# Contracts and evidence boundaries ## Request and answer The web Guide accepts a JSON question through its existing same-origin API. Public answer fields remain defined by `GuideAnswer`; exact-source citations, evidence limits and maturity labels accompany reviewed prose. The example client treats HTTP failure separately from successful responses. Consumers must inspect an answer for task completion; fallback and gap dispositions are not a success score. ## Shared workflow `runEvidenceGuideWorkflow` accepts the reviewed-clause trial input plus observation/identity metadata and returns `{ result, trace }`. It does not authorize model-written public facts. The model may select approved reviewed IDs; deterministic composition and validation supply factual wording. ## Read-only evidence tools MCP evidence `search` accepts a query and returns approved evidence identifiers and canonical URLs. `fetch` accepts an identifier and returns its source-backed summary, maturity/status and limits. Tool discovery and protocol transport are separate from authenticated-client verification. The internal Guide's selector does not automatically use MCP. ## Observation Per-stage outcome and timings, opaque request identity, evidence identifiers, configuration identity and metered attempts are operational diagnostics. Do not include raw visitor questions, transcripts, audio, visitor fingerprints, IP addresses or provider credentials. Authored demonstration questions can be published separately. A simulated fixture must remain labelled simulated. ## Failure behavior Provider timeout, invalid selection and unavailable budget recover to the valid source-only baseline or an explicit evidence gap. An observer failure must not alter the answer. A meter failure must prevent a paid provider attempt. There are no automatic paid retries in this reference. Circuit-breaker behavior is process-local unless separately established. The packaged CLI binds `identity.sourceCommit` to `reference-sha256:` and computes the actual reviewed corpus SHA. This legacy field name carries a source artifact identity, not a Git commit claim. A source checkout without that package manifest reports NOT_PINNED_BY_REFERENCE_MANIFEST instead of inventing an identity. ## Frozen reference CLI contract The downloadable archive's package manifest defines `answer` and `test` scripts. The first positional argument to `answer` is the mode, followed by the authored question text: ```sh npm run answer -- source-only "What demonstrates production workflow leadership?" npm run answer -- fixture-invalid-selection npm run answer -- fixture-timeout ``` These three modes intentionally do not permit live provider calls. The public reproduction runner also handles withdrawal inputs and compares all 120 recorded baseline answer objects. Its instructions and the dated page summary describe current evaluation results; historical preparation notes inside the frozen reference archive are not current release status.