docs backend evidence ev support EE 06

EE-06 — Strict Go prepared bridge

Status: LOCAL_DONE Validation: PASS Integration: INTEGRATION_PENDING

Parent: 41a0a29e (maintained dev, PR #147 head). Date: 2026-10-22. Depends EE-04/05, accepted. Rules EV-07/08/23; journeys EV-02/03/09/12. Risk: critical boundary (manifest/integrity/census/rights/ID admission; no partial batch on any failure).

Before behavior: the Go side admits versioned prepared batches through module ports with bounded typed streams. Manifests verify by shape, frozen profiles, recomputed content identity, input/output descriptors and per-kind census; streams verify by bytes and hashes; entities verify by order, recomputed source keys and assertions; decisions reconcile outcomes. A late corruption, cancellation, close, duplicate, changed reference, license or oversize returns nothing. Runtime producers stay off until storage/publication gates pass. Recovery: leave runtime off, refuse the batch.

Delivered

• Prerequisite envelope fixes (EE-04/05 CLIs, same open PR): entities use array provenance and frozen payloads; decisions use uppercase outcomes, integer roots and null optionals; manifests use the frozen shape with profile/rights hashes, per-artifact descriptors, per-kind census and recomputed content_sha256; entities/decisions sort by key/unit; clocks as field arrays. Both batches validate fully against the frozen schemas (previously refused shape and ordering).
• backend/internal/modules/charging/adapters/prepared/prepared.go: VerifyManifest (frozen shape, profile/format allowlist, recomputed content identity, input/output/census budgets) and LoadBatch (stream integrity, key-ordered entities with recomputed identities, context cancellation, oversize refusal).
• prepared_test.go: verified batch acceptance plus tamper, truncation, cancellation and unknown-profile refusals with no partial output.
• parity_integration_test.go: actual Rust→Go parity on both pinned batches (charging 3,387 entities with 1,298 places; vehicle 181 references), env-gated local acceptance.

Actual checks

From this worktree (2026-10-22, parent 41a0a29e):

• go test -count=1 ./internal/modules/charging/... → PASS (bridge unit + domain tariff/audit).
• go test -race -count=1 ./internal/modules/charging/... → PASS.
• ANPFUEL_TEST_CHARGING_DIR=/tmp/ee04-out ANPFUEL_TEST_VEHICLE_DIR=/tmp/ee05-out go test -count=1 -tags=integration -run TestRustChargingParity|TestRustVehicleParity ./internal/modules/charging/adapters/prepared/ → PASS (41 ms and 3 ms; full-source parity, no synthetic bypass).
• go vet ./internal/modules/charging/... PASS; GOTOOLCHAIN=go1.27.1 staticcheck ./internal/modules/charging/... PASS.
• cargo test --locked → PASS, 177 tests; cargo fmt --check PASS; cargo clippy --all-targets --locked -- -D warnings PASS; no new dependency.
• git diff --check PASS; bash scripts/scan-secrets.sh PASS.
• No DB, HTTP, Android, worker or network code; no source activation beyond local preparation; no PII/secrets in Git/logs/fixtures.

Limits

• This unit bridges prepared batches only. No storage (EE-07), publication, worker, app or runtime producers. Admission here is content verification (hashes/census/IDs), not source-rights grants (those stay user-declared per snapshot).
• Manifest content identity requires Go canonical JSON to match Rust ev-json-v1 byte-for-byte (sorted keys, compact, no HTML escapes); parity tests prove the match on both real batches. Any serializer drift fails closed (refusal, not silent acceptance).
• Raw source bytes/hashes in decisions are carried, not re-verified (source files stay private outside Git); stream and content hashes bind what the bridge reads.
• No device, no production, no deploy and no release acceptance is claimed.

Next: EE-07 (append-only charging/reference storage) needs its own authorization; it consumes this tested typed boundary.