# Local engineering patch evidence

These patches contain the implementation changes and regression tests described in the portfolio's 14 September 2026 engineering notes. They are local, uncommitted changes against the base commits below. Publishing this evidence does not update the linked GitHub repositories or deploy their applications.

| Project | Repository | Base commit | Patch |
| --- | --- | --- | --- |
| RangeCheck | [Tools](https://github.com/SSH-PuR66/Tools) | `e7b19e9cacd938c1d9744b6df9dcdfc645d509ea` | [rangecheck-scope-validation.patch](rangecheck-scope-validation.patch) |
| PolicyScout | [policy-scout](https://github.com/SSH-PuR66/policy-scout) | `f2bfd923e2ec48e337f80914b4da8eaa681087e5` | [policyscout-persistence-validation.patch](policyscout-persistence-validation.patch) |
| NovaMind | [Nova-Mind](https://github.com/SSH-PuR66/Nova-Mind) | `a67abf1df453923e8fcc270f8682c8e2934f6d91` | [novamind-request-contracts.patch](novamind-request-contracts.patch) |

[source-evidence.json](source-evidence.json) records patch hashes, selected source-file hashes, exact base revisions, verification commands, and limits. [results.json](results.json) records the wider portfolio validation scope.

The independent verification pass reran RangeCheck (38 passed) and NovaMind (14 passed). PolicyScout's earlier record reports 40 passed; this pass inspected its source and regressions but could not rerun them because the selected runtime lacked scikit-learn. An isolated dependency download was stopped before test execution. The earlier result remains a recorded result, not a freshly reproduced one.

## Apply and inspect

Download the chosen patch outside a fresh clone. In that clone, check out its exact base commit. Set `PATCH_FILE` to the downloaded patch's absolute path; then run from the repository root:

```sh
git checkout --detach BASE_COMMIT
git apply --check PATCH_FILE
git apply PATCH_FILE
git diff --check
git diff
git status --short
```

Replace `BASE_COMMIT` and `PATCH_FILE` with the chosen table entry and file path. Added files appear in `git status`; inspect the patch itself to see both new and modified files. No commit or push is needed to review and test. Do not apply a patch on top of an already modified checkout.

Each patch was checked with `git apply --check`, then applied to copies of the exact base files in a temporary directory. The resulting files matched the reviewed local source after normalizing CRLF/LF line endings. Source repositories were not modified to prepare these artifacts. Unrelated README and other working changes are excluded.

## Run the local tests

Use a disposable Python environment with the dependencies declared in each project's `pyproject.toml`. `PYTEST_DISABLE_PLUGIN_AUTOLOAD=1` prevents unrelated globally installed pytest plugins from affecting these tests. PolicyScout also needs `PYTHONPATH=src` when it is not installed as a package. On PowerShell:

```powershell
$env:PYTEST_DISABLE_PLUGIN_AUTOLOAD='1'
```

RangeCheck, from the cloned Tools repository:

```powershell
Set-Location RangeCheck
python -m pip install -e '.[dev]'
python -m pytest -q
```

PolicyScout, from its repository root:

```powershell
python -m pip install -e '.[dev]'
$env:PYTHONPATH='src'
python -m pytest -q
```

NovaMind, from its repository root, with Node.js 24:

```sh
node --test tests/api.test.mjs
```

## What the results establish

- RangeCheck: scope-file authorization and numeric-type validation. CLI overrides are outside this parser patch; no network scan is required by these regressions.
- PolicyScout: version, backend, count, digest, and record validation before rebuilding an index. Citation identity is the `(doc_id, chunk_id)` pair. Version 3 remains readable with schema and count checks. SHA-256 is not a signature and cannot authenticate a corpus whose files can both be replaced.
- NovaMind: bounded JSON and explicit endpoint success/error contracts with mocked KV and inference services. Contact inputs are retained on failure in the inspected interface source; the Node tests exercise endpoint behavior, not a browser workflow. A completed KV write is storage acceptance, not email delivery.

The tests do not establish production deployment, production bindings, arbitrary-input safety, or external service operation.