S00 Handoff Packet

Status: Historical published handoff; superseded for current UI authority (2026-07-13) Date: 2026-02-19 Working directory: docs/modules/ui/v2-rewire Sprint: 20260218_005, task R0-07

Use the directory currency notice for current source and test pointers.

Purpose

This packet is the authoritative handoff from sprint 20260218_005 (Spec Freeze) to implementation sprints. All frozen decisions are referenced here.

Implementation execution for this handoff was the reopened sprint set:

SPRINT_20260219_002 through SPRINT_20260219_007
SPRINT_20260219_008 (backend endpoint + migration dependency closure)
SPRINT_20260219_015 (Pack-13 promotions contract binding follow-on)

All completed sprint files from this set are now archived under docs-archive/implplan/.

Frozen decisions

Decision	Document	Key ruling
Canonical IA taxonomy and root domain ordering	`source-of-truth.md` sections 2.1 and 2.2	Seven roots: Dashboard, Release Control, Security and Risk, Evidence and Audit, Integrations, Platform Ops, Administration. Order is fixed.
Ownership boundaries (Policy, Trust, System, Security Data split)	`source-of-truth.md` section 2.2, `authority-matrix.md` section B	Policy Governance -> Administration. Trust and Signing -> Administration. System -> Administration. Legacy Security Data -> split: connectivity in Integrations/Platform Ops, gating impact in Security and Risk.
Superseded alternatives (forbidden placements)	`authority-matrix.md` section B; `S00_nav_rendering_policy.md` do-not list	Trust in Evidence, Policy in Release Control, System as top-level root are forbidden.
Release Control capability rendering policy	`S00_nav_rendering_policy.md`	Releases and Approvals may be direct nav shortcuts under Release Control group; Bundles, Deployments, and Environments stay grouped under Release Control ownership.
Advisory Sources screen ownership and spec	`S00_advisory_sources_spec.md`	Security and Risk owns decision-impact view. Integrations owns connector config. Platform Ops owns freshness ops.
Trust and Signing ownership transition and consumer model	`S00_trust_ownership_transition.md`	Administration is sole owner. Evidence and Audit and Security and Risk are consumers with read-only links only.
Route deprecation map and activation sequence	`S00_route_deprecation_map.md`	Complete v1 -> v2 mapping with per-sprint activation sequence.
Endpoint contract ledger v1	`S00_endpoint_contract_ledger_v1.md`	12 screen domains classified; previously missing rows `S00-T05-RC-01` and `S00-T05-SEC-02` are now reconciled to shipped backend contracts (`EXISTS_COMPAT`).

Downstream target sprints (executed and archived)

Sprint	Dependency on S00 decisions	Unblocked after
`SPRINT_20260219_002_FE_ui_v2_shell_navigation_and_route_truth`	Nav rendering policy, route deprecation map	`SPRINT_20260219_001` DONE
`SPRINT_20260219_003_FE_ui_v2_shell_release_control_structure`	Release Control ownership policy, Pack 12/13/14 structure, contract ledger RC rows	`SPRINT_20260219_002`
`SPRINT_20260219_004_FE_ui_v2_shell_security_and_advisory_sources`	Advisory Sources spec, ownership split, contract ledger SEC rows	`SPRINT_20260219_002`
`SPRINT_20260219_005_FE_ui_v2_shell_evidence_audit_structure`	Trust transition doc, evidence ownership policy, contract ledger EVID row	`SPRINT_20260219_002`
`SPRINT_20260219_006_FE_ui_v2_shell_integrations_platform_ops_alignment`	Integrations/Platform Ops taxonomy, security-data split policy	`SPRINT_20260219_002`
`SPRINT_20260219_007_FE_ui_v2_shell_qa_and_readiness_reverification`	Strict closure gate, ledger reconciliation, readiness publication	`SPRINT_20260219_003` to `SPRINT_20260219_006`

Unresolved risks (carry into implementation)

Risk	Severity	Mitigation	Owner sprint
Bundle API (`S00-T05-RC-01`) contract drift after implementation	Medium	Keep ledger pinned to implemented `/api/v1/release-control/bundles*` routes and reject path regressions that collide with evidence bundle export namespace.	`SPRINT_20260219_008` + downstream QA
Advisory Sources cross-service composition drift (`S00-T05-SEC-02`)	Medium	Keep Concelier freshness and Policy impact/conflicts ownership split explicit; verify tenant/scope behavior in readiness reruns.	`SPRINT_20260219_008` + downstream QA
Trust scope model (`trust:read`, `trust:write`, `trust:admin`) requires Authority alignment	Closed (2026-02-19)	Authority canonical scopes and Platform trust policies are wired; A6 now includes owner mutation routes (`/api/v1/administration/trust-signing/{keys,issuers,certificates,transparency-log}`) with DB backing via migration `046_TrustSigningAdministration.sql`.	`SPRINT_20260219_016`
Approvals multi-tab fan-out latency (`S00-T05-APR-01`)	Medium	Preserve lazy loading and stale-data behavior in shell and add backend performance verification in follow-on integration work.	`SPRINT_20260219_003`
Data Integrity aggregate endpoint (`S00-T05-OPS-01`) spans modules	Medium	Keep ownership split explicit in shell and assign backend composition owner before full readiness GO.	`SPRINT_20260219_006` / `SPRINT_20260219_007`
Legacy alias removal can miss long-tail deep links	Low	Keep redirect map under strict tests and remove aliases only after measured traffic evidence.	`SPRINT_20260219_002` / `SPRINT_20260219_007`

Contract ledger sign-off status

Frontend shell sign-off is complete through SPRINT_20260219_006.
Backend dependency sign-off for previously unresolved rows (S00-T05-RC-01, S00-T05-SEC-02) is now complete via SPRINT_20260219_008 evidence and ledger reconciliation.
Promotions row S00-T05-RC-02 and Administration row S00-T05-ADM-01 are fully reconciled to EXISTS_COMPAT via SPRINT_20260219_016 backend contract enrichment evidence.

Non-shipped exploratory work

None.