# Preview Evidence-Lane NIST Smoke Demo Scenario V01

Issue: #347

Parent issue: #271

## Purpose

This note defines a deterministic local and Preview-facing smoke/demo scenario for the source-grounded proof UI.

The scenario proves that the existing source-grounded proof surface can visibly render package authority and current/public enrichment as separate evidence lanes when the NIST AI RMF current/public path returns safe citation metadata.

Canonical prompt:

`Compare what the approved package says about operational AI governance with what NIST AI RMF says about governance expectations. Keep package and current/public source lanes separate.`

Use source context: `Package + current context`.

Use assistant mode: `Answer`.

## What The Demo Proves

- The source-grounded proof UI renders.
- The Preview current-source evidence lane renders.
- The UI can show package authority and current/public enrichment at the same time.
- The UI can show `nist-ai-rmf-public-framework-candidate`.
- The UI can show `NIST AI Risk Management Framework` when returned in safe citation metadata.
- The UI can show `nist_ai_rmf_framework_bounded_html_extract_v01` when the profile ID is returned.
- The UI states that current/public source content remains enrichment only and is not package authority.
- The browser reports zero direct browser provider calls and zero direct browser current-source calls.

## What The Demo Does Not Prove

- It is not source activation.
- It is not a Preview source-set apply.
- It is not a Production source-set apply.
- It is not Source Registry Admin UI.
- It is not a live registry snapshot.
- It is not a live last-known-good snapshot.
- It is not broad NIST crawling.
- It is not arbitrary web search.
- It is not user-provided URL retrieval.
- It is not provider/model approval.
- It is not package-authority promotion for NIST content.

## Scenario Contract

The deterministic scenario is recorded in `validation/fixtures/source_grounded_chat/preview_evidence_lane_nist_smoke_demo_v01.json`.

Expected source identity:

- Source ID: `nist-ai-rmf-public-framework-candidate`
- Source title: `NIST AI Risk Management Framework`
- Retrieval profile: `nist_ai_rmf_framework_bounded_html_extract_v01`
- Citation class: `current/public citation`
- Claim boundary: `current/public context only; not approved package authority`

Expected lane posture:

- Package lane uses approved package citations.
- Current/public lane uses separately cited NIST AI RMF enrichment.
- Package plus current/public status is visible when both citation classes are returned.
- Current/public source content remains enrichment only and is not package authority.

## Refusal And Insufficient-Source Posture

The scenario relies on existing response-contract states rather than adding new retrieval behavior.

Existing proof validation covers these postures:

- package-only when current context is not requested
- package plus current/public when a configured current adapter returns NIST AI RMF safe metadata
- current/public insufficient when current context is requested but current retrieval is disabled or unavailable
- refused when no approved package support exists
- source-unavailable when no package or current/public evidence is returned

The demo does not invent current/public evidence from model memory. It displays only returned safe metadata and citation fields.

## Runtime Boundary

The browser continues to call only `/api/source-grounded-chat`.

Current/public retrieval remains server-side only through the existing allowlisted retrieval behavior. The browser must not call NIST, provider APIs, Cloudflare APIs, source registry APIs, or user-provided URLs.

The demo does not change retrieval order, retrieval policy, provider prompts, provider configuration, model configuration, source registry state, source-set state, or package authority.

No source registry, Preview source set, or Production source set is mutated by this demo.

## Secret And Payload Boundary

The evidence lane and demo must not expose:

- raw headers
- cookies
- service tokens
- provider keys
- runtime secrets
- raw provider payloads
- secret-bearing URLs

The UI may display safe citation metadata already present in the source-grounded response contract: source ID, title, citation class, retrieval profile, retrieval timestamp, trust label, freshness label, claim boundary, source URL or reader target, and bounded snippet preview.

## Validation Coverage

Focused validator:

```bash
python3 -B validation/scripts/check_preview_evidence_lane_nist_smoke_demo.py
```

Required supporting checks:

```bash
python3 -B validation/scripts/check_minimal_external_chat_proof.py
python3 -B validation/scripts/check_published_site_contract.py
python3 -B validation/scripts/check_first_substantive_current_source_extraction_profile_slice.py
python3 -B validation/scripts/check_current_source_registry_governance.py
python3 -B validation/scripts/run_all.py
.venv/bin/python validation/scripts/check_published_site_contract.py --browser required
git diff --check
```

The published-site browser contract uses the canonical NIST prompt with a local response fixture so the semantic DOM, text, metadata, and request-boundary behavior are deterministic.

## Boundary Confirmations

- No source registry is mutated.
- No Preview source set is mutated.
- No Production source set is mutated.
- No source is enabled, disabled, retired, promoted, or applied.
- No live registry snapshot is created.
- No live last-known-good snapshot is created.
- No Cloudflare operation is added or invoked.
- No Cloudflare Access/WAF change is made.
- No Access service token is created or modified.
- No arbitrary web search is added.
- No user-provided URL retrieval is added.
- No broad crawling is added.
- No broad NIST domain crawling is added.
- No browser-side provider call is added.
- No browser-side current-source retrieval is added.
- No server-side retrieval is moved into the browser.
- No provider/model configuration is changed.
- No runtime retrieval semantics are changed.
- No current/public source content is promoted to package authority.
- No external source content is stored as approved package material.
- #271 remains open.
- #269 remains closed.