← Research archive
Technical note published Sep 2, 2026

Deterministic Evidence Acquisition Preflight and Bounded Smoke Harness

KESPA converted the validated 3,982-card knowledge blueprint into a 4,807-slot evidence-acquisition workload with explicit primary/supporting/cross-check roles, a conservative 60-family source-policy catalog, an offline evidence-quality auditor, invariant validation, and a deterministic 28-slot/24-topic smoke harness. Local preflight checks passed with zero network/provider calls; the recorded checkpoint explicitly notes that the Windows live smoke had not yet been executed.

evidence-acquisition deterministic-smoke preflight source-policy knowledge-factory
MARKDOWN

README.md

4,044 bytes SHA-256 3475797314b4a5c7…

KESPA-NOTE-023 — Deterministic Evidence Acquisition Preflight and Bounded Smoke Harness

Date: 2026-09-02 Status: Published historical technical record Project: KESPA AI / NexLabs Studios

Purpose

Once KESPA had a deterministic knowledge blueprint, the next problem was much larger:

How do you safely acquire evidence for thousands of planned knowledge scopes without immediately launching thousands of network fetches?

The Evidence Acquisition v001 preflight created a bounded test harness first.

Canonical acquisition scope

The validated blueprint produced:

  • canonical topics: 759
  • canonical card scopes: 3,982
  • evidence-source slots: 4,807

The evidence workload was split into explicit roles:

  • primary: 3,982
  • supporting: 609
  • cross-check: 216

Those roles sum to the full 4,807-slot acquisition plan.

Acquisition components

The preflight introduced:

  • a full blueprint evidence collector;
  • an offline evidence-quality auditor;
  • a deterministic representative smoke selector;
  • an acquisition invariant validator;
  • a conservative 60-family source-policy catalog;
  • a Windows offline validation wrapper;
  • a bounded Windows network-smoke wrapper.

The validated v004 blueprint itself remained unchanged.

Deterministic smoke

Instead of testing the entire 4,807-slot queue first, KESPA generated a bounded representative smoke:

  • 28 evidence slots
  • 24 topics

The smoke's deterministic SHA-256 reproduced byte-for-byte.

That matters because the same bounded workload can be reused after changes to discovery or source-policy mechanics.

Discovery is separate from acquisition

The preflight explicitly separated:

candidate source discovery

from:

page-content acquisition

Finding a URL is not evidence.

A source still has to survive the acquisition and evidence-quality rails.

Conservative source handling

The acquisition candidate included controls for:

  • unknown sources -> REVIEW_REQUIRED;
  • SSRF-safe URL handling;
  • redirect validation;
  • robots policy;
  • AI-exclusion handling;
  • bounded evidence excerpts.

PDF ingestion was deliberately deferred.

Recorded validation

The historical checkpoint recorded:

  • Python compilation: PASS locally
  • full queue recognized: 4,807
  • cards reconciled: 3,982
  • canonical topics: 759
  • smoke build: 28 slots / 24 topics
  • smoke deterministic SHA-256: reproduced byte-for-byte
  • full collector offline preflight: PASS locally
  • input/catalog invariant validation: PASS locally
  • evidence auditor mechanical harness: PASS locally
  • network calls during validation: 0

Important validation boundary

The same record explicitly says:

RESULT: NOT YET EXECUTED on your Windows KESPA environment

for the live bounded network smoke at that checkpoint.

So this note is intentionally marked published, not verified from a live Windows acquisition run.

Later experiments separately document the actual v001/v001.1/v001.2 live discovery behavior and the seeded scale runs.

Safety / data impact

During this preflight:

  • production Chroma changed: NO
  • Brain API changed: NO
  • database changed: NO
  • private-data routing changed: NO
  • DeepInfra usage: NONE
  • Groq usage: NONE
  • external web usage during candidate validation: NONE
  • production-ready evidence created: 0

Why this matters

The preflight made a large evidence campaign testable before spending network/provider resources.

It also separated three questions that are easy to accidentally collapse:

1. What knowledge scopes exist?

2. Where might evidence be found?

3. Does directly retrieved evidence actually satisfy the scope and quality gates?

That separation made the later source-discovery and scale experiments much easier to diagnose.

Limitations

This is an acquisition-mechanics record, not a live coverage result.

The later evidence-discovery and scale experiments provide the empirical network outcomes.

TEXT

SHA256SUMS.txt

393 bytes SHA-256 e9a4c0d16ff95406… 
3475797314b4a5c7fd38aae5fed5626b3c47f18a9672696486edaae880a37fd0  README.md
ecce2611b81550e2162041035e246047e2b354462ec1813f1bf8254676907760  note.json
cf8df971b4847aba710f949e79d6ac9520bf2dd13051471707e92f392ac08929  metrics.csv
0943f6982ef4ffd13c998f77b02aafa6983a733c412001a22fbf8859159f3af9  methodology.md
ccb8fc8fd40e80a21bd66719eb50f7a6227e59901a810640ec5b570566841064  provenance.json
MARKDOWN

methodology.md

1,387 bytes SHA-256 0943f6982ef4ffd1…

Methodology

Blueprint reconciliation

The acquisition candidate consumes the already validated canonical blueprint without changing it.

Preflight validation checks that 3,982 cards and 4,807 evidence roles reconcile to the expected 759 canonical topics.

Role assignment

Evidence slots are explicitly labeled as primary, supporting, or cross-check roles.

This lets later policy distinguish basic source coverage from required independent corroboration.

Deterministic smoke construction

A representative subset of 28 evidence slots across 24 topics is generated deterministically.

Its SHA-256 is reproduced during validation so later acquisition-mechanics changes can be tested on the same bounded workload.

Source-policy catalog

A conservative catalog defines source-family behavior.

Unknown source families default to REVIEW_REQUIRED.

Acquisition rails

The collector applies network and content-boundary controls including SSRF safety, redirects, robots policy, AI-exclusion policy, and bounded excerpts.

Discovery is kept separate from direct page-content acquisition.

Offline validation boundary

Compilation, blueprint reconciliation, deterministic smoke reconstruction, invariant checks, and the evidence-auditor harness run without network access.

The historical record does not claim the Windows live network smoke had run at this checkpoint.

CSV

metrics.csv

609 bytes SHA-256 cf8df971b4847aba… 
metric,value,unit_or_status
canonical_topics,759,topics
blueprint_cards,3982,cards
evidence_slots,4807,slots
primary_roles,3982,slots
supporting_roles,609,slots
cross_check_roles,216,slots
source_policy_families,60,families
smoke_slots,28,slots
smoke_topics,24,topics
smoke_sha256_reproduced,PASS,determinism
full_collector_offline_preflight,PASS,validation
input_catalog_invariant_validation,PASS,validation
evidence_auditor_mechanical_harness,PASS,validation
network_calls_during_validation,0,calls
production_ready_evidence_created,0,items
windows_live_network_smoke,NOT_YET_EXECUTED,historical_checkpoint
JSON

note.json

3,321 bytes SHA-256 ecce2611b81550e2… 
{
    "schema": "kespa.public_technical_note.v1",
    "id": "KESPA-NOTE-023",
    "title": "Deterministic Evidence Acquisition Preflight and Bounded Smoke Harness",
    "date": "2026-09-02",
    "status": "published",
    "purpose": "Document the evidence-acquisition preflight layer that translated the canonical bootstrap blueprint into a bounded, auditable acquisition workload before any full network-scale evidence collection was attempted.",
    "canonical_scope": {
        "canonical_topics": 759,
        "blueprint_cards": 3982,
        "evidence_slots": 4807,
        "primary_roles": 3982,
        "supporting_roles": 609,
        "cross_check_roles": 216
    },
    "smoke_harness": {
        "slots": 28,
        "topics": 24,
        "deterministic_reconstruction": true,
        "sha256_reproduced_byte_for_byte": true
    },
    "acquisition_components": [
        "full blueprint evidence collector",
        "offline evidence-quality auditor",
        "deterministic representative smoke selector",
        "acquisition invariant validator",
        "60-family conservative source-policy catalog",
        "Windows offline validation wrapper",
        "bounded Windows network-smoke wrapper"
    ],
    "policy_and_safety": {
        "discovery_separated_from_page_content_acquisition": true,
        "unknown_sources_default": "REVIEW_REQUIRED",
        "ssrf_controls": true,
        "redirect_controls": true,
        "robots_controls": true,
        "ai_exclusion_controls": true,
        "bounded_excerpt_controls": true,
        "blueprint_modified": false
    },
    "recorded_validation": {
        "python_compilation": "PASS locally",
        "full_queue_recognized": "4807/4807",
        "cards_reconciled": "3982/3982",
        "canonical_topics": "759",
        "smoke_build": "28 slots / 24 topics",
        "smoke_sha256_reproduced": "PASS",
        "full_collector_offline_preflight": "PASS locally",
        "input_catalog_invariant_validation": "PASS locally",
        "evidence_auditor_mechanical_harness": "PASS locally",
        "network_calls_during_validation": 0,
        "windows_live_smoke_at_recorded_checkpoint": "NOT YET EXECUTED"
    },
    "data_impact": {
        "production_chroma_changed": false,
        "brain_api_changed": false,
        "database_changed": false,
        "private_data_routing_changed": false,
        "deepinfra_usage": false,
        "groq_usage": false,
        "external_web_usage_during_candidate_validation": false,
        "production_ready_evidence_created": 0
    },
    "interpretation": [
        "The acquisition problem was made finite and measurable before network execution.",
        "Deterministic smoke selection allows the same small representative workload to be rerun after discovery or policy changes.",
        "Separating discovery from acquisition prevents search ranking itself from being treated as evidence.",
        "Unknown source families fail toward review rather than silent approval.",
        "The preflight creates a safe bridge between a large blueprint and later live acquisition experiments."
    ],
    "limitations": [
        "The recorded September 2 checkpoint explicitly states that the Windows live network smoke had not yet been executed.",
        "PDF ingestion was intentionally deferred.",
        "New source families still required review.",
        "Deterministic heuristic ranking was not treated as factual verification.",
        "This note documents acquisition mechanics and preflight validation, not live evidence-coverage performance."
    ]
}
JSON

provenance.json

1,460 bytes SHA-256 ccb8fc8fd40e80a2… 
{
    "schema": "kespa.public_provenance.v1",
    "research_id": "KESPA-NOTE-023",
    "source_basis": "Historical KESPA Knowledge Factory Evidence Acquisition v001 preflight record dated 2026-09-02.",
    "source_observations": [
        "The acquisition candidate recognized 4,807 evidence slots mapped to 3,982 cards and 759 canonical topics.",
        "Role counts were 3,982 primary, 609 supporting, and 216 cross-check.",
        "A deterministic 28-slot / 24-topic smoke was built and its SHA-256 reproduced byte-for-byte.",
        "The implementation included a 60-family conservative source-policy catalog and unknown sources defaulted to REVIEW_REQUIRED.",
        "Python compilation, offline preflight, input/catalog invariants, and the evidence-auditor mechanical harness passed locally.",
        "Zero network calls were made during candidate validation and no production state was changed.",
        "The source explicitly states that the Windows live network smoke had not yet been executed at this checkpoint."
    ],
    "status_note": "This entry is marked published because the mechanics and offline preflight were validated, but the source explicitly states that the live Windows network smoke was not yet executed at this historical checkpoint.",
    "publication_note": "This package publishes architecture, scope counts, safety controls, and validation state. It does not expose credentials, private configuration, raw source evidence text, or private implementation code."
}