Board minutes #42 (2026-08-23) - Ratify BUSINESS_MODEL.md. - Gate A. Blocks putting any section 3 price on a public surface. Decision 6 is due independently of pricing.
Claims audit from the CMO (#41), cross-checked against ADMIN_BILLING_AUDIT.md §2:
Claim
Reality
$0 / $79 / custom (lib/billing.tsPLANS)
Invented.BUSINESS_MODEL.md §3.1 explicitly marks it superseded. Zero backend billing routes; createCheckoutSession / createBillingPortalSession always throw (#3)
Retention 7 / 90 / 365 days
Not built - see the Gate B4 issue
Enterprise SSO/SAML, uptime SLA, custom data residency
No backend exists for any of these. Most dangerous if it reaches a real "Contact sales" conversation
AI summaries read "like a dispatch briefing"
Shipped and live, with no "machine-generated, unverified" label anywhere and no name redaction on public surfaces
A1. Every entitlement claimed on a page is either built, or carries an inline "not yet available" marker on the same screen as the claim - not a bottom-of-page footnote. The existing disclaimer sits below the fold and does not satisfy this.
A2. Every AI transcript and AI summary surface carries "Machine-generated, unverified. Not a substitute for 911 or official dispatch."
A3. Person names redacted by default on all free and public surfaces (backend half tracked in the Gate B3 issue).
Pricing comes off the public site entirely, replaced with "Pricing in development - contact us". The CMO alternative (keep the placeholder plus its disclaimer) was overruled: the number is not merely unwired, it is invented, and a false anchor with a footnote is a worse artefact than an empty page.
The code comment above PLANS in lib/billing.ts read "this is real UI copy (safe to ship)". It is not safe to ship; that comment was corrected in place during the board session. The rest of this issue is the actual work.
Board minutes #42 (2026-08-23) - Ratify BUSINESS_MODEL.md. - **Gate A. Blocks putting any section 3 price on a public surface. Decision 6 is due independently of pricing.**
Claims audit from the CMO (#41), cross-checked against `ADMIN_BILLING_AUDIT.md` §2:
| Claim | Reality |
|---|---|
| `$0 / $79 / custom` (`lib/billing.ts` `PLANS`) | **Invented.** `BUSINESS_MODEL.md` §3.1 explicitly marks it superseded. Zero backend billing routes; `createCheckoutSession` / `createBillingPortalSession` always throw (#3) |
| Retention 7 / 90 / 365 days | Not built - see the Gate B4 issue |
| Enterprise SSO/SAML, uptime SLA, custom data residency | No backend exists for any of these. Most dangerous if it reaches a real "Contact sales" conversation |
| AI summaries read "like a dispatch briefing" | Shipped and live, with **no** "machine-generated, unverified" label anywhere and **no** name redaction on public surfaces |
**Ruled (minutes #42 Decisions 4 and 6):**
- **A1.** Every entitlement claimed on a page is either built, or carries an inline "not yet available" marker **on the same screen as the claim** - not a bottom-of-page footnote. The existing disclaimer sits below the fold and does not satisfy this.
- **A2.** Every AI transcript and AI summary surface carries **"Machine-generated, unverified. Not a substitute for 911 or official dispatch."**
- **A3.** Person names redacted by default on all free and public surfaces (backend half tracked in the Gate B3 issue).
- **Pricing comes off the public site entirely**, replaced with "Pricing in development - contact us". The CMO alternative (keep the placeholder plus its disclaimer) was **overruled**: the number is not merely unwired, it is invented, and a false anchor with a footnote is a worse artefact than an empty page.
The code comment above `PLANS` in `lib/billing.ts` read "this is real UI copy (safe to ship)". It is not safe to ship; that comment was corrected in place during the board session. The rest of this issue is the actual work.
Owner: CMO (copy), CTO (implementation). Date: **2026-09-13**.
Related: #3, `ADMIN_BILLING_AUDIT.md` §2, minutes #42 Decisions 4 and 6.
A3 read: "Person names are redacted by default on all free and public surfaces." With E&O spend declined pre-revenue, it now reads: person names are suppressed by default on ALL surfaces - public, comped and paid - until a policy is bound. Implementation lives in #43; A3 is satisfied only when that ships with no paid-tier carve-out.
Two other clarifications from the same rulings, neither of which changes A1 or A2:
The comped friends-and-family tier ruled in owner ruling 2 is a distinct tier from section 3.2 "Public". Any public copy describing the free tier must describe the delayed/redacted public tier, not what friends and family actually get - describing the comped experience on a public page would be a false claim under A1.
Data / OEM stays dead and must not appear on any public surface, priced or unpriced.
Gate A owner and date unchanged: CMO with CTO, 2026-09-13.
**Condition A3 WIDENED by owner ruling 3, board minutes #42, "Owner rulings, 2026-08-23" comment.**
A3 read: *"Person names are redacted by default on all free and public surfaces."* With E&O spend declined pre-revenue, it now reads: **person names are suppressed by default on ALL surfaces - public, comped and paid - until a policy is bound.** Implementation lives in #43; A3 is satisfied only when that ships with no paid-tier carve-out.
Two other clarifications from the same rulings, neither of which changes A1 or A2:
- The **comped friends-and-family tier** ruled in owner ruling 2 is a distinct tier from section 3.2 "Public". Any public copy describing the free tier must describe the **delayed/redacted public tier**, not what friends and family actually get - describing the comped experience on a public page would be a false claim under A1.
- **Data / OEM stays dead** and must not appear on any public surface, priced or unpriced.
Gate A owner and date unchanged: CMO with CTO, **2026-09-13**.
Partly enacted by board minutes #62 (2026-08-24), commit a1bdccf. This issue stays OPEN.
Gate A was in live breach for a full day after ratification: https://drb.cusano.net/pricing returned 200 with the invented $0/$79/Custom catalog, SSO/SAML and uptime-SLA entitlement claims, and a disclaimer footnote - the exact false price anchor with a footnote that minutes #42 ruled worse than no price.
Done in a1bdccf:
/pricing rewritten: no numbers, no plan cards, no interval toggle. "Pricing is in development", CTA to the existing /waitlist request-access page.
Homepage pricing teaser removed; the PLANS import is gone from app/page.tsx.
Homepage CTAs pointed at /login, which has no signup path - a real visitor could not create an account. Now /waitlist ("Request access"); the secondary CTA is honestly labelled "Sign in".
lib/billing.ts plan-catalog header now states at the definition site that the prices are invented and that retention/SSO/SLA have no backend. This guardrail had been sitting uncommitted in a working tree - a Gate A control that existed only on one machine.
npx tsc --noEmit clean.
Still open under this issue:/settings/billing renders PLANS behind authentication. It is not a public price surface, so it is not a Gate A breach, but the entitlement copy there is still unbacked and must be reconciled before anyone is charged. Also /features overstates delivered experience (CMO draft #59 claims audit): extraction ships, the rendering does not.
**Partly enacted by board minutes #62 (2026-08-24), commit `a1bdccf`. This issue stays OPEN.**
Gate A was in live breach for a full day after ratification: `https://drb.cusano.net/pricing` returned 200 with the invented `$0/$79/Custom` catalog, SSO/SAML and uptime-SLA entitlement claims, and a disclaimer footnote - the exact false price anchor with a footnote that minutes #42 ruled worse than no price.
**Done in `a1bdccf`:**
- `/pricing` rewritten: no numbers, no plan cards, no interval toggle. "Pricing is in development", CTA to the existing `/waitlist` request-access page.
- Homepage pricing teaser removed; the `PLANS` import is gone from `app/page.tsx`.
- Homepage CTAs pointed at `/login`, which has **no signup path** - a real visitor could not create an account. Now `/waitlist` ("Request access"); the secondary CTA is honestly labelled "Sign in".
- `lib/billing.ts` plan-catalog header now states at the definition site that the prices are invented and that retention/SSO/SLA have no backend. This guardrail had been sitting **uncommitted in a working tree** - a Gate A control that existed only on one machine.
- `npx tsc --noEmit` clean.
**Still open under this issue:** `/settings/billing` renders `PLANS` behind authentication. It is not a public price surface, so it is not a Gate A breach, but the entitlement copy there is still unbacked and must be reconciled before anyone is charged. Also `/features` overstates delivered experience (CMO draft #59 claims audit): extraction ships, the rendering does not.
The CMO re-verified in source today (#73) that the two most dangerous live claims here are fixed: app/pricing/page.tsx no longer imports PLANS and ships "Pricing is in development" plus a /waitlist CTA; and both homepage CTAs (app/page.tsx L60/128) now read "Request access" to /waitlist, which POSTs to a real routers/waitlist.py endpoint collecting email/org/note only. The invented price is gone.
This issue is still open as though none of that shipped, which misrepresents Gate A's state to every future sitting.
CTO: confirm the residual sub-items (inline unbuilt markers, AI disclaimer) and either close this issue or retitle it to what actually remains. Date: 2026-08-31 (Monday sitting).
**Board minutes #79, decision 14, 2026-08-25.**
The CMO re-verified in source today (#73) that the two most dangerous live claims here are fixed: `app/pricing/page.tsx` no longer imports `PLANS` and ships "Pricing is in development" plus a `/waitlist` CTA; and both homepage CTAs (`app/page.tsx` L60/128) now read "Request access" to `/waitlist`, which POSTs to a real `routers/waitlist.py` endpoint collecting email/org/note only. The invented price is gone.
This issue is still open as though none of that shipped, which misrepresents Gate A's state to every future sitting.
**CTO: confirm the residual sub-items (inline unbuilt markers, AI disclaimer) and either close this issue or retitle it to what actually remains. Date: 2026-08-31 (Monday sitting).**
Re-verified against source, unattended run 2026-08-29 (live SHA 3df427f). The framing in this issue's title is now stale; the issue itself is correctly still open.
The invented public price is gone. The public pricing page renders "Pricing is in development" and nothing else, and the landing page links to it without a number. The $79 that remains in the codebase is on the authenticated billing settings route, behind sign-in — that is the mock-data problem tracked by #3, not a Gate A breach. No price is published on any public surface.
The live Gate A gap is A2, and it is entirely unmet. A search of the whole frontend for the required "machine-generated, unverified" disclaimer returns zero hits. No such text exists anywhere. Every transcript and AI summary is presented to the reader with no indication that it is machine output that has never been checked — and #48 records that entity-name accuracy in those transcripts has never been measured at all.
That combination is the exposure: unverified machine output about real incidents, displayed as if it were fact, with no qualifier. It is also cheaper to fix than anything else remaining on this issue — a disclaimer component and its render sites, not a data model.
Suggested re-scoping: the pricing leg is discharged; A2 is what is left, and it should be treated as the whole of the remaining work here rather than one bullet among several.
One thing not verified this run: whether any surface outside the web frontend also needs the disclaimer — specifically the Discord bot's message formatting, which publishes summaries into channels. If it does, that is a second render site and should be scoped with A2 rather than discovered later.
**Re-verified against source, unattended run 2026-08-29 (live SHA `3df427f`). The framing in this issue's title is now stale; the issue itself is correctly still open.**
**The invented public price is gone.** The public pricing page renders "Pricing is in development" and nothing else, and the landing page links to it without a number. The `$79` that remains in the codebase is on the authenticated billing settings route, behind sign-in — that is the mock-data problem tracked by #3, not a Gate A breach. **No price is published on any public surface.**
**The live Gate A gap is A2, and it is entirely unmet.** A search of the whole frontend for the required "machine-generated, unverified" disclaimer returns **zero hits**. No such text exists anywhere. Every transcript and AI summary is presented to the reader with no indication that it is machine output that has never been checked — and #48 records that entity-name accuracy in those transcripts has never been measured at all.
That combination is the exposure: unverified machine output about real incidents, displayed as if it were fact, with no qualifier. It is also cheaper to fix than anything else remaining on this issue — a disclaimer component and its render sites, not a data model.
**Suggested re-scoping:** the pricing leg is discharged; A2 is what is left, and it should be treated as the whole of the remaining work here rather than one bullet among several.
**One thing not verified this run:** whether any surface *outside* the web frontend also needs the disclaimer — specifically the Discord bot's message formatting, which publishes summaries into channels. If it does, that is a second render site and should be scoped with A2 rather than discovered later.
Refs #3, #48, #85.
Board ruling — FINAL MINUTES #97, 2026-09-01. Retitled, deliberately NOT closed.
Minutes #79 decision 14 gave the CTO a 2026-08-31 date to close or retitle this. Retitling is done; the title no longer misrepresents Gate A's state to every future sitting.
Both live breaches are now discharged in source and deployed:
The invented $0/$79/Custom public price — discharged in a1bdccf and re-verified twice since (#73, 2026-08-29).
A2, the machine-generated/unverified disclaimer — shipped in b722223, which is origin/main and the live /healthgit_sha. components/ui/MachineOutputNotice.tsx renders on 9 surfaces: app/alerts, app/calls, app/faq, app/features, app/incidents, app/incidents/[id], app/nodes/[id], app/systems, and components/MapView.tsx. The component's own header pins the copy rules so a later edit cannot quietly remove the two required words.
Why this stays open (#97 H4): Gate A is the gate that unblocks publishing a price. Declaring a money gate closed is money, and money does not self-finalise in an unattended sitting. The close goes to the owner or to an attended sitting.
Residual, unchanged: /settings/billing still renders PLANS behind authentication (tracked at #3, not a Gate A public breach) and must be reconciled before anyone is charged.
**Board ruling — FINAL MINUTES #97, 2026-09-01. Retitled, deliberately NOT closed.**
Minutes #79 decision 14 gave the CTO a 2026-08-31 date to close or retitle this. Retitling is done; the title no longer misrepresents Gate A's state to every future sitting.
**Both live breaches are now discharged in source and deployed:**
- The invented `$0/$79/Custom` public price — discharged in `a1bdccf` and re-verified twice since (#73, 2026-08-29).
- **A2, the machine-generated/unverified disclaimer — shipped in `b722223`**, which is `origin/main` and the live `/health` `git_sha`. `components/ui/MachineOutputNotice.tsx` renders on 9 surfaces: `app/alerts`, `app/calls`, `app/faq`, `app/features`, `app/incidents`, `app/incidents/[id]`, `app/nodes/[id]`, `app/systems`, and `components/MapView.tsx`. The component's own header pins the copy rules so a later edit cannot quietly remove the two required words.
**Why this stays open (#97 H4):** Gate A is the gate that unblocks publishing a price. Declaring a money gate closed is money, and money does not self-finalise in an unattended sitting. The close goes to the owner or to an attended sitting.
Residual, unchanged: `/settings/billing` still renders `PLANS` behind authentication (tracked at #3, not a Gate A public breach) and must be reconciled before anyone is charged.
logan
changed title from Gate A: public site states entitlements that do not exist and an invented price; remove pricing, add inline unbuilt markers and an AI disclaimer to Gate A: awaiting owner sign-off to close - public price (a1bdccf) and the A2 disclaimer (b722223) are both shipped and live2026-09-01 02:46:31 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Board minutes #42 (2026-08-23) - Ratify BUSINESS_MODEL.md. - Gate A. Blocks putting any section 3 price on a public surface. Decision 6 is due independently of pricing.
Claims audit from the CMO (#41), cross-checked against
ADMIN_BILLING_AUDIT.md§2:$0 / $79 / custom(lib/billing.tsPLANS)BUSINESS_MODEL.md§3.1 explicitly marks it superseded. Zero backend billing routes;createCheckoutSession/createBillingPortalSessionalways throw (#3)Ruled (minutes #42 Decisions 4 and 6):
The code comment above
PLANSinlib/billing.tsread "this is real UI copy (safe to ship)". It is not safe to ship; that comment was corrected in place during the board session. The rest of this issue is the actual work.Owner: CMO (copy), CTO (implementation). Date: 2026-09-13.
Related: #3,
ADMIN_BILLING_AUDIT.md§2, minutes #42 Decisions 4 and 6.Condition A3 WIDENED by owner ruling 3, board minutes #42, "Owner rulings, 2026-08-23" comment.
A3 read: "Person names are redacted by default on all free and public surfaces." With E&O spend declined pre-revenue, it now reads: person names are suppressed by default on ALL surfaces - public, comped and paid - until a policy is bound. Implementation lives in #43; A3 is satisfied only when that ships with no paid-tier carve-out.
Two other clarifications from the same rulings, neither of which changes A1 or A2:
Gate A owner and date unchanged: CMO with CTO, 2026-09-13.
Partly enacted by board minutes #62 (2026-08-24), commit
a1bdccf. This issue stays OPEN.Gate A was in live breach for a full day after ratification:
https://drb.cusano.net/pricingreturned 200 with the invented$0/$79/Customcatalog, SSO/SAML and uptime-SLA entitlement claims, and a disclaimer footnote - the exact false price anchor with a footnote that minutes #42 ruled worse than no price.Done in
a1bdccf:/pricingrewritten: no numbers, no plan cards, no interval toggle. "Pricing is in development", CTA to the existing/waitlistrequest-access page.PLANSimport is gone fromapp/page.tsx./login, which has no signup path - a real visitor could not create an account. Now/waitlist("Request access"); the secondary CTA is honestly labelled "Sign in".lib/billing.tsplan-catalog header now states at the definition site that the prices are invented and that retention/SSO/SLA have no backend. This guardrail had been sitting uncommitted in a working tree - a Gate A control that existed only on one machine.npx tsc --noEmitclean.Still open under this issue:
/settings/billingrendersPLANSbehind authentication. It is not a public price surface, so it is not a Gate A breach, but the entitlement copy there is still unbacked and must be reconciled before anyone is charged. Also/featuresoverstates delivered experience (CMO draft #59 claims audit): extraction ships, the rendering does not.Board minutes #79, decision 14, 2026-08-25.
The CMO re-verified in source today (#73) that the two most dangerous live claims here are fixed:
app/pricing/page.tsxno longer importsPLANSand ships "Pricing is in development" plus a/waitlistCTA; and both homepage CTAs (app/page.tsxL60/128) now read "Request access" to/waitlist, which POSTs to a realrouters/waitlist.pyendpoint collecting email/org/note only. The invented price is gone.This issue is still open as though none of that shipped, which misrepresents Gate A's state to every future sitting.
CTO: confirm the residual sub-items (inline unbuilt markers, AI disclaimer) and either close this issue or retitle it to what actually remains. Date: 2026-08-31 (Monday sitting).
Re-verified against source, unattended run 2026-08-29 (live SHA
3df427f). The framing in this issue's title is now stale; the issue itself is correctly still open.The invented public price is gone. The public pricing page renders "Pricing is in development" and nothing else, and the landing page links to it without a number. The
$79that remains in the codebase is on the authenticated billing settings route, behind sign-in — that is the mock-data problem tracked by #3, not a Gate A breach. No price is published on any public surface.The live Gate A gap is A2, and it is entirely unmet. A search of the whole frontend for the required "machine-generated, unverified" disclaimer returns zero hits. No such text exists anywhere. Every transcript and AI summary is presented to the reader with no indication that it is machine output that has never been checked — and #48 records that entity-name accuracy in those transcripts has never been measured at all.
That combination is the exposure: unverified machine output about real incidents, displayed as if it were fact, with no qualifier. It is also cheaper to fix than anything else remaining on this issue — a disclaimer component and its render sites, not a data model.
Suggested re-scoping: the pricing leg is discharged; A2 is what is left, and it should be treated as the whole of the remaining work here rather than one bullet among several.
One thing not verified this run: whether any surface outside the web frontend also needs the disclaimer — specifically the Discord bot's message formatting, which publishes summaries into channels. If it does, that is a second render site and should be scoped with A2 rather than discovered later.
Refs #3, #48, #85.
Board ruling — FINAL MINUTES #97, 2026-09-01. Retitled, deliberately NOT closed.
Minutes #79 decision 14 gave the CTO a 2026-08-31 date to close or retitle this. Retitling is done; the title no longer misrepresents Gate A's state to every future sitting.
Both live breaches are now discharged in source and deployed:
$0/$79/Custompublic price — discharged ina1bdccfand re-verified twice since (#73, 2026-08-29).b722223, which isorigin/mainand the live/healthgit_sha.components/ui/MachineOutputNotice.tsxrenders on 9 surfaces:app/alerts,app/calls,app/faq,app/features,app/incidents,app/incidents/[id],app/nodes/[id],app/systems, andcomponents/MapView.tsx. The component's own header pins the copy rules so a later edit cannot quietly remove the two required words.Why this stays open (#97 H4): Gate A is the gate that unblocks publishing a price. Declaring a money gate closed is money, and money does not self-finalise in an unattended sitting. The close goes to the owner or to an attended sitting.
Residual, unchanged:
/settings/billingstill rendersPLANSbehind authentication (tracked at #3, not a Gate A public breach) and must be reconciled before anyone is charged.Gate A: public site states entitlements that do not exist and an invented price; remove pricing, add inline unbuilt markers and an AI disclaimerto Gate A: awaiting owner sign-off to close - public price (a1bdccf) and the A2 disclaimer (b722223) are both shipped and live