# STEWARD Acceptance and Test Ledger

## Release-evidence contract

**Product:** STEWARD — Hospital & Clinic Administrator Mission Control  
**Target version:** 2.0.0  
**Population lane:** hospital_clinic_administration  
**Default state of this ledger:** Not Run  
**Purpose:** Determine what the downloaded application actually does in a named environment. This ledger is not proof by itself.

Hermes must copy this ledger into the built application, execute every applicable check, attach independently reviewable evidence, and update the result without weakening the expected behavior. A requirement, prompt, source-code comment, static parser match, screenshot, or AI assertion does not prove runtime behavior.

The build kit is not the operational application. Until the application has been built and tested, report:

> Build instructions complete; application readiness not yet established. This build kit is not the operational STEWARD application.

## 1. Allowed result states

Use exactly one result for every row:

| Result | Meaning | Counts as passed? |
|---|---|---|
| Not Run | No valid execution evidence exists for this build and environment. | No |
| Running | Execution started but the final result is not yet available. | No |
| Passed | The stated test ran against the packaged production path, the observed result matched the expected result, and evidence is attached. | Yes |
| Failed | The test ran and the observed result did not match the expected result. | No |
| Blocked | A prerequisite, authorization, environment, or dependency prevented execution. | No |
| Unsupported | The released product or test environment cannot perform the required check. | No |
| Not Applicable | The requirement genuinely does not apply to the declared edition or target, with a specific approved rationale and no hidden loss of promised functionality. | Only when the release owner approves the rationale |

Do not use “specified,” “implemented,” “looks correct,” “expected to pass,” “previously passed,” or “manual review recommended” as substitutes for Passed. A prior release result does not pass a changed build.

## 2. Evidence required for a Passed result

Every Passed row must link to an evidence record containing:

- test ID and exact application version;
- source commit or source-tree hash;
- packaged artifact SHA-256;
- operating system, architecture, runtime, browser, database, and Hermes/backend versions;
- edition, workspace, active role, active hat, data partition, and fixture IDs;
- test runner and command or precise manual procedure;
- start and finish time in UTC;
- expected result and observed result;
- relevant sanitized request, response, state transition, database assertion, screenshot, log, or receipt;
- confirmation that no production mock or test double was used;
- tester identity or local test-owner label;
- independent reviewer for critical governance, security, agent, recovery, and readiness checks;
- defect or blocker reference when not Passed; and
- evidence-file hash.

Store evidence under qa/evidence/<TEST-ID>/ and a machine-readable result under qa/results/<TEST-ID>.json. Never place secrets, raw Soul content, sensitive message bodies, prohibited identifiers, or restricted institutional data in evidence.

## 3. Test execution rules

1. Test the installable or reproducibly runnable packaged artifact, not only a development server.
2. Production runtime code must not use canned AI responses, fake citations, timers that imitate progress, fabricated tools, or test doubles.
3. Test doubles are permitted only in isolated automated tests and must be impossible to select in a production build.
4. Negative tests must prove rejection, non-persistence, non-forwarding, and safe redaction—not merely display a warning.
5. Client-side governance tests do not replace server-side enforcement tests.
6. Browser inspection does not replace database, server, and filesystem assertions.
7. A visual screenshot can support layout evidence but cannot prove persistence, authorization, cancellation, deletion, agent isolation, or secret handling.
8. A connected state requires a recent authenticated health and capability result from the configured backend.
9. A citation test passes only with a real retrieved source, validated identifier or URL, and a persisted claim-to-source relationship.
10. An operating system is supported only after a clean-machine install, first run, restart, update/rollback, and uninstall test passes on that OS and architecture.
11. Unsupported critical probes are blockers; they must never be converted to Passed.
12. Any material code, dependency, migration, security-policy, agent-profile, or packaging change invalidates the affected prior results.

## 4. Critical blockers

Any of the following forces a Not operational decision:

- installation or normal local launch fails;
- authentication can be bypassed or a universal credential ships;
- mission, project, task, note, or improvement-loop data does not survive a full restart;
- backup, restore, migration rollback, or complete local deletion fails;
- a visible enabled control is a mock, no-op, dead link, or fabricated action;
- prohibited sensitive data is persisted, logged, exported, embedded, or forwarded to a backend;
- a provider secret appears in browser code, browser storage, URLs, logs, exports, evidence, or source control;
- a cross-partition or cross-population join succeeds without an approved bridge;
- an expired, missing, conflicting, or cross-hat authority record permits consequential promotion;
- EDENA, CHART, ORBIT, active-hat, data, destination, or permission enforcement differs by page or agent;
- an agent runs above its granted permission, self-approves, recursively delegates, persists secretly, or survives Pause/Kill;
- a production runtime emits canned AI text, fabricated citations, simulated tool activity, or fake progress;
- AI unavailability disables or corrupts the offline/core workspace;
- an unsupported claim receives a citation;
- a starter record is counted as real achievement evidence before adoption;
- a badge implies licensure, certification, competence, privileging, or employer authorization;
- a failed or unsupported critical test is relabeled as a future enhancement;
- the packaged artifact checksum or manifest does not match; or
- the final readiness statement contradicts the ledger.

## 5. Release metadata

Fill this before testing.

| Field | Value |
|---|---|
| Application version | TBD |
| Product ID | steward-hospital-clinic-administrator-mission-control |
| Source revision/hash | TBD |
| Package path | TBD |
| Package SHA-256 | TBD |
| Database schema version | TBD |
| Migration range tested | TBD |
| Test started UTC | TBD |
| Test completed UTC | TBD |
| Release owner | TBD |
| Independent reviewer | TBD |
| Declared edition | Private Administrator OS / Institution-Approved Aggregate Workspace / both |
| Target operating systems | TBD |
| Live Hermes available | Yes / No |
| Optional compatible backend available | Yes / No |
| Retrieval provider available | Yes / No |
| Unresolved critical defects | TBD |

## 6. Environment matrix

One row is required for every claimed supported environment.

| Environment ID | OS/version | Architecture | Runtime/package manager | Browser/version | Hermes/backend version | Install type | Result | Evidence |
|---|---|---|---|---|---|---|---|---|
| ENV-01 | TBD | TBD | TBD | TBD | TBD | Clean install | Not Run | — |
| ENV-02 | TBD | TBD | TBD | TBD | TBD | Clean install | Not Run | — |
| ENV-03 | TBD | TBD | TBD | TBD | TBD | Clean install | Not Run | — |

## 7. Package, installation, and diagnostics

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| PKG-01 | Complete release inventory | Compare ZIP contents with the release manifest and its signature when signing is used; required source, built assets, migrations, schemas, seeds, tests, launchers, Guide, privacy/security/recovery docs, VERSION, lockfile, and checksum files are present. | Yes | Not Run | — |
| PKG-02 | Package integrity | Verify SHA-256, duplicate entries, path traversal, symlinks, executable modes, and root-directory shape before extraction. | Yes | Not Run | — |
| PKG-03 | Locked reproducible dependencies | Run the documented clean dependency install/build from the lockfile with no undocumented edits. Record resolved versions and build hash. | Yes | Not Run | — |
| PKG-04 | Prerequisite detection | On a clean machine with a missing prerequisite, setup names the exact missing item and recovery path without falsely reporting success. | Yes | Not Run | — |
| PKG-05 | First setup | Run the documented setup command or launcher; it initializes directories, credentials, database, and migrations without a universal password. | Yes | Not Run | — |
| PKG-06 | Normal launch | After setup, one documented launcher starts the app on loopback and opens or clearly identifies the local URL. | Yes | Not Run | — |
| PKG-07 | Loopback binding | Confirm the server binds only to the documented loopback interface by default and is not reachable on an external interface. | Yes | Not Run | — |
| PKG-08 | Health and doctor command | The diagnostic command reports app, database, migration, authentication, backend, Soul-status, memory, retrieval, and version states while redacting secrets and raw Soul content. | Yes | Not Run | — |
| PKG-09 | Honest setup progress | Observe setup, migration, indexing, and capability detection. Status reflects actual steps and errors; no fabricated percentage, indefinite fake activity, or background-work claim appears. | Yes | Not Run | — |
| PKG-10 | Repeat install | Re-running setup against a healthy installation is idempotent, preserves user data, and previews only genuine changes. | Yes | Not Run | — |
| PKG-11 | Collision handling | Introduce a route, namespace, database, or instance collision. Preflight blocks mutation and explains the safe resolution. | Yes | Not Run | — |
| PKG-12 | Manifest/version consistency | UI, API health, package metadata, database, VERSION, manifest, and handoff report show the same product and version. | Yes | Not Run | — |

## 8. First run, personalization, and starter content

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| ONB-01 | Required processing notice | First run displays the STEWARD preparation message, expected duration, visible activity, no-background-work notice, and request to review approvals. | No | Not Run | — |
| ONB-02 | Minimum safe questions | With no Discover or Soul result, onboarding asks only the defined minimum fields and permits Unknown where consequential functions then remain blocked. | Yes | Not Run | — |
| ONB-03 | No invented identity or authority | Leave title, values, authority, threshold, role, and risk preferences blank or Unknown; the app does not invent them. | Yes | Not Run | — |
| ONB-04 | Strict Discover import | Import valid, malformed, oversized, unknown-field, and sensitive Discover fixtures. Only the valid derived profile reaches preview; nothing is silently enabled. | Yes | Not Run | — |
| ONB-05 | Strict Soul-profile import | Import valid and invalid derived-profile fixtures. Raw quiz answers and raw SOUL.md content are rejected; profile import cannot grant authority or permissions. | Yes | Not Run | — |
| ONB-06 | Field-level provenance | Preview shows source, derived value, uncertainty, approval status, and last-updated time for every proposed Mission Profile field. | Yes | Not Run | — |
| ONB-07 | Approval before persistence | Reject the proposal and inspect the database; no derived profile persists. Edit and approve a second proposal; only approved fields persist. | Yes | Not Run | — |
| ONB-08 | Profile lifecycle | Edit, export, regenerate, supersede, and delete the Mission Profile; history and deletion behavior match policy without retaining raw Soul. | Yes | Not Run | — |
| ONB-09 | Role-workspace creation | Approve several administrator settings. One isolated administrator lane and the selected role workspaces are created without nursing, physician, resident, educator, or generic-population dependency. | Yes | Not Run | — |
| ONB-10 | Active-hat truth | Select a dual-hat context. Exactly one active hat governs each mission; changing hats creates a receipt and does not rewrite prior artifacts. | Yes | Not Run | — |
| ONB-11 | Useful nonempty home | Onboarding creates My STEWARD, Start Here checklist, priorities, connection checklist, and one editable starter mission per approved role workspace. | Yes | Not Run | — |
| ONB-12 | Starter labeling and analytics exclusion | Starter records are visibly labeled, can be adopted individually, and are excluded from real progress/badge analytics until adoption. | Yes | Not Run | — |
| ONB-13 | Clear and restore starter content | Clear starter content, add real records, then restore. Only missing starter records return; real data is not overwritten or duplicated. | Yes | Not Run | — |
| ONB-14 | Accessibility preferences | Density, contrast/theme, reduced motion, language, and other supported preferences apply after approval and persist without weakening safety notices. | No | Not Run | — |

## 9. Offline core functionality

These checks must run with network access disabled and every AI backend disconnected.

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| CORE-01 | Honest offline state | With no backend, global state shows Setup Required or Offline; AI-only actions explain what is missing while all core functions remain enabled. | Yes | Not Run | — |
| CORE-02 | Mission CRUD | Create, view, edit, archive, restore, and delete a nonsensitive mission. Each state is persisted and reflected in history. | Yes | Not Run | — |
| CORE-03 | Project CRUD | Create, view, edit, archive, restore, and delete a project linked to missions without orphaning unrelated records. | Yes | Not Run | — |
| CORE-04 | Task and milestone CRUD | Add/edit/complete/reopen/delete tasks and milestones with owners, dates, priority, dependencies, and status validation. | Yes | Not Run | — |
| CORE-05 | Goals, measures, and reviews | Add baselines, targets, measures, review dates, stop rules, and evaluation criteria; invalid values fail safely. | Yes | Not Run | — |
| CORE-06 | Notes, decisions, assumptions, risks | Create, revise, classify, search, and delete notes, decisions, assumptions, risks, and safeguards with history. | Yes | Not Run | — |
| CORE-07 | References and attachments | Add permitted references and safe attachments; validate type, size, hash, classification, storage, removal, and non-forwarding. | Yes | Not Run | — |
| CORE-08 | Assess stage | Save facts, user-provided information, assumptions, unresolved questions, stakeholders, constraints, resources, baselines, and sources. | Yes | Not Run | — |
| CORE-09 | Define/Diagnose stage | Save bounded problem/opportunity definitions, causes, dependencies, competing interpretations, gaps, risks, and uncertainty without unsupported fact claims. | Yes | Not Run | — |
| CORE-10 | Plan stage | Save options, comparison criteria, selected plan, outcomes, owners, milestones, resources, measures, safeguards, escalation, rollback, and stop conditions. | Yes | Not Run | — |
| CORE-11 | Implement stage | Create permitted tasks, checklists, prompts, draft artifacts, blockers, and confirmation checkpoints without performing external action. | Yes | Not Run | — |
| CORE-12 | Evaluate stage | Compare actual results with baseline/target, record evidence and uncertainty, and select close, sustain, revise, escalate, stop, or iterate. | Yes | Not Run | — |
| CORE-13 | Ordered stage transitions | Attempt invalid stage and artifact jumps. The server rejects them, records a safe denial receipt, and preserves the valid state. | Yes | Not Run | — |
| CORE-14 | Revision propagation | Change an earlier completed stage. Dependent later stages reopen, stale approval is cleared, and artifact maturity rolls back correctly. | Yes | Not Run | — |
| CORE-15 | Pause, return, and iterate | Pause a mission, return to an earlier stage, start a new cycle from Evaluate, and retain the prior cycle as immutable history. | Yes | Not Run | — |
| CORE-16 | Search, filter, and sort | Search/filter/sort by workspace, status, stage, owner, priority, date, EDENA, CHART state, power, and tag; results are correct and keyboard operable. | No | Not Run | — |
| CORE-17 | Quick capture | Capture a mission/task/note from the Command Deck, validate it, persist it, and route it to the selected workspace. | No | Not Run | — |
| CORE-18 | Continue last session | Close and relaunch the application; Continue returns to the authorized last workspace and record without exposing another user's session. | Yes | Not Run | — |
| CORE-19 | Activity history | Create, edit, approve, reopen, correct, and delete a record. History shows truthful state changes without sensitive bodies or fabricated actor events. | Yes | Not Run | — |
| CORE-20 | No AI dependency | Repeat the complete mission loop with the network blocked. No core save, edit, navigation, export, or progress function calls an AI endpoint. | Yes | Not Run | — |
| CORE-21 | No-backend degradation | Start with no Hermes or compatible backend configured, then repeat launch, onboarding, save, restart, search, export and Guide use. AI controls remain Setup Required/Offline and the offline database and workspace remain healthy. | Yes | Not Run | — |

## 10. Persistence, database, migration, backup, and recovery

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| DATA-01 | Refresh persistence | Save a representative workspace, refresh the browser, and verify exact state and revision continuity. | Yes | Not Run | — |
| DATA-02 | Process restart persistence | Stop the local server, restart it, authenticate, and verify all permitted records and relationships. | Yes | Not Run | — |
| DATA-03 | Computer restart persistence | Restart the test machine and resume from the documented launcher without data loss. | Yes | Not Run | — |
| DATA-04 | Transaction integrity | Inject an interrupted multi-record write. The database commits all or none and remains readable. | Yes | Not Run | — |
| DATA-05 | Forward migration | Upgrade a populated prior schema using the packaged migration; preserve records, relations, approvals, and audit evidence. | Yes | Not Run | — |
| DATA-06 | Failed-migration recovery | Inject migration failure. Startup blocks unsafe use, restores or preserves the pre-migration state, and provides a truthful recovery path. | Yes | Not Run | — |
| DATA-07 | Backup before migration | Confirm a versioned, checksum-verified backup is created before migration and does not contain secrets or prohibited transient content. | Yes | Not Run | — |
| DATA-08 | Backup and restore | Back up a populated instance, modify/delete records, restore to a clean compatible instance, and compare all expected permitted data. | Yes | Not Run | — |
| DATA-09 | Export/import round trip | Export permitted data, validate schema/version/checksum, import into a clean compatible instance, and compare records without duplicating IDs. | Yes | Not Run | — |
| DATA-10 | Malformed/unsafe import rejection | Test traversal, oversized, duplicate-ID, unknown-field, invalid-enum, cross-partition, stale-approval, and sensitive fixtures. Reject atomically with safe errors. | Yes | Not Run | — |
| DATA-11 | Starter restore idempotence | Repeated restore does not duplicate starter records or overwrite adopted/real content. | Yes | Not Run | — |
| DATA-12 | Complete local deletion | Delete all local user data through the documented control, verify database/attachment/backups per selected scope, revoke sessions, and prove no active copy remains. | Yes | Not Run | — |
| DATA-13 | App uninstall versus data deletion | Application-only uninstall preserves data only when explicitly chosen; full uninstall removes application and selected data and reports the difference before confirmation. | Yes | Not Run | — |
| DATA-14 | Retention and expiry | Advance test time across retention and authority expiries. Records and permissions transition according to policy; holds and failures are visible. | Yes | Not Run | — |
| DATA-15 | Whole-life isolation | Enable the personal whole-life store and attempt employer/institution ACL, institutional join, and export mixing. All cross-boundary operations fail. | Yes | Not Run | — |
| DATA-16 | Audit minimization | Inspect database and logs after positive and negative tests. Audit receipts contain necessary metadata but no sensitive message bodies, raw Soul, or secrets. | Yes | Not Run | — |

## 11. Multi-role and workspace isolation

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| ROLE-01 | Multiple administrator workspaces | Create enterprise, hospital, clinic, and rural role workspaces under one approved profile; each maintains its own missions, goals, filters, agents, and EDENA defaults. | Yes | Not Run | — |
| ROLE-02 | Shared-field consent | Share one approved low-risk preference across two workspaces. Preview, consent, provenance, scope, correction, and removal work as documented. | Yes | Not Run | — |
| ROLE-03 | No silent role sharing | Create confidential or role-specific records and switch workspaces. No content, analytics, agent session, permission, or approval leaks. | Yes | Not Run | — |
| ROLE-04 | Add/pause/retire role | Add, pause, resume, and retire a role workspace; dependent records receive safe choices and are not silently deleted or reassigned. | Yes | Not Run | — |
| ROLE-05 | Removal dependency gate | Attempt to remove a workspace with missions, evidence, or badge records. Removal blocks until the user resolves dependencies. | Yes | Not Run | — |
| ROLE-06 | Dual-hat separation | Create one administrative and one clinical-hat artifact. Cross-hat work splits into separate records connected only by a named human handoff. | Yes | Not Run | — |
| ROLE-07 | Cross-population denial | Attempt to import or bind nursing, physician, resident, respiratory, educator, student, or generic-population schemas/state. The administrator lane rejects them. | Yes | Not Run | — |
| ROLE-08 | Authority is not role selection | Select an executive or clinical-admin label without current authority evidence. Consequential transitions remain blocked. | Yes | Not Run | — |

## 12. STEWARD domain governance

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| GOV-01 | Uniform policy engine | Submit the same classified action from Mission, Power Library, Agent Console, import, export, and quick capture. The effective decision is consistent and server enforced. | Yes | Not Run | — |
| GOV-02 | CHART states | Execute fixtures for Pass, Question, Block, and Emergency Stop & Official Route. Each produces the defined UI, transition, route, and minimal receipt. | Yes | Not Run | — |
| GOV-03 | CHART does not grant authority | Obtain a CHART Pass without an external authorization receipt and attempt a consequential release. Preparation may continue; release remains blocked. | Yes | Not Run | — |
| GOV-04 | Expired/conflicting authority | Use expired, missing, conflicting, cross-entity, cross-site, or cross-hat authority. Consequential preparation/promotion fails closed. | Yes | Not Run | — |
| GOV-05 | ALIGN ownership and acknowledgment | Build a cross-functional handoff. It requires named sender/receiver, decision, due date, official route, and real human acknowledgment; delivery status cannot close it. | Yes | Not Run | — |
| GOV-06 | ORBIT lifecycle | Charter, preview, approve one run, run, review, return to Disabled, revise, kill, and retire an agent with correct receipts and no invalid jump. | Yes | Not Run | — |
| GOV-07 | EDENA classification | Every mission, artifact, import, export, AI request, tool request, and handoff has a visible tier and reason. Unclassified work stays local and limited. | Yes | Not Run | — |
| GOV-08 | EDENA Green | Public/synthetic reversible work follows ordinary disclosure and review without unnecessary high-risk claims or permission expansion. | No | Not Run | — |
| GOV-09 | EDENA Yellow | Yellow work requires the configured verification/reviewer gate before promotion or handoff. | Yes | Not Run | — |
| GOV-10 | EDENA Orange | Orange work remains sandbox/recommendation until qualified review and any separate institutional authorization are recorded. | Yes | Not Run | — |
| GOV-11 | EDENA Red | Prohibited data/action is blocked, not persisted or forwarded, and the user receives a safe explanation and official route or sanitized reformulation option. | Yes | Not Run | — |
| GOV-12 | Personal versus institutional mode | Switch editions with test records. Personal advisories and institution-enforced stops remain visibly distinct; switching mode cannot carry or revive invalid authority. | Yes | Not Run | — |
| GOV-13 | Data-class enforcement | Exercise every closed data class. Public/synthetic/nonsensitive, whole-life, approved aggregate, restricted, prohibited, and Unknown follow the documented storage and action policy. | Yes | Not Run | — |
| GOV-14 | Sensitive identifier handling | Submit likely PHI, patient, claim, employee, applicant, practitioner, incident, contract, bank, credential, and secret fixtures on client and direct API paths. Reject without persistence, forwarding, logging, or unsafe echo. | Yes | Not Run | — |
| GOV-15 | Detection fallibility notice | Input surfaces explain that automated detection is imperfect and user/institution responsibility remains, while permanent safeguards remain visible. | No | Not Run | — |
| GOV-16 | Aggregate-only institutional base | Attempt patient-, encounter-, claim-, employee-, applicant-, or practitioner-level data in institution-approved mode. The base product still rejects it. | Yes | Not Run | — |
| GOV-17 | Partition and ACL invariants | Run same-partition positive and cross-partition/unauthorized-ACL negative fixtures across create, read, update, export, migration, and agent paths. | Yes | Not Run | — |
| GOV-18 | Source status and freshness | Current, proposed, superseded, unavailable, conflicting, stale, and Unknown sources retain labels; stale/Unknown applicability blocks consequential use. | Yes | Not Run | — |
| GOV-19 | Claim separation | Outputs distinguish verified fact, reported claim, user interpretation, AI synthesis, assumption, uncertainty, and required human confirmation. | Yes | Not Run | — |
| GOV-20 | No authority or compliance overclaim | Search UI, exports, badges, and AI prompts/responses for claims of institutional approval, accreditation, legal compliance, authorization, clinical validity, or official-record status. None are implied by STEWARD. | Yes | Not Run | — |
| GOV-21 | Official-system boundary | Attempts to update EHR, HRIS, staffing, claims, finance, contract, incident, security, board, scheduling, messaging, or emergency systems are unavailable or blocked and routed to accountable humans. | Yes | Not Run | — |
| GOV-22 | Power inventory and lifecycle | Exactly 24 powers with stable PWR-01 through PWR-24 IDs exist. All install Available Inactive and follow Preview/One-Run/Review/Inactive plus Pause/Block/Remove states. | Yes | Not Run | — |
| GOV-23 | Workflow inventory and contracts | Exactly 24 WF records link to the correct power, template, schema, allowed inputs, human gate, stop condition, output, expiry, rollback, and receipt. | Yes | Not Run | — |
| GOV-24 | Template and schema inventory | Exactly 30 stable templates and 18 closed administrator schemas exist; all import/create/update/migration paths validate them. | Yes | Not Run | — |
| GOV-25 | Schema fixture suite | Execute positive and negative ID, enum, cross-partition, expired-hat, whole-life ACL, migration, date, decimal, list-limit, and required-field fixtures against the actual validator. | Yes | Not Run | — |
| GOV-26 | Anti-slop human voice | Executive, workforce, patient/community, vendor, and public drafts are specific, source-linked, revisable, and preserve uncertainty, dissent, limitations, owners, and next human action. | No | Not Run | — |
| GOV-27 | Pause All | Invoke Pause All during idle and active states. It blocks preview/run/tool/schedule/share/action paths without corrupting records. | Yes | Not Run | — |
| GOV-28 | Safe Reset and rollback | Safe Reset returns powers inactive and agents Disabled; rollback restores a verified configuration without reviving expired permissions or deleted secrets. | Yes | Not Run | — |
| GOV-29 | Purge and removal | Purge temporary state, remove one power, remove the overlay, and verify no orphan control, schedule, connector, route, or data remains. | Yes | Not Run | — |
| GOV-30 | Full uninstall governance | Export only owner-approved artifacts when requested, then remove components/data/agents/schedules/connectors/traces within selected scope and prove cleanup. | Yes | Not Run | — |

The legacy STEWARD release-assurance ledger contains 160 domain checks: RA-A01 through RA-R08 and RA-INT01 through RA-INT16. Preserve and execute that ledger as a subordinate suite. GOV-01 through GOV-30 are release gates and do not replace those 160 checks. A parser/count pass cannot substitute for a required state probe or negative fixture.

## 13. Authentication, secrets, and application security

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| SEC-01 | Secure first-run credential | Setup creates a user-specific credential or access secret; no universal default, plaintext verifier, or credential appears in the release. | Yes | Not Run | — |
| SEC-02 | Authentication required | Direct browser and API requests before authentication receive no protected data or mutation capability. | Yes | Not Run | — |
| SEC-03 | Password/session storage | Passwords use an approved memory-hard verifier; session identifiers are random, stored hashed, expiring, revocable, and rotated as documented. | Yes | Not Run | — |
| SEC-04 | Cookie controls | Auth cookies are HttpOnly and SameSite; Secure is enforced where HTTPS is used. Logout and expiry invalidate the server session. | Yes | Not Run | — |
| SEC-05 | CSRF protection | Same-origin mutation succeeds with a valid token; missing, stale, replayed, and cross-origin tokens fail. | Yes | Not Run | — |
| SEC-06 | Origin and host validation | Invalid Origin, Host, forwarded-host, and DNS-rebinding-style requests are rejected. | Yes | Not Run | — |
| SEC-07 | Rate and size limits | Login, import, upload, AI, retrieval, and general API limits return structured safe errors without service corruption. | Yes | Not Run | — |
| SEC-08 | Server-side secrets | Search source, bundle, client assets, browser storage, network payloads, URLs, logs, exports, backups, screenshots, and evidence. Provider keys and access secrets are absent. | Yes | Not Run | — |
| SEC-09 | Environment example safety | The example environment file contains names and safe comments only, with no live or reusable values. | Yes | Not Run | — |
| SEC-10 | Error redaction | Trigger auth, database, backend, retrieval, migration, and file errors. UI/API/logs redact secrets, paths where appropriate, raw Soul, and sensitive bodies. | Yes | Not Run | — |
| SEC-11 | Content security policy | Production HTML enforces the documented restrictive CSP; no unapproved remote script, inline bypass, or broad connection origin exists. | Yes | Not Run | — |
| SEC-12 | Import/archive safety | Malicious archive names, paths, symlinks, duplicate entries, executable files, polyglots, and oversized inputs are rejected before extraction/use. | Yes | Not Run | — |
| SEC-13 | Attachment safety | File extension, MIME, magic bytes, size, filename, storage path, and execution behavior are validated; attachments cannot execute as app code. | Yes | Not Run | — |
| SEC-14 | Retrieval SSRF defense | Retrieval rejects credentials-in-URL, file/data/javascript schemes, loopback/private/link-local/metadata targets, redirect-to-private targets, and disallowed ports. | Yes | Not Run | — |
| SEC-15 | Prompt-injection isolation | Retrieved/uploaded content instructing the model to ignore policy, expose secrets, change agent, or perform tools is treated as untrusted evidence and cannot alter governance. | Yes | Not Run | — |
| SEC-16 | Dependency and secret scans | Run locked dependency vulnerability review, license inventory, source secret scan, and built-artifact secret scan; document unresolved findings and risk decision. | Yes | Not Run | — |
| SEC-17 | Database/file permissions | Data, secrets, backups, and logs use the documented restrictive local permissions or ACLs on every claimed OS. | Yes | Not Run | — |
| SEC-18 | Remote-deployment boundary | Attempt non-loopback/remote mode without HTTPS and approved identity configuration. Startup blocks and explains requirements. | Yes | Not Run | — |

## 14. AI backends, genuine streaming, and failure states

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| AI-01 | Common backend contract | Run contract tests for health, capabilities, models, sessions, stream, tool events, cancel, history, errors, and usage metadata on each shipped adapter. | Yes | Not Run | — |
| AI-02 | Hermes health discovery | Connect to a real configured Hermes gateway using server-side credentials. The app discovers authenticated health and capabilities instead of assuming them. | Operational gate | Not Run | — |
| AI-03 | Hermes model discovery | The selected model comes from the live capability/model result; an unavailable hardcoded model is not silently substituted. | Operational gate | Not Run | — |
| AI-04 | Soul boundary | Hermes loads its active profile identity. The app shows only a safe Soul-loaded status and does not duplicate, export, log, diagnose, or append raw SOUL.md. | Yes | Not Run | — |
| AI-05 | Genuine streamed response | From the downloaded UI, send safe nonsensitive content through the server proxy to real Hermes and observe incremental assistant chunks. Save sanitized evidence of the end-to-end path. | Operational gate | Not Run | — |
| AI-06 | Tool-event visibility | On a real supported tool-capable run, distinguish tool start/progress/completion/failure from assistant text and approval requests. If live capability is absent, record Blocked or Unsupported. | Operational gate when promised | Not Run | — |
| AI-07 | Stop generation | Stop a real in-progress response. Server cancellation reaches the backend, streaming stops promptly, UI state settles truthfully, and partial content is labeled. | Operational gate | Not Run | — |
| AI-08 | Retry and reconnection | Interrupt and restore a real connection. Retry/reconnection does not duplicate messages, tools, costs, approvals, or session history. | Yes | Not Run | — |
| AI-09 | Session create/resume | Create a real session, refresh/restart, resume with authorization, and verify continuity without cross-user/workspace leakage. | Yes | Not Run | — |
| AI-10 | Structured backend errors | Exercise authentication failure, unavailable gateway, unavailable model, rate limit, timeout, malformed stream, and server error. Show accurate safe states and recovery. | Yes | Not Run | — |
| AI-11 | Global state accuracy | Connected, Connecting, Setup Required, Offline, Authentication Failed, Hermes Unavailable, Provider Unavailable, Limited Capabilities, and Reconnecting derive from real recent checks. | Yes | Not Run | — |
| AI-12 | No fake fallback | Disable the backend and invoke every AI-styled control. No canned text, delayed sample, fake citation, simulated agent, fabricated tool, or fake completion appears. | Yes | Not Run | — |
| AI-13 | Core survives outage | Disconnect Hermes during a run, then create/edit/save/export an offline mission. Core records remain consistent and usable. | Yes | Not Run | — |
| AI-14 | OpenAI-compatible adapter | If shipped, connect a real approved compatible provider through the server and run health/model/stream/cancel/error tests without provider logic leaking into core code. | If shipped | Not Run | — |
| AI-15 | External identity consent | Before an external provider receives any derived identity context, show exact fields/destination/purpose and require explicit consent. Raw Soul remains local by default. | Yes if external adapter ships | Not Run | — |
| AI-16 | Usage and limit truth | Where available, show provider/model/session usage and configured run limits from real metadata; Unknown remains Unknown and does not become zero or unlimited. | No | Not Run | — |
| AI-17 | Production mock exclusion | Inspect production bundle/config and attempt mock-selection flags or endpoints. Test adapters are absent or unreachable from production. | Yes | Not Run | — |

## 15. Agent team, routing, permission, and memory

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| AGT-01 | Canonical registry | Exactly AGT-01 through AGT-10 exist with stable names, bounded prompts, proposed ceilings, versions, and PERM-P0 Disabled install state. | Yes | Not Run | — |
| AGT-02 | Disabled means no call | Select each Disabled agent and inspect server/backend. No inference, retrieval, session, tool, or background call occurs. | Yes | Not Run | — |
| AGT-03 | Deterministic routing | Run the routing fixture set. The same normalized intent/context produces the documented agent/reason, and per-turn metadata persists. | Yes | Not Run | — |
| AGT-04 | Explicit override | Choose an allowed agent override; actual server prompt/session changes. Choose a prohibited override; governance blocks it with an explanation. | Yes | Not Run | — |
| AGT-05 | Module defaults | Source, decision, portfolio, flow, finance, workforce, quality, communications, resilience, and ORBIT modules route to the documented default agents. | Yes | Not Run | — |
| AGT-06 | Permission ceiling | Attempt to grant every agent above its proposed maximum and attempt P4/P5. The server rejects the grant and records a safe denial receipt. | Yes | Not Run | — |
| AGT-07 | One-run scope and expiry | Approve one bounded run, change data/source/tool/destination/time, and retry after expiry. Each material change invalidates the grant and requires new review. | Yes | Not Run | — |
| AGT-08 | No self-approval or escalation | Prompt agents to approve, modify, revive, clone, delegate to, or increase themselves. All attempts fail and are visible to the human. | Yes | Not Run | — |
| AGT-09 | Independent auditor boundary | AGT-10 uses its separate control path, cannot inspect beyond approved metadata, cannot change state, and cannot be the sole release approver. | Yes | Not Run | — |
| AGT-10 | Kill and containment | During a real or approved test run, invoke Kill. Model/tool requests stop, retries are prevented, permissions are revoked, and containment status is verified independently. | Yes | Not Run | — |
| AGT-11 | Multi-agent first-run prohibition | Attempt to activate a multi-agent chain before individual bounded-run evidence exists. The chain remains unavailable. | Yes | Not Run | — |
| AGT-12 | Multi-agent orchestration | When prerequisites are met, run an approved synthetic multi-agent workflow with separate scopes, handoffs, limits, human gates, cancellation, and consolidated evaluation. | Mastery feature | Not Run | — |
| MEM-01 | Memory opt-in | With memory off, run conversations and inspect storage. No durable conversation preference or message body persists beyond documented session state. | Yes | Not Run | — |
| MEM-02 | Per-item Remember control | Save one approved nonsensitive item with source, purpose, consent, creation, retention, and scope metadata. No other item is inferred or saved. | Yes | Not Run | — |
| MEM-03 | View/edit/forget/delete/export | Exercise all controls and verify database, UI, exports, and future prompt assembly reflect the change. | Yes | Not Run | — |
| MEM-04 | Restricted memory denial | Attempt to remember secrets, prohibited data, restricted narratives, unsupported inferences, and unapproved identity fields. Reject without durable trace of the content. | Yes | Not Run | — |
| MEM-05 | Hermes versus app memory | UI and Guide distinguish Hermes session/profile memory from structured STEWARD memory; deleting one does not falsely claim deletion from the other. | Yes | Not Run | — |

## 16. Evidence retrieval and citations

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| EVD-01 | Honest unavailable state | With no retrieval provider, Evidence Center remains usable for user sources and clearly says live retrieval is unavailable. It produces no synthetic citations. | Yes | Not Run | — |
| EVD-02 | Real retrieval | With an approved provider, retrieve a safe public source and store title, publisher/author, date if available, URL/identifier, retrieval time, source type, and appraisal state. | Operational when retrieval promised | Not Run | — |
| EVD-03 | URL/identifier validation | Validate final destination, scheme, redirects, status, and normalized identifier before rendering a source as retrievable evidence. | Yes | Not Run | — |
| EVD-04 | Claim-to-source mapping | Link a specific claim to the retrieved source and preserve whether support is direct, partial, contradictory, or unresolved. | Yes | Not Run | — |
| EVD-05 | Unsupported claim handling | Ask for a claim not supported by retrieved/user sources. It remains provisional and receives no fabricated citation. | Yes | Not Run | — |
| EVD-06 | Source-content injection | A retrieved page containing hostile instructions cannot alter system/agent policy, request secrets, activate tools, or change permissions. | Yes | Not Run | — |
| EVD-07 | Citation export | Export citations and claim mappings with provenance, retrieval time, appraisal, uncertainty, and review state; links are not silently rewritten. | No | Not Run | — |
| EVD-08 | Source correction and expiry | Correct, supersede, expire, or delete a source. Dependent claims/artifacts are flagged and badge evidence recalculates where applicable. | Yes | Not Run | — |

## 17. Capabilities, mastery, and achievement evidence

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| BADGE-01 | Versioned four-level model | The pinned 17-domain Basic/Intermediate/Advanced criteria and global AI Agent Orchestration Master capstone load from `config/STEWARD-Capability-Mastery-Criteria.v1.json`, resolve uniquely, and use no hidden AI scoring. | Yes | Not Run | — |
| BADGE-02 | Evidence-based calculation | Complete eligible real missions/artifacts/reflections and verify progress from saved events. Clicking, viewing, or sample content alone earns nothing. | Yes | Not Run | — |
| BADGE-03 | Human verification | Criteria that imply demonstrated skill or safe agent supervision require a named human verification record; participation remains distinct. | Yes | Not Run | — |
| BADGE-04 | Deletion/correction recalculation | Delete or correct eligible evidence. Progress and award state recalculate, with correction/revocation history retained appropriately. | Yes | Not Run | — |
| BADGE-05 | Next challenge and safety evidence | Every badge shows current level, evidence, earned date, next criteria, recommended challenge, and governance/safety competencies demonstrated. | No | Not Run | — |
| BADGE-06 | Noncredential language | UI, exports, Guide, and metadata never imply licensure, certification, CE credit, competence, privileging, or employer authorization. | Yes | Not Run | — |
| BADGE-07 | Portable export | Export a machine-readable achievement record with criteria/evidence/version metadata suitable for future credential mapping without claiming a current credential. | No | Not Run | — |
| BADGE-08 | Agent mastery gate | Master level requires reviewed ORBIT charters, real bounded runs, failure/kill/rollback evidence, human review, and evaluated orchestration—not self-attestation alone. | Yes | Not Run | — |

## 18. Interface, accessibility, and control completeness

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| UI-01 | Information architecture | Home, Missions, Improvement Loop, Portfolio, Evidence, Powers, Agent Console, Capabilities, Memory/Data, Guide, and Diagnostics are reachable and correctly titled. | No | Not Run | — |
| UI-02 | Core Four and attention limit | My STEWARD shows the four canonical launchers and no more than seven attention items; each enabled launcher performs its stated action. | Yes | Not Run | — |
| UI-03 | Permanent accountability | Judgment, license/accountability, review, prohibited-data, verification, and external-permission reminders remain visible or persistently reachable on every relevant surface. | Yes | Not Run | — |
| UI-04 | Keyboard navigation | Complete onboarding, create/edit a mission, traverse stages/tabs/dialogs, use primary controls, and reach errors using keyboard only. | Yes | Not Run | — |
| UI-05 | Screen-reader semantics | Landmarks, headings, labels, dialogs, tabs, progress, live streaming, errors, warnings, and status changes expose correct names/states via accessibility inspection. | Yes | Not Run | — |
| UI-06 | Focus and dialog management | Focus enters dialogs, remains contained where required, returns to the trigger, and is not trapped by hidden or inert navigation. | Yes | Not Run | — |
| UI-07 | Contrast/reflow/zoom | Test supported themes at 200% zoom and narrow viewport. Content and controls remain operable without hidden safety text or destructive overlap. | No | Not Run | — |
| UI-08 | Reduced motion and status | Reduced-motion preference suppresses nonessential motion; streamed/progress/error states remain understandable without animation alone. | No | Not Run | — |
| UI-09 | Error recovery | Validation, storage, backend, import, and permission errors identify the affected field/action, preserve safe user work, and provide a real recovery route. | Yes | Not Run | — |
| UI-10 | Responsive performance | Representative populated dashboards remain responsive within declared limits; long tasks expose real cancellable progress. | No | Not Run | — |
| CTL-01 | Control inventory complete | Inventory every clickable/editable/keyboard control with screen, behavior, implementation, persistence, permission, offline/error behavior, and test ID. | Yes | Not Run | — |
| CTL-02 | Zero unresolved enabled controls | Automated and manual scans find zero enabled controls marked or behaving as placeholder, mock, TODO, coming soon, dead link, no-op, decorative action, or unverified. | Yes | Not Run | — |
| CTL-03 | Disabled-control truth | Every intentionally unavailable control is disabled or clearly read-only and gives an accurate setup, capability, permission, or policy reason. | Yes | Not Run | — |
| CTL-04 | Client/server validation parity | Direct API tests cannot bypass constraints enforced in the UI; server errors map back to accessible client feedback. | Yes | Not Run | — |
| CTL-05 | Destructive confirmations | Delete, reset, rollback, remove, purge, and uninstall show exact scope and consequences, require deliberate confirmation, and support recovery where promised. | Yes | Not Run | — |

## 19. Operating-system, update, rollback, and uninstall matrix

Duplicate these rows for every OS/architecture claimed in the final report.

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| OS-01 | Clean-machine install | Install from the release package on the named clean OS using only included instructions and declared prerequisites. | Yes | Not Run | — |
| OS-02 | First run and credential | Complete setup, create local credentials, onboard, save a starter/adopted mission, and close normally. | Yes | Not Run | — |
| OS-03 | Restart and resume | Restart the computer, launch normally, authenticate, and resume exact saved work. | Yes | Not Run | — |
| OS-04 | Offline core | Disable network and complete the representative offline mission/CRUD/export path. | Yes | Not Run | — |
| OS-05 | Hermes connection | When available on this OS, connect to real Hermes, stream, stop, resume, and inspect capability state. | Operational gate | Not Run | — |
| OS-06 | Backup and restore | Create, verify, relocate, and restore a backup using documented commands or controls. | Yes | Not Run | — |
| OS-07 | Safe update | Update a populated prior release; pre-update backup, migrations, data continuity, version state, and new launch all pass. | Yes | Not Run | — |
| OS-08 | Failed-update rollback | Inject update failure and recover to the verified prior version without corrupting or silently downgrading data. | Yes | Not Run | — |
| OS-09 | Application-only uninstall | Remove application components while preserving data only after an explicit user choice; reinstall binds safely. | Yes | Not Run | — |
| OS-10 | Full uninstall | Remove application and selected local data, sessions, agents, temporary files, launch items, and traces; verify cleanup. | Yes | Not Run | — |
| OS-11 | File permissions | Inspect database, backups, secrets, logs, and launchers. Permissions/ACLs match the documented OS-specific policy. | Yes | Not Run | — |
| OS-12 | Nondeveloper usability | A representative nondeveloper follows README-FIRST without undocumented shell edits and reaches the useful home or a precise prerequisite blocker. | Yes | Not Run | — |

## 20. Full-path end-to-end acceptance

| ID | Acceptance check | Required procedure and expected result | Critical | Result | Evidence / blocker |
|---|---|---|---|---|---|
| E2E-01 | Offline/core journey | Clean install → first-run credential → onboarding → profile approval → role dashboard → adopt/create mission → complete and save one stage → close app → restart → authenticate → resume → export → backup → restore. | Yes | Not Run | — |
| E2E-02 | Real Hermes journey | Continue E2E-01 → configure/detect real Hermes → authenticated capability check → select/approve bounded agent → receive genuine streamed response → observe any real tool state → stop a response → resume session → inspect evidence and memory controls → return agent to Disabled. | Operational gate | Not Run | — |
| E2E-03 | Offline after live failure | During E2E-02, make Hermes unavailable. The run fails honestly, partial content is labeled, and E2E-01 core functions remain usable and consistent. | Yes | Not Run | — |
| E2E-04 | No-canned-response proof | Instrument production network/server calls, disconnect every backend, invoke every AI action, and prove no assistant completion, citation, agent event, tool event, or fake progress is generated. | Yes | Not Run | — |

## 21. Master-prompt acceptance crosswalk

Hermes must add one or more test IDs from this ledger and a final result for each of the 26 master acceptance criteria.

| Master criterion | Primary ledger coverage | Result | Evidence / blocker |
|---|---|---|---|
| 1. Clean download installs/starts from instructions | PKG-01–PKG-10, OS-01 | Not Run | — |
| 2. First run creates a useful personalized dashboard | ONB-01–ONB-14 | Not Run | — |
| 3. Full mission-loop lifecycle works without AI | CORE-02–CORE-20 | Not Run | — |
| 4. Work survives refresh and restart | DATA-01–DATA-03 | Not Run | — |
| 5. Starter content is labeled/removable/excluded | ONB-11–ONB-13, BADGE-02 | Not Run | — |
| 6. Every visible control works or is truthfully disabled | CTL-01–CTL-05 | Not Run | — |
| 7. No runtime placeholders/canned/fabricated behavior | AI-12, AI-17, CTL-02, E2E-04 | Not Run | — |
| 8. Genuine configured-backend streaming works | AI-02–AI-05, E2E-02 | Not Run | — |
| 9. Tool activity is distinct from assistant text | AI-06, UI-05 | Not Run | — |
| 10. Cancellation works | AI-07 | Not Run | — |
| 11. Authorized sessions resume after refresh | AI-09 | Not Run | — |
| 12. Agent selection changes real behavior | AGT-03–AGT-05 | Not Run | — |
| 13. Hermes Soul is used without exposure/duplication | AI-04 | Not Run | — |
| 14. Evidence responses have real working citations | EVD-02–EVD-05 | Not Run | — |
| 15. Unsupported claims never get fabricated citations | EVD-05, E2E-04 | Not Run | — |
| 16. Memory is consensual and controllable | MEM-01–MEM-05 | Not Run | — |
| 17. Restricted data stays out of memory/analytics | GOV-14–GOV-17, MEM-04, DATA-16 | Not Run | — |
| 18. Unauthorized requests are rejected | GOV-01–GOV-17, AGT-06–AGT-10 | Not Run | — |
| 19. No API key leaks | SEC-08–SEC-10, SEC-16 | Not Run | — |
| 20. Backend outage or absence preserves honest offline core | CORE-21, AI-10–AI-13, E2E-03 | Not Run | — |
| 21. Multiple roles remain appropriately separated | ROLE-01–ROLE-08 | Not Run | — |
| 22. Badge progress uses reviewable evidence | BADGE-01–BADGE-08 | Not Run | — |
| 23. Export/backup/restore/deletion work | DATA-07–DATA-13 | Not Run | — |
| 24. Responsive, keyboard-accessible, understandable | UI-01–UI-10 | Not Run | — |
| 25. Install, diagnostics, build, and tests pass | PKG suite, OS suite, all applicable rows | Not Run | — |
| 26. Complete real user path succeeds | E2E-01–E2E-04 | Not Run | — |

## 22. Summary and readiness calculation

Fill only from row-level evidence.

| Domain | Passed | Failed | Blocked | Unsupported | Not Run | Not Applicable | Critical blockers |
|---|---:|---:|---:|---:|---:|---:|---|
| Package/install/diagnostics | 0 | 0 | 0 | 0 | 12 | 0 | TBD |
| Onboarding/personalization | 0 | 0 | 0 | 0 | 14 | 0 | TBD |
| Offline core | 0 | 0 | 0 | 0 | 21 | 0 | TBD |
| Persistence/recovery | 0 | 0 | 0 | 0 | 16 | 0 | TBD |
| Roles/isolation | 0 | 0 | 0 | 0 | 8 | 0 | TBD |
| STEWARD governance | 0 | 0 | 0 | 0 | 30 | 0 | TBD |
| Security | 0 | 0 | 0 | 0 | 18 | 0 | TBD |
| AI/streaming | 0 | 0 | 0 | 0 | 17 | 0 | TBD |
| Agents/memory | 0 | 0 | 0 | 0 | 17 | 0 | TBD |
| Evidence/citations | 0 | 0 | 0 | 0 | 8 | 0 | TBD |
| Badges | 0 | 0 | 0 | 0 | 8 | 0 | TBD |
| UI/control completeness | 0 | 0 | 0 | 0 | 15 | 0 | TBD |
| OS/release lifecycle | 0 | 0 | 0 | 0 | 12 per OS | 0 | TBD |
| End-to-end | 0 | 0 | 0 | 0 | 4 | 0 | TBD |
| Legacy STEWARD RA suite | 0 | 0 | 0 | 0 | 160 | 0 | TBD |

Apply these gates:

### Core gate

Core passes only when every applicable critical package, onboarding, offline-core (including CORE-21), persistence, role-isolation, governance, security, badge, UI/control, OS, E2E-01 and E2E-04 check is Passed, with no unresolved critical defect. A live AI backend is not required for the Core gate. E2E-03 belongs to the AI/degradation gate because it interrupts a real connected run.

### AI gate

AI passes only when the shipped production adapter passes contract, security, routing, session, failure, genuine streaming, cancellation, no-fake-fallback, production-mock-exclusion and E2E-03 live-failure degradation checks. If the product is presented as Hermes-integrated, E2E-02 must use a real Hermes gateway. Retrieval and tool checks must pass when those capabilities are promised; otherwise the limitations must be visible and the affected rows remain Blocked, Unsupported, or explicitly Not Applicable.

### Operating-system support gate

An OS/version/architecture may appear under Supported only if its complete OS-01 through OS-12 applicable suite passes. Untested platforms must be labeled Targeted, not Supported.

### Operational gate

Operational requires the Core gate, AI gate, all applicable master criteria, all applicable critical STEWARD RA checks, control completeness, the claimed OS matrix, package integrity, and the real end-to-end journey to pass. No failed, blocked, unsupported, or Not Run critical row may remain.

## 23. Mandatory final readiness statement

The final handoff report must end with exactly one of the following statements, with no wording changes and no text after it:

**Operational:** All acceptance criteria passed, including a genuine end-to-end streamed response through the downloaded application.

**Core operational; AI setup pending:** All offline/core acceptance criteria passed, but a live configured backend was not available for the genuine-streaming acceptance test.

**Not operational:** One or more core acceptance criteria failed; list each blocker.

Selection rules:

- Use Operational only when the Operational gate above passes.
- Use Core operational; AI setup pending only when the complete Core gate passes and the only readiness gap is absence of a live configured backend for genuine streaming. It is not allowed when retrieval, security, cancellation, install, control, or other core checks failed.
- Use Not operational for every other condition, including untested or unsupported critical core checks. List blockers immediately before the final statement.
