feat(spike): parent home candidate C — handoff-first prototype (S1 fixtures + contract tests)

[obvious-autobuild]

Acceptance criteria

(Rubric art_VyNYOggs v1.0 — candidate 3, handoff-first; binding scenario S1; rubric ground rules 1–3.)

• Home lens is handoff-first: the home leads with the takeover brief — five facts, each source-linked; pending items with state; tonight's plan; takeover confirmation (S1-E). Capture and the feed serve the brief; capture sits in the one-handed thumb zone (S1-A).
• All six S1 beats reachable from the home, on the binding scenario data: capture with interruption + quiet-input completion (S1-A), inspect → correct / restrict / attach with preview-before-confirm (S1-B), per-fact source links (S1-C), failed-extraction recovery with no data loss (S1-D), Marco's read-only question (S1-E), Rosa's grants-filtered view (S1-F).
• The correction changes the plan: the nap→night-waking correction (07:44) is what makes takeover fact feat(security): household visibility threat model with executable fail-closed access cases #4 true ("No nap today"), carries append-only lineage (original never erased), and survives extraction attempt 1 because caregiver-confirmed events are pinned.
• Month history matches the scenario: the same 30-day window all candidates show; the final row is SET from the S1 fixture so month history and the scenario cannot diverge (consistency check encoded as a test).
• Fixtures are deterministic and contract-bound: regeneration is a byte-level no-op (tested); transcripts are sha256-pinned in a self-describing manifest; every wire payload decodes through the contract's Effect schemas at module load (no explicit nulls; integer unix-ms timestamps).
• Audience per contract v0.2 (art_I2TCG08V): publication state (draft/published) and audience are separate dimensions; who-sees-what resolves from household/relationship grants; the S1 per-event restriction is modeled as an explicitly flagged PROPOSED prototype extension; the draft-visibility choice is stated in code, not implied.
• Scope discipline (ground rule 3): extraction-review card flow (slots 11–14), handoff implementation (slot 23), digest flow (slot 24) are OUT of scope — review appears only as one representative doorway screen.
• Nothing merges from this branch (candidate exclusion — exploration only). Draft PR for registry parity with candidates 1–2.

Verification (against HEAD 0c27c82)

• bun test (spike dir): 23 pass / 0 fail, 87 assertions — fixture→contract decode (Entry + Event), transcript sha256 round-trip, determinism (regenerate = byte no-op), S1 beat integrity (one clarification; interruption is a session fact, never transcript bytes; failed attempt visible with transcript preserved), grants semantics (locked-not-silence for Rosa; restrictions narrow; drafts rule), envelope semantics (stale-result suppression, idempotent apply, capture independence), correction pinning (survives attempt 1), read-only question immutability.
• bun run typecheck (tsc strict over src/test/scripts, RN screens included): clean. Bun 1.3.14; effect 4.0.0-rc.115 (pinned).
• bun scripts/generate-fixtures.ts: byte-identical regeneration verified by in-test hash comparison.
• RN screens are typechecked but not executed (no simulator in this environment); the S1 replay is data-driven and deterministic. Screenshots/recordings can follow on request.

Known divergences (for the evaluator)

1. Contract doc vs merged domain schema. packages/domain (pre-v0.3) used timestamp/payload with different field ownership; contract v0.2 and the evaluation corpus use occurredAt/quantity/authorId. This spike follows the contract document. Note: master folded contract v0.3 (PR feat(domain): fold contract v0.3 — context envelope, operation outputs, lineage #14) while this spike was in flight — the spike mirrors the v0.2 contract the frozen rubric pins; reconciliation belongs to the contract lane (Event.authorId already flagged there).
2. Per-event audience restriction (S1-B "parents only") has no home in contract v0.2 — modeled here as an additive prototype-layer record; proposals belong to the contract owner.
3. Personas. Repo evaluation fixtures use caregiver-1/"Ava"; the rubric's binding S1 personas (Elena/Marco/Rosa/Sofia) are used verbatim with slug-style authorIds matching the repo id style.

All data is synthetic. The spike is standalone (spikes/ is not a pnpm workspace member) — CI impact: none beyond the normal PR pipeline.

[obvious-autobuild]

Independent review — pass-with-notes (reviewer does not merge)

Verdict: pass-with-notes · Tested head SHA: 0c27c82e9d079d168d78563474be634e4eb69961 · Reviewed: 2026-09-17, independent read-only review per .obvious/obvious.md workflow.

Scope (ground rule 3)

Merge base 652ace5 → 0c27c82: 21 files, all under spikes/home-c-handoff/ (+3586/−0). No packages/**, backend/**, apps/**, evaluation/**, security/**, verification/**, or .github/** deltas. No contamination.

Acceptance criteria — verified against the diff (8/8)

1. Handoff-first lens — takeover brief is a first-class schema (fiveFacts with per-fact source refs, pendingItems with state, plan + confirmation); tests assert 5 facts, each with ≥1 source ref, pending items resolved.
2. Six S1 beats on binding data — A (interruption as session fact + clarification + typed completion), B (inspect/restrict/attach with preview), C (sourceExcerpt character offsets → verbatim excerpts), D (failed attempt visible, transcript preserved, manual event coexists), E (read-only question, source-linked, no mutation path), F (grants-filtered Rosa feed with locked-cue-not-silence).
3. Correction changes the plan — ev-sleep-2 pins confidence 1, corrects: ev-sleep-1, original retained (supersededBy lineage, append-only), attempt-1 conflicts suppressed as pinned; five-fact feat(security): household visibility threat model with executable fail-closed access cases #4 ("No nap today") derives from the correction; month final row napMinutes: 0 agrees.
4. Month history matches scenario — 30 days; final row source: "set from HOME-C-S1-DAY (not generated)"; consistency encoded as a test.
5. Deterministic, contract-bound fixtures — regeneration is a byte-level no-op (tested, and re-proven below); transcripts sha256-pinned in the manifest; no explicit nulls; integer unix-ms timestamps; decode through Effect schemas at module load (fail-loud).
6. Audience per contract v0.2 — publication state (visibility) and audience (household/relationship grants) are separate dimensions; per-event restriction modeled as an explicitly flagged PROPOSED prototype-layer record; draft-visibility choice stated in code.
7. Scope discipline — review flow appears only as one doorway screen; slots 11–14/23/24 logic absent.
8. Nothing merges — draft, candidate exclusion stated in the body. Honored: this review does not merge (repo rule 6 — parent-home lane keeps merge ownership).

Reviewer-run gates (isolated uncached worktree at the exact head)

• bun test — 23 pass / 0 fail, 87 assertions (reproduces the PR's claim exactly)
• bun run typecheck — tsc strict over src/test/scripts, exit 0
• bun scripts/generate-fixtures.ts — byte-level no-op re-proven (git status over fixtures: 0 changed files)
• Deps installed --frozen-lockfile in the isolated worktree; no shared-tree state

Checks

CI run 35260510319 — conclusion success, headSha = exact tested SHA 0c27c82 (verified via check-runs API + run view, not the PR page). mergeStateStatus: CLEAN re-verified after master advanced fd7a6ab → 9ea7e73 (#15) during review; the merge base is unchanged, so the spike-only diff is unaffected.

Manifest gate — NOT satisfied (blocking for any merge path)

No verification-manifest:v1 block exists on this PR (body or comments). cd verification && bun src/cli.ts validate-pr --pr=23 → manifest_missing, decision refuse (advisory). Per the verification gate (PR #26), the PR is not merge-eligible until a manifest is recorded on the tested head. This is consistent with criterion 8 (candidate hold — nothing merges from this branch), but the owning lane must add the manifest before any merge path — including a post-arena-selection merge — proceeds.

Notes (non-blocking)

1. RN screens are typechecked but not executed — disclosed in the PR; the S1 replay is data-driven and deterministic.
2. Contract v0.2 vs merged packages/domain divergence (occurredAt/quantity/authorId vs timestamp/payload) is disclosed in code and body and correctly routed to the contract lane (v0.3 fold / Event.authorId already flagged). This spike is not the reconciliation owner.
3. Per-event audience restriction is a flagged PROPOSED extension; the proposal belongs to the contract owner.
4. Draft status: registry parity with candidates 1–2 per the body. Promotion is the owning lane's call.

All results above were produced by direct inspection and execution at the exact head SHA; nothing carried over from earlier commits.