feat(ui): add map-context to Evidence Drawer admission

[bartytime4life]

Goal

Add a deterministic, candidate-only anticorruption adapter between the existing renderer-neutral MapContextEnvelope and public-safe EvidenceDrawerPayload profiles. The adapter checks selected-feature, release, evidence, caller-role, freshness, and finite-outcome alignment, then emits the existing DecisionEnvelope shape.

It does not resolve evidence, evaluate policy, authenticate review, establish release state, authorize public use, invoke a deployed route, or publish anything.

Exact state

• CONFIRMED base: main@8ee05f3738c29344d055025bf47448150429e05e
• CONFIRMED exact head: 2b6f3dcf9a4642f23055ef8c8e2a0eb785d31ead
• CONFIRMED relation: three commits ahead, zero behind
• CONFIRMED effective diff: exactly 12 paths
• CONFIRMED delivery: draft PR; human review pending
• NEEDS VERIFICATION: exact-current-head hosted checks
• PROPOSED implementation state: inactive package helper and fixture profile; deployed runtime wiring is not claimed

Why this closes a real dependency gap

Current main already contains:

• the closed renderer-neutral MapContextEnvelope contract and validator;
• the closed public-safe EvidenceDrawerPayload contract and validator;
• the shared packages/envelopes helper package;
• the closed DecisionEnvelope schema and semantic validator;
• UI doctrine requiring map interactions to cross a governed API/evidence boundary rather than pass renderer-native state or direct-store values.

What was missing was a deterministic cross-object admission boundary. Without it, an individually valid drawer payload could cite evidence visible elsewhere in the viewport but unrelated to the selected feature, or propagate stale/denied/error state without a reviewed finite candidate outcome.

Object-family boundary

No new contract or schema authority is created.

Existing object	Role
MapContextEnvelope	Renderer-neutral selected-layer, feature, time, area, evidence, and release context.
EvidenceDrawerPayload	Existing public-safe finite UI projection.
DecisionEnvelope	Existing output shape for a non-authoritative render-admission candidate.

The adapter is an anticorruption layer between bounded contexts, not a fourth sovereign object.

Admission behavior

The helper checks only explicit local declarations and relationships:

1. Exact existing input profiles.
2. assembled_at <= evaluated_at <= expires_at; expiry returns ABSTAIN.
3. Every MapContext governance/non-effect declaration remains exactly false.
4. SYSTEM_TEST is denied unless explicitly admitted for fixture-only execution.
5. Exactly one selected feature; zero or multiple selections return ABSTAIN.
6. The selected layer resolves exactly once, is declared PUBLISHED, and its release ref belongs to the context release set.
7. Selected evidence belongs to the context evidence set.
8. ANSWER and ABSTAIN drawer evidence is a subset of the selected feature evidence, not merely another visible layer's evidence.
9. Drawer outcome, reason, citations, history, and trust-state declarations are compatible with the finite outcome.
10. DENY and ERROR candidates carry no evidence refs, citations, history, title, summary, URL, limitation, or source text.

The emitted candidate uses policy_family = "render", matching decision/outcome, fixed safe obligations, and version 1.0.0.

Finite outcomes

Outcome	Representative reasons
ANSWER	SUPPORTED
ABSTAIN	STALE_EVIDENCE, CONTEXT_EXPIRED, SELECTION_REQUIRED, SELECTION_AMBIGUOUS
DENY	SENSITIVE_DETAIL_RESTRICTED, CALLER_ROLE_DENIED
ERROR	UPSTREAM_ERROR, DRAWER_EVIDENCE_OUTSIDE_SELECTION, DRAWER_TRUST_STATE_MISMATCH

Changed paths

• .github/workflows/map-context-evidence-drawer-admission.yml
• data/receipts/generated/genrec-map-context-evidence-drawer-admission-20260807.json
• docs/architecture/ui/map-context-evidence-drawer-admission.md
• fixtures/ui/map_context_evidence_drawer_admission/README.md
• fixtures/ui/map_context_evidence_drawer_admission/cases.json
• fixtures/ui/map_context_evidence_drawer_admission/payloads/abstain-stale-aligned.json
• fixtures/ui/map_context_evidence_drawer_admission/payloads/answer-aligned.json
• fixtures/ui/map_context_evidence_drawer_admission/payloads/answer-wrong-selection.json
• packages/envelopes/src/envelopes/__init__.py
• packages/envelopes/src/envelopes/map_context_evidence_drawer.py
• tests/packages/envelopes/test_map_context_evidence_drawer_admission.py
• tools/validators/ui/validate_map_context_evidence_drawer_admission.py

Directory Rules basis

ADR-0029 adopts Directory Governance Standard v2. Existing responsibility roots are used:

Responsibility	Home
Shared side-effect-minimal adapter code	packages/envelopes/src/envelopes/
Architecture explanation	docs/architecture/ui/
Synthetic cross-object examples	fixtures/ui/
Operational fixture replay	tools/validators/ui/
Package behavior tests	tests/packages/envelopes/
Read-only hosted validation	.github/workflows/
AI authoring accountability	data/receipts/generated/

No new root or parallel contract, schema, policy, evidence, source, release, proof, receipt, or publication authority is introduced. One PR is the smallest safe review boundary because code, fixtures, exact replay, tests, CI, architecture notes, and provenance share one observable behavior.

Local deterministic validation

10 focused package tests — PASS
8 exact admission cases — PASS
8/8 emitted candidates satisfy the current DecisionEnvelope schema
aligned ANSWER — PASS
aligned stale ABSTAIN — PASS
sensitive DENY without support leakage — PASS
upstream ERROR without support leakage — PASS
wrong selected-feature evidence → ERROR — PASS
expired context → ABSTAIN — PASS
SYSTEM_TEST default deny — PASS
missing selection → ABSTAIN — PASS
deterministic replay and input immutability — PASS
no-network execution — PASS
no drawer title/summary/citation URL/limitation/history leakage — PASS
Python compile / JSON parse / workflow YAML parse — PASS
generated receipt path/hash/truth-label closure — PASS

Hosted CI additionally invokes the existing MapContextEnvelope and EvidenceDrawerPayload validators against the source fixtures before package tests and case replay.

Concurrent-main reconciliation

The feature was initially prepared against main@a6bbaa2a7986858bd72629cf3a77181b9e72a761. During upload, main advanced through independently merged DecisionEnvelope validation, review-authority binding, and adjacent domain/governance slices.

The intervening path set was inspected and found disjoint. The feature branch was synchronized without force in merge commit 424e06b1a054298a5f4ef435765f01e85c721fc9. Receipt-link commit 2b6f3dcf9a4642f23055ef8c8e2a0eb785d31ead binds the generated authoring receipt to PR #2105. Final comparison against current main still shows exactly the intended 12 paths, three commits ahead, zero behind.

Trust boundary / non-effects

A green result proves deterministic fixture-level cross-object admission behavior only. It does not:

• resolve EvidenceRef to EvidenceBundle;
• verify that a release reference exists or is current;
• evaluate access, render, rights, consent, sensitivity, or public-safety policy;
• authenticate a caller, reviewer, steward, signer, or release authority;
• authorize an API response, map display, Focus Mode answer, export, capability, release, publication, or public use;
• read or mutate RAW, WORK, QUARANTINE, canonical, proof, model, catalog, release, or published stores;
• prove that apps/explorer-web, a governed API, or a deployed runtime invokes the helper.

Compatibility

The three existing schemas are unchanged. Existing MapContextEnvelope, EvidenceDrawerPayload, and DecisionEnvelope semantics remain authoritative. The package export addition is backward compatible; build_runtime_response_candidate remains exported.

GENERATED_RECEIPT

data/receipts/generated/genrec-map-context-evidence-drawer-admission-20260807.json

The receipt binds the exact bytes of all 11 authored implementation artifacts without self-reference and now records PR #2105 plus the synchronized base/head. Human review remains pending; the receipt is provenance, not approval.

Reviewer disposition

HOLD AS DRAFT pending exact-current-head hosted validation and independent review.

Reviewer focus:

• selected-feature evidence scoping;
• preservation of existing object boundaries;
• constrained SYSTEM_TEST opt-in;
• DENY/ERROR non-disclosure;
• finite outcomes and safe obligations;
• least-privilege deterministic workflow behavior.

Release and publication posture

No merge, release, deployment, promotion, publication, source activation, or repository-setting change is requested or performed by this PR.

Rollback

Before merge: close this draft PR and delete agent/map-context-evidence-drawer-admission-20260807.

After an authorized merge: revert feature commit c8e8a61f66cf13b4468bc4abb1e575796e01486b, synchronization commit 424e06b1a054298a5f4ef435765f01e85c721fc9, receipt-link commit 2b6f3dcf9a4642f23055ef8c8e2a0eb785d31ead, or the resulting merge commit as appropriate. No data migration, source deactivation, lifecycle reprocessing, cache invalidation, release withdrawal, or public correction is required because no runtime route or published state is activated.

CONTRACT_VERSION followed

3.0.0