# Authority and evidence

Use this reference whenever a task touches live Mappls behavior, credentials, entitlement, compatibility, support, source conflicts, or production readiness.

## Evidence ladder

1. Exact acquired contract or current declared SDK source establishes repository evidence.
2. A source-declared successor establishes lineage, not compatibility.
3. A deterministic fixture proves application handling, not provider behavior.
4. A restricted non-production account observation proves only that exact account, operation, region, time, and input class.
5. Product/contract authority establishes entitlement and supported terms.
6. Independent release authority establishes production approval for a frozen artifact.
7. Deployment observation and reconciliation establish that the approved artifact actually operates as intended.

Never skip a level by inference.

## Credential boundary

- Never accept or request a provider credential in a prompt, chat, generated plan, source file, URL shown to a model, test fixture, log, trace, or support packet.
- Use explicit placeholders such as `MAPPLS_STATIC_KEY`, `MAPPLS_INTOUCH_ACCESS_TOKEN`, or an account-specific secret-manager reference.
- Keep current core REST restricted-key, legacy OAuth, InTouch bearer, browser/mobile key, widget entitlement, mGIS identity, device activation, MCP gateway, and OAuth resource-server credentials distinct.
- Use only the exact host, path, security scheme, region, and restriction declared by the selected generation and issued account.

## Required labels

Label evidence as one of: `exact-source`, `normalized-source`, `adjacent-reference`, `fixture`, `observed-non-production`, `selection-required`, or `external-production-gate`.

If evidence is missing, stop at `selection-required`. Do not fill a gap using a similar product, newer-looking repository, marketing prose, local-only source, or model memory.

## Forbidden claims

Repository evidence does not prove product availability, customer entitlement, host reachability, regional permission, quota, SLA, compatibility, support status, provider payload shape at runtime, production readiness, or customer authorization.

