{
  "schema_version": 5,
  "manifest_id": "mastery-engine-upstreams-2026-07-17-r7",
  "status": "bank_contract_blocks_architecture_journey_blocks_implementation",
  "reviewed_at": "2026-07-17",
  "reviewed_by": "alphatest-loop",
  "contract_revision": "Revision 7 respects left-to-right delivery sequencing: architecture requires the positive Bank adaptivePool receipt plus independent QTI-root reconciliation; the executable owner-backed journey becomes mandatory at implementation and remains mandatory afterward. It binds Platform3 auth to provisioned service profiles rather than a nonexistent token exchange.",
  "auth_and_tenant_propagation": {
    "default": "Derive the AlphaTest tenant only from the verified client JWT, then select a server-held Platform3 service profile with an identical configured tenant. Never forward the client JWT or accept upstream host, credential, or tenant material from request input.",
    "content_qti": "Insert the selected profile's configured PLATFORM3_TENANT into {tenantId}; reject a claim/profile mismatch before the upstream call.",
    "case_results_nweamap": "Forward a least-privilege Bearer JWT; these services derive tenant from the token.",
    "caliper": "Forward Bearer JWT and X-Timeback-Tenant derived from the same verified tenantId claim."
  },
  "authentication_profiles": {
    "provisioned_platform3_service": {
      "status": "bound",
      "server_only_inputs": ["PLATFORM3_TENANT", "PLATFORM3_JWT", "approved service base URLs"],
      "use": "owner-backed conformance and learner flows for the identically configured tenant",
      "transport": "server-side Authorization injection; credential never crosses the AlphaTest request or response boundary",
      "acceptance": "same-profile tenant calls succeed; claim/profile mismatch is rejected before wire I/O; anonymous and bidirectional cross-tenant run probes fail; receipts contain no credential"
    }
  },
  "workload_authentication": {
    "id": "platform3.provisioned_service_jwt",
    "status": "bound",
    "required_contract": "Server-held approved base URL plus PLATFORM3_TENANT and PLATFORM3_JWT provisioned by the Platform3 operator.",
    "acceptance": "Verified AcmeTest tenant equals the selected configured tenant; authenticated upstream call succeeds; anonymous, invalid-bearer, claim/profile mismatch, and bidirectional cross-tenant run probes fail.",
    "migration_trigger": "Only after Platform3 publishes a workload exchange and the existing adaptive journey and isolation probes remain green under it."
  },
  "operations": [
    {
      "id": "content.read_test_spec",
      "status": "bound",
      "base_url_env": "CONTENT_BASE_URL",
      "method": "GET",
      "path_template": "/tenants/{tenantId}/alpha/content/items/{testSpecId}/blueprint",
      "required_scope": "read:content",
      "normalized_response": {"required": ["spec_id", "assessment_role", "kc_coverage", "item_type_mix", "difficulty_constraints", "passing_rule", "min_forms", "max_item_overlap", "enemy_item_rule", "updated_at"]},
      "acknowledgement": "HTTP 200; spec_id equals testSpecId; assessment_role=spec; canonical response hash is stable across two reads",
      "reviewed_source": "https://platform3-andymontgomery-9773s-projects.vercel.app/content/alpha/customer_website#operation-endpoint-get-test-spec-blueprint",
      "probe_receipt": "content-contract-probe-2026-07-16.json"
    },
    {
      "id": "content.validate_adaptive_bank_identity",
      "status": "bound",
      "base_url_env": "CONTENT_BASE_URL",
      "method": "GET",
      "path_template": "/tenants/{tenantId}/alpha/content/items/{testBankId}/bank-members",
      "required_scope": "read:content",
      "normalized_response": {"required": ["bank", "data"], "bank_required": ["bank_id", "assessment_role", "spec_id", "membership_rule", "updated_at"]},
      "eligibility": "bank.membership_rule=qti_adaptive_selection and data is exactly []; any Content member row is a cross-module contract violation",
      "ordering": "not applicable; adaptive membership remains in QTI",
      "acknowledgement": "HTTP 200; bank_id equals testBankId; spec_id equals the selected testSpecId; membership_rule=qti_adaptive_selection; data=[]; canonical identity hash is stable across two reads",
      "reviewed_source": "https://platform3-andymontgomery-9773s-projects.vercel.app/content/alpha/customer_website#operation-endpoint-list-test-bank-members",
      "probe_receipt": "content-contract-probe-2026-07-16.json"
    },
    {
      "id": "qti.read_adaptive_pool_root",
      "status": "bound_root_only",
      "base_url_env": "QTI_BASE_URL",
      "method": "GET",
      "path_template": "/tenants/{tenantId}/qti/artifact-versions/{artifactVersionId}/delivery-json",
      "required_authorization": "tenant-scoped QTI read JWT",
      "request_identity": "artifactVersionId is the immutable QTI assessment-test version returned by Bank beside the Content testBankId; never a caller-composed member list",
      "normalized_response": {"required": ["artifactVersionId", "documentId", "sourceBundleVersion", "qti", "lossiness", "omittedFields"], "qti_required": ["elementName", "attributes", "children"], "root_element": "qti-assessment-test", "member_ref_element": "qti-assessment-item-ref"},
      "acknowledgement": "HTTP 200; response artifactVersionId and ETag equal the requested immutable version; root is qti-assessment-test; ordered assessment-item-ref projection is non-empty; canonical body hash is stable across two reads",
      "reviewed_source": "https://platform3-andymontgomery-9773s-projects.vercel.app/qti/1edtech/customer_website#endpoint-getdeliveryjson",
      "probe_receipt": "qti-adaptive-pool-probe-2026-07-16.json"
    },
    {
      "id": "bank.read_adaptive_pool_manifest",
      "status": "mandatory_owner_contract",
      "owner": "AlphaTest Bank composing its generation provenance with Platform3 QTI and CASE",
      "base_url_env": "BANK_BASE_URL",
      "method": "GET",
      "path_template": "/v1/bank-operations/{operationId}/manifest",
      "required_contract": {
        "resource": "the terminal immutable Bank evidence manifest for the adaptive generation operation",
        "root_required": ["packageId", "artifactId", "artifactVersionId", "qtiIdentifier", "packageHash"],
        "required_per_ordered_ref": ["qtiIdentifier", "artifactId", "artifactVersionId", "caseStandardGuids", "knowledgeComponentGuids"],
        "integrity": ["terminal operation belongs to the verified tenant", "every QTI root item ref resolves exactly once", "all member versions belong to the same immutable pool graph", "CASE/KC GUID arrays are non-empty and canonical", "independent QTI-root reconciliation succeeds", "repeat-read ETag and SHA-256 are stable"]
      },
      "failure_envelopes": {
        "invalid_projection": {"status": 502, "code": "qti-adaptive-pool-invalid", "retryable": false},
        "pinned_projection_changed": {"status": 409, "code": "adaptive-pool-version-drift", "retryable": false}
      },
      "release_acceptance": "A redacted timestamped 200 receipt records Bank operation ID, approved host, ETag, response hash, root native IDs, member count, completeness booleans, and independent QTI reconciliation; deployed smoke can replay it. Absence routes rollback to Bank and fails architecture approval rather than removing Mastery routes.",
      "reviewed_source": "https://alphatest-andymontgomery-9773s-projects.vercel.app/bank/integrator_api/customer_website#get-manifest"
    },
    {
      "id": "qti.read_candidate_runtime",
      "status": "bound",
      "base_url_env": "QTI_BASE_URL",
      "method": "GET",
      "path_template": "/tenants/{tenantId}/qti/candidates/{candidateRef}/runtime-data",
      "required_authorization": "tenant-scoped service or runtime-data reader",
      "normalized_response": {"required": ["tenantId", "candidateRef", "deliverySessionCount", "attemptCount", "deliverySessions", "attempts"], "attempt_required": ["attemptId", "deliverySessionId", "artifactVersionId", "status", "outcomeState", "processingTrace"]},
      "stream_rule": "Read each token-pinned per-offer candidateRef, select only its token-pinned deliverySessionId, and order by the token's offer sequence, then attemptNumber and attemptId. The canonical hash is the public ETag.",
      "acknowledgement": "HTTP 200, tenantId/candidateRef match, and every referenced session and attempt is present in the same tenant.",
      "reviewed_source": "https://platform3-andymontgomery-9773s-projects.vercel.app/qti/1edtech/customer_website#endpoint-getcandidateruntimedata"
    },
    {
      "id": "qti.offer_selected_item",
      "status": "bound",
      "base_url_env": "QTI_BASE_URL",
      "method": "POST",
      "path_template": "/tenants/{tenantId}/qti/delivery-sessions",
      "request": {"body_required": ["candidateRef", "artifactVersionId"]},
      "normalized_response": {"required": ["deliverySessionId", "rootArtifactVersionId", "status", "deliveryJsonSnapshot"]},
      "orchestration_rule": "For offer sequence n, derive an unlinkable candidateRef UUID from HMAC(tenantId, runNonce, n), read that exact candidate runtime first, and reuse a matching existing session or create one immutable artifactVersionId session. A tenant-scoped advisory lock keyed by runNonce serializes the request and expires at request end.",
      "acknowledgement": "HTTP 201, rootArtifactVersionId equals the selected bank member version, candidateRef is the same pseudonymous run reference, and the returned delivery snapshot is non-empty.",
      "reviewed_source": "https://platform3-andymontgomery-9773s-projects.vercel.app/qti/1edtech/customer_website#endpoint-startdeliverysession"
    },
    {
      "id": "qti.score_item_attempt",
      "status": "bound",
      "caller": "AcmeTest QTI player; the engine consumes its result through qti.read_candidate_runtime",
      "base_url_env": "QTI_BASE_URL",
      "method": "POST",
      "path_template": "/tenants/{tenantId}/qti/delivery-sessions/{deliverySessionId}/attempts",
      "request": {"body_required": ["artifactVersionId", "responses"]},
      "normalized_response": {"required": ["attemptId", "responseState", "outcomeState", "processingTrace"]},
      "acknowledgement": "HTTP 200, attemptId is durable, artifactVersionId belongs to the offered session, outcomeState contains the calibrated score variable, and processingTrace has no unsupported-runtime diagnostic.",
      "reviewed_source": "https://platform3-andymontgomery-9773s-projects.vercel.app/qti/1edtech/customer_website#endpoint-submitattempt"
    },
    {
      "id": "case.resolve_mapping",
      "status": "bound",
      "base_url_env": "CASE_BASE_URL",
      "method": "GET",
      "path_template": "/ims/case/v1p1/CFItems/{sourcedId}",
      "required_scope": "case:read",
      "normalized_response": {"required": ["sourcedId", "identifier", "uri", "fullStatement", "lastChangeDateTime"]},
      "acknowledgement": "HTTP 200 and sourcedId/URI match the policy calibration mapping.",
      "reviewed_source": "https://platform3-andymontgomery-9773s-projects.vercel.app/case/1edtech/customer_website#endpoint-get-ims-case-v1p1-cfitems-sourcedid"
    },
    {
      "id": "nweamap.verify_anchor",
      "status": "bound",
      "base_url_env": "NWEAMAP_BASE_URL",
      "method": "GET",
      "path_template": "/nweamap/v1/r90?subject={subject}&rit={rit}&tableVersion={tableVersion}",
      "required_scope": "nweamap:read",
      "normalized_response": {"required": ["tableVersion", "subject", "rit", "r90Grade", "effectiveGrade", "sourcePointKind", "sourceRef"]},
      "acknowledgement": "HTTP 200, requested tableVersion echoed, sourcePointKind=exact, and sourceRef is non-null.",
      "reviewed_source": "https://platform3-andymontgomery-9773s-projects.vercel.app/nweamap/1edtech/customer_website#endpoint-lookup-r90"
    },
    {
      "id": "results.write_result_record",
      "status": "bound",
      "base_url_env": "RESULTS_BASE_URL",
      "method": "POST",
      "path_template": "/alpha/results/v1/result-records",
      "required_scope": "results:write",
      "request": {"headers": ["Authorization", "Idempotency-Key", "Content-Type"], "body_required": ["student_id", "result_kind", "subject_id", "source_adapter_id", "producer_result_id"]},
      "normalized_response": {"required": ["result_record_id", "student_id", "result_kind", "source_adapter_id", "producer_result_id", "modified_at"]},
      "acknowledgement": "HTTP 2xx and returned producer_result_id equals the deterministic run completion key.",
      "reviewed_source": "https://platform3-andymontgomery-9773s-projects.vercel.app/results/alpha/customer_website#endpoint-create-result-record"
    },
    {
      "id": "results.write_kc_components",
      "status": "upstream_gap",
      "required_contract": {"method": "POST", "atomic_with": "results.write_result_record or idempotently attachable by result_record_id", "request_required": ["result_record_id", "case_guid", "classification", "posterior_probability", "evidence_attempt_ids", "policy_version", "calibration_version"], "response_required": ["result_record_id", "component_ids", "component_count", "acknowledged_at"]},
      "available_but_insufficient": "POST /alpha/results/v1/result-records does not accept KC components. POST /alpha/results/v1/imports can materialize KC evidence only from documented raw producer shapes; relabeling AlphaTest output as timeback_assessment_result would violate that contract.",
      "reopen_trigger": "Results publishes and deploys a trusted-scorer write that acknowledges one component for every requested CASE GUID, and authenticated same-tenant plus cross-tenant probes pass.",
      "reviewed_source": "https://platform3-andymontgomery-9773s-projects.vercel.app/results/alpha/customer_website#endpoint-create-result-record"
    },
    {
      "id": "caliper.emit_completion_or_simulation",
      "status": "bound",
      "base_url_env": "CALIPER_BASE_URL",
      "method": "POST",
      "path_template": "/caliper/v1p2/events",
      "request": {"headers": ["Authorization", "X-Timeback-Tenant", "Content-Type"], "body_required": ["sensor", "sendTime", "dataVersion", "data"]},
      "evidence_rule": "Learner completion emits the assessment event only after Results acknowledgements. Synthetic recovery emits a non-learner conformance event whose generated object includes policy/calibration/content hashes, tolerance, aggregate recovery errors, and pass/fail; no synthetic profile is a student identity.",
      "acknowledgement": "POST 204 followed by eventIri read-back and envelope-hash read-back from the published Caliper operations.",
      "reviewed_source": "https://platform3-andymontgomery-9773s-projects.vercel.app/caliper/1edtech/customer_website#endpoint-persistcaliperenvelope"
    },
    {
      "id": "caliper.read_evidence_ack",
      "status": "bound",
      "base_url_env": "CALIPER_BASE_URL",
      "method": "GET",
      "path_template": "/caliper/v1p2/events?eventIri={eventIri}",
      "normalized_response": {"required": ["eventIri", "eventType", "action", "generated", "envelopeId"]},
      "acknowledgement": "HTTP 200 and eventIri/generated references match the emitted completion or simulation receipt.",
      "reviewed_source": "https://platform3-andymontgomery-9773s-projects.vercel.app/caliper/1edtech/customer_website#endpoint-getcalipereventprojection"
    }
  ],
  "wire_receipt_schema": {
    "required_per_span": ["profile", "approvedHost", "operationId", "httpStatus", "upstreamRequestId", "fixtureId", "fixtureVersion", "responseSha256"],
    "forbidden": ["authorization", "token", "studentId", "candidateRef", "responses", "scores", "rawBody"],
    "failure_tests": ["missing span", "wrong host", "wrong tenant", "unapproved operation id", "local fallback"]
  },
  "release_profiles": {
    "owner_conformance": {
      "route_required": true,
      "architecture_approvable_without_journey": true,
      "architecture_blocking_prerequisite": "bank.read_adaptive_pool_manifest must return the complete additive adaptivePool projection with a positive redacted 200 receipt and independent QTI-root reconciliation",
      "implementation_blocking_prerequisite": "the complete owner-backed start-to-stop journey must pass from implementation onward",
      "negative_control_only": "qti-adaptive-pool-probe-2026-07-16.json proves a root-only fixed-form package is insufficient and cannot satisfy release.",
      "required_server_env": ["BANK_BASE_URL", "CONTENT_BASE_URL", "QTI_BASE_URL", "CASE_BASE_URL", "NWEAMAP_BASE_URL", "CALIPER_BASE_URL", "PLATFORM3_TENANT", "PLATFORM3_JWT", "MASTERY_CONFORMANCE_BANK_OPERATION_ID"]
    },
    "production_learner": {
      "advertised_ready": false,
      "blocking_operation_ids": ["bank.read_adaptive_pool_manifest", "results.write_kc_components"],
      "reopen_trigger": "The mandatory Bank projection and Results components are bound; a two-tenant full trace includes exact QTI pool/member/KC hashes, Results base record plus one acknowledged component per CASE GUID, and Caliper read-back. Provisioned Platform3 service credentials are already the accepted auth shape."
    }
  },
  "release_gate": {
    "ready": false,
    "blocking_operation_ids": ["bank.read_adaptive_pool_manifest", "results.write_kc_components"],
    "removed_former_blockers": {
      "qti.read_session": "qti.read_candidate_runtime filtered by token-pinned deliverySessionIds",
      "qti.read_scored_stream": "qti.read_candidate_runtime canonical attempt projection",
      "qti.atomic_offer_item": "qti.offer_selected_item under request-scoped advisory serialization",
      "qti.close_and_score_session": "removed: QTI score_item_attempt is the actual published scoring boundary; mastery completion does not claim QTI session closure",
      "evidence.persist_score_recovery_artifact": "Caliper conformance event plus read-back acknowledgement"
    },
    "architecture_rule": "Architecture approval requires the positive Bank adaptivePool receipt and independent QTI-root reconciliation; it does not require a deployed Mastery journey. Missing Bank projection routes rollback to Bank.",
    "implementation_and_later_rule": "From implementation onward, the owner-backed demo journey must pass and missing Bank projection never authorizes absent adaptive business routes. A QTI root-read 200, route presence, or health is not pool readiness. Production learner completion additionally requires Results components. No Content adaptive member rows, generic list scan, local copy, caller array, or mislabeled fixed form satisfies a gate."
  }
}