# Leak Check

Run this before shipping any app, report, QA probe, or deliverable produced with the Caliper 1EdTech skill.

## Binary pass criteria

Pass only when all statements are true:

- The output calls the live Caliper API through `CALIPER_BASE_URL` or the approved canonical base URL.
- The output uses demo minting or an operator-supplied token; no real token is printed or persisted.
- The output uses `X-Timeback-Tenant` and does not infer tenancy from learner, class, actor, group, or Person identifiers.
- The output captures `caliper-envelope-hash` from the POST response instead of computing it.
- The output reads event and envelope projections only by identifiers the user or surface supplied.
- The output links field meaning back to the hosted customer website or data dictionary.
- The output stores no Caliper domain data outside the surface, except transient UI state or recent handles in browser storage.
- The output uses synthetic public examples or redacted customer data.

## Automatic failure patterns

Fail and stop if the output contains any of these:

- A copied Caliper action, profile, event type, entity type, or relation table used as local validation logic.
- A local normalizer, canonical JSON sorter, SHA-256 hash computation, profile inference, deduplication rule, or schema parser.
- Direct reads from `caliper.*`, `platform.*`, Supabase, Postgres, or implementation source.
- A mock API that stands in for the Caliper surface after credentials are available.
- List, search, filter, cursor, `modifiedSince`, webhook, event feed, PATCH, PUT, DELETE, or official certification behavior.
- The prior-workspace `202 Accepted` with JSON body contract. The approved platform3 Sensor API write returns `204 No Content`.
- A local `caliper.tenant` table. Tenant scope inherits `platform.tenant`.
- Raw learner payloads, bearer tokens, IP addresses, user agents, or raw request bodies in public logs, screenshots, docs, search data, or conformance evidence.

## What to do on failure

If a user job needs a failed primitive, do not build around it with private logic. Report the missing primitive as a surface gap and cite the canonical architecture decision:

- List/query/search gaps: read shape, query model, and list endpoint axes.
- Mutable write gaps: write granularity and concurrency axes.
- Event feed gaps: eventing model axis.
- Deletion or retention gaps: privacy and retention axis.
- Certification claims: conformance evidence axis.