Candidate Evidence Handoff Preflight and Template

Purpose

Workstream: Internal Knowledge.

Audience: Lee and auto-orch operators, including Agent-Orch maintainers preparing an operator-facing evidence handoff, together with future Internal Knowledge playbook authors and independent readers who need to reconstruct the handoff.

Intended outcome: A bounded, auditable packet that lets a maintainer show what was checked, which authority owns each fact, where the result lives, and what remains unresolved without turning a product conclusion into a platform attestation or a transition decision.

Success hypothesis: If acceptance coverage, smoke artifacts, command allowlisting, and output locations are checked before the checklist is drafted, a reader can re-execute the documented validation and distinguish a missing fact from a failed product check.

Validation journey: journey.candidate-evidence-handoff-documentation-validation in journeys/candidate-evidence-handoff-manifest.json.

The handoff is candidate-only documentation evidence. It does not modify the sealed authority, copy private governance material, establish a recurring product defect from one environment-specific reader failure, or authorize approval, activation, promotion, publication, scheduling, rollback, a release pointer, or a live-directory write. Keep those boundaries visible while the operator assembles the evidence.

Preflight Procedure

Before drafting a checklist, read the sealed preflight receipt at artifacts/preflight/candidate-evidence-handoff.json and confirm that the selected workstream is Internal Knowledge, the audience is the maintainers and operators named above, and the intended handoff outcome is still bounded. Then verify acceptance coverage: AC-1, AC-2, and AC-3 must each have a concrete artifact, a source reference, an authority owner, and at least one journey trace. A journey that is exploratory may inform discovery, but every non-exploratory journey must trace to one or more of those three checks.

Next inspect the smoke artifacts before writing prose about execution. Confirm that tests/smoke_manifest.agent-orch.json names the expected start and check contract, that tests/check_documentation_smoke.py resolves its page and registry inputs, and that the documentation-validation journey allowlists the exact re-executable command python3 -B tests/check_documentation_smoke.py. The command is a reproducible claim about how to evaluate the documentation; its presence in the manifest is not proof that a platform ran it. Record the observed exit status and output separately, including the current environment-specific Operation not permitted reader-gate blocker when that is the result. Do not replace it with a guessed product defect or a successful result from another route.

Finally, verify every command before checklist drafting: it must be a non-empty JSON string in command_allowlist, point to the declared repository inputs, and have a named output location. Compare the page metadata with its single entry in registries/pages.json, and compare the three authority-listed source IDs with their public-safe records in registries/sources.json. Preserve the independent validator evidence supplied by the governing handoff; do not self-certify it or rerun a preserved system-validator result as a substitute. The manifest's python3 -B commands are the reader-reexecution allowlist. A preserved record's declared command is copied verbatim as evidence and is not silently changed to the current reader command. Only after acceptance coverage, smoke artifacts, and re-executable commands are all accounted for should the maintainer draft the checklist and mark any result as passed, blocked, or unresolved.

Evidence-Handoff Template

Copy one row for every required artifact and complete every column. “Authority” names the boundary that owns the fact, while “Source reference” identifies the repository-relative record or preserved evidence that a reader can inspect. “Validation result” must state what was actually observed, not what the operator expected. “Command” must be the exact allowlisted invocation used or claimed, and “Output location” must point to the resulting record. If a check was not run, say so. If the evidence is blocked, retain the exact blocker and leave the conclusion unresolved.

Required artifact	Authority	Source reference	Validation result	Exact command	Output location	Unresolved blocker
Sealed authority and source boundary	Platform-owned authority boundary	`sources/authority.json`; `registries/sources.json`	Preflight observed revision `2026-08-08`, exactly `source.naming-decision`, `source.documentation-boundary`, and `source.platform-delivery-contract`, `employee_may_modify: false`, and public-safe records; AC-1 preflight passed	PYTHONDONTWRITEBYTECODE=1 python3 -c 'import json; from pathlib import Path; authority=json.loads(Path("sources/authority.json").read_text(encoding="utf-8")); registry=json.loads(Path("registries/sources.json").read_text(encoding="utf-8")); records={item["id"]: item for item in registry["sources"]}; expected={"source.naming-decision","source.documentation-boundary","source.platform-delivery-contract"}; assert authority["authority_revision"]=="2026-08-08"; assert authority["employee_may_modify"] is False; assert set(authority["source_files"])==expected; assert all(records[item]["disclosure"]=="public-safe" for item in expected); print("local authority/source preflight passed")'	`artifacts/preflight/candidate-evidence-handoff.json`	None observed; private governance and platform controls remain outside this product handoff
Selected workstream and handoff scope	Mission	`registries/workstream-selection-receipt.json`; `artifacts/preflight/candidate-evidence-handoff.json`	Receipt records Internal Knowledge, the named maintainer/operator and independent-reader audience, a bounded evidence handoff, and no affected public claim established	Not run; scope was inspected in the receipt and registry	`artifacts/preflight/candidate-evidence-handoff.json`	None in the supplied scope record
Acceptance coverage	Mission	`artifacts/preflight/candidate-evidence-handoff.json`; this page; `journeys/candidate-evidence-handoff-manifest.json`	AC-1, AC-2, and AC-3 each have a concrete artifact and one non-exploratory journey whose `acceptance_checks` and `traces_to` sets agree	Not rerun; manifest inspection and preserved validator evidence retained	`journeys/candidate-evidence-handoff-manifest.json`	None in the manifest; platform-owned execution remains separate
Smoke manifest and checker	Platform-owned reader-gate boundary	`tests/smoke_manifest.agent-orch.json`; `tests/check_documentation_smoke.py`; `artifacts/preflight/candidate-evidence-handoff.json`	One supplied reader attempt for `journey.resolve-reader-journey-harness-decision` used `python3 tests/check_documentation_smoke.py`, exited `1`, and observed `Operation not permitted` because localhost socket access was denied	Allowlisted re-execution: `python3 -B tests/check_documentation_smoke.py`; supplied attempt: `PYTHONDONTWRITEBYTECODE=1 python3 tests/check_documentation_smoke.py`	`artifacts/preflight/candidate-evidence-handoff.json`	Environment-specific evaluator denial; recurrence, affected claim, and repair target remain unresolved
Preserved product-contract validator evidence	Platform-owned validator authority	`preserved-validator-evidence.json` supplied by the Agent-Orch run	Three preserved records each report exit status `0`, passed `true`, `10` passed, `0` failed, and `0` skipped. Hashes, in supplied order, are `a0cc3d856871267cc247dab9c472f657558b1e253efe31cc2515a25badda9d23`, `9347adc57824c6378b15a155a5f3a716e14588d7549d28a5cde2c485c9a69af5`, and `63699490ab521d98b12e507f2b11c252e0fd2f6476dd8747ece84cfcd6516ff7`	`PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -p no:cacheprovider tests/test_product_contract.py` (copied from each preserved record; not rerun here)	`preserved-validator-evidence.json` supplied by the Agent-Orch run	No blocker in the preserved records; platform validator ownership is retained
Page, registry, and journey outputs	Author, subject to the product contract	`content/public/candidate-evidence-handoff.md`; `registries/pages.json`; `journeys/candidate-evidence-handoff-manifest.json`	Metadata and registry identity agree; the pre-existing required headings are retained and the provenance matrix and decision headings are added; AC-1, AC-2, and AC-3 traces and the two non-empty allowlisted commands agree	`python3 -B -m pytest -p no:cacheprovider tests/test_product_contract.py` is the manifest allowlist; deterministic projection is generated separately	`content/public/candidate-evidence-handoff.md`; `registries/pages.json`; `journeys/candidate-evidence-handoff-manifest.json`; `build/index.json`	Smoke reader result remains environment-blocked; no product defect or transition is inferred

For a handoff that is not yet complete, replace placeholders with explicit unresolved values and keep the original observation beside any later result. The minimum evidence record includes the artifact path, authority boundary, source reference, command, exit status, observed output, output location, acceptance trace, and blocker owner or owner unresolved. The preserved validator results are independent evidence: each supplied record's 10 passed, 0 failed, 0 skipped, exit status 0, command, and evidence hash must be copied only from that preserved validator artifact. The three records are retained separately because they support different upstream acceptance relationships; none is a new local validator claim. The smoke result is recorded from the permitted reader-gate environment, where the one localhost denial is unresolved. A product page may explain these distinctions, but it cannot certify platform-owned execution.

Candidate-Evidence Contract Provenance Matrix

This matrix maps each material packet claim to the source or evidence boundary that owns it, the deterministic route that can check it, the coverage actually visible in the supplied records, and a classification. A declared command is a route, not proof of execution; a platform-owned attestation is not replaced by an author assertion. “Not rerun” records the boundary of this handoff and does not turn an unobserved result into a pass.

Candidate-evidence claim or contract obligation	Authoritative source or evidence boundary	Existing deterministic test or validation route	Observed coverage status	Classification
Internal Knowledge scope, audience, bounded outcome, success hypothesis, and validation journey	`registries/workstream-selection-receipt.json`; `journeys/candidate-evidence-handoff-manifest.json`	Manifest journey `journey.candidate-evidence-handoff-preflight`; declared `python3 -B -m pytest -p no:cacheprovider tests/test_product_contract.py`	The receipt and candidate manifest state the same Internal Knowledge handoff context; this route was not rerun here	Confirmed alignment as source and declaration; execution evidence gap
Sealed authority revision `2026-08-08`, exactly three authority-listed source IDs, and `employee_may_modify: false`	`sources/authority.json`; preserved Agent-Orch validator evidence	Preserved `PYTHONDONTWRITEBYTECODE=1 python3 -m json.tool sources/authority.json`	Exit status `0`, `passed: true`, exact authority values in stdout, and evidence hash `1e034f893dedbd0177f5fe34c9bb24dac0857bb0e47f3bfced06285a574a88b6`	Confirmed alignment for the captured JSON validation; cross-file semantics are a separate check
The three authority-listed IDs have public-safe source-registry records with their recorded class, locator, revision, and digest	`registries/sources.json` joined to `sources/authority.json`	Existing packet’s explicit source-boundary preflight command; `python3 -m json.tool sources/authority.json` only validates the preserved authority record	The packet records the public-safe join, but the preserved validator for this step does not exercise the registry join and no new cross-file run is claimed	Evidence gap; do not promote the packet’s local report into a new platform attestation
Internal Knowledge is the selected queue and the exact three-queue comparison remains visible before item impact or feasibility	`registries/workstream-selection-receipt.json`	Candidate preflight journey declaration; declared `python3 -B -m pytest -p no:cacheprovider tests/test_product_contract.py` route	The receipt records `internal`, `onboarding`, and `customer`, the selection rule, and candidate-only status; no selection test was rerun here	Confirmed alignment in the authoritative receipt; execution evidence gap
Candidate packet acceptance coverage is exactly AC-1 through AC-3, with one required non-exploratory journey and matching `acceptance_checks` and `traces_to` for each	`journeys/candidate-evidence-handoff-manifest.json`	`tests/test_candidate_evidence_preflight.py::test_manifest_matches_the_pinned_three_journey_handoff`; `::test_manifest_model_and_fixture_share_journey_declarations`	The candidate manifest declares the three mappings; the named tests are existing routes and were not rerun here	Confirmed alignment as a declaration; independent execution remains unconfirmed
The candidate handoff allowlist and each journey command are exact, non-empty strings	Candidate handoff manifest `command_allowlist` and journey declarations	`tests/test_candidate_evidence_preflight.py::test_allowlist_is_exactly_synchronized_and_canonical`; `::test_command_claims_are_not_normalized_before_allowlist_matching`; `::test_allowlisted_command_must_match_the_declared_journey_command`	The manifest declares exactly `python3 -B tests/check_documentation_smoke.py` and `python3 -B -m pytest -p no:cacheprovider tests/test_product_contract.py`; no test rerun here	Confirmed alignment as declared route; no execution claim
Evidence records retain exact names, traces, steps, source references, command claims, exit codes, observed results, and the independent review-verdict requirement	`docs/candidate-evidence-preflight-contract.md`; candidate manifest; platform-owned review boundary `code-reviews/content-review.verdict.json`	`tests/test_candidate_evidence_preflight.py` fixture, schema, CLI, and `run_preflight` tests	The contract names the required fields and verdict path, but no verdict artifact is in the declared inputs for this step	Evidence gap; handoff completion remains unestablished
The documentation smoke route and its supplied reader result remain distinct	`tests/smoke_manifest.agent-orch.json`; `tests/check_documentation_smoke.py`; platform-owned reader-gate evidence	Candidate manifest route `python3 -B tests/check_documentation_smoke.py`	The supplied attempt used `python3 tests/check_documentation_smoke.py`, exited `1`, and observed `Operation not permitted` because localhost socket access was denied	Source/test mismatch plus environment-specific unresolved blocker; no recurring product defect, affected claim, or repair target is established
Existing packet text retains three platform-owned product-contract validator records, each reported as exit `0`, `10` passed, `0` failed, and `0` skipped, with distinct hashes	`preserved-validator-evidence.json` supplied by the Agent-Orch handoff; validator authority remains platform-owned	Existing packet’s copied `PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -p no:cacheprovider tests/test_product_contract.py` claims	Those records remain prior supplied packet evidence; this step’s preserved validator record is the separate authority JSON result above, and no product-contract rerun is claimed	Platform attestation retained; current-step confirmation gap, not a product conclusion
Page metadata, page registry identity, journey references, and candidate-only transition boundaries remain coherent	This page; `registries/pages.json`; candidate manifest; receipt `forbidden_actions`	`python3 tools/validate_content.py`; `tests/test_product_contract.py` deterministic suite and candidate-only release tests	The packet states the identity and boundaries; no release, pointer, publication, schedule, rollback, or live-directory action occurred in this step	Confirmed boundary alignment; validation execution is not claimed here

Mismatch Classification and Lee Decision

The matrix separates four states. Confirmed alignment means the source declarations agree, not that an unrun command passed. Evidence gaps identify a missing artifact or an authority boundary not covered by the preserved result. Source/test mismatches identify declarations that do not line up with the test route currently named. Genuinely unresolved choices are limited to the one operator decision below; they do not authorize a transition.

Confirmed alignment. The preserved authority command is successful, the authority JSON retains revision 2026-08-08, the three listed source IDs, and employee_may_modify: false, and the workstream receipt and candidate manifest keep the Internal Knowledge, candidate-only scope visible. The packet’s provenance claims therefore remain bounded to the sources and evidence records named above.

Evidence gaps. The preserved result does not test the authority-to-source registry join, the page-to-registry join, the candidate page’s review-verdict artifact, or the prior product-contract records. The named review path is a requirement, not proof that code-reviews/content-review.verdict.json exists or is clean. Those gaps keep handoff completion unresolved.

Source/test mismatches. The candidate handoff manifest declares three candidate journeys and two python3 -B commands, while the current journeys/user_journeys_manifest.json is a different publication-gap manifest with different journey names and four JSON commands; the candidate test file explicitly compares those manifests. The general preflight contract also describes its own synchronized five-check route. Separately, the supplied smoke attempt omitted -B relative to the candidate allowlist. These are declaration and evidence-routing mismatches to reconcile at the owning source boundary, not evidence of a product harness defect.

Genuinely unresolved choice for Lee. Retain this as a candidate-only, environment-specific evaluation blocker and route one permitted follow-up in an environment with localhost socket access. Do not name a recurring product harness defect, affected claim, or repair target from the single Operation not permitted attempt. No further decision is needed here about approval, promotion, publication, scheduling, rollback, a release pointer, or a live-directory write; those controls remain outside this packet.

Acceptance Checks

AC-1 — Acceptance coverage and authority: The reader verifies the Internal Knowledge workstream, audience, intended outcome, success hypothesis, validation journey, sealed authority revision 2026-08-08, exactly three authority-listed public-safe source IDs, and employee_may_modify: false. The reader also confirms that AC-1, AC-2, and AC-3 each have a non-exploratory natural-language journey trace before checklist drafting, without copying private governance material or inventing authority.
AC-2 — Evidence inventory and ownership: The reader records every required artifact with its owning authority, source reference, observed validation result, exact command, output location, and unresolved blocker. The inventory includes the smoke manifest and checker, all three preserved validator records with their distinct hashes, and the page/registry/journey outputs. Product conclusions remain separate from platform-owned attestations; the localhost-denied Operation not permitted observation is an environment-specific unresolved blocker, not evidence of recurrence, an affected claim, or a repair target.
AC-3 — Re-executable documentation validation: The documentation- validation journey contains the non-empty allowlisted command python3 -B tests/check_documentation_smoke.py. The reader can locate the supplied result for journey.resolve-reader-journey-harness-decision, its claimed command python3 tests/check_documentation_smoke.py, exit status 1, and Operation not permitted output, then route a permitted follow-up in an environment with localhost socket access. The handoff stays candidate-only and performs no approval, activation, promotion, publication, scheduling, rollback, pointer change, or live-directory write.