# Leak Check

Run this checklist before shipping an app, report, QA probe, migration check, or deliverable built with this pack.

## Binary Pass

Pass only if every answer is yes:

- Did all Curriculum facts come from the live Curriculum Alpha API or hosted docs?
- Did credentials come from demo mint or an operator-supplied token, without being printed or persisted?
- Did the app read typed fields instead of parsing standards codes, names, URLs, statements, CASE strings, or source titles?
- Did the app avoid local enum/value tables and instead read `GET /` or the data dictionary?
- Did the app avoid raw Postgres, Supabase, CASE table reads, CFPackages, SQL, CSV, XML, or private source code?
- Did the app avoid local graph storage as a second Curriculum data layer?
- Did the app preserve Problem JSON `code`, `fieldErrors`, `requestId`, and `traceId`?
- Did per-student track state, mastery, next-task ownership, attempts, scores, and gate passes stay in Results?
- Did questions, tests, media, answer keys, and Content bodies stay in Content?
- Did thresholds, retake rules, cut scores, rewards, and retention models stay in Policy?
- Did roster facts stay in People and Orgs and activity moments stay in Events?
- Did source-shaped ingest send source-shaped records to the surface instead of pre-normalizing them client-side?
- Did parsed standards-framework file ingestion validate each JSON file, skip-and-warn arrays/non-framework files, and call the Curriculum standards-framework import endpoint instead of parsing/writing CASE locally?
- Did expected XP come from the Curriculum expected-XP policy path instead of a local zero/default or per-student progress actuals?
- Did the app run `node checks/verify-skill-pack.mjs` or an equivalent live API probe?

## Automatic Fail

Stop and report a surface gap if any of these appear in client code or agent reasoning:

- CASE package parsing or local CASE import/export logic.
- Raw database queries for user-facing Curriculum workflows.
- Standards-code parsing to infer grade, subject, type, or relationship.
- Local graph persistence, local DAG traversal as source of truth, or local cycle repair.
- Copied component-kind, association-type, remediation-reason, renderer, descriptor, or relationship-direction tables.
- Mastery, confidence, decay, gate-pass, report-card, MAP, next-task, placement, or per-student knowledge-state logic.
- Content-effectiveness, answer-key, scoring, event stream, roster, credential, secret, reward, or Policy-threshold logic.
- Alpha-owned Curriculum tables, sidecars, renderer tables, alias tables, external-course tables, track tables, course tables, lesson tables, or member tables.
- TimeBack source records transformed into CASE payloads by the client before ingest.
- Missing expected XP defaulted to zero, or expected effort computed from per-student progress rows.

If one of those is required for the user job, the right output is a surface-gap report with the canonical docs and failing user job. Do not patch around it in the skill pack.