Evidence-affecting path list — assessment

Status: In force. This is the evidence gate's PR-diff backstop list, designated as such by ADR-0005 and linked as the inventory from CONTRIBUTING.md and the pull request template. It stands until a maintained list supersedes it; the governance-docs ticket (#305) closed without producing one. Individual entries stay revisable — see "Judgment calls needing confirmation in review". (Origin: wayfinder ticket #303, autonomy map #298.) Amended 2026-08-23 by ADR-0014: every include-list entry now carries a tier, blocking or advisory. Read "Tiers" before using this list for anything; a hit no longer means one thing. Definition applied: CONTEXT.md, Assurance baseline — "An evidence-affecting change includes acquisition, parsing, extraction, storage, hashing, signing, trusted time, manifests, verification, redaction, export, reporting, AI analysis, and software distribution when it can alter an evidentiary result or its interpretation."

Purpose

This list is the mechanical PR-diff backstop for the evidence gate (decision record: #299). The primary trigger is the evidence-affecting label applied at triage; this list catches PRs whose diff touches an evidence path without the label. It is expressed as globs so a routine or CI step can match it against git diff --name-only. It was drafted as the reviewed source that a machine-consumed file would be seeded from; #305 closed without relocating or superseding it, so this document is the list itself until one is produced.

Method note: produced by a three-slice parallel survey of the codebase (main services; db/shared/ ai/extraction; extension/renderer/distribution edges), each reading files rather than classifying by name, followed by an adversarial completeness/overbreadth challenge. The challenge pass added six paths both surveyors missed, overturned one exclusion on a factual error, and removed two inconsistent inclusions — those changes are already folded into the list below.

Amendments since the survey: src/shared/urlPatterns.ts added to Acquisition (#227) — the ignored-URL matcher moved there out of the already-listed src/main/services/captureServer.ts, and the rename-detection-off rule only catches the move itself, not later edits to the new home. src/renderer/lib/api/** added to the exclusion list (#229) — the renderer query layer split out of src/renderer/lib/queries.ts into per-domain modules, so the reasoning recorded against that one file now applies to the directory. The call is unchanged (still excluded), and judgment call 2 below is restated against the new path; queries.ts itself is a re-export barrel that the last PR of that sequence deletes. extension/src/popup/PopupApp.tsx, extension/src/popup/pageStatus.ts and extension/src/messages.ts added to Acquisition (#387) — the popup's case routing and its capture button moved out of the already-listed extension/src/popup/popup.tsx, which is now a mount point, and the same rename-detection caveat applies: without these three the backstop would stop firing on the code that actually routes a capture. src/main/services/exclusionPolicy.ts added to Acquisition (#400) — the same move as #227, one step further: the decision about what may enter a case moved out of the already-listed src/main/services/captureServer.ts so that src/main/services/recapture.ts, a producer the capture server never sees, enforces the identical rule rather than a second copy of it. The rename-detection-off rule catches the move itself and nothing after, and this file is now the single place that answer is computed, so a later edit touching only it would otherwise match no entry. src/shared/urlCanonicalize.ts added to Acquisition (#392) — the canonical URL identity the extension attach routes (tag apply, note create, URL lookup) resolve against. It decides which Capture a Tag or Note binds to, and whether an attach request acquires new bytes at all (no canonical match means the supplied payload is ingested), so it shapes what enters a case the same way urlPatterns.ts does; the #227 argument applies unchanged. Shared so the extension and the server agree on the rules by construction rather than by convention. src/main/windowSize.ts added to the exclusion list (#515) — window sizing moved there out of the already-listed src/main/index.ts in #478 and landed on no list at all, so once that carve-out had settled a PR touching only the new file would have tripped nothing. The call is exclusion rather than inclusion: window geometry enters no capture, content hash, manifest entry, canonical JSON field or signature, which #478's Evidence impact section argued and its round-2 pre-pass verified. src/main/index.ts stays included at blocking tier for the invariants it does still hold. The Shared Case sync modules under src/main/services/sharing/ were added on 2026-10-14 with #1512, the first code that writes another installation's entries, files and rows into a Case. The four that decide what is stored (session.ts, entryAcceptance.ts, blobAcceptance.ts, workingRows.ts) are blocking; messages.ts and syncState.ts are advisory; and the transport interface with its in-process form, transport.ts, is an exclusion by the #227 and #515 reasoning: it carries bytes between installations, reads no message, and decides nothing about what the session accepts. IrohTransport (irohTransport.ts, #1809) is the same kind of file and joins that entry. nodeKey.ts, which keeps the transport's node key, is advisory: the node id the Owner's signed member-add records is that key's public half. The repo module the rows step writes through, src/main/services/db/workingRowRepo.ts, is already swept in by src/main/services/db/**. #1811 added a fifth blocking module, receivedEvidence.ts, which turns received entries into Capture and Exhibit rows. On 2026-10-19 #1881 added syncService.ts at advisory tier: it decides when sessions run and when the transport starts and stops, and reads no message and stores nothing, so what a session it starts may store is still decided in the blocking modules and the roster checks in session.ts. On 2026-10-20 #1882 added two test-only hooks for the two-instance e2e spec, both read only in an unpackaged build: src/main/captureServerPort.ts, the Capture Server port override, joins the exclusions beside src/main/windowSize.ts, since the server behind the port hashes and stores a Capture the same way on any port; and src/main/services/sharing/loopbackTransport.ts, the same transport interface over sockets on 127.0.0.1, joins the transport.ts entry. src/packages/transaction-record/** was added to Acquisition at blocking tier on 2026-10-17 with #1903, the capture engine's step 7 (D12 of the first-slice plan): it decides which of the browser's exchanges a Transaction Record holds as complete and how the inventory counts the rest. src/packages/evidence-package-layout/** was added to Integrity core at blocking tier on 2026-10-26 with #1904, the capture engine's step 1, which put the Transaction Record and PDF package paths in it. It had been on neither list, although Package Verification, verify.sh, Evidence Package export, the Shared Case sync and Case Archive export and import all take paths from it.

Known gap: carve-outs are caught by review, not by a check

Nothing detects a file being split out of an include-list path. The rename-detection-off rule under "List format" catches the move itself, because that diff still names the old path, and nothing after it — once the carve-out has merged, edits touching only the new home match no entry. That is why each amendment above was needed, and every one of them was written because a person or an agent noticed while reading a diff.

Whether that is the intended control or a gap worth closing with a check is open (#1410). Read this as an unresolved gap rather than a decision already taken. It is a live one: two further carve-outs from src/main/index.ts are on neither list today (#1409).

List format

These lists are the seed for a machine-consumed file, so entries follow fixed rules. Anything seeded from this document should be checked against them.

• One repository-relative glob per entry. No table row or bullet combines two paths; a rule that needs two paths gets two entries. This is what makes the tables extractable by cell.
• Paths are repository-relative POSIX paths with no leading ./ or /, so they compare directly against git diff --name-only output. Matching is case-sensitive, and directory separators are always /.
• A ** segment crosses directory separators. An entry ending in a ** segment means that directory and everything beneath it, recursively. An entry with no wildcard matches exactly one file.
• Run the diff with rename detection off (git diff --name-only --no-renames), so moving a file out of an evidence path still trips the backstop on the old path.
• Only the include list feeds the matcher. The exclusion list is a review record of paths deliberately left out, not a subtraction pass applied on top. Blanket exclusion-over-inclusion would be wrong here: src/renderer/components/dashboard/** is excluded while src/renderer/components/dashboard/cases/DataExplorer.tsx and src/renderer/components/dashboard/cases/ImportCaseDialog.tsx are included, and a blanket override would silently drop them. If a future tool does consume both lists, the more specific pattern wins — an exact path beats a directory glob, and among globs the one with the longer literal prefix before its first wildcard beats the shorter.

Tiers

Added 2026-08-23 by ADR-0014. Every include-list entry carries a tier, and the tier decides what a hit costs.

blocking. A change on this path can alter an evidentiary result or its interpretation. The backstop finding is blocking, the PR owes the ADR-0004 obligations (an Evidence impact section, a known-answer test or a written justification, preserved backward verification), it gets human review, and it never auto-merges.

advisory. The path is real evidence surface, but it is shared with a lot of code that is not. A hit produces a one-line reviewer disposition naming which region the diff touched. It owes no Evidence impact section and does not by itself make the PR evidence-affecting. A reviewer who finds the diff does reach evidence behaviour relabels the PR blocking and the full obligations apply.

The evidence-affecting label applied at triage is unchanged and still the primary trigger. The tiers govern the mechanical backstop only. A labelled PR owes the full obligations whatever its diff touches.

Why the tiers exist

ADR-0005 asked for a mechanical backstop because "looks harmless" is the judgment that fails under review pressure. That reasoning holds. What did not hold is treating every entry as equally load-bearing: judgment calls 1, 3 and 10 below predicted, before the pilot ran, that ipcHandlers.ts/ipc.ts wholesale, pnpm-lock.yaml and the distribution block would fire on changes that could not touch an evidentiary result, and pre-authorised dropping them if that proved out.

It proved out. Measured 2026-08-23 over every PR that has carried the label, matching this document's own include list (extracted by cell per the rules above) against git diff --name-only --no-renames for each merge:

Broad-block means the cross-process contracts block, the software distribution block, or src/main/services/db/**. The eleven include the cross-case recent-activity feed, the UI density setting, the tests/ typecheck gating and its reapply, the preload namespace rename, and two PRs hardening the release supply chain. The one no-hit is #532, a threat-model documentation change labelled by triage judgment alone, which is the label working as designed.

Four of the twenty-six narrow hits are incidental brushes rather than evidence work, and they are the more misleading class because they read as substantive:

• #786 hit src/renderer/components/export/** by adding data-tour="export" to a div in ExportMenu.tsx. The whole diff is a coach-mark tour.
• #455 and #357 hit the same glob changing error handling in ExportComplete.tsx and ExportMenu.tsx. Neither shapes a package.
• #478 hit src/main/index.ts moving window sizing out to resolveWindowSize. That file is listed for the evidence-viewer invariants, webview navigation blocking and sandbox webPreferences, and the diff went nowhere near them. The file it moved the sizing into, src/main/windowSize.ts, is on the exclusion list below (#515).

So 16 of 38 labelled merges, 42%, touched no path where the change could have altered an evidentiary result.

The tiers do not clear all sixteen. Re-running the same measurement against the tiered list, 13 of 38 now classify advisory or no-hit and 25 stay blocking. The gap is src/main/services/db/**, kept blocking deliberately because it holds the evidentiary records, which leaves #677 (the cross-case recent-activity feed) and #435 firing on a repo read. That is a known residual, not an oversight: narrowing db/** to something that distinguishes a read from a write is a real piece of work and it is not this one.

Known exposure of the advisory tier

Recorded rather than resolved, because the tier assignment is a deliberate trade.

src/main/services/settings.ts is advisory, and it persists the operator identity that src/main/services/certification.ts embeds verbatim in an export certification. A change there can therefore reach a shipped package without a blocking finding. The judgment is that the certification path itself is blocking and is where such a change becomes visible. If an advisory-tier defect ever does reach main through this route, that is the evidence to promote the entry, and it should be promoted rather than argued with.

src/main/index.ts stays blocking despite its only observed fire being incidental. One file's noise does not buy dropping the evidence-viewer invariants, and the better fix for the specific carve-out that caused it was to record the carved-out file as an exclusion (#515), which is now done.

Include list

Acquisition (extension → capture server)

Integrity core (hash, manifest, signing, trusted time, verification)

Assurance boundary for this block, stated so the rationales do not overclaim: the manifest chain and the RFC 3161 token cover different things, and neither substitutes for the other. The timestamp request's message imprint is the capture's contentHash (buildTimestampRequest in src/main/services/timestamp.ts), so a granted token dates the captured bytes — it says nothing about whether the manifest chain around them is intact. The chain, conversely, covers manifest entries but is signed with the installation-local keypair generated and held by this install (src/main/services/signingKey.ts), so it detects edits made without that key and is not independent of the Operator who holds it.

Capture lifecycle, storage, parsing, extraction

Annotation, redaction, notes-to-evidence binding

Export, reporting, archive

AI analysis

Interpretation surfaces (renderer)

Shared Case sync

The sync session (#1512) is the one path by which another installation's chain entries, Exhibit bytes and working-layer rows enter a Case directory and database. What it accepts is decided in five modules, and who is a member in three more (#1810); the rest of the directory moves bytes or records state.

Cross-process contracts and configuration

Software distribution

Notable exclusions

A review record of paths deliberately left out, in the same one-glob-per-entry form as the include list — see "List format" for why this list is not applied as a subtraction pass over the includes. It is notable exclusions, not an exhaustive complement of the include list.

Judgment calls needing confirmation in review

1. src/main/ipcHandlers.ts and src/shared/ipc.ts wholesale. Both also carry pure-UI channels, so the gate fires on many non-evidence PRs. The backstop cannot distinguish a payload-type change to an evidence channel from a new UI list query. Accept the noise, or split the files later. Resolved 2026-08-23: both are advisory. The files are not split; the tier absorbs the noise instead.
2. src/renderer/lib/api/** excluded while src/preload/index.ts is included. Both are typed passthroughs. As excluded, a hostile change like hardcoding overrideTamper: true in the import mutation (src/renderer/lib/api/cases.ts) would not trip the backstop. Including it gates most renderer PRs. Current call: excluded — the label-at-triage trigger and human review are expected to catch that class.
3. pnpm-lock.yaml. Included by the same logic as package.json (the lockfile is the actual pin that determines shipped code), but it gates every dependency-bump PR. Current call: include; drop it if dep-bump noise proves unacceptable during the pilot. Resolved 2026-08-23: it did. pnpm-lock.yaml is advisory, still listed.
4. src/main/services/session.ts / src/main/services/serverToken.ts. Included on misattribution/spoofed-ingest rationales; arguably workflow state and authn rather than evidence processing.
5. src/main/services/csvEscape.ts. CSV exports are convenience exports, not signed packages; kept because they are still disclosed case data.
6. Notes cluster (src/main/services/noteAnchorResolver.ts, src/shared/noteDoc.ts, src/shared/noteAnchor.ts). Notes never enter evidence packages; inclusion leans entirely on the "interpretation" clause (what evidence a note points at, and note text in exported reports/archives).
7. Selector cluster (src/main/services/selectorLifecycle.ts, src/main/services/safeRegex.ts). Originally excluded as "matches never enter the evidence package" — the challenge pass found that factually wrong (src/main/services/caseArchive.ts exports and re-imports selectors and selectorMatches). Included on that basis; if selector matches are ruled non-evidentiary despite riding in archives, drop both.
8. Accepted glob false positives. src/main/services/db/** sweeps in the read-only src/main/services/db/diagnosticsRepo.ts; src/renderer/components/settings/db/** sweeps in the generic src/renderer/components/settings/db/ConfirmDialog.tsx. Accepted: a per-file list would silently miss future files added to these directories. Resolved 2026-08-23: the globs stay, and both named files are now explicit exclusions. The precedence rule in "List format" makes the specific exclusion win over the directory glob, so future files in those directories are still swept in.
9. extension/src/toast.ts / extension/src/popup/popup.tsx. One step removed from captured bytes (toast markup can be captured; the popup routes evidence to a case). A stricter list could drop extension/src/popup/popup.tsx.
10. Distribution block (src/main/services/updater.ts, the build configs, .github/workflows/release.yml, pnpm-lock.yaml). Included under the definition's "software distribution" clause. If release PRs get their own review channel instead, this whole section could move out of the backstop. Resolved 2026-08-23: the section is advisory rather than moved out, except scripts/build-verifier.mjs and sea-config.json, which define the binary a receiving party runs and stay blocking.