# DISCOVER Acceptance and Test Ledger

## Release-evidence contract

**Product:** DISCOVER — Healthcare Research & Innovation Leader Mission Control  
**Target version:** 2.0.0  
**Product ID:** `discover-healthcare-research-innovation-leader-mission-control`  
**Population lane:** `healthcare_research_innovation_leadership`  
**Default state of every test in this ledger:** **Not Run**

This ledger is an execution contract, not proof. Hermes must copy it into the built application, test the packaged production path, attach independently reviewable evidence, and update results without weakening expected behavior. The build kit is not the operational application.

Until the executed ledger supports a narrower outcome, report:

> **Not operational:** One or more core acceptance criteria failed or has not been run; blockers are documented in this ledger.

A specification, source-code comment, static match, screenshot, schema file, simulated AI result, prior-release result or model assertion is not runtime proof.

## 1. Allowed result states

| Result | Meaning | Counts as passed? |
|---|---|---|
| Not Run | No valid execution evidence exists for this exact build and environment. | No |
| Running | Execution began but has no final result. | No |
| Passed | Packaged production path ran and observed behavior matched the stated result with evidence. | Yes |
| Failed | Executed behavior differed from expected. | No |
| Blocked | A prerequisite authorization environment or dependency prevented execution. | No |
| Unsupported | The release or environment cannot perform a required check. | No |
| Not Applicable | Genuinely inapplicable to the declared target with approved rationale and no hidden loss of promised behavior. | Only with release-owner approval |

Do not substitute Implemented, Specified, Looks correct, Previously passed, Manual review recommended, Planned or Expected to pass.

## 2. Evidence required for Passed

Each Passed result must link to a record containing:

- test ID; exact app, database-schema and domain-corpus versions;
- source revision/tree hash, packaged artifact SHA-256 and dependency lock hash;
- OS, architecture, runtime, browser, SQLite and Hermes/backend versions;
- edition, tenant, workspace, role, active hat, project/study, partition, data class and fixture IDs;
- command or exact manual procedure, start/end UTC, expected and observed results;
- sanitized request/response, state transition, database assertion, screenshot, log or receipt as appropriate;
- confirmation that production runtime used no mock, canned AI, fake citation, fake tool or timer-simulated stream;
- test-owner label and independent reviewer for critical security, governance, agent, evidence, migration and recovery tests;
- defect/blocker reference when not Passed; and
- evidence-file SHA-256.

Store evidence under `qa/evidence/<TEST-ID>/` and results under `qa/results/<TEST-ID>.json`. Never include secrets, raw Soul, prohibited record bodies, participant/patient/workforce identifiers or confidential institutional material.

## 3. Execution rules

1. Test the installable or reproducibly runnable package, not only a development server.
2. Core CRUD, governance views, starters, guide, backup and diagnostics must work with all AI/retrieval providers disabled.
3. Production may not select a test double. Test doubles remain isolated to test builds.
4. Negative data tests prove reject-before-persistence, zero durable body, zero log/export and zero AI forwarding.
5. Client checks never substitute for server and database enforcement.
6. A connected state requires a recent authenticated provider capability result.
7. Streaming passes only with multiple ordered provider-originated deltas and honest cancellation.
8. Citations pass only with a real source and persisted claim-to-source relationship.
9. Cross-tenant, role, project, study and private-owner isolation is asserted at API, repository, search, memory, AI-context, export and badge layers.
10. A supported OS requires clean install, first run, restart, update/rollback, backup/restore and uninstall for this artifact.
11. Unsupported critical probes are blockers.
12. Material code, dependency, migration, policy, agent, schema or package changes invalidate affected evidence.

## 4. Critical blockers

Any of the following forces Not operational:

- install, normal launch, authentication, durable SQLite CRUD, migration rollback, backup/restore or local deletion fails;
- an enabled visible control is a no-op, placeholder, fake action or dead link;
- a secret appears in browser code/storage, URL, log, export, evidence, package or source;
- prohibited person-level or raw narrative content persists, logs, exports or reaches AI;
- a cross-tenant, cross-role, cross-project/study or private-owner join succeeds without an exact unexpired bridge;
- DATA-D2 proceeds without valid aggregate-export evidence;
- DISCOVER determines research/QI/IRB/exemption/consent/HIPAA/FDA/clinical status;
- a live safety issue remains in the lane or is adjudicated by AI;
- a claim has a fabricated citation or an expired/retracted source silently supports current use;
- an artifact is represented as an official protocol, approval, submission, authorization, publication or deployment;
- any recruit/contact/clinical/submit/publish/message/spend/contract/IP/procurement/deploy/official-write surface exists;
- an agent starts above P0, self-approves, exceeds its token, retries silently, recurses, writes externally, hides work or survives Kill;
- fake AI, tool events, citations, progress or connected state appears in production;
- AI failure disables or corrupts core work;
- starter or synthetic content counts as real outcome or mastery evidence;
- a badge implies credentials, research authorization, IRB status, authorship or institutional authority;
- any critical result is Failed, Blocked, Unsupported or Not Run; or
- final readiness contradicts this ledger.

## 5. Release metadata

| Field | Value |
|---|---|
| Application version | TBD |
| Product ID | discover-healthcare-research-innovation-leader-mission-control |
| Source revision/tree hash | TBD |
| Package filename and SHA-256 | TBD |
| Database schema version | TBD |
| Canonical 18-schema bundle hash | TBD |
| Migration range | TBD |
| Declared edition | Personal Research & Innovation OS / Institution-Approved Aggregate Workspace / both |
| Target OS and architectures | TBD |
| Live Hermes available | Yes / No |
| Optional compatible backend available | Yes / No |
| Retrieval provider available | Yes / No |
| Test start/end UTC | TBD |
| Release owner / independent reviewer | TBD |
| Unresolved critical defects | TBD |

## 6. Control-derived tests

There is exactly one explicit test below for each row of `DISCOVER-Control-Completeness-Matrix.csv`. Passing the control test requires its intended behavior, persistence, permission, offline behavior, error behavior and named verification test—not just its happy path.

| Test ID | Area | Priority | Verification target | Required evidence | Result |
|---|---|---|---|---|---|
| CTL-APP-001 | Launcher | Required | macOS launch: Clean macOS package launch; prove Fully available offline and Stop with recovery guidance; never switch storage origin on failure | Packaged-path UI/API plus persistence and permission assertions for APP-001 | Not Run |
| CTL-APP-002 | Launcher | Required | Windows launch: Clean Windows package launch; prove Fully available offline and Stop with recovery guidance on failure | Packaged-path UI/API plus persistence and permission assertions for APP-002 | Not Run |
| CTL-APP-003 | Launcher | Required | Linux launch: Clean Linux package launch; prove Fully available offline and Stop with recovery guidance on failure | Packaged-path UI/API plus persistence and permission assertions for APP-003 | Not Run |
| CTL-APP-004 | Server | Required | Loopback binding: Loopback and remote-bind negative tests; prove Fully available offline and Refuse startup on unsafe bind on failure | Packaged-path UI/API plus persistence and permission assertions for APP-004 | Not Run |
| CTL-APP-005 | Server | Required | Single instance and port: Concurrent launch test; prove Fully available offline and Do not start second writer on failure | Packaged-path UI/API plus persistence and permission assertions for APP-005 | Not Run |
| CTL-APP-006 | About | Required | Version consistency: Version consistency test; prove Fully available offline and Show integrity failure on mismatch on failure | Packaged-path UI/API plus persistence and permission assertions for APP-006 | Not Run |
| CTL-AUTH-001 | First run | Critical | Create local credential: Credential creation and no-default-secret test; prove Fully available offline and Reject weak malformed or oversized input on failure | Packaged-path UI/API plus persistence and permission assertions for AUTH-001 | Not Run |
| CTL-AUTH-002 | Sign in | Critical | Authenticate: Valid invalid and rate-limit tests; prove Fully available offline and Generic failure; rate-limit attempts on failure | Packaged-path UI/API plus persistence and permission assertions for AUTH-002 | Not Run |
| CTL-AUTH-003 | Session | Critical | Rotate and expire: Rotation expiry fixation tests; prove Fully available offline and Require reauthentication without data loss on failure | Packaged-path UI/API plus persistence and permission assertions for AUTH-003 | Not Run |
| CTL-AUTH-004 | All mutations | Critical | CSRF and origin checks: CSRF Origin Host tests; prove Fully available offline and Reject before mutation on failure | Packaged-path UI/API plus persistence and permission assertions for AUTH-004 | Not Run |
| CTL-AUTH-005 | Session | Critical | Sign out and revoke: Logout and replay tests; prove Fully available offline and Fail closed if revocation commit fails on failure | Packaged-path UI/API plus persistence and permission assertions for AUTH-005 | Not Run |
| CTL-AUTH-006 | Configuration | Critical | Secret boundary: Static dynamic and artifact secret scans; prove Core works without provider secret offline and Disable provider and report setup state on failure | Packaged-path UI/API plus persistence and permission assertions for AUTH-006 | Not Run |
| CTL-ONB-001 | First run | Required | Preparation message: Message and accessibility test; prove Fully available offline and Offer retry without fake progress on failure | Packaged-path UI/API plus persistence and permission assertions for ONB-001 | Not Run |
| CTL-ONB-002 | First run | Required | Safety acknowledgment: Acknowledgment gate test; prove Fully available offline and Block completion until acknowledged on failure | Packaged-path UI/API plus persistence and permission assertions for ONB-002 | Not Run |
| CTL-ONB-003 | First run | Required | Discover import: Valid invalid oversize import tests; prove Fully available offline and Reject atomically and retain no invalid body on failure | Packaged-path UI/API plus persistence and permission assertions for ONB-003 | Not Run |
| CTL-ONB-004 | First run | Required | Soul result import: Raw-answer exclusion and import tests; prove Fully available offline and Reject raw or malformed results on failure | Packaged-path UI/API plus persistence and permission assertions for ONB-004 | Not Run |
| CTL-ONB-005 | First run | Required | Mission Profile review: Field approval provenance tests; prove Fully available offline and Leave unapproved field unused on failure | Packaged-path UI/API plus persistence and permission assertions for ONB-005 | Not Run |
| CTL-ONB-006 | First run | Required | Minimum safe setup: No-source onboarding test; prove Fully available offline and Unknown remains Unknown on failure | Packaged-path UI/API plus persistence and permission assertions for ONB-006 | Not Run |
| CTL-ONB-007 | First run | Required | Starter generation: First rerun and interrupted seed tests; prove Fully available offline and Roll back complete seed transaction on failure | Packaged-path UI/API plus persistence and permission assertions for ONB-007 | Not Run |
| CTL-ONB-008 | First run | Required | Setup completion: Interrupted setup resume test; prove Fully available offline and Remain resumable at failed step on failure | Packaged-path UI/API plus persistence and permission assertions for ONB-008 | Not Run |
| CTL-HOME-001 | Command Deck | Required | Summary cards: Count and scope tests; prove Fully available offline and Show unavailable not stale fabricated counts on failure | Packaged-path UI/API plus persistence and permission assertions for HOME-001 | Not Run |
| CTL-HOME-002 | Command Deck | Required | Start a Mission: Create mission test; prove Fully available offline and Reject missing scope or prohibited input on failure | Packaged-path UI/API plus persistence and permission assertions for HOME-002 | Not Run |
| CTL-HOME-003 | Command Deck | Required | Attention queue: Priority and scope tests; prove Fully available offline and Show rule error without AI ranking on failure | Packaged-path UI/API plus persistence and permission assertions for HOME-003 | Not Run |
| CTL-HOME-004 | Command Deck | Required | Continue work: Resume link authorization test; prove Fully available offline and Hide inaccessible or deleted target on failure | Packaged-path UI/API plus persistence and permission assertions for HOME-004 | Not Run |
| CTL-HOME-005 | Command Deck | Required | Global search: Search isolation tests; prove Fully available offline and Return no results without cross-scope leakage on failure | Packaged-path UI/API plus persistence and permission assertions for HOME-005 | Not Run |
| CTL-HOME-006 | Command Deck | Required | Global Pause: Pause concurrency tests; prove Fully available offline and Fail closed for new runs on failure | Packaged-path UI/API plus persistence and permission assertions for HOME-006 | Not Run |
| CTL-HOME-007 | Command Deck | Required | Governance bar: Cross-screen consistency test; prove Fully available offline and Show Unclassified or Unknown on failure on failure | Packaged-path UI/API plus persistence and permission assertions for HOME-007 | Not Run |
| CTL-HOME-008 | Command Deck | Required | Quick launchers: Launcher no-side-effect tests; prove Fully available offline and Disable with exact missing prerequisite on failure | Packaged-path UI/API plus persistence and permission assertions for HOME-008 | Not Run |
| CTL-ROLE-001 | Role selector | Required | List roles: Role list isolation test; prove Fully available offline and Hide unauthorized role on failure | Packaged-path UI/API plus persistence and permission assertions for ROLE-001 | Not Run |
| CTL-ROLE-002 | Role selector | Required | Create role workspace: Workspace create test; prove Fully available offline and Reject collision or incomplete boundary on failure | Packaged-path UI/API plus persistence and permission assertions for ROLE-002 | Not Run |
| CTL-ROLE-003 | Role selector | Required | Primary role: Single-primary test; prove Fully available offline and Roll back invalid transition on failure | Packaged-path UI/API plus persistence and permission assertions for ROLE-003 | Not Run |
| CTL-ROLE-004 | Role selector | Required | Switch active role: Cross-role cache isolation test; prove Fully available offline and Deny inaccessible workspace on failure | Packaged-path UI/API plus persistence and permission assertions for ROLE-004 | Not Run |
| CTL-ROLE-005 | Authority | Required | Active hat: Hat expiry and scope tests; prove Fully available offline and Unknown or expired blocks consequential promotion on failure | Packaged-path UI/API plus persistence and permission assertions for ROLE-005 | Not Run |
| CTL-ROLE-006 | Authority | Required | Authority profile: Authority lifecycle test; prove Fully available offline and Never infer permission from title on failure | Packaged-path UI/API plus persistence and permission assertions for ROLE-006 | Not Run |
| CTL-ROLE-007 | Role settings | Required | Delete role workspace: Scoped delete and restore tests; prove Fully available offline and Block unresolved dependencies and preserve other roles on failure | Packaged-path UI/API plus persistence and permission assertions for ROLE-007 | Not Run |
| CTL-ROLE-008 | Role settings | Required | Cross-role bridge: Bridge allowlist expiry and negative join tests; prove Fully available offline and Default deny; expire immediately when invalid on failure | Packaged-path UI/API plus persistence and permission assertions for ROLE-008 | Not Run |
| CTL-MISS-001 | Missions | Critical | Create mission: Mission create validation test; prove Fully available offline and Reject invalid scope or prohibited input on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-001 | Not Run |
| CTL-MISS-002 | Missions | Critical | Read mission: Mission read authorization test; prove Fully available offline and Return not found without leakage on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-002 | Not Run |
| CTL-MISS-003 | Missions | Critical | Edit mission: Concurrency and invalidation tests; prove Fully available offline and Reject stale revision atomically on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-003 | Not Run |
| CTL-MISS-004 | Missions | Critical | Duplicate mission: Duplicate sanitization test; prove Fully available offline and Exclude inaccessible links and expired authority on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-004 | Not Run |
| CTL-MISS-005 | Missions | Critical | Archive mission: Archive test; prove Fully available offline and Block active run and explain on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-005 | Not Run |
| CTL-MISS-006 | Missions | Critical | Restore mission: Restore test; prove Fully available offline and Keep archived when validation fails on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-006 | Not Run |
| CTL-MISS-007 | Missions | Critical | Soft delete mission: Soft-delete test; prove Fully available offline and Block active agent or unresolved child state on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-007 | Not Run |
| CTL-MISS-008 | Missions | Critical | Recover mission: Recovery and no-token-revival tests; prove Fully available offline and Require re-review of stale governance on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-008 | Not Run |
| CTL-MISS-009 | Missions | Critical | Search filter sort: Mission query tests; prove Fully available offline and No cross-scope counts or snippets on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-009 | Not Run |
| CTL-MISS-010 | Mission Workspace | Critical | Assess stage: Assess classification test; prove Fully available offline and Reject prohibited data before save on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-010 | Not Run |
| CTL-MISS-011 | Mission Workspace | Critical | Define stage: Define gate test; prove Fully available offline and Cannot mark reviewed without required content on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-011 | Not Run |
| CTL-MISS-012 | Mission Workspace | Critical | Plan stage: Plan completeness test; prove Fully available offline and Block promotion on unresolved consequential fields on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-012 | Not Run |
| CTL-MISS-013 | Mission Workspace | Critical | Implement stage: Implement no-external-action test; prove Fully available offline and No external execution; explain unavailable actions on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-013 | Not Run |
| CTL-MISS-014 | Mission Workspace | Critical | Evaluate stage: Evaluate evidence-link test; prove Fully available offline and Do not invent outcomes or measures on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-014 | Not Run |
| CTL-MISS-015 | Mission Workspace | Critical | Stage review: Ordered stage gate tests; prove Fully available offline and Fail closed on stale hash or missing authority on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-015 | Not Run |
| CTL-MISS-016 | Mission Workspace | Critical | New iteration: Iteration lineage test; prove Fully available offline and Never overwrite prior cycle on failure | Packaged-path UI/API plus persistence and permission assertions for MISS-016 | Not Run |
| CTL-WORK-001 | Projects | Required | Project CRUD: Project CRUD tests; prove Fully available offline and Enforce dependency and scope rules on failure | Packaged-path UI/API plus persistence and permission assertions for WORK-001 | Not Run |
| CTL-WORK-002 | Goals | Required | Goal CRUD: Goal CRUD tests; prove Fully available offline and Reject invalid target or unit on failure | Packaged-path UI/API plus persistence and permission assertions for WORK-002 | Not Run |
| CTL-WORK-003 | Milestones | Required | Milestone CRUD: Milestone tests; prove Fully available offline and Detect impossible or circular links on failure | Packaged-path UI/API plus persistence and permission assertions for WORK-003 | Not Run |
| CTL-WORK-004 | Tasks | Required | Task CRUD: Task CRUD and cycle tests; prove Fully available offline and Reject cycles stale edits and cross-scope owner on failure | Packaged-path UI/API plus persistence and permission assertions for WORK-004 | Not Run |
| CTL-WORK-005 | Measures | Required | Measure CRUD: Measure version tests; prove Fully available offline and Unknown definition blocks result interpretation on failure | Packaged-path UI/API plus persistence and permission assertions for WORK-005 | Not Run |
| CTL-WORK-006 | Reviews | Required | Review CRUD: Review authority tests; prove Fully available offline and Self-approval and expired authority fail on failure | Packaged-path UI/API plus persistence and permission assertions for WORK-006 | Not Run |
| CTL-WORK-007 | Records | Required | Notes decisions assumptions risks safeguards: Supporting record tests; prove Fully available offline and Reject prohibited input and invalid link on failure | Packaged-path UI/API plus persistence and permission assertions for WORK-007 | Not Run |
| CTL-WORK-008 | Attachments | Required | Attachment metadata: Attachment boundary tests; prove Fully available offline and Reject prohibited type body or unsafe path on failure | Packaged-path UI/API plus persistence and permission assertions for WORK-008 | Not Run |
| CTL-WORK-009 | History | Required | Activity history: Audit redaction and scope tests; prove Fully available offline and Hide sensitive bodies and inaccessible objects on failure | Packaged-path UI/API plus persistence and permission assertions for WORK-009 | Not Run |
| CTL-WORK-010 | Artifacts | Required | Maturity gates: Artifact transition tests; prove Fully available offline and Invalidate downstream maturity on material change on failure | Packaged-path UI/API plus persistence and permission assertions for WORK-010 | Not Run |
| CTL-RSH-001 | DISCOVER Studio | Critical | Mission compass: PWR-01 instantiation test; prove Fully available offline and Preview only; never authority on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-001 | Not Run |
| CTL-RSH-002 | DISCOVER Studio | Critical | Unmet need framing: PWR-02 instantiation test; prove Fully available offline and Block prohibited input on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-002 | Not Run |
| CTL-RSH-003 | DISCOVER Studio | Critical | Portfolio prioritization: PWR-03 decision-gate test; prove Fully available offline and No automatic decision on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-003 | Not Run |
| CTL-RSH-004 | DISCOVER Studio | Critical | Boundary navigator: PWR-04 no-determination tests; prove Fully available offline and Ambiguity becomes multiple_or_unresolved on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-004 | Not Run |
| CTL-RSH-005 | DISCOVER Studio | Critical | Integrity and provenance: PWR-05 provenance tests; prove Core authoring works offline offline and Mark unavailable when source cannot be verified on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-005 | Not Run |
| CTL-RSH-006 | DISCOVER Studio | Critical | Data rights and IP map: PWR-06 data-ceiling tests; prove Fully available offline and Unknown blocks promotion on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-006 | Not Run |
| CTL-RSH-007 | DISCOVER Studio | Critical | Study concept: PWR-07 study concept tests; prove Fully available offline and No protocol approval or launch on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-007 | Not Run |
| CTL-RSH-008 | DISCOVER Studio | Critical | Feasibility burden safety: PWR-08 boundary tests; prove Fully available offline and Participant safety issue exits lane on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-008 | Not Run |
| CTL-RSH-009 | DISCOVER Studio | Critical | Measures and analysis intent: PWR-09 prespecification tests; prove Fully available offline and No statistical sign-off on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-009 | Not Run |
| CTL-RSH-010 | DISCOVER Studio | Critical | Co-design planner: PWR-10 participant-boundary tests; prove Fully available offline and No contact list recruitment or protected inference on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-010 | Not Run |
| CTL-RSH-011 | DISCOVER Studio | Critical | Team and conflict map: PWR-11 tests; prove Fully available offline and No employment scoring or authorship adjudication on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-011 | Not Run |
| CTL-RSH-012 | DISCOVER Studio | Critical | Funding readiness: PWR-12 no-action tests; prove Fully available offline and No submission funding acceptance or spend on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-012 | Not Run |
| CTL-RSH-013 | DISCOVER Studio | Critical | Portfolio orchestration: PWR-13 dependency tests; prove Fully available offline and No task assignment in official systems on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-013 | Not Run |
| CTL-RSH-014 | DISCOVER Studio | Critical | Submission readiness: PWR-14 absence-of-submit test; prove Fully available offline and No submit endpoint or compliance attestation on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-014 | Not Run |
| CTL-RSH-015 | DISCOVER Studio | Critical | Site vendor technology readiness: PWR-15 no-procurement tests; prove Fully available offline and No vendor selection procurement or connection on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-015 | Not Run |
| CTL-RSH-016 | DISCOVER Studio | Critical | Bounded experiment: PWR-16 sandbox tests; prove Fully available offline and Block production patient-facing or live data on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-016 | Not Run |
| CTL-RSH-017 | DISCOVER Studio | Critical | Value equity burden scenarios: PWR-17 scenario tests; prove Fully available offline and No causal or financial conclusion on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-017 | Not Run |
| CTL-RSH-018 | DISCOVER Studio | Critical | Translation and scale-stop: PWR-18 no-action tests; prove Fully available offline and No commercialization contract deploy or scale action on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-018 | Not Run |
| CTL-RSH-019 | DISCOVER Studio | Critical | Evidence landscape: PWR-19 real-source tests; prove Manual source entry works offline offline and No fake sources when retrieval offline on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-019 | Not Run |
| CTL-RSH-020 | DISCOVER Studio | Critical | Implementation and adoption: PWR-20 no-production tests; prove Fully available offline and No care or workforce change execution on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-020 | Not Run |
| CTL-RSH-021 | DISCOVER Studio | Critical | Dissemination and publication: PWR-21 no-publication tests; prove Fully available offline and No send publish or authorship decision on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-021 | Not Run |
| CTL-RSH-022 | DISCOVER Studio | Critical | AI use case governance: PWR-22 P0 and ORBIT tests; prove Draft fully available offline and No run without separate exact authorization on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-022 | Not Run |
| CTL-RSH-023 | DISCOVER Studio | Critical | Leadership succession: PWR-23 privacy tests; prove Fully available offline and No personnel decision or scoring on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-023 | Not Run |
| CTL-RSH-024 | DISCOVER Studio | Critical | Whole-life renewal: PWR-24 partition tests; prove Fully available offline and Never expose to tenant analytics agents or exports by default on failure | Packaged-path UI/API plus persistence and permission assertions for RSH-024 | Not Run |
| CTL-EVID-001 | Evidence Center | Critical | Source CRUD: Source lifecycle tests; prove Manual records fully available offline and Mark verification pending when offline on failure | Packaged-path UI/API plus persistence and permission assertions for EVID-001 | Not Run |
| CTL-EVID-002 | Evidence Center | Critical | Search providers: Real retrieval test; prove Shows retrieval unavailable offline and Never substitute canned results on failure | Packaged-path UI/API plus persistence and permission assertions for EVID-002 | Not Run |
| CTL-EVID-003 | Evidence Center | Critical | Import identifier or URL: Identifier resolution tests; prove Manual unresolved record allowed offline and Show resolution error without inventing metadata on failure | Packaged-path UI/API plus persistence and permission assertions for EVID-003 | Not Run |
| CTL-EVID-004 | Evidence Center | Critical | Claim CRUD: Claim lifecycle tests; prove Fully available offline and Reject empty or prohibited claim body on failure | Packaged-path UI/API plus persistence and permission assertions for EVID-004 | Not Run |
| CTL-EVID-005 | Evidence Center | Critical | Claim-source link: Relationship tests; prove Fully available offline and Unsupported remains unsupported on failure | Packaged-path UI/API plus persistence and permission assertions for EVID-005 | Not Run |
| CTL-EVID-006 | Evidence Center | Critical | Citation validator: Citation positive negative tests; prove Local validation only offline and Never fabricate or auto-pass unreachable source on failure | Packaged-path UI/API plus persistence and permission assertions for EVID-006 | Not Run |
| CTL-EVID-007 | Evidence Center | Critical | Correction and retraction watch: Retraction propagation tests; prove Fully available offline and Invalidate dependent current claims on failure | Packaged-path UI/API plus persistence and permission assertions for EVID-007 | Not Run |
| CTL-EVID-008 | Evidence Center | Critical | TRACE card: TRACE completeness tests; prove Fully available offline and Unknown blocks authoritative use on failure | Packaged-path UI/API plus persistence and permission assertions for EVID-008 | Not Run |
| CTL-EVID-009 | Evidence Center | Critical | Prompt-injection quarantine: Direct indirect encoded injection tests; prove Fully available offline and Quarantine body and block unsafe context on failure | Packaged-path UI/API plus persistence and permission assertions for EVID-009 | Not Run |
| CTL-EVID-010 | Evidence Center | Critical | Reproducible export: Evidence export round-trip tests; prove Fully available offline and Exclude prohibited bodies and inaccessible sources on failure | Packaged-path UI/API plus persistence and permission assertions for EVID-010 | Not Run |
| CTL-AI-001 | Setup | Critical | Backend selection: Provider selection test; prove Core remains available offline and Show Setup required on failure | Packaged-path UI/API plus persistence and permission assertions for AI-001 | Not Run |
| CTL-AI-002 | Setup | Critical | Authenticated health: Health truthfulness tests; prove Shows Offline offline and Redact raw error and credentials on failure | Packaged-path UI/API plus persistence and permission assertions for AI-002 | Not Run |
| CTL-AI-003 | Setup | Critical | Model discovery: Model discovery tests; prove Shows unavailable offline and No hardcoded connected model on failure | Packaged-path UI/API plus persistence and permission assertions for AI-003 | Not Run |
| CTL-AI-004 | Assistant | Critical | Create session: Session create tests; prove Unavailable without connection offline and Do not create local fake session on failure | Packaged-path UI/API plus persistence and permission assertions for AI-004 | Not Run |
| CTL-AI-005 | Assistant | Critical | Resume session: Resume isolation tests; prove Unavailable without connection offline and Reject stale inaccessible or unsupported resume on failure | Packaged-path UI/API plus persistence and permission assertions for AI-005 | Not Run |
| CTL-AI-006 | Assistant | Critical | Send message: Real request and data-boundary tests; prove Disabled with clear reason offline and Reject prohibited data and stale governance on failure | Packaged-path UI/API plus persistence and permission assertions for AI-006 | Not Run |
| CTL-AI-007 | Assistant | Critical | Genuine stream: Multi-delta genuine stream test; prove Unavailable without backend offline and Never timer-simulate output on failure | Packaged-path UI/API plus persistence and permission assertions for AI-007 | Not Run |
| CTL-AI-008 | Assistant | Critical | Stop generation: Slow-stream cancellation test; prove Not applicable offline offline and Stop local display and report provider outcome on failure | Packaged-path UI/API plus persistence and permission assertions for AI-008 | Not Run |
| CTL-AI-009 | Assistant | Critical | Retry: Retry idempotency tests; prove Unavailable offline offline and Require confirmation where duplicate risk exists on failure | Packaged-path UI/API plus persistence and permission assertions for AI-009 | Not Run |
| CTL-AI-010 | Assistant | Critical | Tool visibility: Real tool event tests; prove Unavailable offline offline and Unknown tool blocks and alerts on failure | Packaged-path UI/API plus persistence and permission assertions for AI-010 | Not Run |
| CTL-AI-011 | Assistant | Critical | Citation rendering: AI citation integrity tests; prove Local records available offline and Mark unsupported or unverifiable on failure | Packaged-path UI/API plus persistence and permission assertions for AI-011 | Not Run |
| CTL-AI-012 | Assistant | Critical | Conversation deletion: Local remote deletion truthfulness tests; prove Fully available locally offline and Never claim remote deletion without proof on failure | Packaged-path UI/API plus persistence and permission assertions for AI-012 | Not Run |
| CTL-AGT-001 | Agent Console | Critical | Catalog: Agent count ID and default tests; prove Fully available offline and Block catalog on identity or hash drift on failure | Packaged-path UI/API plus persistence and permission assertions for AGT-001 | Not Run |
| CTL-AGT-002 | Agent Console | Critical | Agent detail: Agent detail accuracy test; prove Fully available offline and Maximum never displayed as current permission on failure | Packaged-path UI/API plus persistence and permission assertions for AGT-002 | Not Run |
| CTL-AGT-003 | Agent Console | Critical | Route preview: No-activation route test; prove Fully available offline and Unknowns block run proposal on failure | Packaged-path UI/API plus persistence and permission assertions for AGT-003 | Not Run |
| CTL-AGT-004 | Agent Console | Critical | ORBIT charter: ORBIT schema tests; prove Fully available offline and Invalid or missing field blocks proposal on failure | Packaged-path UI/API plus persistence and permission assertions for AGT-004 | Not Run |
| CTL-AGT-005 | Agent Console | Critical | One-run proposal: Separation-of-duties test; prove Draft available offline and No token created by proposer alone on failure | Packaged-path UI/API plus persistence and permission assertions for AGT-005 | Not Run |
| CTL-AGT-006 | Agent Console | Critical | Approve one run: One-run authorization tests; prove Unavailable without live backend offline and Block self approval expiry or mismatch on failure | Packaged-path UI/API plus persistence and permission assertions for AGT-006 | Not Run |
| CTL-AGT-007 | Agent Console | Critical | Start run: Preflight and single-invocation tests; prove Unavailable offline offline and Mismatch returns blocked; no provider call on failure | Packaged-path UI/API plus persistence and permission assertions for AGT-007 | Not Run |
| CTL-AGT-008 | Agent Console | Critical | Run stream: Agent streaming tests; prove Unavailable offline offline and Never simulate agent work on failure | Packaged-path UI/API plus persistence and permission assertions for AGT-008 | Not Run |
| CTL-AGT-009 | Agent Console | Critical | Pause: Pause tests; prove Fully available offline and Unsupported provider pause becomes honest Stop guidance on failure | Packaged-path UI/API plus persistence and permission assertions for AGT-009 | Not Run |
| CTL-AGT-010 | Agent Console | Critical | Kill: Kill propagation tests; prove Control available when server runs offline and Escalate and fail closed if provider uncertain on failure | Packaged-path UI/API plus persistence and permission assertions for AGT-010 | Not Run |
| CTL-AGT-011 | Agent Console | Critical | Reconcile and retire: Reconciliation and purge tests; prove Available after recorded run offline and Block new run if reconciliation incomplete on failure | Packaged-path UI/API plus persistence and permission assertions for AGT-011 | Not Run |
| CTL-AGT-012 | Agent Console | Critical | Independent audit: Auditor isolation tests; prove Fixtures available offline offline and No control-plane write to tested object on failure | Packaged-path UI/API plus persistence and permission assertions for AGT-012 | Not Run |
| CTL-MEM-001 | Memory | Required | Memory list: Memory isolation tests; prove Fully available offline and Exclude uncertain or cross-scope items on failure | Packaged-path UI/API plus persistence and permission assertions for MEM-001 | Not Run |
| CTL-MEM-002 | Memory | Required | Preview and remember: Consent and prohibited-memory tests; prove Fully available offline and Default deny and reject prohibited category on failure | Packaged-path UI/API plus persistence and permission assertions for MEM-002 | Not Run |
| CTL-MEM-003 | Memory | Required | Edit memory: Memory edit tests; prove Fully available offline and Reject stale revision on failure | Packaged-path UI/API plus persistence and permission assertions for MEM-003 | Not Run |
| CTL-MEM-004 | Memory | Required | Forget: Forget context tests; prove Fully available offline and Fail closed by excluding uncertain item on failure | Packaged-path UI/API plus persistence and permission assertions for MEM-004 | Not Run |
| CTL-MEM-005 | Memory | Required | Delete: Memory deletion tests; prove Fully available offline and Report provider memory separately on failure | Packaged-path UI/API plus persistence and permission assertions for MEM-005 | Not Run |
| CTL-MEM-006 | Memory | Required | Export: Memory export tests; prove Fully available offline and Block prohibited expired or cross-scope items on failure | Packaged-path UI/API plus persistence and permission assertions for MEM-006 | Not Run |
| CTL-MEM-007 | Memory | Required | Temporary cleanup: Cleanup preservation tests; prove Fully available offline and Keep Pause active and report orphans on failure | Packaged-path UI/API plus persistence and permission assertions for MEM-007 | Not Run |
| CTL-CAP-001 | Capabilities | Required | Capability map: Capability calculation tests; prove Fully available offline and Show unavailable on calculation failure on failure | Packaged-path UI/API plus persistence and permission assertions for CAP-001 | Not Run |
| CTL-CAP-002 | Capabilities | Required | Add evidence: Evidence eligibility tests; prove Fully available offline and Reject starter duplicate unsupported or mismatched scope on failure | Packaged-path UI/API plus persistence and permission assertions for CAP-002 | Not Run |
| CTL-CAP-003 | Capabilities | Required | Correct evidence: Correction tests; prove Fully available offline and Never overwrite original history on failure | Packaged-path UI/API plus persistence and permission assertions for CAP-003 | Not Run |
| CTL-CAP-004 | Capabilities | Required | Award levels: Level threshold tests; prove Fully available offline and No click-only award on failure | Packaged-path UI/API plus persistence and permission assertions for CAP-004 | Not Run |
| CTL-CAP-005 | Capabilities | Required | Revoke award: Award revocation tests; prove Fully available offline and Hide stale claim during failed recalculation on failure | Packaged-path UI/API plus persistence and permission assertions for CAP-005 | Not Run |
| CTL-CAP-006 | Capabilities | Required | Achievement export: No-credential-claim export tests; prove Fully available offline and Exclude unauthorized evidence on failure | Packaged-path UI/API plus persistence and permission assertions for CAP-006 | Not Run |
| CTL-GOV-001 | All workflows | Critical | EDENA classification: Cross-route EDENA tests; prove Fully available offline and Policy failure becomes Unclassified on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-001 | Not Run |
| CTL-GOV-002 | All research workflows | Critical | FRAME gate: FRAME positive negative tests; prove Fully available offline and Missing conflict becomes multiple_or_unresolved on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-002 | Not Run |
| CTL-GOV-003 | Evidence | Critical | TRACE gate: TRACE tests; prove Fully available offline and Block current use of invalid source on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-003 | Not Run |
| CTL-GOV-004 | Innovation sandbox | Critical | PROBE gate: PROBE boundary tests; prove Fully available offline and Block production or participant-facing test on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-004 | Not Run |
| CTL-GOV-005 | Agents | Critical | ORBIT gate: ORBIT full-contract tests; prove Draft offline; run needs backend offline and Any Unknown blocks activation on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-005 | Not Run |
| CTL-GOV-006 | All inputs | Critical | Prohibited-input guard: Server bypass and zero-retention tests; prove Fully available offline and Zero persistence log export and AI forwarding on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-006 | Not Run |
| CTL-GOV-007 | D2 intake | Critical | Aggregate export validation: D2 positive negative expiry tests; prove Fully available offline and Reject atomically when any evidence invalid on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-007 | Not Run |
| CTL-GOV-008 | Partitions | Critical | Scope enforcement: Cross-partition matrix tests; prove Fully available offline and Default deny missing scope on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-008 | Not Run |
| CTL-GOV-009 | Consequential transitions | Critical | Human confirmation: Approval matrix tests; prove Fully available offline and Block stale hash self-approval or expiry on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-009 | Not Run |
| CTL-GOV-010 | Edition banner | Critical | Personal versus institutional: Edition distinction tests; prove Fully available offline and Default to stricter unresolved state on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-010 | Not Run |
| CTL-GOV-011 | Research boundary | Critical | No determination: Forbidden determination tests; prove Fully available offline and Route questions to named humans on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-011 | Not Run |
| CTL-GOV-012 | Action boundary | Critical | No external action: Forbidden action surface and API tests; prove Fully available offline and No hidden endpoint or tool on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-012 | Not Run |
| CTL-GOV-013 | Safety route | Critical | Participant or clinical safety exit: Safety boundary tests; prove Fully available offline and No seriousness relatedness diagnosis or triage on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-013 | Not Run |
| CTL-GOV-014 | Audit | Critical | Governance receipts: Receipt integrity tests; prove Fully available offline and Fail consequential action if receipt cannot commit on failure | Packaged-path UI/API plus persistence and permission assertions for GOV-014 | Not Run |
| CTL-DATA-001 | Data | Critical | Readable export: Export round-trip and secret scan; prove Fully available offline and Warn unencrypted and exclude secrets prohibited data on failure | Packaged-path UI/API plus persistence and permission assertions for DATA-001 | Not Run |
| CTL-DATA-002 | Data | Critical | Create backup: Backup interruption tests; prove Fully available offline and Leave prior backup intact on failure on failure | Packaged-path UI/API plus persistence and permission assertions for DATA-002 | Not Run |
| CTL-DATA-003 | Data | Critical | Restore preview: Restore negative matrix tests; prove Fully available offline and Reject malformed cross-scope or incompatible backup on failure | Packaged-path UI/API plus persistence and permission assertions for DATA-003 | Not Run |
| CTL-DATA-004 | Data | Critical | Execute restore: Atomic restore tests; prove Fully available offline and Roll back on any failure on failure | Packaged-path UI/API plus persistence and permission assertions for DATA-004 | Not Run |
| CTL-DATA-005 | Data | Critical | Update: Update migration tests; prove Fully available offline and Stop before damage on integrity or migration failure on failure | Packaged-path UI/API plus persistence and permission assertions for DATA-005 | Not Run |
| CTL-DATA-006 | Data | Critical | Rollback: Rollback expiry tests; prove Fully available offline and Block incompatible rollback on failure | Packaged-path UI/API plus persistence and permission assertions for DATA-006 | Not Run |
| CTL-DATA-007 | Data | Critical | Delete local data: Deletion locked-file tests; prove Fully available offline and Report files or remote data outside control on failure | Packaged-path UI/API plus persistence and permission assertions for DATA-007 | Not Run |
| CTL-DATA-008 | Data | Critical | Uninstall: Keep/delete uninstall tests per OS; prove Fully available offline and Never delete data without explicit choice on failure | Packaged-path UI/API plus persistence and permission assertions for DATA-008 | Not Run |
| CTL-DATA-009 | Starters | Critical | Adopt clear restore: Starter lifecycle tests; prove Fully available offline and Never overwrite or delete real records on failure | Packaged-path UI/API plus persistence and permission assertions for DATA-009 | Not Run |
| CTL-DIAG-001 | Diagnostics | Required | App and database: Database diagnostic tests; prove Fully available offline and Block and show recovery on integrity failure on failure | Packaged-path UI/API plus persistence and permission assertions for DIAG-001 | Not Run |
| CTL-DIAG-002 | Diagnostics | Required | Hermes status: Hermes diagnostic tests; prove Shows Offline or Setup required offline and Redact credentials and raw responses on failure | Packaged-path UI/API plus persistence and permission assertions for DIAG-002 | Not Run |
| CTL-DIAG-003 | Diagnostics | Required | Model stream session cancel: Capability freshness tests; prove Shows unavailable offline and Stale becomes Limited capabilities on failure | Packaged-path UI/API plus persistence and permission assertions for DIAG-003 | Not Run |
| CTL-DIAG-004 | Diagnostics | Required | Memory tools retrieval: Capability redaction tests; prove Shows disabled offline and No secret destination or raw memory exposure on failure | Packaged-path UI/API plus persistence and permission assertions for DIAG-004 | Not Run |
| CTL-DIAG-005 | Diagnostics | Required | Run diagnostics: Read-only and redaction tests; prove Local checks fully available offline and Never mutate or include record bodies on failure | Packaged-path UI/API plus persistence and permission assertions for DIAG-005 | Not Run |
| CTL-DIAG-006 | Diagnostics | Required | Control completeness: DOM API matrix reconciliation test; prove Fully available offline and Any unregistered enabled control fails release on failure | Packaged-path UI/API plus persistence and permission assertions for DIAG-006 | Not Run |
| CTL-GUIDE-001 | Guide | Required | Guide navigation: Guide section and link tests; prove Fully available offline and Always available without AI on failure | Packaged-path UI/API plus persistence and permission assertions for GUIDE-001 | Not Run |
| CTL-GUIDE-002 | Guide | Required | Contextual help: Help coverage tests; prove Fully available offline and Critical governance help cannot be permanently hidden on failure | Packaged-path UI/API plus persistence and permission assertions for GUIDE-002 | Not Run |
| CTL-GUIDE-003 | Guide | Required | First-run restart: Restart no-duplicate tests; prove Fully available offline and Explain separate policy renewal on failure | Packaged-path UI/API plus persistence and permission assertions for GUIDE-003 | Not Run |
| CTL-GUIDE-004 | Guide | Required | Research boundary examples: Guide language tests; prove Fully available offline and Never present example as approval or advice on failure | Packaged-path UI/API plus persistence and permission assertions for GUIDE-004 | Not Run |
| CTL-ACCESS-001 | All screens | Required | Keyboard navigation: Automated and manual keyboard tests; prove Fully available offline and No trap; unavailable reason announced on failure | Packaged-path UI/API plus persistence and permission assertions for ACCESS-001 | Not Run |
| CTL-ACCESS-002 | Dynamic UI | Required | Status announcements: Screen-reader announcement tests; prove Fully available offline and Critical errors remain visible on failure | Packaged-path UI/API plus persistence and permission assertions for ACCESS-002 | Not Run |
| CTL-ACCESS-003 | All screens | Required | Responsive and reflow: Viewport zoom and text-spacing tests; prove Fully available offline and No clipped controls or page overflow on failure | Packaged-path UI/API plus persistence and permission assertions for ACCESS-003 | Not Run |
| CTL-ACCESS-004 | Preferences | Required | Motion contrast density text: Preference noninterference tests; prove Fully available offline and Reset invalid preference safely on failure | Packaged-path UI/API plus persistence and permission assertions for ACCESS-004 | Not Run |
| CTL-ACCESS-005 | Artifacts | Required | Accessible exports: Export accessibility tests; prove Fully available for Markdown offline and Fail honestly if optional renderer unavailable on failure | Packaged-path UI/API plus persistence and permission assertions for ACCESS-005 | Not Run |

## 7. Cross-cutting acceptance scenarios

| Test ID | Area | Priority | Expected result | Required evidence | Result |
|---|---|---|---|---|---|
| INT-001 | Clean install | Critical | A new unpacked package installs and launches with no undeclared dependency or preexisting data. | Clean-machine transcript package hash and screenshot | Not Run |
| INT-002 | Restart durability | Critical | Mission project task evidence profile and governance records survive full server and browser restart. | Before/after database assertions | Not Run |
| INT-003 | Offline core | Critical | All core CRUD starters guide backup and local governance work with network and AI disabled. | Network-denied run and feature checklist | Not Run |
| INT-004 | No fake AI | Critical | Production contains and emits no canned response fake tool fake citation or timer-generated stream. | Source/build scan and runtime trace | Not Run |
| INT-005 | Static-to-SQLite migration | Critical | Approved legacy browser export migrates once with preview backup validation and no silent overwrite. | Migration transcript and row reconciliation | Not Run |
| INT-006 | Failed migration | Critical | Injected migration failure rolls back and prior data/app remain usable. | Database hashes and recovery transcript | Not Run |
| INT-007 | Restore atomicity | Critical | Corrupt incompatible and cross-partition backups are rejected; valid restore swaps atomically. | Negative fixtures and database hashes | Not Run |
| INT-008 | Discover/Soul privacy | Critical | Raw quiz answers and raw Soul never persist log export or enter AI context. | Database/log/export/context scans | Not Run |
| INT-009 | Multi-role isolation | Critical | Other role content cannot appear through URL API search cache memory AI badges or export. | Cross-role attack matrix | Not Run |
| INT-010 | Multi-tenant isolation | Critical | Research tenant A cannot read infer count or join tenant B without a valid bridge. | Repository/API/search negative tests | Not Run |
| INT-011 | Study/project isolation | Critical | Unrelated project and study records remain isolated within one tenant. | Scoped query and link tests | Not Run |
| INT-012 | Private partition | Critical | Whole-life private content never enters tenant views analytics retrieval agents or default exports. | Cross-partition scans | Not Run |
| INT-013 | Bridge lifecycle | Critical | Exact allowlisted fields cross only for stated purpose; expiry or revocation blocks immediately. | Bridge positive negative expiry evidence | Not Run |
| INT-014 | Prohibited data zero retention | Critical | PHI PII participant rows narratives secrets and confidential fixtures are rejected before persistence and forwarding. | DB filesystem logs export and provider-capture assertions | Not Run |
| INT-015 | D2 aggregate evidence | Critical | Valid D2 evidence is accepted only in exact scope; missing expired hash-mismatched or low-cell evidence is rejected. | D2 fixture matrix | Not Run |
| INT-016 | FRAME ambiguity | Critical | Ambiguous research-QI-clinical-innovation facts yield multiple_or_unresolved and named human routes only. | Policy/API/UI evidence | Not Run |
| INT-017 | Forbidden determinations | Critical | All attempts to produce local IRB exemption HIPAA FDA consent clinical or NOT RESEARCH determinations are blocked. | Prompt/API/template negative matrix | Not Run |
| INT-018 | Safety exit | Critical | Participant or clinical-safety content exits the lane without adjudication or narrative retention. | Synthetic boundary fixture and zero-retention evidence | Not Run |
| INT-019 | All 24 Powers | Critical | Every PWR-01 through PWR-24 opens the correct workflow/template/schema and safe finish. | ID traversal and schema validation report | Not Run |
| INT-020 | All 30 templates | Critical | Every template creates a real editable schema-valid draft; none is decorative or externally actionable. | Template traversal and CRUD report | Not Run |
| INT-021 | All 18 schemas | Critical | Canonical bytes match hashes; all compile independently; positive and negative conditions execute. | Hash compile and fixture report | Not Run |
| INT-022 | Evidence reality | Critical | A real source search persists query source metadata status and selection without fabricated fields. | Provider trace and source rows | Not Run |
| INT-023 | Claim-citation integrity | Critical | Each displayed citation maps to a real source and exact claim relationship; unsupported claims remain marked. | Claim-source database and rendered artifact | Not Run |
| INT-024 | Retraction propagation | Critical | Corrected retracted or expired source invalidates dependent current-use state and prompts review. | Before/after source and claim states | Not Run |
| INT-025 | Retrieval injection | Critical | Direct indirect and encoded source instructions cannot change policy tools routes or permissions. | Adversarial source fixtures and traces | Not Run |
| INT-026 | Genuine Hermes stream | Critical | Real Hermes session produces multiple ordered deltas typed events and terminal state. | Raw sanitized provider/network timeline | Not Run |
| INT-027 | Stream cancellation | Critical | Stop reaches provider and authorized tool work; no further accepted delta or side effect occurs. | Slow-stream cancellation timeline | Not Run |
| INT-028 | Retry idempotency | Critical | Retry does not duplicate accepted messages tool calls artifacts or receipts. | Fault-injection trace and database assertions | Not Run |
| INT-029 | Backend offline transition | Critical | Connection loss changes state truthfully while core data remains usable and uncorrupted. | Network fault transcript | Not Run |
| INT-030 | Ten-agent default | Critical | Exactly ten agents install P0 disabled with zero credentials tools memory network destinations schedules or hidden state. | Registry and runtime capability dump | Not Run |
| INT-031 | ORBIT one run | Critical | Exact token permits one invocation and zero retries; any hash scope expiry or authority mismatch blocks before provider call. | Authorization fixture matrix | Not Run |
| INT-032 | Pause and Kill | Critical | Pause blocks new work; Kill terminates selected run and prevents resume without a new token. | Concurrent-run timeline and receipts | Not Run |
| INT-033 | Auditor separation | Critical | Independent auditor cannot mutate tested agent charter token approval run or receipt. | Authorization and database negative tests | Not Run |
| INT-034 | No external action | Critical | No UI route API tool or agent can recruit contact submit publish message spend contract file IP procure deploy or write officially. | Route/API/tool inventory and adversarial calls | Not Run |
| INT-035 | Memory consent | Critical | Memory is off by default and each permitted item requires purpose category consent retention scope and expiry. | Memory database and context tests | Not Run |
| INT-036 | Forget/delete truthfulness | Critical | Forget removes local context; Delete removes local value; provider limitation remains explicit. | Context capture DB scan and UI statement | Not Run |
| INT-037 | Starter integrity | Critical | Seed is idempotent; Adopt Clear Restore work; starter/synthetic records do not count as outcomes or badges. | Seed lineage and badge assertions | Not Run |
| INT-038 | Badge noncredential | Critical | All four levels require eligible evidence and never imply licensure certification authority IRB status or authorship. | Criteria fixtures and copy scan | Not Run |
| INT-039 | Accessibility | Required | Keyboard focus reflow zoom reduced motion status announcements and accessible exports pass. | Automated results and manual review evidence | Not Run |
| INT-040 | Release integrity | Critical | Manifest checksums versions lockfile SBOM secret scan ZIP safety and control reconciliation pass for final package. | Release validator output | Not Run |

## 8. Research-corpus compatibility suite

The canonical source corpus contains 160 release-assurance criteria: `RA-A01` through `RA-R08` and `RA-INT01` through `RA-INT16`. They remain a separate mandatory compatibility suite. Import their exact fixtures, adapters, hashes, expected action/data deltas and evidence-chain rules. Do not mark those legacy criteria Passed merely because the new full-stack acceptance scenario passes. Record all 160 initially as **Not Run** and execute them against the packaged runtime after extracting and validating canonical source bytes.

Minimum compatibility outputs:

- one machine-readable result and redacted raw log per criterion;
- before/after state hashes and action/data deltas;
- canonical fixture, adapter and environment hashes;
- predecessor-linked receipt chain and independent review;
- explicit Unsupported or Blocked when the runtime cannot execute a probe; and
- zero reinterpretation of an expected block as a successful action.

## 9. Readiness decision

### Operational

Allowed only when all 171 control-derived tests, all 40 cross-cutting scenarios, all applicable 160 corpus criteria, every critical security/governance/recovery test and every claimed supported-OS suite Passed with no unresolved critical defect. Live AI claims require real Hermes/backend evidence.

### Core operational; AI setup pending

Allowed only when all offline/core, security, database, partition, research-boundary, evidence-record, starter, backup/recovery, packaging and accessibility gates Passed; AI/retrieval-specific tests are Blocked only because the user has not configured a provider; the UI truthfully shows Setup required/Offline; and no promised non-AI function is missing.

### Not operational

Required if any core or critical test is Failed, Blocked, Unsupported or Not Run; if control completeness is unresolved; or if the package is the build kit rather than the built tested application.

## 10. Sign-off

| Role | Name or local label | Decision | UTC | Evidence/signature reference |
|---|---|---|---|---|
| Build owner | TBD | TBD | TBD | TBD |
| Independent security/governance reviewer | TBD | TBD | TBD | TBD |
| Research-domain reviewer | TBD | TBD | TBD | TBD |
| Release owner | TBD | TBD | TBD | TBD |
