[nicho1ab]

Pull Request Evidence

Governing issue and intended outcome

• Governing issue: Refs Validate Compare Facilities responsive, accessibility, and hosted evidence #644
• Intended outcome: Fail-closed producer-side hosted runtime-event classification without application behavior changes.

Implementation scope

• Major files or components changed: scripts/capture-hosted-ui-evidence.ps1; tests/unit/test_hosted_ui_evidence_capture.py; tests/fixtures/hosted_ui_evidence_capture/issue_644_runtime_event_classification_fixture.ps1; docs/developer/ui-evidence-review.md.
• Important behavior intentionally left unchanged or out of scope: Application UI, packet accounting, integrated Issue Validate Compare Facilities responsive, accessibility, and hosted evidence #644 orchestration, deployment, and production data.
• Reviewer UI regression contracts: Preserved RT-RC-005; no reviewer-facing route or interaction changed.

Acceptance-criteria evidence

Acceptance criterion	Evidence and result
Runtime metadata reconciles fail closed.	Shared Test-RuntimeEventClassificationLedger validates raw inventories, rows, counts, and context/resource correlation.
Exact optional telemetry only.	Only static.cloudflareinsights.com/beacon.min.js is EXPECTED_OPTIONAL_TELEMETRY with ALLOWLISTED_OPTIONAL_TELEMETRY.
Malformed ledgers reject.	Fixed fixture covers duplicate, omitted, unobserved, unknown, application, wildcard, malformed, and ambiguous inputs.

Validation and failure classification

Exact command	Result	Failure classification, if applicable
pytest tests/unit/test_hosted_ui_evidence_capture.py -q -k issue_644_runtime_events	Pass - 2 passed	none
pytest tests/unit/test_hosted_ui_evidence_capture.py -q	Pass - 72 passed	none
pytest tests/unit/test_hosted_ui_acceptance.py -q -k runtime_event_inventory_must_reconcile_and_classify_exact_resources	Pass - acceptance subset 3 passed	none
PowerShell parser ParseFile scripts/capture-hosted-ui-evidence.ps1	Pass	none
pwsh -NoProfile -File scripts/capture-hosted-ui-evidence.ps1 -LibraryOnly	Pass - no output or side effects	none
python scripts/check_docs.py; python scripts/check_no_secrets.py; python scripts/audit_portable_paths.py publication	Pass	none
git diff --check	Pass	none

• Implementation-caused failures: None.
• Pre-existing failures: None.
• Environmental failures: None.
• Tests intentionally not run and why: Full owner suite not repeated; scope remained runtime-event capture and classification.

Validation impact and evidence delta

• Decision:
• Delta:
• Policy version:
• Validation newly performed: Focused runtime tests, complete capture module, acceptance subset, parser, library load, documentation, security, portable-path, and diff validation.
• Retained evidence reused: None.
• Live evidence recollected: None - no browser capture or acceptance packet created.
• Superseded evidence: None.
• Invalidated evidence: None.
• Required-check state: Pending GitHub checks.
• Blockers: None.
• Governed-boundary disclosures: This PR does not establish visual, owner, parent, hosted, or stakeholder acceptance.
• Authorized mutations: Four scoped repository files and this PR body.
• Unauthorized mutations: None.
• Compact evidence envelope:

UI and accessibility evidence (when applicable)

Not applicable - no UI or accessibility change; raw console and network inventories remain separate and preserved.

Reviewer-facing redesign artifact classification (when applicable)

Not applicable - no reviewer-facing redesign.

Artifact or assertion	Class	Disposition	Durable reason or requirement ID	Replacement evidence
No reviewer-facing redesign	Not applicable	Not applicable	RT-RC-005 preserved	Complete capture module

Documentation, assumptions, and remaining risks

• Documentation impact: Documents deterministic producer rows, shared reconciliation, exact allowlist, zero events, and malformed-ledger failures.
• Assumptions and limitations: Historical 26 failed beacon requests and 26 console resource-load observations had equal counts, but correlation requires matching context and normalized identity rather than counts alone.
• Remaining risks or follow-up: Integrated Issue Validate Compare Facilities responsive, accessibility, and hosted evidence #644 evidence remains separate.

Governed-boundary review

Governed boundary	Status	Specific explanation or evidence
Schemas and migrations	No change	No schema changed.
Ingestion and source-connector contracts	No change	No connector changed.
Security and privacy	Authorized change	Exact optional-telemetry allowlist with raw inventory preservation.
Production data and correction behavior	No change	No data mutation.
Deployment and infrastructure	No change	No deployment.
Repository governance	Authorized change	Shared fail-closed reconciliation seam.
Required GitHub workflows and checks	No change	validate, docs-check, fixtures, security remain required.
Tests or checks weakened to obtain passage	Authorized change	Added failure coverage; no contract weakened.

Required GitHub checks

• validate
• docs-check
• fixtures
• security

Publication correction

The initial validate run reported nine Ruff E501 findings in the test file.
The follow-up commit 9741f88ab9673999cf7d0ed53cccdd59c2ae57af is formatting-only:
it wraps those nine lines without changing assertions, literals, fixtures, test
names, implementation semantics, or validation contracts. Ruff passed, the
runtime-classification tests passed 2/2, and the complete hosted-evidence module
passed 72/72.