docs: add offline evidence handoff plan

docs/go-mcp-minimal-plan.md

@@ -25,6 +25,7 @@ N0  Baseline cleanup and direction lock
   -> N9  MCP stdio smoke verification
   -> N10 Operator runbook and process scripts
   -> N11 Commit/review checkpoint
+  -> N12-pre Offline evidence intake
   -> N12 Real logged-in UIA capture gate
 ```
 
@@ -752,7 +753,84 @@ Pass if:
 - Unrelated generated files are staged.
 - Worktree contains ignored build outputs outside `runs/`.
 
-**Next node:** N12.
+**Next node:** N12-pre if the current environment cannot log in; otherwise N12 may start only when the real logged-in current-environment preconditions below are met.
+
+---
+
+## N12-pre: Offline evidence intake
+
+**Purpose:** Define and validate offline evidence copied from a separate logged-in test sandbox when the current repository environment cannot log in to iSphere.
+
+**Preconditions:**
+
+- N11 accepted.
+- Current environment cannot manually log in to iSphere / IMPlatformClient.
+- Business manager approves offline evidence intake as a pre-gate only.
+
+**Actions:**
+
+- Follow `docs/offline-evidence-intake-plan.md`.
+- Prefer mode A, **Full sandbox artifact bundle**. The user does not need to understand or generate JSON; they only copy folders from the logged-in test sandbox.
+- Recommended full-bundle shape:
+
+```text
+runs/offline-evidence-intake/<evidence-id>/
+  copy-notes.txt
+  raw/
+    install/
+    user-profile/
+    programdata/
+    shortcuts/
+    temp-importal-localcache/
+    other-candidates/
+  metadata/
+  notes/
+```
+
+- Common candidate source paths include install directories, `%APPDATA%`, `%LOCALAPPDATA%`, `%PROGRAMDATA%`, `Documents`, Desktop/Start Menu shortcuts, and `%TEMP%\importal` or `localcache` folders.
+- Pay attention to historical iSphere anchors such as `importal\localcache`, `LoginLog`, `IMPP.Util.dll`, `IMPlatformClient`, and `iSphere`.
+- Optional mode B, **Minimal redacted UIA package**, is only for advanced operators who already know how to produce JSON:
+
+```text
+runs/offline-evidence-intake/<evidence-id>/
+  manifest.json
+  scan_windows-redacted.json
+  dump_uia-main-redacted.json
+```
+
+- For optional mode B, confirm the package states `n12_status = offline_pre_only_not_n12_pass` and uses only:
+
+```text
+version
+self_check
+scan_windows
+dump_uia
+```
+
+**Expected outputs:**
+
+- Full sandbox artifact bundle for read-only offline inventory, or optional minimal UIA JSON package for advanced users.
+- No claim that the current environment has a logged-in iSphere window.
+- No claim that N12 passed.
+
+**Acceptance conditions:**
+
+Pass if:
+
+- In mode A, the copied bundle preserves directory structure and includes at least one useful `raw/` source area plus `copy-notes.txt` when available.
+- In mode A, repository-side handling is read-only inventory: do not directly run unknown binaries and do not modify original copied files.
+- In mode B, required JSON files exist and parse as JSON, and the manifest records offline pre-evidence only, not N12 pass.
+- For both modes, the route does not design or perform automatic login, send message, send file, receive file, injection, hook, memory reading, or endpoint-security bypass.
+
+**Stop conditions:**
+
+- Any step requires the user to understand JSON before they can provide the recommended full bundle.
+- Any step directly runs unknown binaries from the copied bundle.
+- Any step modifies original copied files.
+- Package is used to design automatic login, sending, file transfer, injection, hook, memory reading, or endpoint-security bypass.
+- Any reader treats the offline package as a replacement for true N12.
+
+**Next node:** N12 remains blocked until the current environment can manually log in and perform a live current-environment UIA capture.
 
 ---
 
@@ -763,7 +841,7 @@ Pass if:
 **Preconditions:**
 
 - N11 accepted.
-- User has copied real install/user files if needed.
+- Optional N12-pre offline evidence, if used, has been validated only as pre-gate context and not as N12 pass evidence.
 - User manually opens and logs in to iSphere.
 - iSphere main window is visible.
 
@@ -808,6 +886,7 @@ Pass if:
 - No candidate window appears.
 - UIA tree is empty or inaccessible.
 - Captured data contains sensitive secrets that need redaction before reporting.
+- Current environment cannot log in; in that case, use only N12-pre offline analysis and do not mark N12 passed.
 
 **Next node:** Future selector design. Do not implement selectors until N12 passes.
 
@@ -829,16 +908,16 @@ Every node must satisfy these rules:
 
 ## 4. Current Next Node
 
-Current next node is:
+Current guidance after N0-N11 completion is:
 
 ```text
-N0 -> N1 -> N2
+N12-pre if the current environment cannot log in; N12 only after current-environment manual login is possible.
 ```
 
 Immediate next action:
 
 ```text
-Run N1 C# baseline verification, then start N2 Go module skeleton.
+If login is unavailable here, collect/validate the full sandbox artifact bundle described in docs/offline-evidence-intake-plan.md. Minimal manifest/scan/dump JSON is optional and only for advanced operators.
 ```
 
-Do not start N8 or N12 early.
+Do not treat offline evidence as N12 pass. Do not start selector/action design until true N12 passes in the current environment.

docs/go-mcp-runbook.md

@@ -211,7 +211,17 @@ Procedure:
 
 During this procedure, the operator must not click, type, send, upload, download, modify client state, or capture passwords/tokens.
 
-## 10. Troubleshooting
+## 10. If this environment cannot log in
+
+Do not run or mark the real-login UIA capture gate as passed.
+
+If login is only possible in another test sandbox, follow `docs/offline-evidence-intake-plan.md` and use the recommended **Full sandbox artifact bundle** route. The user does not need to generate JSON. Ask them to copy the logged-in test sandbox's install directory, user-data directories, ProgramData directories, shortcuts, `%TEMP%\importal` / `localcache` candidates, and simple copy notes into `runs\offline-evidence-intake\<evidence-id>\`.
+
+The minimal `manifest.json` / `scan_windows-redacted.json` / `dump_uia-main-redacted.json` route is optional and only for advanced operators. In either route, the package is `N12-pre` context only. It can support offline inventory and reverse analysis, but it does not replace live current-environment `win_helper_scan_windows` and `win_helper_dump_uia` evidence.
+
+After receiving a full bundle, first do read-only inventory. Do not directly run unknown copied binaries, do not modify original copied files, do not use copied credential-like material to log in, and do not design automatic login, send message, send file, receive file, injection, hook, memory reading, or endpoint-security bypass behavior.
+
+## 11. Troubleshooting
 
 - If C# helper build fails, run `scripts\build-win-helper.ps1` directly and check for missing .NET Framework reference assemblies.
 - If `win_helper_version` fails, rerun `powershell -NoProfile -ExecutionPolicy Bypass -File scripts\verify-win-helper.ps1` first.

docs/handoff-2026-07-06.md

@@ -0,0 +1,381 @@
+# iSphere AI Bridge Handoff - 2026-07-06
+
+## 1. Handoff summary
+
+This repository is ready to hand off for the next operator.
+
+Current branch:
+
+```text
+codex/isphere-win-helper-first-phase
+```
+
+Current direction:
+
+```text
+Go MCP server + C# ISphereWinHelper.exe
+```
+
+The Python MCP path has been removed from the active plan. The current first-phase surface exposes only four read-only WinHelper-backed MCP tools:
+
+```text
+win_helper_version
+win_helper_self_check
+win_helper_scan_windows
+win_helper_dump_uia
+```
+
+No search, conversation opening, message sending, file sending/receiving, automatic login, injection, hook, memory reading, or endpoint-security bypass is implemented.
+
+## 2. Current completed state
+
+Completed plan nodes:
+
+```text
+N0   Baseline cleanup and direction lock
+N1   C# WinHelper baseline verification
+N2   Go module skeleton
+N3   Go helper protocol contract
+N4   Go helper process client
+N5   Helper client live verification
+N6   MCP library decision
+N7   Go MCP server skeleton
+N8   Four read-only MCP tool handlers
+N9   MCP stdio smoke verification
+N10  Operator runbook and process scripts
+N11  Commit and review checkpoint
+```
+
+N11 was completed with verification and commits. The latest checkpoint commits at handoff time are:
+
+```text
+bbd2be8 docs: record final go mcp checkpoint reviews
+57f1d42 docs: add go mcp runbook
+17fa9dd test: add go mcp verification script
+8956f33 feat: add go helper client and mcp tools
+63cda71 docs: add go mcp plan and process logs
+87e0e47 chore: remove temporary python mcp layer
+```
+
+After N11, the plan was adjusted because the current environment cannot log in to iSphere. The next step is not true N12 yet. It is now:
+
+```text
+N12-pre: Offline evidence intake
+```
+
+## 3. Current stop point
+
+Do not mark N12 as passed yet.
+
+True N12 still requires all of the following in the current environment:
+
+```text
+1. User manually opens iSphere in this environment.
+2. User manually logs in.
+3. iSphere main window is visible.
+4. Go MCP read-only tools run against that live visible window.
+5. win_helper_scan_windows finds the candidate window.
+6. win_helper_dump_uia captures the UIA tree.
+7. Output is saved under runs/real-loggedin-lab/uia-dumps/.
+```
+
+The user currently cannot log in inside this environment. Therefore, the next operator should start with offline evidence intake only.
+
+## 4. New next step: N12-pre offline evidence intake
+
+The user has full permission over the test sandbox and can copy files from another sandbox where iSphere can be manually logged in.
+
+Do not ask the user to manually generate UIA JSON first. The practical route is:
+
+```text
+Full sandbox artifact bundle
+```
+
+Expected location inside this repo after the user provides it:
+
+```text
+runs/offline-evidence-intake/<evidence-id>/
+```
+
+Recommended package structure:
+
+```text
+runs/offline-evidence-intake/<evidence-id>/
+  raw/
+    user-profile/
+    install/
+    programdata/
+    temp/
+    shortcuts/
+  metadata/
+  notes/
+    copy-notes.txt
+```
+
+Important: `runs/*` is ignored by Git. Do not commit raw evidence packages.
+
+## 5. What to ask the user to copy
+
+Ask the user to copy these from the sandbox that can log in to iSphere.
+
+### 5.1 Full test user profile
+
+```text
+C:\Users\<logged-in-test-user>\
+```
+
+Place it under:
+
+```text
+raw/user-profile/
+```
+
+### 5.2 iSphere / IMPlatformClient install directory
+
+Common parent locations:
+
+```text
+C:\Program Files\
+C:\Program Files (x86)\
+D:\...
+```
+
+Everything keywords:
+
+```text
+iSphere
+IMPlatformClient
+IMPlatform
+IMPP
+importal
+```
+
+Place install folders under:
+
+```text
+raw/install/
+```
+
+### 5.3 ProgramData
+
+If size is acceptable, copy:
+
+```text
+C:\ProgramData\
+```
+
+Otherwise copy only directories matching:
+
+```text
+iSphere
+IMPlatformClient
+IMPlatform
+IMPP
+importal
+```
+
+Place under:
+
+```text
+raw/programdata/
+```
+
+### 5.4 Temp/importal/localcache
+
+High-priority path:
+
+```text
+C:\Users\<logged-in-test-user>\AppData\Local\Temp\importal\
+```
+
+Important names:
+
+```text
+importal\localcache
+LoginLog
+```
+
+Place under:
+
+```text
+raw/temp/importal/
+```
+
+### 5.5 Shortcuts
+
+Copy relevant shortcuts from:
+
+```text
+C:\Users\<logged-in-test-user>\Desktop\
+C:\Users\<logged-in-test-user>\AppData\Roaming\Microsoft\Windows\Start Menu\
+C:\ProgramData\Microsoft\Windows\Start Menu\
+```
+
+Place under:
+
+```text
+raw/shortcuts/
+```
+
+### 5.6 Optional metadata
+
+If convenient, ask the user to include:
+
+```text
+metadata/process-list.txt
+metadata/installed-programs.txt
+metadata/os-version.txt
+metadata/env.txt
+metadata/tree-user-profile.txt
+metadata/tree-install.txt
+metadata/tree-programdata.txt
+```
+
+### 5.7 Copy notes
+
+Ask the user to write:
+
+```text
+notes/copy-notes.txt
+```
+
+Minimal content:
+
+```text
+source sandbox: <name>
+windows user: <test user>
+iSphere manually logged in: yes/no
+client opened before copy: yes/no
+copy time: <time>
+package is from test sandbox: yes
+```
+
+## 6. Everything search keywords
+
+If the user uses Everything, ask them to search these keywords and copy the containing directories:
+
+```text
+iSphere
+IMPlatformClient
+IMPlatform
+IMPP
+importal
+localcache
+LoginLog
+IMPP.Util.dll
+csimlog.dll
+iSphere.exe
+IMPlatformClient.exe
+```
+
+## 7. First action after evidence arrives
+
+Do not run copied executables directly.
+
+First action should be read-only inventory:
+
+```text
+1. Unpack evidence under runs/offline-evidence-intake/<evidence-id>/.
+2. Preserve original tree.
+3. Produce a directory inventory.
+4. Hash key executables and DLLs.
+5. Identify install paths, config files, cache/log/database candidates.
+6. Identify whether LoginLog / importal/localcache exists.
+7. Decide whether local-data discovery is possible from copied files.
+```
+
+Recommended next analysis skills/workstreams:
+
+```text
+comm-app-inventory
+local-data-discovery
+reverse-evidence-report
+```
+
+## 8. Verification commands for current repo
+
+Before handing off or after pulling on a new machine, run:
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File scripts\verify-win-helper.ps1
+powershell -NoProfile -ExecutionPolicy Bypass -File scripts\verify-go-mcp.ps1
+go test ./...
+go build ./cmd/isphere-mcp
+```
+
+Expected high-level result:
+
+```text
+verify-win-helper: ok=true
+verify-go-mcp: ok=true, tool_count=4, helper_name=ISphereWinHelper
+go test: pass
+go build: pass
+```
+
+## 9. Important repository files
+
+```text
+docs/go-mcp-minimal-plan.md
+  Active node plan, now including N12-pre before true N12.
+
+docs/offline-evidence-intake-plan.md
+  Detailed offline artifact intake plan.
+
+docs/go-mcp-runbook.md
+  Operator runbook.
+
+docs/go-csharp-helper-boundary.md
+  Helper protocol and Go/C# boundary.
+
+scripts/verify-win-helper.ps1
+  Builds/verifies C# helper.
+
+scripts/verify-go-mcp.ps1
+  Builds/verifies Go MCP and calls win_helper_version.
+
+native/ISphereWinHelper/
+  C# helper source.
+
+internal/helperclient/
+  Go helper protocol and process client.
+
+internal/mcpserver/
+  Go MCP stdio server skeleton.
+
+internal/tools/
+  Four read-only WinHelper MCP tool registrations.
+```
+
+## 10. Hard boundaries for the next owner
+
+Do not implement these until explicitly planned and approved later:
+
+```text
+search contacts
+open conversation
+send message
+send file
+receive/download file
+automatic login
+process injection
+hook
+memory reading
+security bypass/evasion
+```
+
+Do not treat the offline evidence package as N12 pass.
+
+Do not commit raw copied evidence under `runs/`.
+
+## 11. Current handoff expectation
+
+The next owner should first get the offline evidence package from the user, then perform read-only inventory and report what local files are actually useful.
+
+Only after that should the team decide whether to:
+
+```text
+1. Continue offline local-data discovery.
+2. Ask for a better evidence package.
+3. Wait until current-environment live login becomes possible.
+4. Re-plan true N12.
+```

docs/offline-evidence-intake-plan.md

@@ -0,0 +1,464 @@
+# Offline Evidence Intake Plan
+
+## 1. Conclusion
+
+The current environment cannot log in to iSphere / IMPlatformClient. Therefore the original N12 live gate is still blocked.
+
+The replacement route before N12 is:
+
+```text
+N12-pre: Offline evidence intake
+```
+
+N12-pre now supports two intake modes:
+
+1. **A. Full sandbox artifact bundle (recommended)**
+   - The user does not need to understand JSON.
+   - The user copies the logged-in test sandbox's relevant installation and user-data directories into a structured evidence folder.
+   - This is the preferred route when the user can only log in in another sandbox.
+
+2. **B. Minimal redacted UIA package (optional, advanced users only)**
+   - The user/operator already knows how to run the four read-only helper/MCP operations and produce `manifest.json`, `scan_windows-redacted.json`, and `dump_uia-main-redacted.json`.
+   - This remains useful for controlled UIA-only capture, but it is no longer the default request to the user.
+
+Neither mode is N12 pass. In both cases this is **not N12 pass** because the current repository environment still has not shown a live, manually logged-in iSphere main window through `win_helper_scan_windows` and `win_helper_dump_uia`.
+
+## 2. Scope and boundary source
+
+Boundary documents and implementation facts used by this plan:
+
+- `docs/go-csharp-helper-boundary.md`: Go calls C# helper through `isphere.helper.v1`; the first phase only has four read-only ops.
+- `docs/go-mcp-runbook.md`: current phase exposes four read-only tools and forbids search/send/file/login automation/security-bypass behavior.
+- `native/ISphereWinHelper/Program.cs`: the helper dispatches only `version`, `self_check`, `scan_windows`, and `dump_uia` in the current implementation.
+- `native/ISphereWinHelper/UiaDumper.cs`: `dump_uia` accepts `hwnd`, `max_depth`, `include_text`, and `max_children`.
+- `native/ISphereWinHelper/WindowScanner.cs`: `scan_windows` accepts `include_all_visible`.
+
+Allowed live helper/tool boundary remains exactly:
+
+```text
+version
+self_check
+scan_windows
+dump_uia
+```
+
+N12-pre may include copied files from a separate test sandbox for offline reverse engineering, but it still must not design or perform: send message, send file, receive file, automatic login, injection, hook, target-process memory reading, endpoint-security bypass, stealth, persistence, or security evasion.
+
+## 3. Why original N12 is still not satisfied
+
+Original N12 requires all of the following in the current environment:
+
+1. The user manually opens and logs in to iSphere / IMPlatformClient.
+2. The main iSphere window is visible.
+3. The Go MCP read-only tools run against that live window.
+4. `win_helper_scan_windows` finds the candidate window.
+5. `win_helper_dump_uia` returns a UIA control tree for that current-environment window.
+6. No clicking, typing, sending, uploading, receiving/downloading, automatic login, injection, hook, target-process memory reading, or endpoint-security bypass occurs.
+
+A copied test sandbox bundle does not satisfy N12 because:
+
+- It proves only that files existed in another logged-in sandbox.
+- It does not prove the current helper can see a current logged-in window.
+- It does not produce a current-environment `hwnd`, live process id, or live UIA tree.
+- It supports offline reverse analysis only.
+
+Therefore all copied evidence is N12-pre context and **not N12 pass**.
+
+## 4. Intake mode A: Full sandbox artifact bundle (recommended)
+
+### 4.1 Purpose
+
+Use this mode when the user says: "I can log in in another sandbox and copy files, but I do not know what manifest/scan/dump JSON is."
+
+The user only needs to copy folders. The user does not need to run helper commands, does not need to create JSON, and does not need to understand UIA.
+
+### 4.2 What to copy
+
+Copy from the logged-in test sandbox after normal manual login has succeeded. Preserve the original directory structure as much as possible.
+
+Recommended destination in this repository:
+
+```text
+runs/offline-evidence-intake/<evidence-id>/
+  copy-notes.txt
+  raw/
+    install/
+    user-profile/
+    programdata/
+    shortcuts/
+    temp-importal-localcache/
+    other-candidates/
+  metadata/
+    directory-tree.txt
+    file-list.txt
+    installed-programs.txt
+    process-list.txt
+    services.txt
+    environment.txt
+  notes/
+    operator-notes.txt
+```
+
+Minimum useful bundle:
+
+```text
+runs/offline-evidence-intake/<evidence-id>/
+  copy-notes.txt
+  raw/install/
+  raw/user-profile/
+  raw/programdata/
+  raw/shortcuts/
+  metadata/
+```
+
+Recommended archive format:
+
+```text
+<evidence-id>.zip
+```
+
+or:
+
+```text
+<evidence-id>.7z
+```
+
+### 4.3 Windows candidate paths to collect
+
+The exact install path may differ. Copy every matching candidate that exists in the logged-in test sandbox.
+
+Installation directories:
+
+```text
+C:\Program Files\iSphere\
+C:\Program Files\IMPlatformClient\
+C:\Program Files (x86)\iSphere\
+C:\Program Files (x86)\IMPlatformClient\
+C:\Program Files\IMPP\
+C:\Program Files (x86)\IMPP\
+<custom install path containing iSphere, IMPlatformClient, IMPP, importal>
+```
+
+User data directories:
+
+```text
+%APPDATA%\iSphere\
+%APPDATA%\IMPlatformClient\
+%APPDATA%\IMPP\
+%APPDATA%\importal\
+%LOCALAPPDATA%\iSphere\
+%LOCALAPPDATA%\IMPlatformClient\
+%LOCALAPPDATA%\IMPP\
+%LOCALAPPDATA%\importal\
+%USERPROFILE%\Documents\iSphere\
+%USERPROFILE%\Documents\IMPlatformClient\
+```
+
+Program data directories:
+
+```text
+%PROGRAMDATA%\iSphere\
+%PROGRAMDATA%\IMPlatformClient\
+%PROGRAMDATA%\IMPP\
+%PROGRAMDATA%\importal\
+```
+
+Shortcut locations:
+
+```text
+%USERPROFILE%\Desktop\
+%APPDATA%\Microsoft\Windows\Start Menu\Programs\
+%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\
+```
+
+Temp/cache candidates:
+
+```text
+%TEMP%\importal\
+%TEMP%\importal\localcache\
+%LOCALAPPDATA%\Temp\importal\
+%LOCALAPPDATA%\Temp\importal\localcache\
+C:\Users\<user>\AppData\Local\Temp\importal\localcache\
+```
+
+Historical clues to pay attention to, but not mandatory:
+
+```text
+importal\localcache
+LoginLog
+IMPP.Util.dll
+IMPP.Util.Log.LogSecurityPolicy
+IMPlatformClient
+iSphere
+IMPP
+csimlog.dll
+WriteLog
+```
+
+These names are useful search anchors during offline inventory. They are not a requirement for the user to understand.
+
+### 4.4 Suggested copy layout mapping
+
+Use this mapping when placing copied files into the evidence package:
+
+| Source in test sandbox | Destination in package |
+| --- | --- |
+| iSphere / IMPlatformClient install folder | `raw/install/<original-folder-name>/` |
+| `%APPDATA%` matching folders | `raw/user-profile/AppData/Roaming/<folder-name>/` |
+| `%LOCALAPPDATA%` matching folders | `raw/user-profile/AppData/Local/<folder-name>/` |
+| `%PROGRAMDATA%` matching folders | `raw/programdata/<folder-name>/` |
+| Desktop and Start Menu shortcuts | `raw/shortcuts/<source-location>/` |
+| `%TEMP%\importal` or localcache | `raw/temp-importal-localcache/<source-location>/` |
+| Any extra matching folder | `raw/other-candidates/<short-description>/` |
+
+### 4.5 `copy-notes.txt`
+
+Ask the user to include a simple text file. No JSON required.
+
+Template:
+
+```text
+Evidence ID: <evidence-id>
+Source sandbox: test sandbox, manually logged in
+Capture time: <local time if known>
+iSphere was logged in before copy: yes/no/unknown
+Copied install folders: <brief list>
+Copied user folders: <brief list>
+Copied temp/localcache folders: <brief list>
+Anything missing or unavailable: <brief note>
+This is N12-pre only, not N12 pass.
+```
+
+### 4.6 Metadata folder
+
+The metadata folder is helpful but should stay simple. It can be generated by the sandbox operator or by manually exporting lists.
+
+Suggested files:
+
+```text
+metadata/directory-tree.txt
+metadata/file-list.txt
+metadata/installed-programs.txt
+metadata/process-list.txt
+metadata/services.txt
+metadata/environment.txt
+```
+
+Examples of acceptable metadata content:
+
+- Directory trees for copied folders.
+- File names, sizes, timestamps, and extensions.
+- Installed program names related to iSphere / IMPlatformClient.
+- Process list showing `IMPlatformClient`, `iSphere`, `IMPP`, or `importal` if present.
+- Environment basics such as Windows version and username placeholder.
+
+Metadata is not a tool implementation requirement. If the user cannot produce it, the raw folder bundle is still the priority.
+
+## 5. Intake mode B: Minimal redacted UIA package (optional, advanced)
+
+Use this only if the operator already understands the helper/MCP tools and can produce JSON.
+
+Recommended directory:
+
+```text
+runs/offline-evidence-intake/<evidence-id>/
+  manifest.json
+  scan_windows-redacted.json
+  dump_uia-main-redacted.json
+  version.json                 # optional
+  self_check.json              # optional
+  notes.md                     # optional
+```
+
+Required files:
+
+1. `manifest.json`
+2. `scan_windows-redacted.json`
+3. `dump_uia-main-redacted.json`
+
+Required manifest status:
+
+```text
+offline_pre_only_not_n12_pass
+```
+
+The minimal UIA package may be useful when the operator can call only:
+
+```text
+version
+self_check
+scan_windows
+dump_uia
+```
+
+### 5.1 `manifest.json` simple shape
+
+```json
+{
+  "schema_version": "offline-evidence-intake.v1",
+  "evidence_id": "2026-07-05-sandbox-a",
+  "n12_status": "offline_pre_only_not_n12_pass",
+  "source_environment": "separate_logged_in_test_sandbox",
+  "operations_used": ["version", "self_check", "scan_windows", "dump_uia"],
+  "files": [
+    "manifest.json",
+    "scan_windows-redacted.json",
+    "dump_uia-main-redacted.json"
+  ]
+}
+```
+
+### 5.2 `scan_windows-redacted.json` requirements
+
+Required concept:
+
+- Output derived from `scan_windows`.
+- Include iSphere / IMPlatformClient candidate windows.
+- Preserve process name, class name, visible flag, bounds, and score when available.
+- It is acceptable to replace raw `hwnd` and `pid` with placeholders because they do not work outside the source sandbox.
+
+Example:
+
+```json
+{
+  "schema_version": "offline-evidence-intake.v1",
+  "source_op": "scan_windows",
+  "n12_status": "offline_pre_only_not_n12_pass",
+  "windows": [
+    {
+      "window_id": "win-main-1",
+      "hwnd": "HWND_SOURCE_SANDBOX_1",
+      "pid": "PID_SOURCE_SANDBOX_1",
+      "process_name": "IMPlatformClient",
+      "title": "iSphere main window",
+      "class_name": "WindowsForms10.Window.8.app.example",
+      "visible": true,
+      "bounds": { "x": 0, "y": 0, "width": 1200, "height": 800 },
+      "score": 110,
+      "candidate_role": "main_window"
+    }
+  ]
+}
+```
+
+### 5.3 `dump_uia-main-redacted.json` requirements
+
+Required concept:
+
+- Output derived from `dump_uia`.
+- Preserve tree shape and selector fields: `name`, `control_type`, `automation_id`, `class_name`, `localized_control_type`, `framework_id`, `is_enabled`, `is_offscreen`, `bounds`, `children`, and `truncated_children`.
+- If the operator wants to keep the package small, use `max_depth` and `max_children` limits.
+
+Example:
+
+```json
+{
+  "schema_version": "offline-evidence-intake.v1",
+  "source_op": "dump_uia",
+  "n12_status": "offline_pre_only_not_n12_pass",
+  "window_id": "win-main-1",
+  "hwnd": "HWND_SOURCE_SANDBOX_1",
+  "dump_args": {
+    "max_depth": 8,
+    "include_text": true,
+    "max_children": 80
+  },
+  "root": {
+    "name": "iSphere main window",
+    "control_type": "Window",
+    "automation_id": "",
+    "class_name": "WindowsForms10.Window.8.app.example",
+    "localized_control_type": "window",
+    "framework_id": "WinForm",
+    "is_enabled": true,
+    "is_offscreen": false,
+    "bounds": { "x": 0, "y": 0, "width": 1200, "height": 800 },
+    "children": []
+  }
+}
+```
+
+## 6. What we do after receiving a full bundle
+
+Initial handling is read-only inventory:
+
+1. Keep the uploaded archive or copied folder as the original evidence.
+2. Do not directly run unknown binaries from the bundle.
+3. Do not modify original copied files.
+4. Inventory file names, sizes, timestamps, and directory layout.
+5. Identify candidate config, cache, log, database, DLL, executable, and shortcut files.
+6. Classify readable formats such as JSON, XML, INI, SQLite, plain text, compressed archives, and .NET assemblies.
+7. If a file appears encrypted or proprietary, record the evidence and likely owner DLL/class; do not turn that into automatic login, injection, hook, target-process memory reading, or bypass behavior.
+8. Produce a short offline evidence report listing what exists and which later analysis is safe.
+
+Read-only inventory can inspect file metadata and parse copied files offline. It must not launch the copied client as the user's live client, send messages, transfer files, alter caches, or attempt automatic login.
+
+## 7. Allowed offline analysis
+
+After intake, offline analysis may:
+
+- Build an inventory of installation files, configs, caches, logs, DLLs, shortcuts, and local databases.
+- Identify likely startup entry points and installed executable names.
+- Identify likely log/cache folders such as `importal\localcache` and `LoginLog`.
+- Inspect .NET assembly metadata and strings from copied DLLs, including names like `IMPP.Util.dll`, without modifying the files.
+- Parse readable copied logs/configs/databases in read-only mode.
+- Draft hypotheses for future live UIA capture and selector design.
+
+Offline analysis must not:
+
+- Mark N12 passed.
+- Implement search contacts, open conversation, send message, send file, receive file, automatic login, injection, hook, target-process memory reading, endpoint-security bypass, stealth, persistence, or security evasion.
+- Run unknown copied binaries as part of intake.
+- Modify the original bundle.
+- Use any copied credential-like material to log in or impersonate a user.
+
+## 8. Conditions to enter true N12
+
+True N12 can start only when all of these are true:
+
+1. N11 is accepted.
+2. The current repository environment can manually open and log in to iSphere / IMPlatformClient using the normal approved process.
+3. The current environment shows the main iSphere window visibly.
+4. `scripts\verify-win-helper.ps1` and `scripts\verify-go-mcp.ps1` pass in the current environment.
+5. The operator uses only `win_helper_scan_windows` and `win_helper_dump_uia` against the current visible logged-in window.
+6. The output is saved under `runs\real-loggedin-lab\uia-dumps\`.
+7. No clicking, typing, sending, uploading, receiving/downloading, automatic login, injection, hook, target-process memory reading, or endpoint-security bypass occurs.
+
+If the current environment still cannot log in, only N12-pre offline analysis is allowed. N12 remains blocked and must not be marked passed.
+
+## 9. Coordinator request checklist for the user
+
+Use this final user-facing request. It intentionally avoids asking the user to understand JSON.
+
+```text
+请在能登录 iSphere 的测试沙盒里，先正常手动登录一次，然后把相关文件夹复制出来，打成 zip 或 7z。
+
+放到本仓库时建议路径：
+runs/offline-evidence-intake/<evidence-id>/
+
+推荐目录结构：
+raw/install/                 放安装目录
+raw/user-profile/            放 %APPDATA% 和 %LOCALAPPDATA% 里相关目录
+raw/programdata/             放 %PROGRAMDATA% 里相关目录
+raw/shortcuts/               放桌面和开始菜单快捷方式
+raw/temp-importal-localcache/ 放 %TEMP%\importal 或 localcache 相关目录
+metadata/                    放目录树、文件列表、进程列表等，有就放，没有也可以
+notes/copy-notes.txt         简单写明从哪里复制、是否登录后复制
+
+优先找这些路径或名字：
+- C:\Program Files 或 C:\Program Files (x86) 下包含 iSphere、IMPlatformClient、IMPP、importal 的目录
+- %APPDATA% 下包含 iSphere、IMPlatformClient、IMPP、importal 的目录
+- %LOCALAPPDATA% 下包含 iSphere、IMPlatformClient、IMPP、importal 的目录
+- %PROGRAMDATA% 下包含 iSphere、IMPlatformClient、IMPP、importal 的目录
+- Documents 里相关目录
+- Desktop 和 Start Menu 里的快捷方式
+- %TEMP%\importal\localcache 或类似 localcache 目录
+- 特别关注但不强制：importal\localcache、LoginLog、IMPP.Util.dll、IMPlatformClient、iSphere
+
+要求：
+- 保留原目录结构，最好整体压缩成 zip/7z。
+- 附一个 copy-notes.txt，写明大概复制了哪些目录。
+- 这只是 N12-pre 离线证据，不是 N12 通过。
+- 不需要生成 manifest/scan/dump JSON；那些是高级可选路径。
+- 不要做自动登录、发送消息、发送文件、接收文件、注入、hook、读内存或规避安防。
+```

docs/process/business-manager-review.md

@@ -353,3 +353,59 @@
 - 是否遗漏：无阻塞性遗漏。N11 验证、提交、临时产物清理、Python MCP 缺失确认、无 search/send/file tools 等关键验收已有审查证据；唯一剩余事项是 N11-B 将审查追加的 process docs 精确提交并核对 `git status --short` clean，这属于已批准两段节奏的收尾，不是 N11 业务目标缺口。若 N11-B 后仍非 clean、出现 broad stage、提交 build 产物或出现 N12/业务动作文件，应立即停止并返工。
 - 是否允许进入下一轮：不允许实际进入 N12，停止在 N12 前。原因是当前事实没有用户已手动登录并打开 iSphere 主窗口的前置条件；即使 N11-B 完成 clean，也只能进入“等待用户手动登录/打开 iSphere 并重新发起 N12 执行前审批”的状态，不能自动开始 real logged-in UIA capture。
 - 业务经理结论：批准 N11-A 通过；批准执行 N11-B 最终 process checkpoint 精确提交，提交范围仅限审查阶段追加/修改的 process docs，并由主协调核对 `git status --short` clean。不要求返工，不停止项目本身；但明确不批准实际进入 N12，不得真实采集、不得搜索/发送/文件/自动登录/注入/hook/读内存。N12 必须等待用户手动登录并打开 iSphere 可见主窗口后，再单独提交执行前审批。
+## 2026-07-05 N11 后 / N12 前业务边界变更判断
+
+- 当前节点：N11 已完成后的 N12 前业务边界变更判断；用户说明当前环境无法登录，只能在别的沙盒登录后复制所需文件/证据。本轮只判断业务路线与边界，不进入 N12，不看代码。
+- 本轮目标：
+  - 判断“从别的沙盒复制文件/证据”是否满足原 N12 Real logged-in UIA capture gate。
+  - 判断是否允许新增离线前置节点（建议命名为 N12-pre / offline evidence intake），用于先定义可复制证据包清单、脱敏边界和验收规则。
+  - 明确离线证据包允许/禁止内容，避免密码、token、聊天内容、联系人隐私、发送/文件能力、自动登录、注入、hook、读内存或规避安防。
+  - 判断是否允许当前主会话先给用户一份“需要复制哪些文件/证据”的清单，以及是否立即更新计划文档。
+- 业务判断：从别的沙盒复制文件/证据不满足原 N12。原 N12 的关键前置条件是用户在当前可执行环境手动打开并登录 iSphere，且 iSphere 主窗口可见，然后使用当前 Go MCP 只读工具 `win_helper_scan_windows` / `win_helper_dump_uia` 采集真实窗口 UIA；离线复制证据不能证明当前环境存在可见登录窗口，也不能替代当前环境的实时 UIA capture gate。因此 N12 仍被阻断。但允许新增 N12-pre / offline evidence intake 作为 N12 前置路线，用于接收和审查用户从别的沙盒导出的脱敏证据包，目标是判断是否足以改写后续计划或准备离线分析，不允许把它当作 N12 已通过。
+- 是否跑偏：未跑偏。新增离线前置节点是对“当前环境无法登录”的业务约束适配，仍围绕只读 UIA 证据、窗口/控件识别和后续 selector 设计准备；不允许搜索联系人、打开会话、发送消息、发送/接收文件、自动登录、注入、hook、读内存或规避安防。
+- 是否过度设计：未过度设计。建议先给用户一份最小证据清单和脱敏边界，等待文件到位后再审批/维护正式 N12-pre 计划；当前不需要立即重写大计划或创建复杂 intake 流程，避免在没有证据样本前过度设计。
+- 是否遗漏：需补齐离线证据包清单与边界。允许包含：1) 证据清单 manifest（来源沙盒、采集时间、iSphere/IMPlatform 版本、OS 版本、是否手动登录但不含账号密码）；2) 使用只读方式导出的 `scan_windows` 候选窗口结果；3) 手动登录后主窗口的脱敏 `dump_uia` JSON，字段限于窗口/控件识别所需的 `name`、`control_type`、`automation_id`、`class_name`、`children`、窗口标题/进程名/句柄等元数据；4) 脱敏截图（可选，必须遮挡联系人、头像、聊天内容、账号信息、组织信息和任何个人数据）；5) 安装/版本元数据（可执行文件路径、文件版本、产品版本、哈希、必要资源文件名列表）；6) 采集步骤记录与校验摘要。禁止包含：密码、token、cookie、session、证书、私钥、自动登录材料、联系人列表、聊天消息、文件附件、下载内容、个人资料、原始数据库/缓存、未脱敏日志、内存 dump、进程 dump、抓包、注入/hook/读内存产物、发送/接收文件能力证明或任何可用于绕过登录/安防的数据。
+- 是否允许进入下一轮：不允许实际进入 N12；允许下一步仅进入 N12-pre / offline evidence intake 的准备动作，即主会话可以给用户“需要复制哪些文件/证据”的清单和脱敏要求。收到证据包后，必须先做新的执行前审批，再决定是否更新 `docs/go-mcp-minimal-plan.md` 增加 N12-pre 或改写后续路线；不得直接把离线证据视为 N12 通过。
+- 业务经理结论：N12 不满足，停止在 N12 前；批准离线证据包路线作为 N12 前置补充，不批准真实采集、不批准搜索/发送/文件/自动登录/注入/hook/读内存。当前主会话允许先给用户最小操作清单；本轮不要求立即修改计划文档，等用户证据到位后再审批新节点和必要计划更新。
+## 2026-07-05 N12-pre 离线证据路线设计审查
+
+- 当前节点：N11 后、N12 前的业务边界变更设计审查；审查逆向子智能体新增的 `docs/offline-evidence-intake-plan.md`、`docs/go-mcp-minimal-plan.md` 中的 N12-pre 插入，以及 `docs/go-mcp-runbook.md` 的无法当前环境登录指引。本轮只做业务设计审查，不看代码、不做代码审查、不进入真实 N12。
+- 本轮目标：
+  - 判断 N12-pre Offline evidence intake 是否能在当前环境无法登录的约束下，作为 N12 前置补充路线承接用户从其他沙盒复制的脱敏证据。
+  - 判断该路线是否仍保留原 N12 的 live current-environment UIA capture gate，不把离线证据误判为 N12 pass。
+  - 判断证据包清单、允许/禁止边界、脱敏规则、manifest/scan/dump 三个 required files 是否足够清晰。
+  - 判断是否允许主协调基于文档向用户提出文件/证据包要求，以及这些文档是否应立即提交。
+- 业务判断：通过。新的 N12-pre 路线符合业务目标：它承认当前环境无法登录的现实，给出可复制、可脱敏、可验证形状的离线证据包路线，同时明确 `offline_pre_only_not_n12_pass`，不把离线证据等同于原 N12。required files 聚焦 `manifest.json`、`scan_windows-redacted.json`、`dump_uia-main-redacted.json`，与后续 UI 结构/selector 可行性分析直接相关，交付价值明确。
+- 是否跑偏：未跑偏。文档明确 N12-pre 只能使用 `version/self_check/scan_windows/dump_uia` 四个只读 op，禁止 password/token/cookie/session/contact/chat/attachment/raw db/cache/memory dump/packet capture/hook/injection/read memory，也禁止搜索联系人、打开会话、发送消息、发送/接收文件、自动登录和规避安防；计划仍保留原 N12 必须当前环境手动登录并 live UIA capture 的条件。
+- 是否过度设计：未过度设计。相较此前“只要几个文件”的粗略清单，当前 manifest schema、redaction rules、required-file checks 和 repository-side validation 是必要的业务边界设计，用于防止用户复制敏感数据或误把离线证据当作 N12 通过。当前仍停留在文档和清单层，没有新增工具、验证器、代码或脚本，因此没有过度工程化。
+- 是否遗漏：无阻塞性遗漏。文档已覆盖 N12-pre 定位、三类必需文件、可选文件、禁止内容、脱敏规则、保存路径、校验方式、离线分析允许/禁止范围，以及进入真正 N12 的条件。非阻塞建议：主协调对用户输出时应使用简化版清单，强调“先脱敏再复制”和“离线包不等于 N12 通过”；收到证据后仍需单独做 N12-pre 执行前审批/验收审查。
+- 是否允许进入下一轮：允许主协调基于该文档向用户提出文件/证据包要求；不允许进入真实 N12，不允许真实采集，不允许搜索/发送/文件/自动登录/注入/hook/读内存。建议下一步只是向用户确认能否按清单提供脱敏证据包，并等待文件到位后再审批 N12-pre intake。
+- 业务经理结论：批准 N12-pre 离线证据路线设计；允许主协调向用户提出 evidence package 要求。提交节奏上，不建议立即提交这些文档；建议先让用户确认清单是否可提供、是否存在必须调整的字段，确认后再做一次精确的 N12-pre docs checkpoint 提交。若用户确认无调整，则提交范围应仅限相关文档和过程日志，不得混入代码、脚本、真实证据或构建产物。
+## 2026-07-05 N12-pre full sandbox artifact bundle 路线审查
+
+- 当前节点：N11 后、N12 前的 N12-pre 离线证据接入路线扩大审查；审查逆向子智能体将 N12-pre 调整为两种 intake 模式后的业务合理性。本轮只做业务设计审查，不看代码、不做代码审查、不进入真实 N12。
+- 本轮目标：
+  - 判断推荐模式 A：Full sandbox artifact bundle 是否能解决用户“不懂 manifest/scan/dump JSON，只能复制登录后测试沙盒文件”的现实问题。
+  - 判断模式 B：Minimal redacted UIA package 是否仍可作为高级可选路线保留。
+  - 判断新路线是否仍明确 not N12 pass，且后续处理只做 read-only inventory，不直接运行未知二进制、不修改原始拷贝文件。
+  - 判断是否允许主协调现在给用户一份“复制完整测试沙盒证据包”的简化清单，以及是否继续暂不提交，等待用户确认可提供哪些目录后再 checkpoint。
+- 业务判断：通过。Full sandbox artifact bundle 路线符合当前业务目标：用户无法在当前环境登录且不理解 JSON，要求“从长计议”并复制登录后的测试沙盒安装文件和用户目录；推荐用户只复制目录，比继续要求 manifest/scan/dump 更可执行。文档将 install、user profile、ProgramData、shortcuts、TEMP/importal/localcache 等目录纳入结构化证据包，并特别提示 `importal\localcache`、`LoginLog`、`IMPP.Util.dll` 等线索，有助于后续只读清点、离线分析和设计后续路线。
+- 是否跑偏：未跑偏。文档明确 full bundle 仍是 N12-pre，不是 N12 pass；N12 仍要求当前环境手动登录和 live UIA capture。文档也明确收到后先做 read-only inventory，不直接运行未知二进制，不把测试沙盒文件用于自动登录，不设计搜索联系人、打开会话、发送消息、发送/接收文件、注入、hook、读内存或规避安防能力；`git diff --name-only -- '*.go' '*.cs' 'scripts/*.ps1'` 无输出，说明本轮未改代码/脚本。
+- 是否过度设计：未过度设计。相比之前只要求 JSON 的路线，full bundle 模式更贴合用户实际能力；目录分区、copy-notes、metadata、raw/install、raw/user-profile、raw/programdata、raw/temp-importal-localcache 是为了让非技术用户能复制，同时让后续清点可控。保留 minimal redacted UIA package 作为高级可选不会增加执行负担，也避免丢失原先 UIA 证据路线。
+- 是否遗漏：无阻塞性遗漏。已覆盖两种 intake 模式、推荐路线、目录结构、关键候选路径、not N12 pass、read-only inventory、禁止运行未知二进制、禁止修改原始证据、禁止自动登录/发送/文件/注入/hook/读内存/规避安防。非阻塞补充要求：主协调给用户清单时应强调这是“测试沙盒证据包”，不要提交 raw evidence 到 Git；如果压缩包内有真实个人/生产数据，应先说明并隔离处理；收到后需先做 N12-pre 执行前审批和只读 inventory 审查。
+- 是否允许进入下一轮：允许主协调向用户给出“复制完整测试沙盒证据包”的简化清单；不允许进入真实 N12，不允许开始真实采集，不允许运行或使用复制来的未知二进制，不允许基于复制文件实现搜索/发送/文件/自动登录/注入/hook/读内存。下一步应只是让用户确认能提供哪些目录/压缩包，并等待证据到位或用户反馈后再决定 N12-pre intake 审批。
+- 业务经理结论：批准 full sandbox artifact bundle 路线；允许主协调现在给用户简化清单。提交节奏上，继续暂不提交这些文档，先让用户确认可提供哪些目录和是否有压缩包；确认后再做精确 N12-pre docs checkpoint。后续提交范围应仅限相关文档和过程日志，不得提交 raw 证据包、代码、脚本或构建产物。
+## 2026-07-05 N12-pre 完整测试沙盒包扩大清单判断
+
+- 当前节点：N11 后、N12 前的 N12-pre 离线证据接入边界扩大判断；用户补充“我拥有完整权限”，且说明当前材料均为测试文件。本轮只做业务边界判断，不看代码、不做代码审查、不进入真实 N12。
+- 本轮目标：
+  - 判断是否允许把用户复制清单从“相关目录优先”升级为“完整测试沙盒包优先”。
+  - 判断是否允许主协调给用户最终清单：完整复制 `C:\Users\<登录用户>`、安装目录、`C:\ProgramData` 相关或完整副本、`C:\Users\<用户>\AppData\Local\Temp\importal`、快捷方式、进程/版本/目录树元数据，并建议压缩为 zip/7z。
+  - 明确保留边界：离线包不是 N12 pass；收到后先做 read-only inventory；不直接运行未知二进制；不进入发送/文件/自动登录/注入/hook/读内存。
+  - 判断是否需要现在更新文档，还是等用户提供包后再 checkpoint。
+- 业务判断：允许扩大清单。用户已明确拥有完整权限且材料是测试文件，在业务上可以将 N12-pre 的推荐输入升级为“完整测试沙盒包优先”，因为完整用户目录和完整/相关 ProgramData 更能保留登录后运行环境、缓存、配置、日志、快捷方式和版本线索，降低用户漏拷关键目录的风险，也比要求用户识别 JSON 或具体应用目录更可执行。
+- 是否跑偏：未跑偏。该扩大只改变 N12-pre 证据包收集范围，不改变 N12 通过条件；完整测试沙盒包仍是 offline pre evidence，不等于当前环境 live UIA capture。收到后只能做 read-only inventory 和离线分析，不得直接运行未知二进制，不得把包内 credential-like/test session 材料用于登录或冒充用户，不得实现搜索联系人、打开会话、发送消息、发送/接收文件、自动登录、注入、hook、读内存或规避安防。
+- 是否过度设计：未过度设计。对非技术用户而言，“完整测试沙盒包优先”比逐项筛选相关目录更简单，且能避免关键 AppData/ProgramData/Temp/importal/localcache 漏拷；压缩为 zip/7z、附目录树/进程/版本元数据属于必要交付包装，不是功能扩张。后续只读 inventory 再决定哪些文件有分析价值，能减少前期沟通成本。
+- 是否遗漏：无阻塞性遗漏。最终清单应至少包括：1) 完整 `C:\Users\<登录用户>` 测试用户目录；2) iSphere/IMPlatformClient 安装目录；3) `C:\ProgramData` 中相关目录，若用户确认都是测试环境且体积可接受，可提供完整 `C:\ProgramData` 副本；4) `C:\Users\<用户>\AppData\Local\Temp\importal`、`importal\localcache`、`LoginLog` 等 Temp/cache 线索；5) 桌面和开始菜单快捷方式；6) 必要系统元数据，如目录树、文件列表、文件版本/哈希、运行进程列表、安装程序列表、OS 版本、环境变量摘要。仍需强调 raw evidence 不提交 Git，进入仓库后应放在 `runs/offline-evidence-intake/<evidence-id>/` 或由主协调指定的非提交证据位置。
+- 是否允许进入下一轮：允许主协调向用户发出最终“完整测试沙盒包优先”清单；不允许进入真实 N12，不允许运行复制来的未知二进制，不允许开始发送/文件/自动登录/注入/hook/读内存能力。用户提供包后，应先做 N12-pre intake 执行前审批与只读 inventory 计划，再开展文件清点。
+- 业务经理结论：批准将复制清单扩大为完整测试沙盒包优先。当前不建议立即更新/提交文档；先让用户按最终清单提供或确认可提供哪些目录，等证据包到位或用户确认后，再按实际情况做精确 docs checkpoint。若后续更新文档，提交范围只能是相关文档和过程日志，不能提交 raw 测试证据包、代码、脚本或构建产物。

docs/process/csharp-helper-log.md

@@ -38,3 +38,19 @@
 - 关键输出：
   - `{"ok":true,"configuration":"Release","platform":"anycpu","csc":"C:\\WINDOWS\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","source_dir":"E:\\coding\\codex\\isphere-ai-bridge\\native\\ISphereWinHelper","output":"E:\\coding\\codex\\isphere-ai-bridge\\runs\\win-helper\\ISphereWinHelper.exe"}`
   - `{"ok":true,"helper":"E:\\coding\\codex\\isphere-ai-bridge\\runs\\win-helper\\ISphereWinHelper.exe","version":"0.1.0","scan_window_count":30,"uia_available":true}`
+
+## 2026-07-05 19:45:57 +08:00 - N12-pre offline evidence intake route design
+
+- 当前 helper 状态：未变更；本轮只确认现有 helper 边界仍为 `version` / `self_check` / `scan_windows` / `dump_uia` 四个只读 op。
+- 是否修改 C# 文件：否。
+- 验证命令：未运行 helper 构建/验证；本轮为文档设计与边界复核，读取 `docs/go-csharp-helper-boundary.md`、`docs/go-mcp-runbook.md`、`native/ISphereWinHelper/Program.cs`、`UiaDumper.cs`、`WindowScanner.cs` 确认 op 与参数。
+- 验证结果：新增 `docs/offline-evidence-intake-plan.md`，并在 `docs/go-mcp-minimal-plan.md` 中把离线证据接入定义为 `N12-pre`，明确不替代 real logged-in UIA capture gate；`docs/go-mcp-runbook.md` 增加“当前环境无法登录”指引。
+- 是否保持只读边界：是；未写 Go/C# 功能代码，未创建新 MCP server/tools，未修改 helper 行为，未进入真实 N12，未采集真实 iSphere 登录 UIA，未点击、输入、发送、上传、下载，未设计搜索联系人、打开会话、发送消息、发送/接收文件、自动登录、注入、hook、读内存或规避安防能力。
+
+## 2026-07-05 21:31:11 +08:00 - N12-pre full sandbox artifact bundle update
+
+- 当前 helper 状态：未变更；本轮只更新离线证据接入设计，helper 仍保持 `version` / `self_check` / `scan_windows` / `dump_uia` 四个只读 op 边界。
+- 是否修改 C# 文件：否。
+- 验证命令：未运行 helper 构建/验证；本轮为文档更新与边界复核。
+- 验证结果：`docs/offline-evidence-intake-plan.md` 已调整为两个 intake 模式：A. Full sandbox artifact bundle（推荐，用户只复制目录，不要求理解 JSON）；B. Minimal redacted UIA package（可选，高级用户）。`docs/go-mcp-minimal-plan.md` 和 `docs/go-mcp-runbook.md` 已同步说明 full bundle 是 N12-pre，不等同 N12 通过。
+- 是否保持只读边界：是；未写 Go/C# 功能代码，未创建新工具，未修改 helper 行为，未进入真实 N12，未真实采集 iSphere 登录 UIA，未设计发送消息、发送文件、接收文件、自动登录、注入、hook、读内存或规避安防能力。