Evidence Map

Evidence Map

What backs each claim, and which rail it ran on. File links are pinned to commit 9900817.

Evidence	Kind	Path	What it shows	Caveats
Test suite	Mock rail	tests/	170 tests: gate, pipeline, delegation, tighten, approvals, reconcile, HTTP, agent replay/preflight, sandbox client (stubbed HTTP)	Never touches PayPal. Re-run for this wiki: 170 passed
CI	Mock rail	.github/workflows/ci.yml	Runs pytest + demo.py on every push/PR to main	Python 3.12 only
demo.py	Mock rail	demo.py	Allow, block, delegate + cascade, chain VERIFIED	Deterministic. Re-run for this wiki: exit 0, 15 receipts
demo_six_beat.py	Mock rail + LLM	demo_six_beat.py	The six beats incl. UNKNOWN → reconcile	Needs PERMIT_GROK_CLI, or --replay with a transcript you recorded (none committed)
demo_sla_escrow.py	Mock rail	demo_sla_escrow.py	Acceptance-signature settlement through a carve	Re-run for this wiki: exit 0, 17 receipts
trace.py	Mock rail, over HTTP	trace.py	Same gate through server.py; an assertion spy proves blocked spends never call authorize	Free loopback port. Re-run for this wiki: TRACE COMPLETE
Sandbox runbook	Procedure + API observations	docs/sandbox-runbook.md	Scripted integrated run; Oct 2 spike facts (payee merchant_id on orders, approval-page stall)	The integrated run is "not yet recorded" (README)
Sandbox client	Code (real REST)	settlement/sandbox_client.py	Orders API AUTHORIZE, CAD, merchant/amount binding, idempotent capture	ORDER_ALREADY_AUTHORIZED recovery absent at this commit
Sandbox client tests	Mock (stubbed HTTP)	tests/test_sandbox_client.py	Binding, approval polling, 204 void	10 tests. Pins behaviour, not live PayPal
Oct 2 sandbox spike report	API observations (git history only)	git show 3f88feb^:spike-report.md (per README)	Real REST calls: OAuth, order, authorize, capture, void; merchant identity	Not in the current tree

What is no longer in the tree

• runs/launch-2026-10-05-* (the sandbox launch run log and ledger export) was removed by PR #5 (4d216a8). At 9900817 there is no recorded sandbox run in the tree, so this wiki cites none.
• CLIMB-SCORE.md (self-score) and .cursor/ (editor rules, MCP config) were removed by PR #5.
• scripts/sandbox_smoke.py and launch_sandbox.py were removed in 980da3e.

Known stale statements at 9900817

• settlement/paypal_client.py docstring: "the recorded video uses sandbox mode" (the checklist says the recording is the mock rail), and "built during the Oct 6–8 spike" (the README, runbook and sandbox_client.py say the spike was Oct 2).
• server.py docstring: /estop "revokes the permit and every descendant (cascade)". The code does not cascade. See E-Stop and Revocation.
• docs/submission-checklist.md: --hold and --live flags that don't exist, and "git remote: none". See Hackathon Submission Status.