cell. Evidence: recovery conformance. - [ ] B8.15.f Verify redacted immutable audit and coverage gate; prohibit connect/pull/push from standing in for untested commands. Evidence: release audit. - [ ] B8.16 Validate renderers/farms, virtual-production devices, XR devices/runtimes, mocap vendors, MetaHuman/Live Link, Resolve, Houdini, engine runtime/gameplay, and package/install targets independently. Evidence: specialized pairwise matrix with declared unavailable cells. - [ ] B8.16.a Register exact producer/control-room/host/plugin/device/runtime/ target version tuples and required specialized capabilities. Evidence: specialized matrix. - [ ] B8.16.b Validate each renderer/farm and VP device/stage combination for auth, commands, resources, safety, output, failure, and read-back. Evidence: independent rows. - [ ] B8.16.c Validate each XR platform/device/runtime and mocap vendor/device/ protocol combination for live/deploy/quality/failure behavior. Evidence: independent rows. - [ ] B8.16.d Validate each MetaHuman/Live Link, Resolve, and Houdini version combination for identity/media/procedural workflows and round-trip. Evidence: independent rows. - [ ] B8.16.e Validate each engine runtime/gameplay and package/install target for scenario/build/install/upgrade/rollback/read-back. Evidence: independent rows. - [ ] B8.16.f Declare unavailable/unsupported cells with reason/owner/plan and prevent any specialized profile from inheriting generic bridge or another target's evidence. Evidence: independence gate. ### B9 — Bellona observability, verification, and launch - [ ] B9.1 Instrument host, session, command, transfer, interchange, cache, validation, build, release, and recall traces/metrics. Evidence: bounded schema. - [ ] B9.1.a Define bounded span/event/metric names, attributes, units, cardinality, sampling, retention, and owners for every subsystem. Evidence: telemetry registry. - [ ] B9.1.b Propagate tenant-safe trace/session/command/job/stage/artifact/ build/release correlation across gateway, hosts, workers, adapters, and targets. Evidence: traced fixture. - [ ] B9.1.c Instrument success, latency, traffic/load, retries/backpressure, partial/unknown outcomes, typed failures, gates, cost, and recall closure. Evidence: signal tests. - [ ] B9.1.d Redact credentials, tokens, local paths, asset/project names, command payloads, content, free text, and unbounded identifiers. Evidence: telemetry privacy scan. - [ ] B9.2 Define SLOs for connection, command, transfer, queue, conversion, validation, build, target availability, and release verification. Evidence: error-budget policy. - [ ] B9.2.a Define user-visible indicators, populations, windows, sources, exclusions, and measurement quality for each named operation. Evidence: SLI catalog. - [ ] B9.2.b Ratify latency, availability, freshness, correctness, fidelity, durability, and capacity objectives by support tier/profile. Evidence: target matrix. - [ ] B9.2.c Build dashboards and multi-window burn alerts with actionable host/adapter/target drill-down and bounded labels. Evidence: alert tests. - [ ] B9.2.d Define error-budget release freeze, exception, remediation, recovery, and retrospective policy. Evidence: policy exercise. - [ ] B9.3 Run protocol, contract, migration, and version-skew suites. Evidence: host/client/server matrix. - [ ] B9.3.a Test current/supported prior gateway-host protocol negotiation, messages, state machines, capabilities, errors, and unknown fields. Evidence: protocol matrix. - [ ] B9.3.b Test API/event/SDK/host-plugin contracts across server/client/ consumer version combinations. Evidence: contract matrix. - [ ] B9.3.c Test schema migration upgrade/backfill/mixed-version/rollback/ roll-forward/cleanup at representative scale. Evidence: migration report. - [ ] B9.3.d Test host/plugin/adapter/target version boundaries, deprecation/expiry, downgrade, and fail-closed unsupported behavior. Evidence: skew suite. - [ ] B9.4 Run known-value USD, geometry, transform, material, rig, animation, camera, dependency, and fidelity tests. Evidence: gate registry coverage. - [ ] B9.4.a Register independently derived fixtures with source, generator, expected raw values/tolerances, profile, rights, and checksums. Evidence: fixture registry. - [ ] B9.4.b Cover USD composition/schema/resolver/dependency and geometry/ topology/transform/unit/axis measures. Evidence: foundational report. - [ ] B9.4.c Cover material/texture/color/render and skeleton/skinning/blend- shape/animation measures. Evidence: asset report. - [ ] B9.4.d Cover camera/light/scene/metadata/dependency, target import/ runtime, and round-trip fidelity separately per profile. Evidence: target report. - [ ] B9.4.e Prove every production measure/gate/profile/version maps to current known-value proof and non-pass states cannot satisfy coverage. Evidence: gate audit. - [ ] B9.5 Run `usdchecker` and pinned custom-validator goldens. Evidence: current reports. - [ ] B9.5.a Pin OpenUSD/`usdchecker` and custom validator code/config/ dependencies/profiles with checksums. Evidence: validator manifest. - [ ] B9.5.b Run valid/boundary/invalid/malicious USD stages/packages in hermetic resolver contexts and compare raw reports to goldens. Evidence: golden suite. - [ ] B9.5.c Verify typed parser mapping, severity/location/rule identity, truncation, unknown output, and validator failure/unavailability. Evidence: parser tests. - [ ] B9.5.d Publish exact current report artifacts/versions and block stale validator evidence at release. Evidence: freshness gate. - [ ] B9.6 Run real-database, artifact, gateway, host, queue, cache, build, target, and search integration tests. Evidence: durable round-trip. - [ ] B9.6.a Stand up production-like isolated database/artifact/evidence/ gateway/queue/cache/search/build/target services plus supported host adapters. Evidence: environment manifest. - [ ] B9.6.b Exercise enrollment/session/command, intake/interchange/cache/ validation, build/release/deploy/read-back, and search/audit lifecycle. Evidence: durable round-trip. - [ ] B9.6.c Exercise duplicate/reordered messages, concurrency, restart, stale cache/index, partial target, and cleanup/reconciliation. Evidence: fault cases. - [ ] B9.6.d Verify checksums, immutable lineage, tenancy, authorization, audit/outbox, and target truth at every boundary. Evidence: invariant report. - [ ] B9.7 Run full-journey Playwright: host connect to verified release. Evidence: real or hermetic supported host adapter. - [ ] B9.7.a Provision a supported real or hermetic host/plugin/version with a known rights-cleared asset/scene, credentials, target, and expected measures. Evidence: fixture manifest. - [ ] B9.7.b Enroll/approve/connect the host, inspect health/capabilities, open scoped session, and execute typed pull/ingest commands. Evidence: Playwright trace. - [ ] B9.7.c Preview conversion/loss, run interchange, inspect source/USD/ target diff and raw/current gates, and approve exact evidence. Evidence: review assertions. - [ ] B9.7.d Build candidate/evidence, deploy, run target smoke/fidelity, independently read back, and assert verified release. Evidence: journey report. - [ ] B9.8 Run full-journey Playwright: host failure, reconnect, rerun, compare, waive/reject, and release. Evidence: exact state. - [ ] B9.8.a Inject disconnect/crash during a deterministic command or stage and assert session/command/job/attempt/partial/unknown state. Evidence: failure trace. - [ ] B9.8.b Reconnect/restart, reconcile host/project/object/artifact state, and rerun/resume from the safe boundary. Evidence: recovery assertions. - [ ] B9.8.c Compare exact failed/prior/new revisions and inspect raw fidelity loss with semantic parity. Evidence: comparison trace. - [ ] B9.8.d Exercise eligible scoped waiver and non-waivable rejection, expiry/staleness, and named approval. Evidence: decision assertions. - [ ] B9.8.e Release only the eligible new revision and prove failed/stale/ unwaived outputs cannot publish. Evidence: exact-state report. - [ ] B9.9 Run full-journey Playwright: artifact quarantine/recall and downstream reconciliation. Evidence: target verification. - [ ] B9.9.a Release a fixture artifact into library, dependent project/build/ package, and supported target with traceable consumer refs. Evidence: setup trace. - [ ] B9.9.b Initiate quarantine or recall from an exact finding/revision and assert blast-radius preview, authority, step-up, and audit. Evidence: action trace. - [ ] B9.9.c Assert new use/build/release is blocked and active/derived/ deployed state transitions per policy with explicit partial results. Evidence: propagation assertions. - [ ] B9.9.d Retry unreachable recipients and independently read back every target/consumer until closure or visible unresolved state. Evidence: reconciliation report. - [ ] B9.10 Run WCAG 2.2 AA, keyboard, announcement, non-drag, and semantic preview parity suites. Evidence: themes/viewports/locales. - [ ] B9.10.a Run automated WCAG checks across authenticated roles/routes, themes, locales, and wide/compact/single-column viewports. Evidence: accessibility report. - [ ] B9.10.b Complete keyboard-only host/session/command, DAG, preview/diff, gate/waiver, batch/schedule, release/recall journeys. Evidence: keyboard traces. - [ ] B9.10.c Verify names/roles/values, focus order/restoration, live announcements, errors, step-up dialogs, and stale/partial/failure state. Evidence: assistive-technology matrix. - [ ] B9.10.d Verify non-drag alternatives, 200–400% zoom/reflow, touch targets, color independence, reduced motion, and semantic graph/3D/image parity. Evidence: conformance suite. - [ ] B9.11 Run fleet, concurrent session, command, transfer, large scene, conversion, batch, build, and search load tests. Evidence: backpressure and SLO. - [ ] B9.11.a Define representative/maximum host fleet, tenants, session/ command mixes, artifact/scene sizes, dependencies, network, batch/build, search corpus, resources, and budgets. Evidence: load plan. - [ ] B9.11.b Measure enrollment/heartbeat/session/gateway/command streaming and artifact transfer under sustained/burst/slow/abusive clients. Evidence: control-plane report. - [ ] B9.11.c Measure scan/resolve/convert/cache/validate/preview/search, batch/scheduling/build/package/deploy/read-back under load. Evidence: data-plane report. - [ ] B9.11.d Verify quotas/fairness/backpressure/circuit breakers/cancel/ recovery, bounded memory/storage/logs, correctness, cost, and SLO. Evidence: overload report. - [ ] B9.12 Run command injection, host spoof, plugin tamper, malicious asset/USD/archive, path, SSRF, secret leak, artifact tamper, auth, tenant, and release bypass tests. Evidence: zero blockers. - [ ] B9.12.a Test command/argument/schema confusion, shell/script/eval/ console escape, expected-revision bypass, and unsafe compensation. Evidence: command security suite. - [ ] B9.12.b Test enrollment/host/session spoof, credential replay/theft, attestation/signature bypass, plugin downgrade/tamper, and compromised host results. Evidence: identity/supply-chain suite. - [ ] B9.12.c Test malicious files/archives/USD/resolvers/dependencies, traversal/symlink/Unicode paths, SSRF/rebinding/redirect, and parser/ decompression abuse. Evidence: content security suite. - [ ] B9.12.d Test secret/path/content leakage through APIs/UI/search/logs/ traces/events/support bundles and two-tenant isolation. Evidence: disclosure suite. - [ ] B9.12.e Test artifact/evidence/signature/target read-back tamper and gate/waiver/approval/release/recall bypass. Evidence: release security suite with zero blockers. - [ ] B9.13 Run gateway/host/worker loss, artifact corruption, cache loss, backup/restore, release rollback, and recall drills. Evidence: RPO/RTO. - [ ] B9.13.a Inject gateway/host/worker process/network/resource loss during sessions, commands, transfer, conversion, build, and commit. Evidence: compute drill. - [ ] B9.13.b Corrupt/lose staged, authoritative, cached, packaged, and deployed artifact bytes and verify checksum detection/quarantine/ recomputation/recovery. Evidence: artifact drill. - [ ] B9.13.c Restore databases/artifacts/evidence/config/keys/indexes/queues from backup and reconcile sessions/jobs/builds/search/audit/targets. Evidence: restore report. - [ ] B9.13.d Roll back failed release and execute quarantine/recall during active downstream use with per-target read-back. Evidence: release drill. - [ ] B9.13.e Measure achieved RPO/RTO, data loss, duplicate work, target inconsistency, and unresolved consumers against objectives. Evidence: scorecard. - [ ] B9.14 Publish host install, bridge, interchange, fidelity, build, release, security incident, and recovery runbooks. Evidence: game-day. - [ ] B9.14.a Assign owner/audience/prerequisites/triggers/authority/ diagnostics/actions/safety/escalation/rollback to each runbook. Evidence: template audit. - [ ] B9.14.b Write per-host install/update/revoke and bridge/session/command/ gateway operational runbooks. Evidence: reviewed docs. - [ ] B9.14.c Write intake/interchange/dependency/fidelity/validator/waiver and build/render/package/release/target runbooks. Evidence: reviewed docs. - [ ] B9.14.d Write security/privacy/supply-chain incident, quarantine/recall, backup/restore/disaster/dependency-outage runbooks. Evidence: reviewed docs. - [ ] B9.14.e Execute representative game-days, remediate deviations, and revalidate every command/link/owner. Evidence: exercise report. - [ ] B9.15 Produce engineering-readiness evidence per supported host/target pair. Evidence: incomplete pairs cannot inherit another pair's proof. - [ ] B9.15.a Build one evidence bundle per exact host/plugin/OS/server/ protocol/source-target/profile tuple with owners and support window. Evidence: pair registry. - [ ] B9.15.b Map requirements to design/code/contracts/migrations/known- value/fidelity/security/accessibility/performance/recovery/runbook proof with exact versions. Evidence: traceability index. - [ ] B9.15.c Include command-by-command, conversion/round-trip, build/deploy, target smoke/read-back, limitations, waivers, and approvals per pair. Evidence: readiness bundle. - [ ] B9.15.d Surface failed/stale/missing/unavailable evidence explicitly and block the pair without borrowing another pair's proof. Evidence: independence gate. - [ ] B9.15.e Reproduce and verify bundles/checksums/links from authoritative evidence. Evidence: clean-room generation. - [ ] B9.16 Obtain named DCC/engine, pipeline, security, accessibility, engineering, and product approvals. Evidence: human signoff. - [ ] B9.16.a Define approver scope/competence/independence, required evidence, supported host/target coverage, decision options, conditions, and expiry. Evidence: approval policy. - [ ] B9.16.b Present the exact release candidate/readiness bundles, compatibility matrix, limitations, risks, waivers, and unresolved items. Evidence: review packet. - [ ] B9.16.c Capture named signed approve/reject/conditional decisions with role, time, exact revisions/pairs, rationale, and conditions. Evidence: signoff records. - [ ] B9.16.d Invalidate/renew approvals after material code/config/profile/ host/target/evidence/risk changes. Evidence: staleness tests. - [ ] B9.17 Run distinct full journeys for render queue, gameplay systems, virtual-production stage, XR deployment, mocap stream/record/retarget, MetaHuman, DaVinci conform, Houdini cook, audio/video conversion, cross-domain/lore compilation, agent/MCP dry-run approval, package install/rollback, events, and SDK clients. Evidence: no generic bridge or build journey substitutes for specialized proof. - [ ] B9.17.a Run independent render-queue and gameplay-system journeys with specialized resources, failures, quality/scenarios, target read-back, and rollback. Evidence: production traces. - [ ] B9.17.b Run independent VP-stage, each XR-platform deployment, and each mocap vendor live/record/retarget journey with device safety, consent, faults, and target read-back. Evidence: device traces. - [ ] B9.17.c Run independent MetaHuman/Live Link, DaVinci conform/delivery, Houdini cook/farm, and A/V conversion/package journeys. Evidence: creative traces. - [ ] B9.17.d Run cross-domain/lore compilation through producer contracts, mappings, build/deploy/read-back, and correction/recall propagation. Evidence: integration trace. - [ ] B9.17.e Run agent/MCP intent-to-plan/dry-run/approval/execution/ intervention/read-back and adversarial boundaries. Evidence: agent trace. - [ ] B9.17.f Run package fresh install/upgrade/uninstall/rollback, event publish/deliver/replay/dead-letter, and every external SDK/CLI/plugin client. Evidence: ecosystem traces. - [ ] B9.17.g Prohibit generic bridge/build success from satisfying any missing specialized journey. Evidence: coverage gate. - [ ] B9.18 Run agent/remote-control adversarial suites for ambiguous intent, prompt/tool injection, stale selection/revision, hidden destructive side effect, approval confusion, privilege expansion, organization/spend bypass, unsafe path/network target, late result, host compromise, and audit tamper. Evidence: fail-closed thresholds and incident drills. - [ ] B9.18.a Test ambiguous/conflicting/incomplete intent, wrong context, hallucinated object, prompt/content/tool-output injection, and unsupported goal; require safe clarification/refusal. Evidence: intent suite. - [ ] B9.18.b Test stale selection/revision, TOCTOU between dry-run/approval/ execution, hidden/described-mismatched side effects, irreversible actions, and approval scope/confusion. Evidence: plan integrity suite. - [ ] B9.18.c Test role/session/command/path/property privilege expansion, cross-tenant/org policy evasion, step-up/dual-control bypass, and chained-tool authority laundering. Evidence: authorization suite. - [ ] B9.18.d Test token/time/cost/spend/capacity budget evasion, parallel fan-out, retry loops, late results, cancellation races, and partial completion disguised as success. Evidence: resource/control suite. - [ ] B9.18.e Test traversal/SSRF/rebinding/redirect/credential exfiltration, malicious host/plugin compromise, falsified results/read-back, and quarantine escape. Evidence: execution security suite. - [ ] B9.18.f Test audit suppression/redaction abuse/reordering/deletion/ tamper and ensure immutable intent/plan/approval/tool/result/target reconstruction. Evidence: audit integrity suite. - [ ] B9.18.g Ratify fail-closed thresholds, run pause/kill/quarantine/recall/ recovery incident drills, and close every release blocker. Evidence: adversarial release report. - [ ] B9.19 EVE-SEAM-EXIT: require "required Eve reads and writes admitted with source and behavior evidence, or an exact task-0.8 explicit non-goal proves zero operations; a named defer preserves ownership but never passes completion" before this phase exits. Evidence: source-derived totality record and passing verifier. - [ ] B9.19.a Re-run the route, bridge, state-signal, and complete domain-code envelope census; review every changed candidate instead of carrying a stale phase disposition forward. Evidence: current ratchets. - [ ] B9.19.b Bind the exact ratified task-0.8 workflow and requirement set; classify it as a required seam or an exact source-backed non-goal. Evidence: charter-bound disposition set. - [ ] B9.19.c For a required seam, admit both read and write operations with byte-pinned source and behavior evidence. A named defer retains its owner and unblock condition but fails completion. Evidence: operation proofs. - [ ] B9.19.d Permit a zero-operation boundary only for an exact ratified task-0.8 explicit non-goal; absence or unavailability is not a non-goal. Evidence: source-bound non-goal proof. - [ ] B9.19.e Run the totality verifier, every retained gate-case CLI, and the injected durable-candidate control; retain red and green receipts. Evidence: release gate logs. --- ## 5. Cross-domain integration completion - [ ] X.1 Prove Isis-generated assets enter Yemaya projects with immutable generation and rights provenance. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.1.a Define the Isis export/Yemaya intake contract for immutable asset/ generation revisions, ingredients, model/tool/config/seed, rights/ license, disclosures, checksums, and lifecycle. Evidence: contract. - [ ] X.1.b Authorize and transfer the minimal tenant/project-scoped manifest idempotently without granting Yemaya Isis generation authority. Evidence: seam tests. - [ ] X.1.c Create a Yemaya project reference/import revision that retains canonical Isis identity and provenance. Evidence: integration test. - [ ] X.1.d Propagate Isis supersession/revoke/quarantine/recall and verify Yemaya project/derivative state by read-back. Evidence: traced journey. - [ ] X.2 Prove Yemaya-promoted assets enter Oshun output gallery through the editorial boundary. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.2.a Define the Yemaya promotion/gallery-ingest contract with exact asset/project/release revisions, editorial decision, rights, quality, provenance, renditions, locale, and lifecycle. Evidence: contract. - [ ] X.2.b Require authorized editorial promotion and current gallery eligibility without granting the gallery Yemaya mutation authority. Evidence: boundary tests. - [ ] X.2.c Materialize permission-aware gallery projection/renditions and verify displayed/downloaded bytes/metadata against the manifest. Evidence: integration journey. - [ ] X.2.d Propagate supersession/unpublish/revoke/recall and reconcile search/cache/gallery/consumer state. Evidence: read-back test. - [ ] X.3 Prove Aja motion assets can enter Yemaya/Bellona without bypassing consent, watermark, or validation. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.3.a Define Aja motion export contract with exact artifact/skeleton/ mapping/profile/quality/consent/rights/watermark/provenance revisions and intended consumers. Evidence: contract. - [ ] X.3.b Enforce current consent, quality, compatibility, disclosure, and watermark gates at Aja handoff and Yemaya/Bellona intake. Evidence: negative tests. - [ ] X.3.c Import/reference through public Yemaya and Bellona contracts while preserving Aja authority and immutable lineage. Evidence: integrations. - [ ] X.3.d Propagate subject/consent/quality/artifact revoke or recall to projects/builds/packages/targets and verify closure. Evidence: traced journey. - [ ] X.4 Prove Bellona can package Yemaya/Aja/Isis artifacts without mutating their authoritative lineage. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.4.a Define a common immutable producer-artifact reference contract with domain authority, exact revision/checksum, dependencies, rights/ consent/canon/quality, and recall endpoint. Evidence: contract. - [ ] X.4.b Resolve and lock producer refs through public APIs without copying or rewriting authoritative provenance records. Evidence: resolver tests. - [ ] X.4.c Build Bellona package manifests/representations with conversion lineage pointing back to each producer identity. Evidence: integration test. - [ ] X.4.d Read back package/target and prove source authority/provenance unchanged; propagate producer recall. Evidence: traced journey. - [ ] X.5 Prove Metis media uses curated Isis and Yemaya surfaces rather than raw generation machinery. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.5.a Define the curated-media discovery/selection contract with approved asset/release/rendition, audience/locale, rights/consent, accessibility, correctness, and provenance. Evidence: contract. - [ ] X.5.b Restrict Metis identity/capabilities to curated search/preview/use and prohibit raw generation/model/job/configuration endpoints. Evidence: least-privilege tests. - [ ] X.5.c Select and attach exact eligible Isis/Yemaya media revisions to a Metis lesson through public seams. Evidence: integration journey. - [ ] X.5.d Propagate media correction/unpublish/revoke/recall and verify learner rendering/catalog/cache reconciliation. Evidence: read-back. - [ ] X.6 Prove Metis embodied instruction calls Aja only through the canonical adapter and handles degraded health. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.6.a Define/version the canonical health/capability, demonstration, overlay, asynchronous handoff/status/result/cancel contracts. Evidence: adapter spec. - [ ] X.6.b Prevent Metis imports/credentials/calls to Aja internal jobs, models, media, stores, or privileged APIs. Evidence: architecture and auth tests. - [ ] X.6.c Run demonstration/overlay/handoff journeys with idempotency, correlation, consent/quality/provenance, and intended-use boundaries. Evidence: integration trace. - [ ] X.6.d Handle healthy/degraded/unavailable/incompatible/stale/late result states without fabricating guidance or success. Evidence: failure journey. - [ ] X.7 Prove Veritas and Metis grounding share generic mechanics while retaining distinct source/claim policies. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.7.a Define shared source ingestion, chunking, retrieval, citation, claim-evidence, revision, correction, audit, and evaluator primitives. Evidence: generic contracts. - [ ] X.7.b Define separate Veritas publication/source-risk and Metis pedagogy/curriculum/learner claim policies, roles, thresholds, and outputs. Evidence: policy contracts. - [ ] X.7.c Run identical mechanical fixtures through both domains and prove shared behavior where intended. Evidence: integration comparison. - [ ] X.7.d Run policy-divergent fixtures and prove neither domain inherits the other's admissibility, verdict, review, or release decision. Evidence: boundary journey. - [ ] X.8 Prove Euterpe-generated or edited audio carries rights/provenance when consumed by Isis, Yemaya, Veritas, or Metis. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.8.a Define Euterpe audio handoff with source/voice/performer/model/ edit revisions, rights/license/consent, generated/edited ranges, disclosure, quality, renditions, and checksum. Evidence: contract. - [ ] X.8.b Enforce consumer-specific intended use, locale, accessibility, quality, rights, and consent at each intake. Evidence: eligibility tests. - [ ] X.8.c Run independent Isis, Yemaya, Veritas, and Metis consumption journeys retaining canonical Euterpe lineage. Evidence: integration matrix. - [ ] X.8.d Propagate source/voice/performer rights or consent revoke and verify every derivative/publication/lesson/project. Evidence: recall trace. - [ ] X.9 Prove identity, tenant, workspace, locale, and trace context survive every registered cross-domain handoff. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.9.a Register every handoff with allowed identity/service actor, tenant/project/workspace mapping, locale/time zone, trace/baggage, and data-classification rules. Evidence: context registry. - [ ] X.9.b Propagate authenticated actor/on-behalf-of and least-privilege service identity without forwarding reusable credentials. Evidence: identity tests. - [ ] X.9.c Map tenant/workspace/object scopes explicitly and reject missing, ambiguous, stale, or cross-tenant context. Evidence: isolation tests. - [ ] X.9.d Preserve locale/time zone and tenant-safe trace/causation through async queues/webhooks/retries while bounding/redacting baggage. Evidence: traced matrix. - [ ] X.10 Prove cross-domain retries are idempotent and do not duplicate jobs, assets, reviews, releases, grades, or notifications. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.10.a Define operation-specific idempotency scope/key/request hash, retention window, response replay, conflict, and retry-safe boundary. Evidence: contract. - [ ] X.10.b Persist producer outbox and consumer inbox/dedupe state transactionally with domain mutation. Evidence: atomicity tests. - [ ] X.10.c Inject duplicate, delayed, reordered, lost-ack, timeout, crash, and concurrent retry at every handoff. Evidence: fault matrix. - [ ] X.10.d Verify authoritative counts/identities and downstream read-back show one job/asset/review/release/grade/notification side effect. Evidence: traced journey. - [ ] X.11 Prove source, consent, rights, model, canon, or artifact revocation reaches every registered downstream consumer. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.11.a Maintain a complete versioned consumer/dependency registry from each revocable authority to derivatives, caches, indexes, packages, releases, channels, targets, and external consumers. Evidence: registry. - [ ] X.11.b Emit signed minimal revocation events with authority, exact subject/revision/scope, effective time, reason class, replacement, and correlation. Evidence: event contract. - [ ] X.11.c Compute impact and execute fail-closed quarantine/unpublish/ recall/recompute/review actions per consumer with checkpoint/retry. Evidence: propagation tests. - [ ] X.11.d Verify every consumer/target by read-back and retain unreachable/ failed recipients as unresolved incidents. Evidence: closure report. - [ ] X.12 Prove cross-domain search and notifications do not leak protected titles, counts, source identities, learner data, biometric data, or unreleased media. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.12.a Define allowed search/notification fields and prohibited titles/ counts/identity/learner/biometric/unreleased/content metadata by domain/role/purpose. Evidence: data policy. - [ ] X.12.b Build authorization-filtered minimal projections before indexing or notification fan-out. Evidence: projection tests. - [ ] X.12.c Test query/suggestion/facet/count/snippet/timing/error and notification recipient/subject/body/link/preview inference attacks. Evidence: leakage suite. - [ ] X.12.d Propagate permission/release/consent/revocation changes to indexes, caches, digests, queued notifications, and external delivery. Evidence: reconciliation journey. - [ ] X.13 Prove deep links enforce current authorization, tenant, expiry, and object existence instead of trusting embedded context. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.13.a Register allowed issuer/audience/route/purpose/context fields, maximum lifetime, return behavior, and prohibited secrets/authority. Evidence: link policy. - [ ] X.13.b Mint signed links with tenant/project/object/revision, audience, purpose, expiry, nonce, and key version. Evidence: signature tests. - [ ] X.13.c Validate signature/audience/tenant/expiry/replay plus current actor authorization, object existence/revision, and lifecycle at load. Evidence: negative matrix. - [ ] X.13.d Render safe forbidden/expired/missing/stale outcomes without existence leakage and require fresh authorization for any mutation. Evidence: browser journey. - [ ] X.14 Prove audit and trace records reconstruct each cross-domain journey without storing protected content. Evidence: cross-domain contract, integration test, and traced journey. - [ ] X.14.a Define common correlation/causation/resource revision/event time/ actor/service/domain/action/outcome fields and domain-owned audit event mappings. Evidence: audit contract. - [ ] X.14.b Apply structured allowlists/redaction/hashing to content, source/ subject identity, biometrics, learner data, free text, secrets, URLs, and paths before export. Evidence: redaction tests. - [ ] X.14.c Preserve immutable ordered evidence refs through synchronous and asynchronous calls, queues, webhooks, retries, compensation, and recall. Evidence: trace continuity test. - [ ] X.14.d Reconstruct representative successful/failed/partial/retried/ revoked journeys using refs and authorized drill-down, not copied protected content. Evidence: investigation exercise. - [ ] X.15 Prove version negotiation and compatibility windows across all producer/consumer pairs. Evidence: compatibility matrix. - [ ] X.15.a Register every producer/consumer contract/profile/event/SDK pair with supported versions, capabilities, constraints, owner, environment, and support dates. Evidence: matrix. - [ ] X.15.b Negotiate the highest mutually approved version/capability deterministically and bind it to the handoff. Evidence: selection tests. - [ ] X.15.c Test current/prior/next unknown fields, optional capability, deprecation, expiry, downgrade, and unsupported combinations per pair. Evidence: skew suite. - [ ] X.15.d Surface expiring/incompatible consumers and block silent coercion or use outside the compatibility window. Evidence: operational gate. - [ ] X.16 Run end-to-end failure drills across provider, queue, storage, search, host, target, and publisher dependencies. Evidence: no silent success or irrecoverable partial state. - [ ] X.16.a Define failure injection points and expected state/ownership/ retry/compensation/recovery for each dependency and handoff. Evidence: drill plan. - [ ] X.16.b Inject provider and queue timeout/unavailable/duplicate/reorder/ poison/dead-letter cases during representative journeys. Evidence: messaging report. - [ ] X.16.c Inject database/blob/cache/search/index corruption/loss/staleness and reconcile authoritative state. Evidence: storage/search report. - [ ] X.16.d Inject host/worker/target/publisher outage, partial commit, unknown outcome, and late result. Evidence: external dependency report. - [ ] X.16.e Verify UI/API/events/audit expose exact failed/partial/degraded state and recovery/read-back reaches closure within objectives. Evidence: end-to-end scorecard. - [ ] X.17 Prove Metis lecture, diagram, simulation, voice, and other teaching media use Isis/Yemaya/Euterpe provider and production seams with source/correctness/accessibility/consent lineage intact. Evidence: contract, traced journey, revocation, and learner-render read-back. - [ ] X.17.a Define separate lecture/diagram/simulation/image/video/audio/ voice handoff profiles with source/claim/correctness/accessibility/ consent/rights/provenance requirements. Evidence: contracts. - [ ] X.17.b Route generation/production only through authorized Isis/Yemaya/ Euterpe public seams and retain Metis pedagogical/editorial authority. Evidence: boundary tests. - [ ] X.17.c Run each media type from source-linked request through candidate/ review/validation/lesson attachment and accessible learner render. Evidence: traced matrix. - [ ] X.17.d Propagate source correction/withdrawal and media/voice/consent revocation into lessons/catalogs/caches and verify learner read-back. Evidence: recall journey. - [ ] X.18 Prove Veritas podcast, video, live, social, and multilingual assets use governed Euterpe/Yemaya/Isis production seams without granting those systems protected-source or publication authority. Evidence: least-privilege contract and correction/retraction journey. - [ ] X.18.a Define separate podcast/video/live/social/multilingual production requests containing only approved script/claim/source-safe refs, publication intent, locale, rights, and accessibility requirements. Evidence: contracts. - [ ] X.18.b Enforce least-privilege provider identities/views that cannot access protected sources or decide publication/correction. Evidence: authorization tests. - [ ] X.18.c Run each asset type through Euterpe/Yemaya/Isis production, Veritas review/gates, channel packaging/publication, and target read- back. Evidence: traced matrix. - [ ] X.18.d Propagate Veritas correction/retraction and provider asset/voice/ consent recall without transferring editorial authority. Evidence: lifecycle journey. - [ ] X.19 Prove Yemaya's engine/DCC, virtual-production, XR, mocap, render, and build actions use Bellona public contracts and Aja handoffs without duplicating bridge/runtime authority. Evidence: host-specific traced journeys and version/failure behavior. - [ ] X.19.a Define Yemaya-to-Bellona project/asset/action/target requests and Bellona status/result/evidence contracts with exact revisions and ownership. Evidence: seam spec. - [ ] X.19.b Define Aja motion/capture handoff contracts and prevent Yemaya or Bellona from duplicating Aja consent/quality authority. Evidence: boundary tests. - [ ] X.19.c Run engine/DCC, VP, XR, mocap, render, and build journeys through public typed commands per supported host/profile. Evidence: traces. - [ ] X.19.d Exercise version incompatibility, host/device/resource loss, partial target, cancel/rollback, and read-back without duplicate runtime control. Evidence: fault matrix. - [ ] X.20 Prove Bellona cross-domain and lore-to-engine compilation preserves Hathor/Yemaya/Isis/Aja source entity IDs, canon, generated ingredients, consent, rights, revisions, mappings, and target artifacts. Evidence: deterministic evidence bundle and downstream read-back. - [ ] X.20.a Define producer-specific source manifests with stable entity/ revision/canon/ingredient/consent/rights/artifact identities and correction/revoke hooks. Evidence: contracts. - [ ] X.20.b Record every normalized intermediate and source-to-target entity/property/asset mapping, default, substitution, omission, and human decision. Evidence: mapping ledger. - [ ] X.20.c Compile with pinned toolchain/templates/adapters/models/config/ seeds/environment and preserve deterministic or disclosed nondeterministic step provenance. Evidence: compilation trace. - [ ] X.20.d Assemble signed evidence and read back target entities/assets/ state to verify all source IDs/revisions/canon/rights/mappings. Evidence: deterministic bundle. - [ ] X.20.e Propagate source/canon/consent/rights/artifact changes through recompilation/quarantine/recall and verify target closure. Evidence: lifecycle test. - [ ] X.21 Prove Veritas correction/retraction and Metis source withdrawal propagate into generated audio/video/lecture/diagram/simulation, newsletters/social/B2B, catalogs, and other registered derivatives. Evidence: complete consumer registry, saga, and verified read-back. - [ ] X.21.a Register every derivative type/channel/catalog/external consumer with producer source/claim refs, authoritative mutation endpoint, correction action, read-back, and owner. Evidence: zero-orphan registry. - [ ] X.21.b Emit versioned correction/retraction/withdrawal events with exact scope/effective time/replacement/reason/correlation and no protected payload. Evidence: event contract. - [ ] X.21.c Traverse generated media/teaching assets/publications/social/B2B/ catalog derivatives and preview required update/unpublish/recompute/ notification. Evidence: impact report. - [ ] X.21.d Execute a resumable idempotent propagation saga with per-consumer retry/compensation and explicit unreachable/partial state. Evidence: saga tests. - [ ] X.21.e Verify every registered target by read-back and keep incomplete closure as an incident. Evidence: reconciliation report. - [ ] X.22 Prove Euterpe and Aja biometric/voice/performer/subject consent revocation reaches Isis-generated derivatives, Yemaya projects, Bellona packages/builds, Metis lessons, and Veritas media. Evidence: impact preview and fail-closed recall journey. - [ ] X.22.a Maintain protected dependency edges from Euterpe voice/ performer and Aja subject/source consent grants to all registered derivatives/uses without exposing identity. Evidence: dependency audit. - [ ] X.22.b Ingest revocation with authenticated authority, exact grant/ subject-safe scope, effective time, purpose/region, replacement, and legal-hold semantics. Evidence: revocation contract. - [ ] X.22.c Preview affected Isis assets, Yemaya projects, Bellona artifacts/ packages/builds/targets, Metis lessons, and Veritas publications with release risk. Evidence: impact view. - [ ] X.22.d Immediately block new use/export/release and execute quarantine/ unpublish/recall/recompute across domains with retry. Evidence: fail- closed journey. - [ ] X.22.e Verify every store/cache/index/channel/target by read-back while preserving protected audit/legal-hold evidence. Evidence: closure report. - [ ] X.23 Prove marketplaces, plugins/models, external SDK clients, webhooks, remote agents, DCC hosts, devices, distributors, and channel adapters use common identity/tenant/version/audit principles without sharing secrets or authority implicitly. Evidence: external-boundary contract and adversarial matrix. - [ ] X.23.a Define common external principal/device/workload identity, enrollment/authentication, tenant/project scope, capability grant, version negotiation, secret ownership, audit, and revoke primitives. Evidence: boundary standard. - [ ] X.23.b Define specialized profiles for marketplaces/models/plugins, SDK/webhook clients, agents/MCP, DCC/devices, and distributors/channels without collapsing their risks or authority. Evidence: profile matrix. - [ ] X.23.c Prove credentials/secrets are audience/environment/tenant/ purpose-bounded, independently rotated, never forwarded, and cannot confer another integration's authority. Evidence: secret tests. - [ ] X.23.d Test spoof/replay/version downgrade, tenant confusion, privilege expansion, tool/content injection, supply-chain tamper, duplicate side effect, audit tamper, and revoke per profile. Evidence: adversarial matrix. - [ ] X.23.e Reconcile lifecycle/compatibility/security status across all external boundaries and surface unsupported/expired actors. Evidence: operational report. - [ ] X.24 Prove domain-specific taxonomies remain interoperable through versioned mappings rather than collapsed into a universal lossy enum. Evidence: round-trip fixtures for assets, media, rights, people/roles, locale, status, quality, and release concepts. - [ ] X.24.a Define independently owned/versioned domain taxonomies with stable IDs, meanings, aliases, constraints, lifecycle, and code-owned floors. Evidence: taxonomy registry. - [ ] X.24.b Define pairwise/contextual mapping records with source/ destination versions, exact/broader/narrower/compound/unmapped/ prohibited relation, conditions, and owner. Evidence: mapping schema. - [ ] X.24.c Require explicit unmapped/ambiguous/loss states and human/policy decision instead of a universal fallback enum. Evidence: negative tests. - [ ] X.24.d Round-trip asset/media/rights/people-role/locale/status/quality/ release fixtures and verify preserved identity or declared loss. Evidence: fixture matrix. - [ ] X.24.e Preview and migrate mapping/taxonomy version changes across contracts/search/data/gates/releases with compatibility windows. Evidence: lifecycle journey. --- ## 6. Rollout waves and final definition of done Recommended waves: 1. Baseline, standards, scope decisions, and shared kit. 2. Tara migration proof. 3. Metis and Veritas, because their V1 authoring scope and grounding reuse are the clearest. 4. Isis integration across the existing three audience hosts. 5. Yemaya AAA-suite reconciliation plus study/case additions inside the existing Studio. 6. Aja and Bellona operations consoles, with supported-host matrices. 7. Euterpe integration and release profiles in its existing Studio. 8. Cross-domain revocation, recovery, performance, and launch exercises. - [ ] DONE.1 Every checkbox claimed complete links to authoritative current evidence. Evidence: automated missing-evidence audit. - [ ] DONE.1.a Parse every parent/child checkbox and require exactly one non-placeholder evidence statement or immutable evidence reference. Evidence: ledger schema audit. - [ ] DONE.1.b Resolve referenced files/URLs/records, revisions/checksums, owners, dates, and environment against authoritative current sources. Evidence: evidence-link audit. - [ ] DONE.1.c Mark stale, missing, unverifiable, superseded, revoked, or unauthorized evidence as non-complete. Evidence: negative fixtures. - [ ] DONE.1.d Block a completed parent while any required child/evidence is incomplete. Evidence: hierarchy audit. - [ ] DONE.2 Every discovered package, route, app, contract, migration, job, gate, publisher, and critical journey has an explicit disposition. Evidence: zero unclassified inventory rows. - [ ] DONE.2.a Regenerate normalized inventories from repository, deployment, contract/schema, migration, job/event, gate, publisher, and test sources. Evidence: inventory manifests. - [ ] DONE.2.b Match each stable inventory row to exactly one retained/ refactored/migrated/replaced/removed/external/deferred disposition with owner/rationale/destination. Evidence: mapping audit. - [ ] DONE.2.c Resolve duplicate, conflicting, obsolete, and newly discovered rows through domain-owner review. Evidence: disposition log. - [ ] DONE.2.d Prove no unclassified or orphaned rows and no ledger disposition lacks a source item or explicit net-new scope. Evidence: zero-orphan audit. - [ ] DONE.3 Every capability in Section 3 is implemented per applicable domain or has an approved decision record with compensating control. Evidence: final release-evidence index and requirement audit. - [ ] DONE.3.a Map each Section 3 capability to every applicable domain/ profile/host/target with owner and applicability rationale. Evidence: coverage matrix. - [ ] DONE.3.b Link implemented cells to exact design/code/schema/migration/ test/operation evidence. Evidence: traceability audit. - [ ] DONE.3.c Link non-implemented cells to named approved decision, risk, compensating control, validation, expiry, and remediation owner. Evidence: exception audit. - [ ] DONE.3.d Block completion on missing, inherited, stale, or inapplicable- without-rationale cells. Evidence: final requirement gate. - [ ] DONE.4 Every domain-specific algorithm has independently verified known-value tests. Evidence: final release-evidence index and requirement audit. - [ ] DONE.4.a Register every production algorithm/version/profile and its inputs, outputs, units, applicability, owner, and release consumers. Evidence: algorithm registry. - [ ] DONE.4.b Provide analytically, independently, or externally derived valid/boundary/invalid fixtures with expected values/tolerances and checksums. Evidence: fixture manifests. - [ ] DONE.4.c Run current implementations against fixtures in supported environments and retain raw results/version provenance. Evidence: test reports. - [ ] DONE.4.d Prove no algorithm inherits another algorithm/profile's proof and unavailable evaluation cannot pass. Evidence: coverage gate. - [ ] DONE.5 Every model-based evaluator has current calibration, uncertainty, subgroup, threshold, drift, and human-review evidence. Evidence: final release-evidence index and requirement audit. - [ ] DONE.5.a Register exact model/evaluator/config/preprocessing/corpus/ labels/splits/intended-use versions and protected-data approvals. Evidence: evaluator registry. - [ ] DONE.5.b Measure performance, calibration, uncertainty/abstention, subgroup error, out-of-distribution behavior, and human disagreement on current held-out data. Evidence: evaluation report. - [ ] DONE.5.c Ratify pass/fail/review thresholds from declared costs and prohibit low-confidence/unavailable from passing. Evidence: threshold record. - [ ] DONE.5.d Verify drift monitoring, expiry, replacement/canary/rollback, and historical replay. Evidence: operational proof. - [ ] DONE.6 Every provider or external host is live in the approved environment or fails loudly as not configured/unavailable. Evidence: final release-evidence index and requirement audit. - [ ] DONE.6.a Register each required provider/host/target/environment with approved identity, endpoint, version/profile, credentials owner, capability, and health contract. Evidence: dependency registry. - [ ] DONE.6.b Run least-privilege live capability/health and representative operation probes in the approved environment. Evidence: probe reports. - [ ] DONE.6.c Exercise missing credentials/configuration, outage, timeout, incompatible version, degraded, and revoked states. Evidence: failure matrix. - [ ] DONE.6.d Prove APIs/UI/jobs/releases show explicit unavailable/not- configured state and never fixture or false success. Evidence: honesty gate. - [ ] DONE.7 Every mutation path has auth, object/property authorization, idempotency/concurrency, audit, tenancy, and negative tests. Evidence: final release-evidence index and requirement audit. - [ ] DONE.7.a Inventory every UI/API/job/CLI/SDK/webhook/agent/host/database mutation and its authoritative surface. Evidence: mutation registry. - [ ] DONE.7.b Test authentication, role/capability, tenant/project, object, property, purpose/consent, step-up/dual control, and secret boundaries. Evidence: authorization matrix. - [ ] DONE.7.c Test idempotency, expected revision/optimistic concurrency, duplicate/reorder/retry, TOCTOU, cancellation, and late result. Evidence: race suite. - [ ] DONE.7.d Verify immutable redacted audit/outbox, target read-back, and two-tenant isolation for success/failure/partial/compensation. Evidence: integration proof. - [ ] DONE.7.e Resolve or block every untested/duplicate/bypass mutation path. Evidence: zero-gap gate. - [ ] DONE.8 Every release/export path recomputes current gates, locks exact revisions, writes deterministically where possible, and verifies by target read-back. Evidence: final release-evidence index and requirement audit. - [ ] DONE.8.a Inventory every release/export/publish/deploy/package/channel path with target/profile/version and authoritative gate owner. Evidence: release registry. - [ ] DONE.8.b Recompute current quality, rights/consent, safety/integrity, security, compatibility, approval, and target gates immediately before execution. Evidence: freshness tests. - [ ] DONE.8.c Lock exact source/dependency/config/toolchain/model/adapter/ validator/profile/approval/target revisions and checksums. Evidence: candidate manifests. - [ ] DONE.8.d Produce deterministic bytes/manifests/signatures where possible or declare and bound nondeterminism. Evidence: reproducibility reports. - [ ] DONE.8.e Independently read back target contents/state/identity/ checksums/semantics and block transport-only success. Evidence: target verification matrix. - [ ] DONE.9 Every revocation/correction/recall path reaches all registered downstream dependencies and proves closure by read-back. Evidence: final release-evidence index and requirement audit. - [ ] DONE.9.a Register every revocable source/consent/right/model/canon/ artifact/claim/release authority and downstream derivative/consumer/ target edge. Evidence: dependency registry. - [ ] DONE.9.b Test exact impact preview, authority, effective scope/time, replacement, legal hold, and fail-closed new-use block. Evidence: control tests. - [ ] DONE.9.c Execute resumable idempotent propagation with checkpoint, retry, compensation, notification, and explicit unreachable/partial state. Evidence: saga matrix. - [ ] DONE.9.d Read back every store/cache/index/package/channel/target/ external consumer and keep unresolved closure as an incident. Evidence: reconciliation proof. - [ ] DONE.10 Every critical browser journey has deep Playwright coverage against live or explicitly labeled hermetic dependencies. Evidence: final release-evidence index and requirement audit. - [ ] DONE.10.a Inventory critical role/domain/profile/host/target journeys, mutations, failures, mobile paths, and accessibility alternatives. Evidence: browser coverage matrix. - [ ] DONE.10.b Use live approved dependencies or explicit production- equivalent hermetic adapters with persistent fixture labeling and contract parity. Evidence: environment manifests. - [ ] DONE.10.c Assert authoritative backend/target state, exact revisions, evidence/lineage, authorization, idempotency, and read-back—not only screenshots or DOM. Evidence: Playwright traces. - [ ] DONE.10.d Cover loading/empty/stale/partial/degraded/unavailable/failure/ retry/cancel/recovery and retain diagnostics/artifacts. Evidence: fault coverage. - [ ] DONE.10.e Eliminate or approve every critical unautomated gap with owner, reason, equivalent proof, and expiry. Evidence: final audit. - [ ] DONE.11 Every applicable route meets WCAG 2.2 AA with keyboard, announcement, non-drag, zoom, theme, viewport, locale, and semantic alternative coverage. Evidence: final release-evidence index and requirement audit. - [ ] DONE.11.a Inventory authenticated/public routes, roles, states, complex widgets, visualizations, media, and critical actions by applicability. Evidence: accessibility matrix. - [ ] DONE.11.b Run automated WCAG checks across themes, locales, and wide/ compact/single-column viewports. Evidence: automated reports. - [ ] DONE.11.c Complete keyboard/screen-reader journeys with focus, announcements, error recovery, step-up, status, and dynamic updates. Evidence: assistive-technology traces. - [ ] DONE.11.d Verify non-drag controls, 200–400% zoom/reflow, touch targets, color independence, reduced motion, captions/transcripts, and semantic graph/3D/canvas/media parity. Evidence: manual/automated results. - [ ] DONE.11.e Close or explicitly block every severity/applicability gap; no domain/profile inherits another's evidence. Evidence: release gate. - [ ] DONE.12 Every interactive and asynchronous path meets its ratified performance, reliability, capacity, and cost budgets. Evidence: final release-evidence index and requirement audit. - [ ] DONE.12.a Inventory interactive routes/actions and async API/queue/ worker/provider/host/build/publisher paths with populations and owners. Evidence: budget registry. - [ ] DONE.12.b Ratify latency/responsiveness/throughput/availability/ correctness/durability/capacity/cost indicators and budgets by tier. Evidence: SLO records. - [ ] DONE.12.c Run representative/worst-supported sustained, burst, large- object, slow dependency, and failure/recovery tests. Evidence: load reports. - [ ] DONE.12.d Verify backpressure/quotas/fairness/degradation/cancellation, bounded resource use, tenant isolation, data integrity, and cost. Evidence: overload proof. - [ ] DONE.12.e Link operational telemetry/error budgets and block unresolved regressions or unmeasured critical paths. Evidence: final gate. - [ ] DONE.13 Every supported standards/profile/host/target pair has its own conformance evidence and declared limitations. Evidence: final release-evidence index and requirement audit. - [ ] DONE.13.a Generate the exact supported standards/profile/producer/ consumer/host/plugin/OS/target/version pair matrix with owners and support windows. Evidence: compatibility registry. - [ ] DONE.13.b Run pair-specific contract, known-value/fidelity, security, accessibility, performance, failure/recovery, and read-back tests. Evidence: conformance bundles. - [ ] DONE.13.c Record unsupported/partial/lossy/nondeterministic limitations, mitigations, UI/docs/API discovery, and expiry per pair. Evidence: limitations registry. - [ ] DONE.13.d Declare unavailable cells explicitly and block one pair/ profile/host/target from inheriting another's proof. Evidence: independence audit. - [ ] DONE.14 Security, privacy, safety, rights, integrity, accessibility, and supply-chain scans have zero unresolved release blockers. Evidence: final release-evidence index and requirement audit. - [ ] DONE.14.a Define current threat/data/safety/rights/accessibility/supply- chain scopes, severity policy, scanner/tool/config versions, owners, and exception rules. Evidence: assurance plan. - [ ] DONE.14.b Run code/dependency/container/IaC/secret/license/SBOM/ provenance, application/host/agent adversarial, privacy leakage, safety/ claim, rights/consent, integrity, and accessibility assessments. Evidence: current reports. - [ ] DONE.14.c Deduplicate/triage findings, prove remediation with targeted regression, and record residual limitations. Evidence: closure records. - [ ] DONE.14.d Verify zero unresolved release blockers and no expired, overbroad, conflicting, or self-approved exception. Evidence: release gate. - [ ] DONE.15 Backup, restore, replay, rollback, revocation, dependency outage, and disaster-recovery drills meet ratified RPO/RTO. Evidence: final release-evidence index and requirement audit. - [ ] DONE.15.a Inventory authoritative databases/blobs/evidence/config/keys/ indexes/queues/targets and ratify RPO/RTO, retention, restore order, and owners. Evidence: recovery plan. - [ ] DONE.15.b Execute backup integrity and clean-environment restore with checksums, keys/config, permissions, queues/indexes, and target reconciliation. Evidence: restore report. - [ ] DONE.15.c Execute event/job replay, release/deployment rollback, source/consent/correction revocation, and provider/host/target outage drills. Evidence: drill matrix. - [ ] DONE.15.d Measure data loss, downtime, duplicate/partial work, consumer/ target inconsistency, and achieved RPO/RTO. Evidence: scorecard. - [ ] DONE.15.e Remediate and rerun every missed objective or unresolved recovery path. Evidence: closure proof. - [ ] DONE.16 Documentation, generated API references, compatibility matrices, user help, runbooks, and architecture diagrams match the shipped system. Evidence: final release-evidence index and requirement audit. - [ ] DONE.16.a Inventory required operator/developer/user/policy/runbook/ architecture/compatibility documents with owners, audience, source, and release version. Evidence: documentation registry. - [ ] DONE.16.b Regenerate API/event/SDK/CLI/host contracts and compatibility/ limitation matrices from authoritative sources. Evidence: drift-free artifacts. - [ ] DONE.16.c Verify commands, routes, permissions, examples, screenshots, links, diagrams, versions, defaults, failure/recovery, and support contacts against the release candidate. Evidence: doc tests. - [ ] DONE.16.d Run representative user/operator/developer tasks from docs in clean environments and correct discrepancies. Evidence: walkthroughs. - [ ] DONE.16.e Block stale, contradictory, inaccessible, unlocalized where required, or orphaned documentation. Evidence: final docs gate. - [ ] DONE.17 Feature flags, fixtures, compatibility shims, temporary migrations, deprecated routes, and honesty debt each have an owner and removal date. Evidence: final release-evidence index and requirement audit. - [ ] DONE.17.a Inventory every flag, fixture/demo path, shim/adapter, temporary dual read/write/backfill, deprecated route/API/schema, and misleading/placeholder state. Evidence: debt registry. - [ ] DONE.17.b Record purpose, exact scope, owner, introduced date, dependencies, risk, telemetry, removal criterion/date, and rollback. Evidence: complete rows. - [ ] DONE.17.c Prove production fixtures are visibly labeled/non-mutating, flags fail safely, shims honor compatibility, and deprecations notify consumers. Evidence: behavior tests. - [ ] DONE.17.d Create tracked removal work and alert/escalate overdue or ownerless entries; block release blockers and expired shims. Evidence: governance gate. - [ ] DONE.18 Engineering-readiness packets are current and reproducible from repository evidence. Evidence: final release-evidence index and requirement audit. - [ ] DONE.18.a Define packet schema for release identity, scope, traceability, contracts/migrations, verification, assurance, SLO/performance, recovery, runbooks, limitations, approvals, and provenance. Evidence: schema. - [ ] DONE.18.b Assemble packets from immutable repository/test/build/target artifacts and approved external evidence with exact revisions/ checksums. Evidence: generated packets. - [ ] DONE.18.c Validate links/checksums/freshness/coverage/signatures and surface missing/failed/stale/waived/unavailable proof. Evidence: packet audit. - [ ] DONE.18.d Reproduce packets from a clean checkout/environment and obtain identical canonical hashes except declared nondeterministic fields. Evidence: reproducibility test. - [ ] DONE.19 Named human governance approvals exist for each audience, host, standard profile, and supported integration. Evidence: final release-evidence index and requirement audit. - [ ] DONE.19.a Register required approver roles/competence/independence, scope, evidence prerequisites, decision options, conditions, expiry, and invalidation triggers. Evidence: approval policy. - [ ] DONE.19.b Generate exact audience/host/profile/integration coverage matrix and attach the immutable release/readiness evidence presented. Evidence: review packets. - [ ] DONE.19.c Capture named signed approve/reject/conditional decisions with role, time, exact revision/scope, rationale, conditions, and conflicts. Evidence: approval records. - [ ] DONE.19.d Block missing/inherited/expired/stale/conflicted approvals and reapprove after material change. Evidence: governance gate. - [ ] DONE.20 The release commit is present on `origin/main`; no local-only commit or branch divergence remains. Evidence: final release-evidence index and requirement audit. - [ ] DONE.20.a Verify applicable checks pass on the exact staged diff and no unrelated/user changes are included. Evidence: verification/staging record. - [ ] DONE.20.b Commit with a task-scoped message and record commit identity, tree, authorship, verification, and release-evidence refs. Evidence: local commit. - [ ] DONE.20.c Fetch and integrate current `origin/main`, resolve conflicts, and rerun affected verification when remote history moved. Evidence: integration record. - [ ] DONE.20.d Push the exact release commit to `origin/main` and verify local `HEAD` equals the fetched remote branch tip. Evidence: remote parity check. - [ ] DONE.20.e Verify no relevant uncommitted change, local-only commit, or branch divergence remains. Evidence: final Git status. - [ ] DONE.21 The atomic capability inventory is bidirectionally complete: every feature asserted or implemented by an app, route, component, package, contract, API/job/CLI, schema, event, test, inventory, deep dive, walkthrough, proposal, or release spec has a reviewed disposition and ledger mapping, and every ledger feature maps back to authoritative or explicitly net-new scope. Evidence: deterministic zero-orphan audit and seven named domain-owner approvals. - [ ] DONE.21.a Enumerate and normalize feature assertions from every named repository and documentation source with stable source location, symbol/route/contract ID, domain, owner, and checksum. Evidence: deterministic source inventory. - [ ] DONE.21.b Decompose compound assertions into independently reviewable capabilities without generating generic or keyword-derived task text. Evidence: semantic review record. - [ ] DONE.21.c Map every source capability to one or more exact ledger parents/children and a reviewed retain/refactor/migrate/replace/remove/ external/defer/net-new disposition. Evidence: forward mapping. - [ ] DONE.21.d Map every ledger capability back to authoritative source items or an explicitly approved net-new requirement with rationale/ owner/proof. Evidence: reverse mapping. - [ ] DONE.21.e Detect and resolve unmapped/orphaned/duplicate/conflicting/ obsolete/ambiguous items deterministically and preserve reviewed exceptions. Evidence: zero-orphan audit. - [ ] DONE.21.f Obtain named Isis, Metis, Yemaya, Veritas, Euterpe, Aja, and Bellona owner approval of their inventories, dispositions, boundaries, and unresolved limitations. Evidence: seven signoffs. This ledger is complete only when the evidence proves the full system. A large amount of existing code, a green narrow test, an attractive demo, or the absence of an obvious TODO is not proof of completion.