Evidence-affecting path list — assessment

Status: In force. This is the evidence gate's PR-diff backstop list, designated as such by ADR-0005 and linked as the inventory from CONTRIBUTING.md and the pull request template. It stands until a maintained machine-consumed list supersedes it; the governance-docs ticket (#305) closed without producing one. Individual entries stay revisable — see "Judgment calls needing confirmation in review". (Origin: wayfinder ticket #303, autonomy map #298.) Definition applied: CONTEXT.md, Assurance baseline — "An evidence-affecting change includes acquisition, parsing, extraction, storage, hashing, signing, trusted time, manifests, verification, redaction, export, reporting, AI analysis, and software distribution when it can alter an evidentiary result or its interpretation."

Purpose

This list is the mechanical PR-diff backstop for the evidence gate (decision record: #299). The primary trigger is the evidence-affecting label applied at triage; this list catches PRs whose diff touches an evidence path without the label. It is expressed as globs so a routine or CI step can match it against git diff --name-only. It was drafted as the reviewed source that a machine-consumed file would be seeded from; #305 closed without relocating or superseding it, so this document is the list itself until one is produced.

Method note: produced by a three-slice parallel survey of the codebase (main services; db/shared/ ai/extraction; extension/renderer/distribution edges), each reading files rather than classifying by name, followed by an adversarial completeness/overbreadth challenge. The challenge pass added six paths both surveyors missed, overturned one exclusion on a factual error, and removed two inconsistent inclusions — those changes are already folded into the list below.

Amendments since the survey: src/shared/urlPatterns.ts added to Acquisition (#227) — the ignored-URL matcher moved there out of the already-listed src/main/services/captureServer.ts, and the rename-detection-off rule only catches the move itself, not later edits to the new home. src/renderer/lib/api/** added to the exclusion list (#229) — the renderer query layer split out of src/renderer/lib/queries.ts into per-domain modules, so the reasoning recorded against that one file now applies to the directory. The call is unchanged (still excluded), and judgment call 2 below is restated against the new path; queries.ts itself is a re-export barrel that the last PR of that sequence deletes. extension/src/popup/PopupApp.tsx, extension/src/popup/pageStatus.ts and extension/src/messages.ts added to Acquisition (#387) — the popup's case routing and its capture button moved out of the already-listed extension/src/popup/popup.tsx, which is now a mount point, and the same rename-detection caveat applies: without these three the backstop would stop firing on the code that actually routes a capture.

List format

These lists are the seed for a machine-consumed file, so entries follow fixed rules. Anything seeded from this document should be checked against them.

• One repository-relative glob per entry. No table row or bullet combines two paths; a rule that needs two paths gets two entries. This is what makes the tables extractable by cell.
• Paths are repository-relative POSIX paths with no leading ./ or /, so they compare directly against git diff --name-only output. Matching is case-sensitive, and directory separators are always /.
• A ** segment crosses directory separators. An entry ending in a ** segment means that directory and everything beneath it, recursively. An entry with no wildcard matches exactly one file.
• Run the diff with rename detection off (git diff --name-only --no-renames), so moving a file out of an evidence path still trips the backstop on the old path.
• Only the include list feeds the matcher. The exclusion list is a review record of paths deliberately left out, not a subtraction pass applied on top. Blanket exclusion-over-inclusion would be wrong here: src/renderer/components/dashboard/** is excluded while src/renderer/components/dashboard/cases/DataExplorer.tsx and src/renderer/components/dashboard/cases/ImportCaseDialog.tsx are included, and a blanket override would silently drop them. If a future tool does consume both lists, the more specific pattern wins — an exact path beats a directory glob, and among globs the one with the longer literal prefix before its first wildcard beats the shorter.

Include list

Acquisition (extension → capture server)

Integrity core (hash, manifest, signing, trusted time, verification)

Assurance boundary for this block, stated so the rationales do not overclaim: the manifest chain and the RFC 3161 token cover different things, and neither substitutes for the other. The timestamp request's message imprint is the capture's contentHash (buildTimestampRequest in src/main/services/timestamp.ts), so a granted token dates the captured bytes — it says nothing about whether the manifest chain around them is intact. The chain, conversely, covers manifest entries but is signed with the installation-local keypair generated and held by this install (src/main/services/signingKey.ts), so it detects edits made without that key and is not independent of the Operator who holds it.

Capture lifecycle, storage, parsing, extraction

Annotation, redaction, notes-to-evidence binding

Export, reporting, archive

AI analysis

Interpretation surfaces (renderer)

Cross-process contracts and configuration

Software distribution

Notable exclusions

A review record of paths deliberately left out, in the same one-glob-per-entry form as the include list — see "List format" for why this list is not applied as a subtraction pass over the includes. It is notable exclusions, not an exhaustive complement of the include list.

Judgment calls needing confirmation in review

1. src/main/ipcHandlers.ts and src/shared/ipc.ts wholesale. Both also carry pure-UI channels, so the gate fires on many non-evidence PRs. The backstop cannot distinguish a payload-type change to an evidence channel from a new UI list query. Accept the noise, or split the files later.
2. src/renderer/lib/api/** excluded while src/preload/index.ts is included. Both are typed passthroughs. As excluded, a hostile change like hardcoding overrideTamper: true in the import mutation (src/renderer/lib/api/cases.ts) would not trip the backstop. Including it gates most renderer PRs. Current call: excluded — the label-at-triage trigger and human review are expected to catch that class.
3. pnpm-lock.yaml. Included by the same logic as package.json (the lockfile is the actual pin that determines shipped code), but it gates every dependency-bump PR. Current call: include; drop it if dep-bump noise proves unacceptable during the pilot.
4. src/main/services/session.ts / src/main/services/serverToken.ts. Included on misattribution/spoofed-ingest rationales; arguably workflow state and authn rather than evidence processing.
5. src/main/services/csvEscape.ts. CSV exports are convenience exports, not signed packages; kept because they are still disclosed case data.
6. Notes cluster (src/main/services/noteAnchorResolver.ts, src/shared/noteDoc.ts, src/shared/noteAnchor.ts). Notes never enter evidence packages; inclusion leans entirely on the "interpretation" clause (what evidence a note points at, and note text in exported reports/archives).
7. Selector cluster (src/main/services/selectorLifecycle.ts, src/main/services/safeRegex.ts). Originally excluded as "matches never enter the evidence package" — the challenge pass found that factually wrong (src/main/services/caseArchive.ts exports and re-imports selectors and selectorMatches). Included on that basis; if selector matches are ruled non-evidentiary despite riding in archives, drop both.
8. Accepted glob false positives. src/main/services/db/** sweeps in the read-only src/main/services/db/diagnosticsRepo.ts; src/renderer/components/settings/db/** sweeps in the generic src/renderer/components/settings/db/ConfirmDialog.tsx. Accepted: a per-file list would silently miss future files added to these directories.
9. extension/src/toast.ts / extension/src/popup/popup.tsx. One step removed from captured bytes (toast markup can be captured; the popup routes evidence to a case). A stricter list could drop extension/src/popup/popup.tsx.
10. Distribution block (src/main/services/updater.ts, the build configs, .github/workflows/release.yml, pnpm-lock.yaml). Included under the definition's "software distribution" clause. If release PRs get their own review channel instead, this whole section could move out of the backstop.