Candidate Evidence Provenance: Bounded Repair Route

Scope and sealed authority

This candidate-only packet records the deterministic candidate-evidence preflight failure and the smallest supported repair route. It is product-side provenance, not a new semantic claim, platform attestation, approval, or publication decision.

The sealed authority is sources/authority.json. It has revision 2026-08-08, lists exactly these logical sources, and sets employee_may_modify to false:

source.naming-decision
source.documentation-boundary
source.platform-delivery-contract

The matching records in registries/sources.json are public-safe. This packet does not copy private governance material and does not alter the authority or its source boundary.

Preserved validator evidence

The independent Agent-Orch validator preserved the following result for this step. It is not a local rerun:

Command: python3 -m pytest -p no:cacheprovider tests/test_candidate_evidence_preflight.py -q
Exit status: 1
Duration: 0.896599 seconds
Result: 16 failed, 6 passed, 8 subtests passed
Evidence hash: 2980064346d86791b6305f3eceb949f8b6edd727d6ec1d9fac8e34c6ace9bd3b

The preserved output shows declaration and shape mismatches, including a manifest/model allowlist mismatch, missing candidate-handoff journey IDs in the manifest, and the absent evidence_schema expected by the fixture oracle. The preserved record is the authority for those observed results. This step does not replace it with a new command result.

What the failure establishes

The test fixture is shaped for the pinned candidate-evidence handoff: its journeys are the three journey.candidate-evidence-handoff-* declarations and its claimed commands are the two commands in models/candidate_evidence_handoff_contract.json. The current journeys/user_journeys_manifest.json instead declares a publication-reader gap manifest with four JSON-tool commands and no candidate-evidence schema. That is why the independent oracle cannot find the fixture's first journey and why the model and manifest do not synchronize.

This establishes a bounded declaration-reconciliation defect in the candidate-evidence route. It does not establish a change to sealed authority, a recurring reader-harness defect, an affected product claim, or a runtime repair target. The separate Operation not permitted reader observation remains an environment-specific evaluation blocker unless authoritative follow-up evidence establishes more.

Bounded repair route

The owning maintainer should reconcile the candidate-evidence manifest and model at their source boundary before treating a candidate-evidence handoff as complete:

Compare journeys/user_journeys_manifest.json with the pinned journeys/candidate-evidence-handoff-manifest.json and preserve the pinned three journey IDs, exact names, acceptance mappings, expected exit codes, review-verdict path, evidence schema, and canonical allowlist.
Synchronize the corresponding execution declarations in models/candidate_evidence_handoff_contract.json and retain the fixture's exact journey names, traces, command claims, exit codes, and observed results. Do not normalize near-match command strings.
Keep the required independent review artifact separate from reader evidence; naming code-reviews/content-review.verdict.json is not proof that the artifact exists or passes.
After an authorized source-boundary repair, run the exact preflight in an environment permitted to create no bytecode or pytest cache files, and preserve its complete result. A future pass must not be inferred from this preserved failure.

This packet and its registry/journey projection are the only product-side corrections made in this bounded step. The authority, source registry, pinned handoff manifest, model, fixtures, tests, governance controls, and publication boundary remain unchanged here. No unresolved canonicalization or policy question is decided for Lee.

Candidate-only boundary and Lee decision

The selected workstream context is Internal Knowledge. The smallest safe disposition is to retain the candidate-only handoff as unresolved and route the declaration repair to its owning manifest/model boundary. Lee is not asked to approve, promote, publish, schedule, activate, roll back, change a release pointer, or write a live directory.

The later authoritative record must show synchronized declarations and a readable independent review verdict before handoff completion is considered. If a reader-gate follow-up is also needed, it must retain the exact journey ID, command, exit status, observed output, retry or recurrence evidence, source references, and affected work item. Missing recurrence or product impact must remain unresolved.

Acceptance checks

AC-1 — Authority trace: The reader verifies revision 2026-08-08, the exact three authority-listed source IDs, their public-safe registry records, and employee_may_modify: false without modifying authority.
AC-2 — Preserved failure trace: The reader reports the preserved validator command, exit status 1, duration, result counts, and evidence hash without claiming a rerun or replacing the captured record.
AC-3 — Bounded repair route: The reader can identify the manifest/model synchronization defect, the exact declaration fields to reconcile, and the separate review-verdict requirement without inventing a product defect or policy decision.
AC-4 — Candidate boundary: The reader keeps the Internal Knowledge handoff unresolved and candidate-only, with all approval and publication transitions untouched.