logan/server-26
1
0
Fork 0
Code Issues 84 Pull Requests Actions Packages Projects Releases Wiki Activity

Gate A: awaiting owner sign-off to close - public price (a1bdccf) and the A2 disclaimer (b722223) are both shipped and live #46

New Issue
Open
opened 2026-08-23 17:33:10 -04:00 by logan · 5 comments
logan commented 2026-08-23 17:33:10 -04:00
Owner
Copy Link
Copy Source

Board minutes #42 (2026-08-23) - Ratify BUSINESS_MODEL.md. - Gate A. Blocks putting any section 3 price on a public surface. Decision 6 is due independently of pricing.

Claims audit from the CMO (#41), cross-checked against ADMIN_BILLING_AUDIT.md §2:

Claim Reality
$0 / $79 / custom (lib/billing.ts PLANS) Invented. BUSINESS_MODEL.md §3.1 explicitly marks it superseded. Zero backend billing routes; createCheckoutSession / createBillingPortalSession always throw (#3)
Retention 7 / 90 / 365 days Not built - see the Gate B4 issue
Enterprise SSO/SAML, uptime SLA, custom data residency No backend exists for any of these. Most dangerous if it reaches a real "Contact sales" conversation
AI summaries read "like a dispatch briefing" Shipped and live, with no "machine-generated, unverified" label anywhere and no name redaction on public surfaces

Ruled (minutes #42 Decisions 4 and 6):

  • A1. Every entitlement claimed on a page is either built, or carries an inline "not yet available" marker on the same screen as the claim - not a bottom-of-page footnote. The existing disclaimer sits below the fold and does not satisfy this.
  • A2. Every AI transcript and AI summary surface carries "Machine-generated, unverified. Not a substitute for 911 or official dispatch."
  • A3. Person names redacted by default on all free and public surfaces (backend half tracked in the Gate B3 issue).
  • Pricing comes off the public site entirely, replaced with "Pricing in development - contact us". The CMO alternative (keep the placeholder plus its disclaimer) was overruled: the number is not merely unwired, it is invented, and a false anchor with a footnote is a worse artefact than an empty page.

The code comment above PLANS in lib/billing.ts read "this is real UI copy (safe to ship)". It is not safe to ship; that comment was corrected in place during the board session. The rest of this issue is the actual work.

Owner: CMO (copy), CTO (implementation). Date: 2026-09-13.
Related: #3, ADMIN_BILLING_AUDIT.md §2, minutes #42 Decisions 4 and 6.

Board minutes #42 (2026-08-23) - Ratify BUSINESS_MODEL.md. - **Gate A. Blocks putting any section 3 price on a public surface. Decision 6 is due independently of pricing.** Claims audit from the CMO (#41), cross-checked against `ADMIN_BILLING_AUDIT.md` §2: | Claim | Reality | |---|---| | `$0 / $79 / custom` (`lib/billing.ts` `PLANS`) | **Invented.** `BUSINESS_MODEL.md` §3.1 explicitly marks it superseded. Zero backend billing routes; `createCheckoutSession` / `createBillingPortalSession` always throw (#3) | | Retention 7 / 90 / 365 days | Not built - see the Gate B4 issue | | Enterprise SSO/SAML, uptime SLA, custom data residency | No backend exists for any of these. Most dangerous if it reaches a real "Contact sales" conversation | | AI summaries read "like a dispatch briefing" | Shipped and live, with **no** "machine-generated, unverified" label anywhere and **no** name redaction on public surfaces | **Ruled (minutes #42 Decisions 4 and 6):** - **A1.** Every entitlement claimed on a page is either built, or carries an inline "not yet available" marker **on the same screen as the claim** - not a bottom-of-page footnote. The existing disclaimer sits below the fold and does not satisfy this. - **A2.** Every AI transcript and AI summary surface carries **"Machine-generated, unverified. Not a substitute for 911 or official dispatch."** - **A3.** Person names redacted by default on all free and public surfaces (backend half tracked in the Gate B3 issue). - **Pricing comes off the public site entirely**, replaced with "Pricing in development - contact us". The CMO alternative (keep the placeholder plus its disclaimer) was **overruled**: the number is not merely unwired, it is invented, and a false anchor with a footnote is a worse artefact than an empty page. The code comment above `PLANS` in `lib/billing.ts` read "this is real UI copy (safe to ship)". It is not safe to ship; that comment was corrected in place during the board session. The rest of this issue is the actual work. Owner: CMO (copy), CTO (implementation). Date: **2026-09-13**. Related: #3, `ADMIN_BILLING_AUDIT.md` §2, minutes #42 Decisions 4 and 6.
logan commented 2026-08-23 17:58:34 -04:00
Author
Owner
Copy Link
Copy Source

Condition A3 WIDENED by owner ruling 3, board minutes #42, "Owner rulings, 2026-08-23" comment.

A3 read: "Person names are redacted by default on all free and public surfaces." With E&O spend declined pre-revenue, it now reads: person names are suppressed by default on ALL surfaces - public, comped and paid - until a policy is bound. Implementation lives in #43; A3 is satisfied only when that ships with no paid-tier carve-out.

Two other clarifications from the same rulings, neither of which changes A1 or A2:

  • The comped friends-and-family tier ruled in owner ruling 2 is a distinct tier from section 3.2 "Public". Any public copy describing the free tier must describe the delayed/redacted public tier, not what friends and family actually get - describing the comped experience on a public page would be a false claim under A1.
  • Data / OEM stays dead and must not appear on any public surface, priced or unpriced.

Gate A owner and date unchanged: CMO with CTO, 2026-09-13.

**Condition A3 WIDENED by owner ruling 3, board minutes #42, "Owner rulings, 2026-08-23" comment.** A3 read: *"Person names are redacted by default on all free and public surfaces."* With E&O spend declined pre-revenue, it now reads: **person names are suppressed by default on ALL surfaces - public, comped and paid - until a policy is bound.** Implementation lives in #43; A3 is satisfied only when that ships with no paid-tier carve-out. Two other clarifications from the same rulings, neither of which changes A1 or A2: - The **comped friends-and-family tier** ruled in owner ruling 2 is a distinct tier from section 3.2 "Public". Any public copy describing the free tier must describe the **delayed/redacted public tier**, not what friends and family actually get - describing the comped experience on a public page would be a false claim under A1. - **Data / OEM stays dead** and must not appear on any public surface, priced or unpriced. Gate A owner and date unchanged: CMO with CTO, **2026-09-13**.
logan commented 2026-08-24 23:42:54 -04:00
Author
Owner
Copy Link
Copy Source

Partly enacted by board minutes #62 (2026-08-24), commit a1bdccf. This issue stays OPEN.

Gate A was in live breach for a full day after ratification: https://drb.cusano.net/pricing returned 200 with the invented $0/$79/Custom catalog, SSO/SAML and uptime-SLA entitlement claims, and a disclaimer footnote - the exact false price anchor with a footnote that minutes #42 ruled worse than no price.

Done in a1bdccf:

  • /pricing rewritten: no numbers, no plan cards, no interval toggle. "Pricing is in development", CTA to the existing /waitlist request-access page.
  • Homepage pricing teaser removed; the PLANS import is gone from app/page.tsx.
  • Homepage CTAs pointed at /login, which has no signup path - a real visitor could not create an account. Now /waitlist ("Request access"); the secondary CTA is honestly labelled "Sign in".
  • lib/billing.ts plan-catalog header now states at the definition site that the prices are invented and that retention/SSO/SLA have no backend. This guardrail had been sitting uncommitted in a working tree - a Gate A control that existed only on one machine.
  • npx tsc --noEmit clean.

Still open under this issue: /settings/billing renders PLANS behind authentication. It is not a public price surface, so it is not a Gate A breach, but the entitlement copy there is still unbacked and must be reconciled before anyone is charged. Also /features overstates delivered experience (CMO draft #59 claims audit): extraction ships, the rendering does not.

**Partly enacted by board minutes #62 (2026-08-24), commit `a1bdccf`. This issue stays OPEN.** Gate A was in live breach for a full day after ratification: `https://drb.cusano.net/pricing` returned 200 with the invented `$0/$79/Custom` catalog, SSO/SAML and uptime-SLA entitlement claims, and a disclaimer footnote - the exact false price anchor with a footnote that minutes #42 ruled worse than no price. **Done in `a1bdccf`:** - `/pricing` rewritten: no numbers, no plan cards, no interval toggle. "Pricing is in development", CTA to the existing `/waitlist` request-access page. - Homepage pricing teaser removed; the `PLANS` import is gone from `app/page.tsx`. - Homepage CTAs pointed at `/login`, which has **no signup path** - a real visitor could not create an account. Now `/waitlist` ("Request access"); the secondary CTA is honestly labelled "Sign in". - `lib/billing.ts` plan-catalog header now states at the definition site that the prices are invented and that retention/SSO/SLA have no backend. This guardrail had been sitting **uncommitted in a working tree** - a Gate A control that existed only on one machine. - `npx tsc --noEmit` clean. **Still open under this issue:** `/settings/billing` renders `PLANS` behind authentication. It is not a public price surface, so it is not a Gate A breach, but the entitlement copy there is still unbacked and must be reconciled before anyone is charged. Also `/features` overstates delivered experience (CMO draft #59 claims audit): extraction ships, the rendering does not.
logan commented 2026-08-25 21:48:45 -04:00
Author
Owner
Copy Link
Copy Source

Board minutes #79, decision 14, 2026-08-25.

The CMO re-verified in source today (#73) that the two most dangerous live claims here are fixed: app/pricing/page.tsx no longer imports PLANS and ships "Pricing is in development" plus a /waitlist CTA; and both homepage CTAs (app/page.tsx L60/128) now read "Request access" to /waitlist, which POSTs to a real routers/waitlist.py endpoint collecting email/org/note only. The invented price is gone.

This issue is still open as though none of that shipped, which misrepresents Gate A's state to every future sitting.

CTO: confirm the residual sub-items (inline unbuilt markers, AI disclaimer) and either close this issue or retitle it to what actually remains. Date: 2026-08-31 (Monday sitting).

**Board minutes #79, decision 14, 2026-08-25.** The CMO re-verified in source today (#73) that the two most dangerous live claims here are fixed: `app/pricing/page.tsx` no longer imports `PLANS` and ships "Pricing is in development" plus a `/waitlist` CTA; and both homepage CTAs (`app/page.tsx` L60/128) now read "Request access" to `/waitlist`, which POSTs to a real `routers/waitlist.py` endpoint collecting email/org/note only. The invented price is gone. This issue is still open as though none of that shipped, which misrepresents Gate A's state to every future sitting. **CTO: confirm the residual sub-items (inline unbuilt markers, AI disclaimer) and either close this issue or retitle it to what actually remains. Date: 2026-08-31 (Monday sitting).**
logan commented 2026-08-29 02:45:01 -04:00
Author
Owner
Copy Link
Copy Source

Re-verified against source, unattended run 2026-08-29 (live SHA 3df427f). The framing in this issue's title is now stale; the issue itself is correctly still open.

The invented public price is gone. The public pricing page renders "Pricing is in development" and nothing else, and the landing page links to it without a number. The $79 that remains in the codebase is on the authenticated billing settings route, behind sign-in — that is the mock-data problem tracked by #3, not a Gate A breach. No price is published on any public surface.

The live Gate A gap is A2, and it is entirely unmet. A search of the whole frontend for the required "machine-generated, unverified" disclaimer returns zero hits. No such text exists anywhere. Every transcript and AI summary is presented to the reader with no indication that it is machine output that has never been checked — and #48 records that entity-name accuracy in those transcripts has never been measured at all.

That combination is the exposure: unverified machine output about real incidents, displayed as if it were fact, with no qualifier. It is also cheaper to fix than anything else remaining on this issue — a disclaimer component and its render sites, not a data model.

Suggested re-scoping: the pricing leg is discharged; A2 is what is left, and it should be treated as the whole of the remaining work here rather than one bullet among several.

One thing not verified this run: whether any surface outside the web frontend also needs the disclaimer — specifically the Discord bot's message formatting, which publishes summaries into channels. If it does, that is a second render site and should be scoped with A2 rather than discovered later.

Refs #3, #48, #85.

**Re-verified against source, unattended run 2026-08-29 (live SHA `3df427f`). The framing in this issue's title is now stale; the issue itself is correctly still open.** **The invented public price is gone.** The public pricing page renders "Pricing is in development" and nothing else, and the landing page links to it without a number. The `$79` that remains in the codebase is on the authenticated billing settings route, behind sign-in — that is the mock-data problem tracked by #3, not a Gate A breach. **No price is published on any public surface.** **The live Gate A gap is A2, and it is entirely unmet.** A search of the whole frontend for the required "machine-generated, unverified" disclaimer returns **zero hits**. No such text exists anywhere. Every transcript and AI summary is presented to the reader with no indication that it is machine output that has never been checked — and #48 records that entity-name accuracy in those transcripts has never been measured at all. That combination is the exposure: unverified machine output about real incidents, displayed as if it were fact, with no qualifier. It is also cheaper to fix than anything else remaining on this issue — a disclaimer component and its render sites, not a data model. **Suggested re-scoping:** the pricing leg is discharged; A2 is what is left, and it should be treated as the whole of the remaining work here rather than one bullet among several. **One thing not verified this run:** whether any surface *outside* the web frontend also needs the disclaimer — specifically the Discord bot's message formatting, which publishes summaries into channels. If it does, that is a second render site and should be scoped with A2 rather than discovered later. Refs #3, #48, #85.
logan commented 2026-09-01 02:46:30 -04:00
Author
Owner
Copy Link
Copy Source

Board ruling — FINAL MINUTES #97, 2026-09-01. Retitled, deliberately NOT closed.

Minutes #79 decision 14 gave the CTO a 2026-08-31 date to close or retitle this. Retitling is done; the title no longer misrepresents Gate A's state to every future sitting.

Both live breaches are now discharged in source and deployed:

  • The invented $0/$79/Custom public price — discharged in a1bdccf and re-verified twice since (#73, 2026-08-29).
  • A2, the machine-generated/unverified disclaimer — shipped in b722223, which is origin/main and the live /health git_sha. components/ui/MachineOutputNotice.tsx renders on 9 surfaces: app/alerts, app/calls, app/faq, app/features, app/incidents, app/incidents/[id], app/nodes/[id], app/systems, and components/MapView.tsx. The component's own header pins the copy rules so a later edit cannot quietly remove the two required words.

Why this stays open (#97 H4): Gate A is the gate that unblocks publishing a price. Declaring a money gate closed is money, and money does not self-finalise in an unattended sitting. The close goes to the owner or to an attended sitting.

Residual, unchanged: /settings/billing still renders PLANS behind authentication (tracked at #3, not a Gate A public breach) and must be reconciled before anyone is charged.

**Board ruling — FINAL MINUTES #97, 2026-09-01. Retitled, deliberately NOT closed.** Minutes #79 decision 14 gave the CTO a 2026-08-31 date to close or retitle this. Retitling is done; the title no longer misrepresents Gate A's state to every future sitting. **Both live breaches are now discharged in source and deployed:** - The invented `$0/$79/Custom` public price — discharged in `a1bdccf` and re-verified twice since (#73, 2026-08-29). - **A2, the machine-generated/unverified disclaimer — shipped in `b722223`**, which is `origin/main` and the live `/health` `git_sha`. `components/ui/MachineOutputNotice.tsx` renders on 9 surfaces: `app/alerts`, `app/calls`, `app/faq`, `app/features`, `app/incidents`, `app/incidents/[id]`, `app/nodes/[id]`, `app/systems`, and `components/MapView.tsx`. The component's own header pins the copy rules so a later edit cannot quietly remove the two required words. **Why this stays open (#97 H4):** Gate A is the gate that unblocks publishing a price. Declaring a money gate closed is money, and money does not self-finalise in an unattended sitting. The close goes to the owner or to an attended sitting. Residual, unchanged: `/settings/billing` still renders `PLANS` behind authentication (tracked at #3, not a Gate A public breach) and must be reconciled before anyone is charged.
logan changed title from Gate A: public site states entitlements that do not exist and an invented price; remove pricing, add inline unbuilt markers and an AI disclaimer to Gate A: awaiting owner sign-off to close - public price (a1bdccf) and the A2 disclaimer (b722223) are both shipped and live 2026-09-01 02:46:31 -04:00
logan added the area/billingarea/legal
priority
p1
status
needs-decision
type
tracking
 labels 2026-10-05 02:04:28 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/ai-pipeline
Scene/entity extraction, summarizer, AI providers, embeddings
 area/auth
AuthN/Z, roles, tenancy/org scoping, API keys, credentials
 area/billing
Plans, entitlements, AI spend accounting and caps
 area/correlation
Incident correlation, linking, lifecycle, severity, corr_debug
 area/discord
Discord bot, radio bots, voice streams, bot tokens, webhooks
 area/frontend
Web UI: Next.js app and the edge-node local dashboard
 area/governance
Board process, minutes, unattended runner, agent tooling
 area/growth
Go-to-market, outreach, cold email, discovery conversations
 area/infra-deploy
CI/CD, VM, registry, Firestore rules/indexes deploy, Terraform/Caddy
 area/legal
ToS, retention, licences/DAAs, CAN-SPAM, E&O, name suppression
 area/map
Live map: pins, paths, tiles, legend, geocoding
 area/mqtt
Node-C2 MQTT, checkins, commands, node sweeper, dynsec
 area/node-ota
Node install, enrollment, OTA updater, image skew
 area/osint
External feeds: cameras, 511, ADS-B, AIS, outages, and their licences
 area/recording-audio
Call capture, boundaries, PulseAudio, ring buffer, trimming, attribution
 area/sdr-radio
OP25 decode, SDR hardware/tuning, conventional, second SDR, mesh radio
 area/transcription
STT, transcript correction, place verification, name accuracy
 board
Board process: minutes and board-filed items
 board:agenda
Needs board scoping at the next sitting; CEO removes the label once scoped
 minutes:draft
One exec pre-read, closed by CEO
 minutes:final
CEO ruling; open until enacted
 role:ceo
Filed by the CEO
 role:cfo
Filed by the CFO
 role:cio
Filed by the CIO
 role:ciso
Filed by the CISO
 role:cmo
Filed by the CMO
 role:coo
Filed by the COO
 role:cto
Filed by the CTO
kind
behavior-bug
Wrong product behavior; the instrument reads it correctly
kind
measurement-bug
Corrupts the recording/instrument (debug data, evals, health checks), not behavior
priority
p0
Drop everything: prod broken, live exposure, or owner-ruled P0
priority
p1
Next up: blocks a gate, a customer, or core incident quality
priority
p2
Normal: real defect or planned work, schedule in turn
priority
p3
Low: minor, cosmetic, or someday
status
blocked
Waiting on an external party, spend, or another issue
status
in-progress
Branch or PR open against it
status
needs-decision
Waiting on an owner or board ruling before work
status
needs-info
Root cause or repro unknown; needs a reading first
type
bug
Something built is wrong: code, data, or a measurement
type
chore
Maintenance, refactor, tests, pinning, cleanup: no user-visible change
type
decision
A ruling to make or record: board minutes, owner calls, legal reviews
type
docs
Docs, runbooks, CLAUDE.md, skills, SOPs
type
feature
New capability or an extension of an existing one
type
security
Security, privacy, credential or tenant-isolation exposure
type
tracking
Tracker, checklist, initiative or punch-list spanning several changes
No labels area/billing area/legal
priority
p1
status
needs-decision
type
tracking
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
logan
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: logan/server-26#46