Readiness and completion gates
The staged engineering deliverables and exact evidence still required before the system can be called fully working.
Contract freeze before parallel implementation
Opus 5 lead review and two Sonnet reviews requested revisions on 2026-09-13. These were tool-free reviews of bounded source summaries, not independent runtime validation. Their model identities were verified; their verdicts do not authorize spending or database changes.
Gate 0: reconcile the historical missing-RPC claim with current scoped read-only evidence; version the plan, receipt, ledger states and refusal codes; inventory supported/parked capabilities. The lead must approve this shared contract before the two implementation lanes modify it concurrently.
Then give the data/API owner the manifest → plan → ledger → stored outcome/receipt path, and the verification owner the independent journey oracle, report assertions and eval cases. Shared schema changes return to the lead; avoid two workers silently defining different receipts.
No-spend acceptance and live acceptance are separate gates. Recorded fixtures and isolated local storage can prove contracts and recovery without paid collection. They cannot prove live provider charges or authorize the next purchase. A future single funded run requires a fresh quote and exact owner approval; a smaller Snapshot rehearsal is a proposal, not an authorized additional run.
Milestones
| Milestone | Deliverable | Exit evidence |
|---|---|---|
| 1. Understand the actual system | Field dictionary, route/provider map, database relationships, supported/parked matrix and source-linked Fumadocs. | Each relevant transition has an owner, schema and coverage status; unknowns are explicit. |
| 2. Reproduce and repair the failure | Measured Deep-size queue reproduction, checkpoint fix, truthful skipped stages and retained run evidence. | Real storage/process-boundary reproduction passes independently at representative maximum size. |
| 3. Make correctness measurable | One coherent journey harness, failure injection and calibrated AI evals where applicable. | Source-bound reports prove hard invariants and reveal incomplete outcomes instead of averaging them away. |
| 4. Prove approved live acceptance | Fresh authenticated quotes, reviewed exact plan/cap, one approved funded run and retained report/receipt. | Modules, groups, counts, sources, provider charges, account changes and customer ledger reconcile. |
| 5. Hand off a working system | Current docs, reproducible runbook, independently rerun proof and aligned project tracking. | An operator can run and inspect the system; unresolved requirements block full completion. |
Known gaps from the current inspection
| Gap | Evidence level | Next action |
|---|---|---|
| Funded Deep attempt failed during a large in-progress SEO checkpoint | Current authenticated attempt: pull 7adc7273-afdb-4566-b39b-4b0ceefa8d20; isolated provider delta $0.447132; terminal reason supabase_transport_failed; no execution receipt or customer debit. | Verify the checksummed in-progress compression repair against recovered retained state, then require a new quote and cap before any second funded attempt. |
| Quote readiness previously accepted empty scope and stale price evidence | Repaired locally with refusal tests. Authenticated no-spend Snapshot/Market/Deep quotes returned 200 against manifest 9d41aa65, but later receipt/account-observation work changed the current manifest to 312ccd6a and deliberately invalidated those hashes. | Keep the empty-selection and 30-day/future-skew price-basis refusals in the release suite. Require a fresh authenticated quote for the current manifest before any future execution approval. |
| Account balance observation is implemented but funded reconciliation is not proven | Current source records selected billed-provider balances before dispatch and after stages settle, and labels shared-account movement as unattributed. The retained failed Deep run predates a complete execution receipt. | Recover the retained run and reconcile request-level costs, provider observations and customer credits without assuming shared-account delta equals one invoice. |
| Deletion removed evaluation evidence | Historical receipt plus source SQL cascade relationship. | Retain evaluation identity and rows until reconciliation is archived and independently verified. |
| Historical missing-RPC blocker is closed by a current read-only check | 2026-09-13: current schema contains the function; readCompleteCreditLedger returned passed with row_count=0 for a non-customer all-zero UUID, using one live read and no writes. | Do not reapply the old migration. Continue checkpoint/recovery work; this probe does not prove real customer balances or funded-run acceptance. |
| Checkpoint repairs and one coherent no-spend journey pass locally; the whole funded journey remains unproven | Focused codec, compaction, selected-plan queue and PostgreSQL proofs pass. A controlled authenticated quote-to-report-to-export harness also passes with zero provider spend and exactly one customer-credit debit. The funded public-seam run still failed before report finalization. | Recover and reconcile the retained run, prove data-plane stability, then run the full public-seam acceptance only under a new explicit numeric cap. |
| Repository declarations are indexed; runtime field-contract coverage remains incomplete | Fumadocs now regenerates every API route declaration, checked-in JSON Schema and all ten Brand Studio Supabase SQL sources with exact declarations. This does not prove deployed schema parity or runtime validation of inline JavaScript/provider shapes. | Complete nested provider/normalized schemas and machine-readable public API contracts, then compare the intended project live schema read-only against the checked-in database reference. |
Final acceptance checklist
PASS only when the whole required scope works at the declared target: authenticated quote, matching approved plan, complete collection, validated storage, grounded analysis, saved report, reload/export and reconciled receipt.
Every selected module and group has the expected target and quantities, or an explicit bounded/source-exhaustion explanation. A failed required module cannot be relabeled complete because other modules succeeded.
Failures preserve evidence, budget uncertainty and honest progress. Parked work never appears as running. Restart or re-poll does not authorize another purchase.
Independent proof uses a distinct run/lineage and reproduces the exercised source manifest. Documentation, schemas, model verdicts and unit tests are supporting evidence, not the final outcome.
Keep the goal active while live acceptance or any required evidence is missing. Approval is a boundary before the specific consequential operation, not a reason to leave safe local preparation unfinished.