W10 Canonical-Handoff Evidence Packet
Historical record — 2026-08-16
Preserved as observed. Current truth: Program Masterplan.
Release boundary:
releaseEligible: false. This is a bench-local evidence handoff for a canonical owner; it is not a release artifact, merge-ready patch, package, signed output, or authorization to ship.
Purpose and strict non-goals
Purpose: preserve the installed W10 source inventory, decisions, and verification evidence before later bench changes blur that boundary, so an authenticated canonical owner can review and port the repairs through the locked release process.
Strict non-goals: this packet does not port code; edit compiled build/, vendor/, or provenance/; generate a release; run a locked build; claim compatibility; sign; package; publish; modify WordPress data; or authorize shipping. It supplies no canonical repository URL, immutable commit, canonical manifest hash, signature, or merge-ready patch.
Release NO-GO: missing canonical inputs
Release is blocked, not merely deferred.
| Required gate/input | Why this bench cannot satisfy it |
|---|---|
| Canonical public maintained repository URL and immutable full commit SHA | No .git exists at plugin or repository root. SOURCE-PROVENANCE.md prohibits inferring provenance from a ZIP name or workspace path. |
| Locked build/sign tooling and dependency locks | The required tools/ suite, package-lock.json, and composer.lock are absent. Digests, locks, and approvals must not be invented. |
| Canonical provenance, detached manifest, SBOM, dependency-scope, and coexistence evidence | The locked builder emits these from authenticated source and tool inputs unavailable on this bench. |
| Protected compatibility gates | PHP 8.3 and 8.4 support claims require canonical CI evidence. No CI definition is present here. |
| Protected signing context | Signing requires the authorized release-environment key path. No key material belongs on this bench or in source. |
| Compiled block source/toolchain | build/quiz/ is readable but must remain unedited; the absent source and locked Node toolchain are canonical-owner inputs. |
| Canonical review and regeneration | Every bench-local source change requires owner review and locked-pipeline regeneration before it can ship. |
| Runtime quality gate | tools/quality-gate.sh, tests/, phpunit.xml, and phpcs.xml are absent; bench probes and browser evidence cannot replace canonical gates. |
Evidence: wp/wp-content/plugins/quizwizz/BUILDING.md:7-12,39-57,64-117; wp/wp-content/plugins/quizwizz/SOURCE-PROVENANCE.md:3-27; 2026-08-19-masterplan-narrative > release-inputs-absent-from-this-ssot-archive.
Observed source inventory for canonical review
This is an observed installed-source inventory, not a patch and not an assertion that the files are canonical. The handoff-freeze hashes are in evidence/2026-08-16-w10-handoff/SHA256SUMS-installed.txt, relative to the installed plugin root. The approved post-W10 execution later changed four overlapping paths; the final installed inventory and exact expected drift are preserved separately in SHA256SUMS-post-w10-installed.txt and post-w10-drift.json, without rewriting the historical boundary.
| Subsystem | Observed paths to review |
|---|---|
| Builder runtime | assets/js/qwizz-builder-controls.js — W10-01, anchors 6-8, 189-193 |
| Settings/admin accessibility | assets/css/qwizz-admin-settings-core.css — W10-02 and W10-08, anchors 1591-1605, 1794-1828; assets/css/qwizz-admin-dashboard.css, assets/css/qwizz-admin-stats.css, assets/css/qwizz-admin-responsive.css — W10-08, anchors 386-414, 78-86, 203-230 |
| Admin navigation | includes/Admin/AdminMenu.php — W10-04, anchors 50-56, 59-88 |
| Public embed and dedicated route | includes/Frontend/QuizEmbed.php; templates/single-qw_quiz.php — W10-05/W10-06, anchors 12-37, 74-82, 92, 10-11 |
| Player runtime and presentation | assets/js/qwizz-player.js; assets/js/qwizz-player-renderer.js; assets/css/qwizz-player.css — W10-03/W10-05/W10-06/W10-07, anchors 208-211, 352-364, 620-629, 768-786, 149-155, 329-353, 53-60, 100-110, 126-138 |
Authority: 2026-08-15-visual-ia-remediation > critical-files-and-anchors.
Preserved decision record
W10-04 deliberately reverses the 2026-07-30 two-row submenu decision. The Dashboard’s 35 deep links could reach native QuizWizz screens, but the rail exposed no matching row or current state on direct URL/bookmark arrival. The installed five-row rail is a preserved operational decision, not a defect laundered into history. A future owner may hide rows only by preserving registration and matcher behavior that prevents silent deletion of core-generated entries.
Verification evidence and limits
| Item | Observed evidence | Limit |
|---|---|---|
| Browser contract | evidence/2026-08-15-visual-ia/verify-2026-08-16.json: status: pass, failures: [], consoleErrors: []. | Orchestrator measurement, not independent expert observation. |
| Probe harness | TAP 1..30; assertions=30; failures=0. | Historical bench evidence; not canonical CI or a release gate. |
| Installed versions | QuizWizz 1.10.0; schema 1.6.7. | No version or schema change is authorized by this packet. |
| Debug residue | Final run held logs/debug.log at 38,409 → 38,409. | The log is bench-local operational evidence. |
| Installed bytes | Eleven W10-freeze hashes in SHA256SUMS-installed.txt; eleven final installed hashes in SHA256SUMS-post-w10-installed.txt; seven unchanged and four expected changes enumerated in post-w10-drift.json. | Observed installed hashes are not canonical manifest inputs or signatures. The historical manifest no longer verifies against the intentionally evolved final tree. |
No independent expert browser observation exists. Values above are orchestrator measurements preserved with their stated limits.
Patch gate blocked
No git diff --no-index patch is produced. This tree has no .git, and no authentic immutable canonical baseline was supplied; therefore the required a/ side for a drift-checked round trip does not exist. A patch against an invented baseline would fabricate provenance rather than bridge it.
Canonical-owner checklist (future external actions)
- Resolve every provenance, ownership, license, policy, and compatibility blocker.
- Start from a clean immutable canonical commit and derive
SOURCE_DATE_EPOCHfromgit show -s --format=%ct HEAD. - Review and port the approved source repairs, then run the protected pinned-node release build from the authenticated source tree.
- Require sorted paths, fixed timestamps, normalized modes, a detached manifest, CycloneDX SBOM, SLSA-style provenance, dependency-scope evidence, coexistence evidence, and PHP 8.3–8.4 gates.
- Sign using the protected key path only; verify the signature in the authorized environment.
- Build twice independently and compare ZIP bytes with the canonical comparison tool.
- Supply and review the eight provenance fields: canonical repository URL; immutable commit; source-archive hash; builder/tool versions and digests; dependency lock hashes; protected CI workflow/run; release manifest hash; authorized signature and public-key identity.
Repository URL and commit must never be inferred from a ZIP name or workspace path (SOURCE-PROVENANCE.md:3-27). Development mode attests releaseEligible: false and cannot pass --require-release-eligible (BUILDING.md:88-91). These are future external actions, not completed or authorized work.
Narrow rollback
Delete this packet plus evidence/2026-08-16-w10-handoff/. No plugin or WordPress state is touched by this phase.