# P3-WP14 enterprise pilot acceptance evidence

## Result boundary

Current local-engineering status is derived only from a fresh ledger and fresh-verifier run; persisted evidence is unsigned and is not a standing PASS claim. The locally reproducible isolated configuration render evidence, when freshly verified, injects each snapshot into a restricted subprocess environment and consumes a distinct non-secret label and published backend port in a separate Compose JSON render. This document records local engineering evidence only. It cannot certify enterprise formal UAT, production deployment, target-scale capacity, a real integration, training attendance, or five-party signoff.

## RED evidence

The new contract test was run before the P3-WP14 delivery artifacts existed:

```text
PYTHONPATH=. .venv/bin/pytest -q tests/test_phase3_wp14_acceptance_handover_contract.py
# 5 failed
# Expected reason: the eight P3-WP14 deliverables were absent.
```

The failure was a true contract RED: missing files, not an import or test-runner error.

## Local artifact evidence

- Matrix: `docs/acceptance/P3_WP14_UAT_CASES.json` contains 29 cases across P3-WP01–P3-WP13, seven roles, and all mandated categories.
- Traceability: `docs/phase3/P3_WP14_264_MODULE_CLOSURE_AUDIT.json` reads 264/264 source-ledger rows without modifying `docs/FUNCTION_MODULE_CENSUS_20260726.md`.
- Migration: source and deployment revision `20260818_559` are byte-identical in the release traceability manifest. No new migration was introduced because WP14 is documentation/contract integration only.
- Second isolated environment: the formal same-signed-version second-environment case is `BLOCKED_EXTERNAL`: the available manifest is explicitly unsigned (`signed=false`) and neither an enterprise signature nor a second authorized environment was provided. `P3_WP14_LOCAL_CONFIG_A.json` and `P3_WP14_LOCAL_CONFIG_B.json` instead support a separately named `PASS_LOCAL` unsigned configuration portability rehearsal. `scripts/validate_p3_wp14_local_configs.py` reads each snapshot once, records byte hashes, rejects differences outside its allowlist, and renders with `--env-file /dev/null` plus an empty controlled home/Docker config so root `.env` and user Docker/Git configuration cannot affect it. This rehearsal is not formal UAT and does not satisfy the signed-version requirement.
- Release: `P3_WP14_RELEASE_MANIFEST.json` is an unsigned `UNCOMMITTED_WORKTREE_EVIDENCE` manifest, with actual content digests for source/deployment trees, migrations, OpenAPI, Compose, generator, and non-dependent WP14 assets plus the current git base/tree. Its root context follows one stable, secure read of `.dockerignore`; it audits every Compose image and Dockerfile `FROM`, marking every non-`@sha256` tag `UNRESOLVED_MUTABLE_TAG` and immutable/signed deployability `BLOCKED_EXTERNAL`. It explicitly does not claim a clean worktree, a signature, a push, a deployment, or formal approval.
- Fresh verification: `scripts/generate_p3_wp14_verification_ledger.py` writes an `UNSIGNED_REPRODUCIBILITY_CACHE` (ledger, digest-only log, and trace linkage). It cannot independently grant `PASS_LOCAL`. Its descriptor readers and writers share a reentrant lock on the trusted parent-directory inode: writers fsync and verify a unique temporary inode, atomically publish it, and restore the prior verified record before releasing that lock if publication verification fails. A same-UID process that bypasses this cooperative lock is not a trusted publisher; pathname mutation is detected where possible but cannot upgrade an unsigned cache into evidence. `scripts/verify_p3_wp14_fresh_local_engineering.py` first reruns that bounded generator with a minimal environment and timeout, then rechecks manifest/ledger/log/trace/TTL/dependency and all 20-case mappings in the same process before it may report a current-session local result. Its external signature anchor remains `TBD_EXTERNAL` and the enterprise gate remains `BLOCKED_EXTERNAL`.

For a read-only review of an already-generated cache, use `scripts/verify_p3_wp14_fresh_local_engineering.py --verify-existing`. It only reports `VERIFY_EXISTING_DIAGNOSTIC_ONLY`; it does not run the generator, write evidence, or grant `PASS_LOCAL`.

## Fresh GREEN command ledger

All commands below are fresh local engineering runs. The Docker archive smoke subtest used only the local Docker engine after explicit local permission; no enterprise endpoint or system was contacted.

```text
PYTHONPATH=. .venv/bin/pytest -q tests/test_phase3_wp14_acceptance_handover_contract.py
# 5 passed in 2.08s

PYTHONPATH=. .venv/bin/pytest -q tests/test_phase3_wp00_baseline_contract.py
# 12 passed in 2.34s

PYTHONPATH=. .venv/bin/pytest -q tests/test_phase3_wp14_acceptance_handover_contract.py tests/test_phase3_wp04_delivery_contract.py::test_release_snapshot_comparison_ignores_atime_but_rejects_content_mutation tests/test_permission_matrix.py
# 16 passed in 1.52s

PYTHONPATH=. .venv/bin/pytest -q tests/test_phase3_wp00_baseline_contract.py tests/test_phase3_wp14_acceptance_handover_contract.py tests/test_phase3_wp04_delivery_contract.py::test_release_snapshot_comparison_ignores_atime_but_rejects_content_mutation tests/test_permission_matrix.py
# 28 passed in 2.45s

PYTHONPATH=. .venv/bin/pytest -q tests/test_phase3_wp04_delivery_contract.py
# 30 passed in 18.08s

PYTHONPATH=. .venv/bin/pytest -q tests/test_phase3_wp01_enterprise_acceptance_contract.py tests/test_phase3_wp02_enterprise_identity_contract.py tests/test_phase3_wp03_enterprise_connectors.py tests/test_phase3_wp04_delivery_contract.py tests/test_phase3_wp04_production_runtime.py tests/core/orchestration/test_production_observability.py tests/test_phase3_wp06_subscription_migration_contract.py tests/test_phase3_wp07_enterprise_delivery_contract.py tests/acceptance/test_phase3_wp08_third_domain_replication.py tests/agent/test_wp09_model_gateway.py tests/test_wp10_tenant_api.py tests/test_wp11_bi_ai_catalog_api.py tests/test_wp12_metering_showback_api.py tests/test_wp13_plugin_platform_api.py
# 236 passed in 22.91s

PYTHONPATH=. .venv/bin/pytest -q tests/test_phase3_wp04_delivery_contract.py::test_release_snapshot_comparison_ignores_atime_but_rejects_content_mutation
# 1 passed
```

The WP04 diagnostic found and removed a local test-environment false rejection: after reading a manifest, the CLI compared whole `stat_result` values, including filesystem-managed `atime`. On this host, read access intermittently changed `atime` while inode, ownership, link count, size, mtime, ctime, digest, signature, cwd, lock path, and configuration remained stable, producing `RELEASE_REJECTED`. A test-first repair now ignores `atime` but continues to reject content-relevant metadata changes; source and deployment CLI mirrors are byte-identical. This is a local engineering remediation, not enterprise acceptance evidence.

JSON parsing, source/deployment mirror comparison, Python compilation, and `git diff --check` are recorded in the final integrity command below.

## P3-WP00 release-copy and evidence-vocabulary consistency repair

The first broader P3-WP00 command produced `25 passed, 2 failed`: its recursive source/deployment comparison treated interpreter-generated `__pycache__/*.pyc` files as release inputs, and its acceptance-evidence enum rejected a real BI/AI engineering-baseline status already recorded in the execution register. P3-WP14 repaired the contract without removing any user cache: recursive comparison now explicitly excludes only `__pycache__` and `*.pyc`, while `diff -qr` still compares every source and migration file byte-for-byte. The acceptance-evidence vocabulary now comes only from the authoritative fixed P3-WP00 record set (`P3-WP00` through `P3-WP14`) and its explicit status fields (`baseline_status`, `engineering_completion_status`, and `engineering_status`); arbitrary additional work-package records or nested `ENGINEERING_*` text cannot widen it. The fresh P3-WP00 result is recorded by the current verification ledger, rather than asserted here from a historical run.

## External residuals

`TBD_EXTERNAL` or `BLOCKED_EXTERNAL`: pilot environment; five named enterprise signers; IdP; sources; network; monitoring; SMTP; collaboration; ITSM; security/legal; infrastructure; third domain; AI; multi-tenancy; BI/AI; cost; plugin policy; target-scale workload and result; real browser UAT; training attendance; target-environment upgrade/rollback/restore; and remote-save authorization.

No secrets, raw enterprise data, real endpoint, or external enterprise integration result is stored in this evidence package.