Proof intake
This is the operator intake sheet for the last mile: CI ring credentials, Kustom references, connector credentials, live KPI events and independent security review. It keeps the team from collecting vague screenshots that cannot unblock release.
Current state
Latest executor decision is external_pending. The current blocker is:
Required auth secrets missing for 2 release rings.
Evidence form
Collect: FLOW_SMOKE_BEARER_TOKEN or FLOW_SMOKE_COOKIE for staging and production.
Archive: release-governor and ultimate-gate output per ring
Pass rule: Both staging and production rings pass with archived output and no manual bypass.
Current blocker: CI auth secrets are not configured yet.
Platform / DevOps
external-infra-pending
gate:flow:release-governor + gate:flow:release-ultimate-gate
Collect: Kustom merchant mode, checkout reference, paid reference and one recovery/refund/adjustment event.
Archive: signed Kustom report with provider reference and admin sign-off
Pass rule: Checkout, payment verification, reconciliation and recovery are traceable in Flow.
Current blocker: Final provider transaction proof depends on enabled merchant lane.
Finance Ops
provider-proof-pending
flow-paid-happy-path-live.ps1 + Kustom report publish
Collect: Tenant-approved HubSpot/helpdesk/PMS credential plus scoped replay fixture.
Archive: setup, webhook replay, external id, internal id, reconciliation and SLA proof
Pass rule: At least one CRM/helpdesk/PMS lane proves create, update/replay and reconciliation.
Current blocker: Real tenant/provider credentials are not available in CI.
Integrations
tenant-credential-pending
connector staging verification + replay evidence export
Collect: Real lead, booking and paid events from one pilot tenant.
Archive: lead to booking to paid funnel completeness, conversion and source proof
Pass rule: Funnel completeness is at least 98% for the pilot cohort with no missing attribution gap.
Current blocker: Requires real customer traffic.
Revenue Ops
live-traffic-pending
weekly KPI targets + live KPI proof export
Collect: Pentest scope, tester, findings, fix owner, retest result and signed closure.
Archive: security review report with findings, fixes, retest and owner sign-off
Pass rule: No critical/high open findings; medium findings have accepted owners and due dates.
Current blocker: Needs independent review or customer security sign-off.
Security
external-review-pending
security closure + pentest pack export
Guardrails
Execution order
KPI targets
Threshold: 100% in staging and production
Run release ultimate gate per ring after CI auth secrets are configured.
Threshold: >= 0.95
Archive control-plane verification output and compare against the weekly target.
Threshold: <= configured threshold
Use release-ring evidence to track p95 duration across planned runs.
Threshold: >= 99%
Run webhook replay against first-class connectors and archive pass/fail counts.
Threshold: >= 98%
Measure lead to booking to paid attribution completeness from live customer traffic.