# Flow Proof Intake

- Current progress: 387/402 (96.3%)
- Executor status: external_pending
- Current blocker: Required auth secrets missing for 2 release rings.
- Receipt: `reports/flow-release/live-proof-queue-receipt.json`

## Evidence lanes

### CI ring proof
- Owner: Platform / DevOps
- State: external-infra-pending
- Collect: FLOW_SMOKE_BEARER_TOKEN or FLOW_SMOKE_COOKIE for staging and production.
- Archive: release-governor and ultimate-gate output per ring
- Command: `gate:flow:release-governor + gate:flow:release-ultimate-gate`
- Pass rule: Both staging and production rings pass with archived output and no manual bypass.
- Blocker: CI auth secrets are not configured yet.

### Kustom paid proof
- Owner: Finance Ops
- State: provider-proof-pending
- Collect: Kustom merchant mode, checkout reference, paid reference and one recovery/refund/adjustment event.
- Archive: signed Kustom report with provider reference and admin sign-off
- Command: `flow-paid-happy-path-live.ps1 + Kustom report publish`
- Pass rule: Checkout, payment verification, reconciliation and recovery are traceable in Flow.
- Blocker: Final provider transaction proof depends on enabled merchant lane.

### Connector replay proof
- Owner: Integrations
- State: tenant-credential-pending
- Collect: Tenant-approved HubSpot/helpdesk/PMS credential plus scoped replay fixture.
- Archive: setup, webhook replay, external id, internal id, reconciliation and SLA proof
- Command: `connector staging verification + replay evidence export`
- Pass rule: At least one CRM/helpdesk/PMS lane proves create, update/replay and reconciliation.
- Blocker: Real tenant/provider credentials are not available in CI.

### Live KPI proof
- Owner: Revenue Ops
- State: live-traffic-pending
- Collect: Real lead, booking and paid events from one pilot tenant.
- Archive: lead to booking to paid funnel completeness, conversion and source proof
- Command: `weekly KPI targets + live KPI proof export`
- Pass rule: Funnel completeness is at least 98% for the pilot cohort with no missing attribution gap.
- Blocker: Requires real customer traffic.

### Independent security review
- Owner: Security
- State: external-review-pending
- Collect: Pentest scope, tester, findings, fix owner, retest result and signed closure.
- Archive: security review report with findings, fixes, retest and owner sign-off
- Command: `security closure + pentest pack export`
- Pass rule: No critical/high open findings; medium findings have accepted owners and due dates.
- Blocker: Needs independent review or customer security sign-off.

## Guardrails
- Never paste secrets into notes, tickets, screenshots or public artifacts.
- Every provider proof needs a provider reference, Flow internal id and owner sign-off.
- Every pilot KPI claim needs tenant, source, timestamp and funnel-stage evidence.
- Security review evidence must include scope, findings, remediation, retest and accepted residual risk.
- A lane can be marked complete only when its artifact can be rerun or independently reviewed.

## Launch order
1. Configure CI auth secrets without exposing them in artifacts.
2. Run ring gates for staging and production and archive the outputs.
3. Run one pilot tenant through install, first lead, proposal, signature and payment.
4. Run one connector replay with tenant-approved credentials.
5. Close pentest/security review with retest evidence.