# Leak Check

Run this before shipping any app, report, QA probe, or deliverable produced with the Events Alpha skill.

## Binary Pass Criteria

Pass only when all statements are true:

- The output calls the live Events Alpha API through `EVENTS_BASE_URL` or the approved canonical base URL.
- The output uses demo minting or an operator-supplied token; no real token is printed or persisted.
- The output uses `X-Timeback-Tenant` and does not infer tenancy from student, actor, group, content, org, source, or event identifiers.
- The output writes events through `POST /events` and reads events through `GET /events` or `GET /events/{eventId}`.
- The output imports production migration rows through `POST /source-imports` only when it has source-shaped TimeBack or Horizons rows, and it verifies success by reading materialized rows through public Events Alpha endpoints.
- When the output needs a student name, it resolves `event.studentId` through People & Orgs `GET /people/{personId}` or a documented People & Orgs roster call; it does not parse the name from an Events field.
- When the output reads attendance or discipline moments, it uses `GET /attendance-events`, `GET /attendance-events/{id}`, `GET /discipline-events`, or `GET /discipline-events/{id}` and treats the returned descriptor fields as already resolved by the surface.
- The output uses only event ids, cursor values, fields, and activity-source records returned by the surface or supplied by the user.
- The output links field meaning back to the hosted customer website or data dictionary.
- The output stores no Events domain data outside the surface, except transient UI state or recent request handles in browser storage.
- The output uses synthetic public examples or redacted customer data.

## Automatic Failure Patterns

Fail and stop if the output contains any of these:

- A copied event-kind map, event-type tuple map, Caliper action/profile/entity table, source-trust table, or relationship resolver used as local validation logic.
- A copied source-import adapter map, field-synonym map, raw-source parser, pre-normalizer, descriptor resolver, or materialization workaround.
- Local Caliper normalization, profile inference, kind inference, deduplication, canonical JSON sorting, hash computation, schema parsing, or point-in-time roster joining.
- Local score, mastery, gradebook, report-card, student knowledge graph, NWEA account, content-effectiveness, K-8 advancement, stuck-attempt, tenure, or minutes-calendar math.
- Local Ed-Fi attendance-category, behavior, participation-code, location, soft-delete, draft/canonical, or platform-id reconciliation tables.
- Attendance or discipline writes through Events Alpha instead of the Ed-Fi base surface.
- Discipline narrative parsing, raw Ed-Fi payload reads, or draft recovery presented as a public Events Alpha workflow.
- Direct reads from `caliper.*`, `platform.*`, Supabase, Postgres, private logs, or implementation source.
- A mock API that stands in for the Events Alpha surface after credentials are available.
- Event update/delete, outbound webhook, push stream, raw payload, canonical payload, credential, secret, public conformance mutation, or official certification behavior.
- Raw learner payloads, bearer tokens, IP addresses, user agents, or raw request bodies in public logs, screenshots, docs, search data, or proof evidence.

## What To Do On Failure

If a user job needs a failed primitive, do not build around it with private logic. Report the missing primitive as a surface gap and cite the canonical architecture decision:

- Results, score, mastery, gradebook, and durable outcomes: module boundary and event-result separation.
- Kind mapping, typed fields, and parsing gaps: typed field and policy-config decisions.
- Source import mapping, materialization, or adapter rejection gaps: source-ingest ITDs and the implementation source-import contract.
- Relationship or point-in-time gaps: relationship projection and point-in-time decisions.
- Attendance/discipline writes, descriptors, drafts, canonical acknowledgement, or source-key correction: Ed-Fi base surface ownership.
- Query, cursor, list, and polling gaps: read shape, query model, list endpoint, and eventing axes.
- Mutable write gaps: write granularity and concurrency axes.
- Deletion, retention, raw payload, or privacy gaps: privacy and retention axis.
- Certification claims: conformance evidence axis.