# Flow Live Proof Queue

Decision: 96.2% ready, external proof still open.

## Latest executor run
- GeneratedAt: 2026-07-20T14:08:00Z
- Overall: external_pending
- Passed: 4
- External pending: 1
- Failed: 0
- TODO progress: 387/402 (96.3%)
- Current blocker: Required auth secrets missing for 2 release rings.
- Artifact: `reports/flow-release/external-proof-executor.json`
- Receipt: `reports/flow-release/live-proof-queue-receipt.json`
- Source command: `scripts/flow-external-proof-executor-live.ps1`

## Queue lanes

### CI ring proof
- Owner: Platform / DevOps
- State: external-infra-pending
- Input: FLOW_SMOKE_BEARER_TOKEN or FLOW_SMOKE_COOKIE for staging and production.
- Command: `gate:flow:release-governor + gate:flow:release-ultimate-gate`
- Artifact: release-governor and ultimate-gate output per ring
- Pass rule: Both staging and production rings pass with archived output and no manual bypass.
- Blocker: CI auth secrets are not configured yet.

### Kustom paid proof
- Owner: Finance Ops
- State: provider-proof-pending
- Input: Kustom merchant mode, checkout reference, paid reference and one recovery/refund/adjustment event.
- Command: `flow-paid-happy-path-live.ps1 + Kustom report publish`
- Artifact: signed Kustom report with provider reference and admin sign-off
- Pass rule: Checkout, payment verification, reconciliation and recovery are traceable in Flow.
- Blocker: Final provider transaction proof depends on enabled merchant lane.

### Connector replay proof
- Owner: Integrations
- State: tenant-credential-pending
- Input: Tenant-approved HubSpot/helpdesk/PMS credential plus scoped replay fixture.
- Command: `connector staging verification + replay evidence export`
- Artifact: setup, webhook replay, external id, internal id, reconciliation and SLA proof
- Pass rule: At least one CRM/helpdesk/PMS lane proves create, update/replay and reconciliation.
- Blocker: Real tenant/provider credentials are not available in CI.

### Live KPI proof
- Owner: Revenue Ops
- State: live-traffic-pending
- Input: Real lead, booking and paid events from one pilot tenant.
- Command: `weekly KPI targets + live KPI proof export`
- Artifact: lead to booking to paid funnel completeness, conversion and source proof
- Pass rule: Funnel completeness is at least 98% for the pilot cohort with no missing attribution gap.
- Blocker: Requires real customer traffic.

### Independent security review
- Owner: Security
- State: external-review-pending
- Input: Pentest scope, tester, findings, fix owner, retest result and signed closure.
- Command: `security closure + pentest pack export`
- Artifact: security review report with findings, fixes, retest and owner sign-off
- Pass rule: No critical/high open findings; medium findings have accepted owners and due dates.
- Blocker: Needs independent review or customer security sign-off.

## Launch order
1. Configure CI auth secrets without exposing them in artifacts.
2. Run ring gates for staging and production and archive the outputs.
3. Run one pilot tenant through install, first lead, proposal, signature and payment.
4. Run one connector replay with tenant-approved credentials.
5. Close pentest/security review with retest evidence.