# Preview Evidence-Lane Multi-Source Smoke Matrix V01 Issue: #350 Parent issue: #271 ## Purpose This note defines a deterministic local and Preview-facing smoke/demo matrix for the source-grounded proof UI. The matrix proves that the existing source-grounded proof surface can visibly represent package authority and current/public enrichment as separate evidence lanes across multiple existing source profiles. This is proof/demo coverage. It is not source activation, source promotion, runtime retrieval redesign, provider/model configuration, package-authority promotion, Source Registry Admin UI, Source Registry Admin live apply, Preview source-set apply, Production source-set apply, OKF implementation, Google SDLC implementation, or multi-agent orchestration implementation. ## Matrix Sources | Source | Source ID | Retrieval profile | Matrix posture | |---|---|---|---| | NIST AI RMF | `nist-ai-rmf-public-framework-candidate` | `nist_ai_rmf_framework_bounded_html_extract_v01` | Supported current/public evidence lane. | | NIST SSDF | `nist-ssdf-sp-800-218-candidate` | `nist_ssdf_sp_800_218_bounded_html_extract_v01` | Supported current/public evidence lane. | | OWASP GenAI LLM Top 10 2025 | `owasp-genai-llm-top-10-2025-candidate` | `owasp_genai_2025_bounded_html_extract_v01` | Supported current/public evidence lane. | | CISA / NSA / NCSC Secure AI System Development Guidelines | `cisa-nsa-ncsc-secure-ai-system-development-guidelines-candidate` | `cisa_nsa_ncsc_secure_ai_guidance_bounded_html_extract_v01` | Preview current/public evidence lane only. Do not promote CISA / NSA / NCSC to Production. | ## Canonical Prompts NIST AI RMF: `Compare what the approved package says about operational AI governance with what NIST AI RMF says about governance expectations. Keep package and current/public source lanes separate.` NIST SSDF: `Compare what the approved package says about secure AI capability delivery with what NIST SSDF says about secure software development practices. Keep package and current/public source lanes separate.` OWASP GenAI 2025: `Compare what the approved package says about GenAI application risk controls with what OWASP GenAI LLM Top 10 2025 says about prompt injection and LLM application risks. Keep package and current/public source lanes separate.` CISA / NSA / NCSC Secure AI: `Compare what the approved package says about secure AI operations with what the CISA / NSA / NCSC Secure AI System Development Guidelines say about secure design, development, deployment, and operation. Keep package and current/public source lanes separate.` ## What The Matrix Proves - The source-grounded proof UI renders. - The Preview current-source evidence lane renders. - The evidence lane can show package authority and current/public enrichment at the same time. - Source rows can show safe source identity: source ID, source title, profile ID, current/public lane status, source URL or reader target, claim boundary, and bounded snippet preview when returned. - Current/public source content remains enrichment only and is not package authority. - Source-specific evidence posture is source-bounded and profile-bound. - Existing insufficient, refused, and source-unavailable response states remain visible through the evidence lane. - Browser telemetry remains zero for direct browser provider calls and direct browser current-source calls. ## What The Matrix Does Not Prove - It is not live Preview mutation. - It is not live Production mutation. - It is not source registry mutation. - It is not source-set mutation. - It is not source enablement, disablement, retirement, promotion, rollback, or apply behavior. - It is not Cloudflare CLI/API work. - It is not Cloudflare Access/WAF work. - It is not service-token work. - It is not broad NIST, OWASP, CISA, NSA, NCSC, or partner-domain crawling. - It is not arbitrary web search. - It is not user-provided URL retrieval. - It is not browser-side provider execution. - It is not browser-side current-source retrieval. - It is not package-authority promotion for current/public material. ## Scenario Contract The deterministic scenario is recorded in `validation/fixtures/source_grounded_chat/preview_evidence_lane_multi_source_smoke_matrix_v01.json`. The fixture records four source rows, their canonical prompts, expected safe identity fields, expected lane posture, direct browser call counters, and forbidden exposure markers. The focused validator is: ```bash python3 -B validation/scripts/check_preview_evidence_lane_multi_source_smoke_matrix.py ``` The matrix validator reuses existing response contracts and source-profile evidence. It does not add source retrieval behavior or new extraction profiles. ## Runtime Boundary The browser continues to call only `/api/source-grounded-chat`. Current/public retrieval remains server-side only through existing allowlisted retrieval behavior. The browser must not call NIST, OWASP, CISA, NSA, NCSC, provider APIs, Cloudflare APIs, source registry APIs, or user-provided URLs. No source registry, Preview source set, or Production source set is mutated by this matrix. ## Secret And Payload Boundary The evidence lane and matrix must not expose: - raw headers - cookies - service tokens - provider keys - runtime secrets - raw provider payloads - secret-bearing URLs The UI may display safe citation metadata already present in the source-grounded response contract: source ID, title, citation class, retrieval profile, retrieval timestamp, trust label, freshness label, claim boundary, source URL or reader target, and bounded snippet preview. ## Stale Local Path Hygiene This issue also removes stale Tony-specific absolute local paths from active navigation and operator-facing docs. Repo-internal active links should be relative where practical. Historical validation receipts may preserve past execution evidence when they are immutable evidence artifacts. The cleanup must not blindly replace the old absolute path with a new Tony-specific absolute path in public docs. ## Boundary Confirmations - No source registry is mutated. - No Preview source set is mutated. - No Production source set is mutated. - No source is enabled, disabled, retired, promoted, or applied. - No live registry snapshot is created. - No live last-known-good snapshot is created. - No Cloudflare operation is added or invoked. - No Cloudflare Access/WAF change is made. - No Access service token is created or modified. - No arbitrary web search is added. - No user-provided URL retrieval is added. - No broad crawling is added. - No browser-side provider call is added. - No browser-side current-source retrieval is added. - No server-side retrieval is moved into the browser. - No provider/model configuration is changed. - No runtime retrieval semantics are changed. - No current/public source content is promoted to package authority. - No external source content is stored as approved package material. - No Source Registry Admin UI is implemented. - No Source Registry Admin live apply is started. - No Production apply is started. - No OKF implementation is started. - No Google SDLC implementation is started. - No multi-agent orchestration implementation is started. - `codex-automerge` is not applied. - #271 remains open. - #269 remains closed.