docs backend evidence ev support EE 01

EE-01 — Reproducible Brazilian sample and rights qualification

Status: LOCAL_DONE Validation: PASS Integration: INTEGRATION_PENDING Parent83897983. Date2026-10-21. Rules B-BR-EV-03/05–09/15; BUC-EV-02/03/08/12.

Before admission: qualify initial OCM export/PBE reference samples, actual bytes/profile/clocks/rights and minimization. Public docs are not feed approval. No credentials, paid access, company contact, import activation or raw personal data in Git/logs. Samples stay under a0700 temporary directory; commit only hashes/counts/field names and rights decisions. Risk: privacy/license/source drift. One initial GitHub tree/main lookup changed during discovery; reject mixed refs and pin a commit before reading any POI/reference bytes. No initial sample was admitted. Verify SHA256 plus Git blob identity where available.

Acceptance: real Brazilian bytes and reference IDs, bounded local inspection, profile/country/lookup/privacy negatives, source clock distinctions, explicit SAMPLE_VERIFIED versus RIGHTS_PENDING/ACCESS_PENDING; do not certify full corpus or source admission from three examples. Recovery: quarantine an unsupported sample and retain prior source; no product data touched.

Qualification result (not source activation)

Sanitized sample register records actual raw SHA256/bytes, clock field values, source field names/connection counts and immutable URLs. Pinned OCM commit8e3bedca48ca94807d96b2f5e7ee02cffe63ae54; BR directory listing has1,298 entries and is not truncated. This is a file-list count, not a census of Brazilian locations/equipment or current public chargers. Only three POIs were downloaded: OCM-154527 (1,108bytes/1 connection row), OCM-154528 (1,496/3), OCM-15468 (1,657/1). Reference country resolves BR to36. Each blob's Git SHA1 and bytes were checked against the observed immutable tree, plus SHA256 here. The first mixed-main lookup was rejected and replaced with commit-pinned reads.

All three report provider1, open-data=true and CC-BY-4.0 in provider metadata. The publisher export documentation requires per-provider licensing rather than a blanket export license; CC BY4.0 terms include attribution, license/change notice. The register classifies conditional reuse of that identified license only; this is not a grant over other providers, contacts/photos/comments, home locations or a production approval. Source-level rights propagation, minimization and public-access eligibility remain mandatory in EE-03/04/07/18. Raw cost notes are not structured complete tariffs; status/type fields and last verification timestamps are not an authorized live equipment feed.

The official PBE index links the inspected PDF. Actual3,387,564bytes,9pages, SHA25643e928f89a526f7b59013faca3501b2b0716e5a8cdc2e097b8653638aa688ba0. PDF layout/text, not CSV. The index label says25Aug, URL says19Jan, internal update14Aug2026; retain all three, never infer source edition from URL/local fetch. MJ/km, equivalent km/L and electric range need distinct meanings. The PDF's stated model totals are not an independently parsed/censused row count. No table parser or complete PBE vehicle census was built in EE-01. Offline/redistribution permission basis remains RIGHTS_PENDING; G-EV-DATA cannot pass until resolved.

Other first-party/community/operator candidates remain separate. Optional live provider status is ACCESS_PENDING with no account/API-key purchase/contact. The initial EV source qualification record is complete; both admission flags remain false. EE-03/04/05 must close required source-specific rights/profile/ full-file acceptance, not substitute synthetic fixtures for those proofs.

Privacy and actual validation

scripts/qualify-ev-samples.py --folder /tmp/abastevo-ee01 performs local bounded profile inspection only:8MiB reference/PDF,512KiB per POI,1..10 samples, capped Poppler CPU/address-space/output and30s process timeout. It emits hashes and allowlisted metadata; no addresses, coordinates, contact/comment/contributor values. Seven immediate privacy/country/missing-license/unknown-connector/ duplicate/non-finite/byte-budget/corrupt-PDF tests PASS. Actual source inspection and nine-page PDF metadata PASS; raw folder0700 and artifacts0600. No raw source or extracted PDF text was committed. Source URLs are public publisher evidence, not credentials. Document links/JSON/secret surfaces/diff --check PASS. No production data/parser/migration/runtime mutation, deployment or source activation.