Live proof queue
Last mile proof for the remaining Flow 4%
Product and runtime surfaces are green. This queue shows the exact outside evidence still needed before Flow can honestly move from production-ready to production-proven.
Current decision
96.2% ready, external proof still open
Nothing in this queue should be marked green from internal code alone. Each lane needs a real artifact, credential, transaction, traffic sample or independent sign-off.
5
proof lanes
5
external pending
0
false greens allowed
Latest executor run
external_pending
Last run: 2026-07-20T14:08:00Z. Artifact: reports/flow-release/external-proof-executor.json.
4
passed
1
external pending
0
failed
Current blocker
CI secrets before ring proof
Required auth secrets missing for 2 release rings.
Queue lanes
Exact inputs, commands and pass rules
CI ring proof
Input: FLOW_SMOKE_BEARER_TOKEN or FLOW_SMOKE_COOKIE for staging and production.
Command: gate:flow:release-governor + gate:flow:release-ultimate-gate
Artifact: release-governor and ultimate-gate output per ring
Pass rule: Both staging and production rings pass with archived output and no manual bypass.
Blocker: CI auth secrets are not configured yet.
Kustom paid proof
Input: Kustom merchant mode, checkout reference, paid reference and one recovery/refund/adjustment event.
Command: flow-paid-happy-path-live.ps1 + Kustom report publish
Artifact: signed Kustom report with provider reference and admin sign-off
Pass rule: Checkout, payment verification, reconciliation and recovery are traceable in Flow.
Blocker: Final provider transaction proof depends on enabled merchant lane.
Connector replay proof
Input: Tenant-approved HubSpot/helpdesk/PMS credential plus scoped replay fixture.
Command: connector staging verification + replay evidence export
Artifact: setup, webhook replay, external id, internal id, reconciliation and SLA proof
Pass rule: At least one CRM/helpdesk/PMS lane proves create, update/replay and reconciliation.
Blocker: Real tenant/provider credentials are not available in CI.
Live KPI proof
Input: Real lead, booking and paid events from one pilot tenant.
Command: weekly KPI targets + live KPI proof export
Artifact: lead to booking to paid funnel completeness, conversion and source proof
Pass rule: Funnel completeness is at least 98% for the pilot cohort with no missing attribution gap.
Blocker: Requires real customer traffic.
Independent security review
Input: Pentest scope, tester, findings, fix owner, retest result and signed closure.
Command: security closure + pentest pack export
Artifact: security review report with findings, fixes, retest and owner sign-off
Pass rule: No critical/high open findings; medium findings have accepted owners and due dates.
Blocker: Needs independent review or customer security sign-off.
Launch order
The only honest route to 100%
- Configure CI auth secrets without exposing them in artifacts.
- Run ring gates for staging and production and archive the outputs.
- Run one pilot tenant through install, first lead, proposal, signature and payment.
- Run one connector replay with tenant-approved credentials.
- Close pentest/security review with retest evidence.
Operator rule
Stop building dashboards. Collect proof.
The next meaningful progress is not another internal page. It is one real pilot tenant, one real payment reference, one connector replay and one security review result archived into these lanes.