# Binary Leak Check

Run this check before delivering any app, report, QA probe, or generated artifact built with this skill.

The answer must be "no" for every forbidden item. If any answer is "yes", stop and report a surface leak instead of shipping a workaround.

## Forbidden local logic

- Did you copy the Ed-Fi UDM schema, field catalog, descriptor catalog, descriptor value list, or domain table into the app or report?
- Did you parse resource names, descriptor names, URLs, or field names to infer business meaning that the surface should provide?
- Did you maintain local roster identity or reconcile Ed-Fi identifiers to platform3 OneRoster sourcedIds outside the API?
- Did you mint a local `edfi_local_id`, `ack_id`, or roster sourcedId?
- Did you compute, normalize, or predict ETags instead of using API headers and response fields?
- Did you maintain an idempotency replay cache or dedup layer outside the surface?
- Did you hard-delete or purge records locally to compensate for the soft-delete API?
- Did you redact Problem details, export rows, or audit evidence locally because the surface returned unsafe data?
- Did you access implementation source, Supabase tables, private loop files, or non-public credentials to complete a customer-facing workflow?
- Did you transform the Ed-Fi 1EdTech surface into Alpha school-language vocabulary inside the app or report?

## Required positive evidence

Before final output, confirm:

- The work names the canonical customer website and data dictionary URLs used.
- The work calls the live implementation URL or a caller-provided approved base URL.
- Demo mode uses `POST /dev/mint?tenantId=demo`; real mode uses an operator token.
- Every write sends `Idempotency-Key`.
- Every update/delete/promotion sends `If-Match` from a surface response.
- Every descriptor-dependent write reads the descriptor catalog first or cites a returned descriptor URI.
- Every roster-touched write uses platform3 OneRoster sourcedId overlay fields when required by the data dictionary.
- Every list proof reads `Total-Count`, `totalCount`, or `page.totalCount` from the surface.
- Every Problem report preserves `type`, `code`, `status`, `requestId`, `traceId`, and `fieldErrors` when present.
- `bin/proof-replay.sh`, if run, only calls the live API and asserts returned fields. It must not become a schema parser, descriptor table, retry ledger, ETag calculator, soft-delete store, or private database reader.

## Routing surface leaks

If a leak is found, route it to the earliest flawed deliverable:

- Architecture: missing commitment or unpinned decision.
- Data dictionary: missing field meaning, range, nullability, descriptor provenance, roster overlay, or route mapping.
- Customer website: public instructions are insufficient for a cold integrator.
- Implementation: live behavior contradicts the approved docs.

The skill pack must not fix the leak by adding local logic.