Independent readiness audit · August 20, 2026 · v1.1

Ready for external sandbox. Not ready for a controlled live recovery trial.

The platform is READY FOR EXTERNAL SANDBOX TESTING under synthetic/non-production data and controlled accounts. It is NOT READY FOR CONTROLLED LIVE TRIAL because multiple non-waivable P0 controls are missing, conflicting, or unverified.

Verdict instrument

Where readiness actually stands, scored on evidence

0%26%

evidence-weighted readiness

2 proven · 104 blockers

NO-GO · live recovery trialREADY WITH CONTROLS · external sandboxREADY · internal simulation

Readiness is scored on evidence, not intent: PROVEN counts full, PARTIAL and DEFERRED count half, UNVERIFIED counts almost nothing, and MISSING or CONFLICT count zero. Every UNKNOWN grades as RED.

Go/No-Go board · 22 gates

RED · 19CONDITIONAL · 3GREEN · 0

Latest build record

The newest package is a build record, not a proof

This revision treats the latest CTO package as the newest build record, but not as self-proving. Every material claim was compared with source, migrations, locally reproducible tests/builds and the live custom-domain runtime where possible.

Build / checkpoint

756c429 · a9432068

Labelled in the archive with no .git metadata, signed manifest or deployment mapping.

Local verification

TS + 2 builds pass

TypeScript and both production builds complete locally; 123 tests run without a database.

Test suite

198 declared

Database-backed tests require the shared live database and are not reproducible from the archive.

Production records

The live runtime reports zero production records — current build activity, not live readiness.

Scheduler health

DEGRADED

One overdue obligation reported alongside a degraded scheduler cadence.

Open exceptions

61 · 10 critical

Exception backlog is visible in the product rather than hidden behind a polished dashboard.

Governing test

The question this audit actually asks

Do not ask whether the software has a feature. Ask whether the system can prove the control works when something goes wrong.

A prior report saying a control exists is useful documentary evidence, but it is not enough for PROVEN where source, configuration, test or runtime evidence should exist. Every P0 UNKNOWN/UNVERIFIED is treated as RED for live-Trial approval.

Internal · Controlled Distributionaudience · CEO, CTO, engineering, security, QA, operations, finance and live-Trial decision board

Control requirements

0114

master register rows

Trial blockers

0104

must close before live

Go/No-Go gates RED

0/2219/22

board position

New findings

016

this inspection

Decision ladder

Four decision levels, four different answers

Internal simulation

READY

Continue with synthetic fixtures, adversarial cases and repeatable evidence capture.

External sandbox

READY WITH CONTROLS

Use isolated non-production identities/data; no real borrower or live field action; monitor auth-provider transition.

Controlled live Trial

NOT READY

Scheduler durability, MFA, malware scanning, DB audit grants, restore drill, external tenant isolation, analytics privacy, domain/auth cutover, production ownership and baseline remain open/unverified.

Expanded live operation

NOT READY

Requires earned Trial evidence, capacity, multi-lender configuration, independent security review and operating maturity.

Board decision

NO-GO for the first real recovery assignment. Continue simulation and external sandbox only. No executive risk acceptance can substitute for the non-waivable safety, tenant, identity, malware, audit, scheduling or restore controls.

Section 6 · Master register

Every requirement, its status, its blocker and the proof that closes it

Master control register · 114 requirements

104 trial blockers · 114 shown

Section 14 · Live Trial board

The only launch gate that counts

Gate	Verdict	Evidence required for GREEN
Durable scheduler	RED	Executor survives deploy/restart/idle; lease/idempotency/replay tests.
Scheduler monitoring	RED	Independent monitor detects killed scheduler/missed cadences and alerts named owner.
MFA / privileged actions	RED	MFA, recovery, step-up/dual approval and negative-role tests.
Malware scanning	RED	Scan/quarantine prevents preview/index/AI/staff access until clean.
Audit DB permissions	RED	Application writer denied UPDATE/DELETE; chain verification passes.
Backups	RED	Current encrypted backup config/retention/access/owner demonstrated.
Restore drill	RED	Replacement-environment restore meets RTO/RPO and reconciles all artifacts.
Tenant isolation	RED	Real lender/vendor IDOR/API/file/export/search tests pass.
External accounts	RED	Genuine isolated lender/vendor identities complete end-to-end sandbox.
Analytics privacy	RED	Zero sensitive collector traffic/provider retention; dual scripts removed/controlled.
Domain/OAuth/session	RED	TLS, cookie, provider allowlist, CORS/CSRF/origin/login/logout/rollback pass.
Auth-provider continuity	RED	Manus transition impact documented; onboarding window/contingency approved.
Incident response	CONDITIONAL	Incident UI exists; vendor-compromise/SEV1 exercise still required.
Monitoring/on-call	RED	P0 alert catalog routes and escalates in end-to-end tests.
AI authority	CONDITIONAL	Strong contracts visible; server tool/IAM enforcement and kill-switch proof required.
AI adversarial review	RED	Independent assessment completed; critical/high findings closed.
Document integrity	CONDITIONAL	Checksum/version UI exists; immutable original/provenance/access proof required.
Wrongful-recovery prevention	RED	Every stop-work hazard/state/notification/acknowledgement path passes.
Production ownership	RED	Company controls all critical accounts with two admins and recovery drill.
Baseline/data dictionary	RED	Pre-Trial baseline, cohort segregation and metric definitions approved.
Trial protocol	RED	Lender/vendors/geography/volume/exclusions/hours/contacts/stopping rules signed.
Critical bug status	RED	Current repository/todo/test output and unresolved P0/P1 bug register provided.

Section 3 · New findings

What this inspection found that no prior report carried

NF-01

Public HTML loads both Umami and Plausible.

A second collector contradicts the understood Umami-only posture and may receive operational routes.

DispositionDisable all analytics on authenticated origins or prove strict public-route allowlisting for every collector; purge prior sensitive paths.

NF-02

Umami suppression is a client monkey-patch applied to a finite sensitive-route denylist.

Initial pageviews, future routes, Plausible, referrers, page titles and provider retention are not proven controlled.

DispositionDefault deny; initialize analytics only on an allowlist of public routes; network/provider tests.

NF-03

Assignment URLs use an internal ID, while references/VINs appear in page content.

The specific reference-in-path claim is reduced, but the internal ID remains sensitive and titles/referrers may still leak.

DispositionTemplate/redact paths and suppress title/referrer; never emit identifiers/properties.

NF-04

Auth client reads sessionStorage manus-cookie/app_session_id and sends it as Bearer authorization.

A JavaScript-readable bearer fallback weakens an httpOnly-only session posture and increases XSS impact.

DispositionExplain provenance/necessity; remove for production if possible; threat-model and test token exposure, rotation and revocation.

NF-05

auth.me data is copied to localStorage as manus-runtime-user-info.

Potential personal/role data persists outside httpOnly protection and beyond the active tab.

DispositionMinimize or remove; enumerate fields and retention; clear on logout/account change; XSS review.

NF-06

OAuth state cookie is JavaScript-set, host-only, Secure, SameSite=None, Path=/.

Host scoping is correct, but the state value is script-readable and CSRF/replay guarantees require server verification.

DispositionProve state/nonce/PKCE validation, expiry, one-time use and replay rejection.

NF-07

No CSP, Referrer-Policy, Permissions-Policy or explicit anti-framing header observed.

The app loads third-party scripts and handles sensitive operational data; header defense is materially valuable.

DispositionDeploy and regression-test CSP/connect-src/frame-ancestors, referrer and permissions policy.

NF-08

Manus sign-in shows an Aug 23–25 account/data transition notice for newly created regional accounts.

External sandbox/live users may be affected by identity continuity or deletion during the proposed window.

DispositionObtain written provider impact statement; avoid onboarding/live Trial during uncertainty; prove account/data boundaries and contingency.

NF-09

Lifecycle has 38 explicit edges plus seven generated cancellation edges; cancellation is absent for several active states.

Stop-work may safely cover those states, but cancellation/recall semantics must be proven across dispatch, active work, located, reported and custody.

DispositionMap stop-work vs terminal cancellation; test every active state and post-custody legal/operational outcome.

NF-10

Trial Pause UI says it suspends automated progression and timer escalation.

Pausing escalation can hide overdue safety/compliance obligations if health appears calm.

DispositionPause new actions while preserving deadline visibility and independent overdue alerts; prove no silent-green state.

NF-11

Staff portal scope selection is implemented; genuine external-account enforcement is not visible.

Staff impersonation/scope selection cannot prove server tenant isolation.

DispositionUse real lender/vendor identities; test altered IDs, exports, files, errors and API calls.

NF-12

VENDOR and LENDER sessions satisfy the shared staffProcedure used by most internal routers.

External identities can reach internal APIs; this is an authorization defect, not missing paperwork.

DispositionReplace the procedure hierarchy with fail-closed authenticated/internal/vendor/lender/admin boundaries and prove every route denies external roles.

NF-13

The optimistic-concurrency write reads the wrong mysql2 return shape and defaults to success.

A zero-row update can be treated as an applied state change under concurrency.

DispositionRead the actual ResultSetHeader, refuse zero-row updates, and add deterministic concurrency tests.

NF-14

State, transition, event, audit, human touch, idempotency and follow-on effects do not share one transaction.

Partial failure can retain an effect without its audit record, or an audit record without its effect.

DispositionMake the write path atomic or durably recoverable; prove it with step-by-step fault injection.

NF-15

The current schema cannot be reproduced from the committed migration chain.

ai_decision_records, audit_chain_head, notification_deliveries, reference_sequence, scheduler_heartbeat and stop_work_orders have no committed migration.

DispositionCommit the missing migration with idempotent synthetic/TRIAL backfill; prove clean install, upgrade from 0006, rollback and live schema parity.

NF-16

Structural document scanning can mark a named file CLEAN without inspecting its bytes, and mandatory AI decision records can fail after the AI action is retained.

Both paths produce a green control signal with no underlying proof.

DispositionScan object bytes with a licensed engine before any downstream access; write the decision record inside the same transaction as the AI effect.

Section 4 · Ranked risk

The ten risks that decide the trial

Severity × likelihood heat field

PossibleLikelyImminent

Critical

High

CriticalPossible

Wrongful or continued recovery after recall/cure/bankruptcy/legal hold

Safety, legal and reputational harm; stop-work behavior is visible but end-to-end server/notification proof is absent.

Wrongful or continued recovery after recall/cure/bankruptcy/legal hold

CriticalPossible

Safety, legal and reputational harm; stop-work behavior is visible but end-to-end server/notification proof is absent.

Silent scheduler/deadline failure after deploy, restart or idle

CriticalLikely until closed

Prior CTO record explicitly describes this failure mode; UI health does not prove external detection or durable execution.

Cross-tenant lender/vendor exposure

CriticalPossible

External accounts and hostile tenant tests are explicitly unproven; portals contain high-value VIN, assignment, document and financial data.

Compromised internal/vendor identity without MFA/step-up

CriticalPossible

MFA is described as pre-live work; privileged Trial/AI/compliance actions exist.

Sensitive route/identifier leakage to analytics or hosting telemetry

HighLikely/current

Both Umami and Plausible are present; suppression is incomplete and client-side.

Malicious upload reaches preview, staff, AI or downstream processing

HighPossible

Malware scan/quarantine is described as open; documents are operational evidence.

Unrecoverable or inconsistent data after outage

CriticalPossible

Backups/restore drill and audit-chain validation after restore are not proven.

Audit history can be mutated through database privileges

HighPossible

Application append-only design is insufficient without DB-level grants and denial tests.

Authentication/provider interruption during Manus transition/domain cutover

HighTime-sensitive

Live sign-in displays provider transition notice; ownership, continuity and fallback are unverified.

Metrics or AI claims mislead lenders/investors

HighLikely without governance

Synthetic fixtures exist; real baseline, data dictionary and calibrated AI outcomes remain open.

Section 5 · Next actions

Ten engineering actions, in order

01Freeze external-account creation and all live assignments; keep the environment synthetic/internal until the authorization defect is closed and re-tested.
02Replace the procedure hierarchy with fail-closed internal/vendor/lender/admin boundaries; inventory every route and prove VENDOR/LENDER cannot call any internal router.
03Correct mysql2 affectedRows handling and make state, transition, event, audit, side effects and idempotency atomic; run concurrency and step-wise fault injection.
04Generate, review and commit the missing migration with explicit synthetic/TRIAL backfill; prove clean install, upgrade from 0006, rollback, restore and live schema/journal parity.
05Build real file ingestion and quarantine: object bytes, byte-derived MIME/size/hash, licensed AV, no downstream access before verdict, plus malicious/polyglot tests.
06Remove all analytics from the authenticated origin or enforce a server public-route allowlist; verify zero Umami/Plausible traffic and request historical deletion.
07Create an isolated ephemeral test database and CI pipeline; reproduce all 198 tests from zero without touching shared Trial data.
08Enable MFA/step-up, production env validation, session rotation/revocation and security headers; threat-model and remove the sessionStorage bearer fallback.
09Finish scheduler/notification operations: deploy probe and rollback, independent on-call alert, out-of-band delivery/retry/acknowledgement, multi-day endurance.
10Apply audit DB grants, complete an off-platform backup and destructive restore drill, reconcile hashes/entities/documents, then reconvene the go/no-go board.

Section 1 · Evidence

What the audit could see, and what it could not

E1Live runtime, 2026-08-20: unauthenticated root presents “Sign in to continue” and redirects to Manus OAuth.

E2Public edge headers, 2026-08-20: HTTPS 200, HSTS includeSubDomains/preload, no-cache/no-store, nosniff; no CSP/Referrer-Policy/Permissions-Policy observed.

E3Public HTML, 2026-08-20: Umami and hosting-injected Plausible scripts are both present.

E4Deployed bundle /assets/index-Duu0UoJ7.js: Umami denylist/track monkey-patch for selected sensitive paths; assignment routes use /assignments/{id}.

E5Deployed bundle lifecycle definitions: 28 states; 38 explicit transitions plus 7 generated pre-custody cancellation edges; guards, roles and selected human approvals are declared.

E6Deployed bundle StopWorkPanel.tsx: CURE, CANCELLATION, RECALL, BANKRUPTCY, LEGAL_HOLD, IDENTITY_CONFLICT, DUPLICATE_RECOVERY; UI states field action is refused.

E7Deployed bundle AiWorkforce.tsx: 12 versioned role contracts; fingerprinting; seven-role exercised set and five unexercised roles; prohibited actions/fallbacks declared.

E8Deployed bundle SchedulerHealthBanner.tsx / MissionControl.tsx: FAILED/DEGRADED/unknown display, last success, next expected, missed cadences, backlog and oldest overdue.

E9Deployed bundle AssignmentWorkspace.tsx / TrialControls.tsx: checksummed versioned documents, audit-chain verification UI, immutable eligibility snapshot UI and content-unverifiable handling text.

E10Deployed bundle VendorPortal.tsx / LenderPortal.tsx: ownVendorId/ownLenderId context for external users; staff scope-selection UI; real external-account enforcement not observed.

E11Deployed bundle IncidentCenter.tsx: SEV1–4, append-only stage concept, root-cause requirement, SEV1 pauses trial intake by default.

E12Deployed bundle TrialControls.tsx: AI kill switch, Trial Pause, feature flags, rule editing, golden scenarios and contract sync UI.

E13Deployed bundle FinanceCenter.tsx: duplicate holds/rate comparison UI; explicit no-money-moves posture and payment-intent-only statement.

E14Referenced CTO-record summaries: 28/38/42 architecture, trial exercises, hash-chain counts, AI outage resilience and explicit pre-live items. Original PDFs/source were not available.

E15CTO Patch / Trial 1 Hardening Requirements v1.2 generated in this workspace; requirements document, not implementation evidence.

E16Workspace inventory: no platform/ repository, 91-test suite, todo.md, RUNBOOK-durable-scheduling.md, schema, IaC, provider config or original CTO PDFs were available for direct inspection.

E17Deployed auth client: host-relative /api/oauth/callback; __Host-oauth_state set by JavaScript; sessionStorage bearer fallback reads manus-cookie/app_session_id; auth.me is copied to localStorage.

E18Manus sign-in runtime, 2026-08-20: regional account-transition notice warns newly created account data may be deleted Aug 23–25; platform/session/data impact is unverified.

Material evidence not available

The complete platform/ source repository and commit SHA.
The 91-test suite, test names, fixtures and current repeat-run output.
Database schema, migrations, constraints, roles/grants and production query plans.
Cloud/hosting/IaC, secrets, monitoring, backup and restore configuration.
OAuth-provider, MFA, CORS, CSRF and session-provider configuration.
Original CTO response PDFs, architecture diagrams and adversarial-review brief.
Authenticated external lender/vendor accounts and production-like network captures.

PROVEN

Implemented and supported by strong evidence appropriate to the claim.

PARTIAL

Some implementation is visible, but a material layer, environment, test, or operating proof is absent.

MISSING

Required before the relevant phase and no adequate implementation was found; may also be explicitly described as open.

CONFLICT

Current implementation or deployment contradicts the intended security/operating model or another requirement.

DEFERRED

Intentionally postponed because it does not reduce Trial 1 risk or enable the first lender.

UNVERIFIED

May exist, but available evidence does not establish it strongly enough.

Section 2 · Deployment facts

Point-in-time facts, stated as interpretations

Fact	Interpretation
Unauthenticated root is gated	The runtime presents a sign-in challenge; authorization after login remains unverified.
HTTPS/HSTS edge posture	Positive for this host at inspection time; certificate ownership/renewal and API subdomains remain unverified.
Dual analytics scripts present	This proves a current privacy/data-flow finding, not a safe analytics configuration.
28-state lifecycle declaration	The deployed client declares 28 states. Server-only enforcement and database invariants remain PARTIAL/UNVERIFIED.
38 explicit + 7 generated cancellation edges	The deployed client declares this topology. It does not prove every command uses a single server write path.
Twelve AI employee specifications	The definitions, version and fingerprint logic exist in the deployed client. Tool enforcement/model operation remains PARTIAL.
Host-relative OAuth callback	The client constructs callback from window.location.origin. Provider allowlists and cross-host session outcome remain unverified.

Reported controls · promotion requirements

Single controlled assignment-state write path

UNVERIFIED

Exact server function/service; call graph proving no side paths; DB transaction; bypass tests.

Deterministic state/guard enforcement

PARTIAL

E5 client topology plus server engine source, current guard catalog and negative tests.

AI cannot write assignment state or increase authority

PARTIAL

E7 contract definitions plus server tool allowlist, service identity permissions and adversarial test output.

Immutable eligibility snapshots

PARTIAL

E9 UI/bundle plus schema constraints, hash implementation and replay/tamper tests.

Hash-chained append-only audit

PARTIAL

E9 UI/bundle plus canonical serializer, sequence/concurrency logic, DB grants and verification output.

Stale-write/concurrency protection

UNVERIFIED

Expected-version client behavior plus transaction isolation, server compare-and-swap logic and concurrent tests.

Vendor compliance hard gates

PARTIAL

E5/E9/E13 UI declarations plus dispatch engine, current credential sources and expired-after-dispatch tests.

AI outage fails safe

UNVERIFIED

Current repeatable outage test showing deterministic operations continue without queued autonomous replay.

Duplicate invoice and rate variance controls

PARTIAL

E13 UI plus uniqueness/idempotency logic, rate versioning and negative tests.

No money movement in Trial 1

PARTIAL

E13 client posture plus provider/account inventory, network egress review and server capability proof.

Strengths worth preserving

The declared lifecycle is explicit rather than a loose status field, with roles, guards and human-approval flags attached to material commands.
Stop-work is represented as a first-class safety mechanism for cure, cancellation, recall, bankruptcy, legal hold, identity conflict and duplicate recovery.
AI role contracts expressly separate autonomous, recommend-only and prohibited behavior; no role contract claims protected state-write authority.
Finance is bounded to validation, exception handling and payment intent; the deployed UI expressly says no money moves during Trial 1.
The product surfaces audit integrity, eligibility-snapshot integrity, scheduler health, incident handling, exceptions and Trial controls instead of hiding them behind a polished dashboard.

Section 9 · Data flow and privacy

Where sensitive fields actually go

Data class	Creation / use	Potential destinations	Evidence	Required control
Borrower/debtor and account data	Lender intake; assignment identity	Browser, API, DB, logs, exports, lender/vendor views, backups, AI	UNVERIFIED	Minimize; field-level access; retention/hold; never analytics.
VIN/plate/vehicle	Intake, identity, field updates, recovery	URLs/DOM, DB, portal, evidence, logs, AI, exports	PARTIAL — visible in lender/workspace UI	Never analytics/log payload; conflict gate; mask by role.
Assignment/internal reference	Intake and cross-system identity	URL path, UI, analytics, logs, APIs, reports	PARTIAL — internal ID path; reference in DOM	Opaque route; path template; tenant authorization.
Address/location	Intake, field/recovery/custody	Portal, maps, docs/photos, AI, exports, notifications	UNVERIFIED	Need-to-know field scope; no analytics; secure communication.
Vendor identity/compliance	Onboarding and eligibility	DB, docs, portals, audit, reminders, AI, exports	PARTIAL — compliance/portal surfaces	Tenant/role scope; expiry history; document security.
Insurance/bond/licenses	Vendor evidence and dispatch gate	Object store, DB metadata, AI extraction, audit/snapshot	PARTIAL — requirement/expiry/snapshot UI	Scan/quarantine; version/hash; exact snapshot linkage.
Photos/recovery evidence	Vendor field submission	Browser upload, object store, preview, AI, lender portal, backup	UNVERIFIED	Malware/content validation; provenance; access logs; metadata policy.
Lender instructions/approvals	Intake and direction changes	DB/event history, email, portal, audit, AI	UNVERIFIED	Authoritative event, version, signer, acknowledgement, stop-work.
Invoice/payment information	Vendor/lender finance workflow	DB, docs, finance UI, exports, audit, backups	PARTIAL — finance UI	No bank/payment execution; least privilege; immutable adjustments.
Internal notes/exceptions/incidents	Operations and investigations	DB, logs, AI, alerts, exports, legal hold	UNVERIFIED	Classification, role scope, redaction, retention and evidence hold.
Authentication/role data	Manus OAuth and auth.me	Cookies, sessionStorage, localStorage, API headers, logs	CONFLICT/PARTIAL	Remove JS bearer; minimize storage; rotate/revoke; redact logs.

9.1 · Analytics privacy closure test

01Use a clean browser profile and canary values in every identifier field. Capture direct load, refresh, back/forward and SPA navigation.
02Inspect request URL, query, body, headers, referrer, title and properties for Umami, Plausible, CDN/hosting telemetry, error tools and tag managers.
03Exercise /assignments, /assignments/{id}, compliance, finance, incidents, portals, documents, 404/error and login/logout transitions.
04Search provider dashboards and exports for every canary; delete historic sensitive route data and retain deletion evidence.
05Fail deployment when an unapproved collector hostname/script appears or a route is not explicitly classified public/non-sensitive.

Section 11 · Wrongful recovery

Hazard, prevention, detection, escalation, evidence

Identity/VIN uncertainty

Preventive: VIN/evidence guards; identity conflict state; stop-work
Detective: Mismatch/conflict/duplicate alerts
Escalation: Operations + compliance; counsel/lender as needed
Audit evidence: Input versions, failed guards, evidence, decision

Client declarations visible; end-to-end proof absent.

Authority/cancellation uncertainty

Preventive: Trusted lender authority; immediate stop-work; no stale dispatch
Detective: Changed instruction/cancellation event and acknowledgement monitor
Escalation: Operations owner; executive/counsel for conflict
Audit evidence: Signer, reason, source, time, propagation/ack

Instruction/version/notification path unverified.

Vendor eligibility lapse

Preventive: Eligibility evaluated at dispatch; hard gate before ranking
Detective: Expiry monitor and post-dispatch re-evaluation
Escalation: Compliance + operations + lender
Audit evidence: Credential/doc/rule snapshot and exclusion reason

Pre-dispatch partial; after-dispatch behavior unverified.

Legal restriction

Preventive: Bankruptcy/legal-hold stop-work independent of AI
Detective: Exception/incident/overdue acknowledgement
Escalation: Counsel + executive/operations
Audit evidence: Source notice, scope, actions refused, release authority

Stop-work reason visible; full legal workflow unverified.

Duplicate/conflicting assignment

Preventive: Idempotency/duplicate hold before dispatch
Detective: Cross-reference conflict queue
Escalation: Operations + lender validation
Audit evidence: Submission IDs, duplicate key, disposition

Guard declared; API/DB proof absent.

Stale information/concurrency

Preventive: Expected-version and last-moment guard re-evaluation
Detective: Version-conflict alert and refused event
Escalation: Operations resolves current truth
Audit evidence: Expected/actual version, actor, rejected command

Client semantics visible; server concurrency unverified.

Safety gate

No live assignment should enter until each wrongful-recovery hazard has one exercised prevention path, one exercised detection path, a named human escalation, reconstructable audit evidence and a tested failure mode.

Section 10 · Edge cases

Thirty scenarios and the behavior each one demands

Scenario	Required safe behavior	Control
Recall immediately before dispatch	Stop-work beats dispatch atomically; dispatch refuses.	SAF-01/LCY-03
Cancellation during active vendor work	Field action stops; vendor acknowledges; chronology preserved.	SAF-01/SAF-03
Cancellation after custody	No unsafe delete/cancel shortcut; custody/legal disposition workflow.	SAF-03
Duplicate lender submission/repeated API	One business effect; conflict routed to review.	SAF-04/INT-02
Wrong VIN / VIN-plate conflict / duplicate VIN	Identity hold; no verification/continuation; human resolution.	SAF-02
Incorrect vehicle located/recovered	Immediate stop, law-enforcement/incident/evidence workflow.	SAF-07
Insurance expires before dispatch	Hard eligibility fail and recorded reason.	VEN-01
Insurance expires after dispatch	Monitor; defined stop/reassignment/lender decision.	SAF-06
Missing bond/disabled vendor	Eligibility fail; no ranking override.	VEN-01
Vendor decline / no acknowledgement	Attempt closes; deadline/escalation; safe redispatch.	E5/E8
Vendor misses first action/unreachable	Durable overdue alert; human escalation/reassignment.	SCH/COM
Lender changes instructions	Authorized versioned event; affected work stops until acknowledged.	SAF-05
Bankruptcy/legal hold/dispute	Stop-work; counsel/ops escalation; no field action.	SAF-01
Law-enforcement involvement	Incident/exception and evidence-preserving contact protocol.	SAF-07/INC
Storage/transport failure or damage	Custody conflict; photos/evidence; insurer/lender escalation.	LCY/SAF/DOC
Missing/late/conflicting documents	Hold, deficiency, version history; no silent replacement.	DOC-01
Malicious/mislabeled upload	Reject/quarantine before preview, AI or staff download.	DOC-03
Invoice duplicate/rate variance/invalid code	Hold; human disposition; versioned rate evidence.	FIN-02
Two employees change one assignment	One commit; stale write refused; coherent audit/deadlines.	LCY-04
Outage during active recovery	Read-safe mode, stop-work channel and reconciliation after recovery.	SAF-08
AI outage/fallback	Deterministic/human operation; no unsafe queued replay.	AIW-06
Scheduler outage/redeploy pending timers	External alert; lease recovery; idempotent replay.	SCH-01..04
DB interruption/partial commit	Transaction rollback; later reconciliation; no false success.	ARC-04
Vendor account compromise	Revoke/suspend, identify active cases, preserve evidence, notify.	INC-03
Privileged internal compromise	MFA/step-up, pause, revoke, audit and dual resume.	IAM-02/07
Clock skew/DST/timezone change	Trusted UTC semantics; deterministic local deadline display.	SCH-03
Notification provider accepts but does not deliver	Obligation stays open; delivery/ack escalates.	COM-02
Presigned file URL reused after role/tenant change	Short expiry plus current authorization or revocation.	DOC-04
Analytics/tag reintroduced by host/deploy	Release detector fails closed; analytics gate turns RED.	PRV-02/03
OAuth/provider outage during cutover	Existing sessions behavior known; safe fallback/rollback.	DOM-02..05

Section 12 · Incident model

The 2:14 AM vendor-compromise tabletop

DetectAuthentication anomaly or reported compromise creates SEV1/SEV2 with trusted timestamp and owner.
ContainRevoke sessions/credentials, disable vendor access, block new dispatch, preserve active assignment readability and stop unsafe action.
ScopeQuery every assignment, document, export, API call, field update and privilege event touched by the identity.
PreserveFreeze relevant logs/audit/object versions; record evidence custody; do not rewrite suspicious actions.
OperateContact on-call Operations/Security; raise stop-work where authority or field instructions are uncertain; assign safe human owners.
CommunicateNotify affected lender(s), vendor executive contact and counsel according to approved thresholds; avoid unsupported conclusions.
CorrectReverse/amend invalid effects through controlled events; restore tenant/vendor eligibility only after verified remediation.
ResumeRequire Security + Operations approval, MFA/credential reset, active-case validation and monitoring window.
LearnRoot cause, missed detection, control changes, owner/date; verify fixes and close only with substantive cause.

12.2 · Minimum alert catalog

Scheduler stale/missed cadence, timer failure, abandoned lease, oldest overdue and growing backlog.
Audit verification break/unverifiable growth, database failure, backup failure and restore-test failure.
Unusual authentication, expired/revoked session use, privileged-role change, break-glass use and cross-tenant denial anomaly.
Vendor credential expiry, blocked dispatch attempt, stop-work not acknowledged and stuck active assignment.
Malware/quarantine event, unexpected file type/volume and unauthorized evidence access/export.
AI provider outage/rate limit, prohibited tool attempt, cross-tenant request, confidence/override drift and kill-switch change.
Integration signature/idempotency/order/retry/DLQ failure and cancellation/hold delivery failure.
SEV1/SEV2 incident and Trial Pause/resume; executive dashboard must show business impact and accountable owner.

Section 13 · Cutover

Domain, session and authentication cutover

Before

Company-controlled domain/DNS/certificate; exact old/new hosts; TTL/health; OAuth redirect/logout allowlists; CORS/CSRF/origin/WebSocket/API/webhook/email/reset links; cookie name/Path/Secure/SameSite/Domain/expiry; re-login expectation; analytics removal; Manus transition impact.

Rehearsal

Production-like hostname; login/callback/state/nonce/PKCE; direct deep links; refresh/multi-tab/logout/revocation; old/new host cookies; wrong Origin/Referer/redirect; sibling subdomain; storage/token review; rollback.

Cutover

External DNS/TLS test; synthetic login; provider callback; session rotation; API credential pairing; analytics canaries; error/callback/session-churn monitoring; named rollback owner.

Rollback

Restore DNS/application/provider allowlists without leaving broad dual-origin trust; reconcile writes; define session invalidation/re-login; retain incident evidence.

Session truth

Host-only cookies are a sound least-scope default, but they do not migrate between two different hosts. Unless a tested migration exists, users should expect to authenticate again on the new host.

Sections 15–17 · Open questions

What must be answered, and by whom

For the CTO

01What exact repository commit, environment and deployment correspond to the inspected bundle?
02Which single server function/service is the protected state-write kernel, and what inventory proves no other route/job/admin path writes assignment state?
03How many server transitions exist today — 38 explicit, 45 including generated cancellations, or another number?
04Provide the current automated test list/results. Which tests exercise real concurrency, partial failure, stop-work propagation, cross-tenant IDOR, scheduler redeploy and restore?
05Where does deadline execution run? How are leases, abandoned claims, retries, dead letters, idempotency, external freshness and post-deploy probes implemented?
06What are the database roles/grants for assignment, audit, eligibility snapshot, document and configuration tables? Can the application audit writer UPDATE or DELETE?
07Why does the client read sessionStorage manus-cookie/app_session_id and send it as a bearer token? Can this production fallback be removed?
08What MFA, session, account-recovery, privileged-action and break-glass controls are configured in the identity provider?
09How does server code derive lender/vendor tenant scope? Provide hostile cross-tenant tests using real external identities.
10How are original uploads stored, scanned, quarantined, versioned, linked, accessed, retained and restored?
11What analytics does Manus hosting inject, and how will Plausible/Umami be removed from authenticated origins and historic sensitive paths purged?
12Who owns every production account, domain, key, backup and recovery method? Can a second engineer deploy, pause and restore without you?
13What current backup jobs exist and when will the destructive restore/audit reconciliation drill be performed?
14Which AI roles are truly wired to live models, which seven were exercised, and where are model/provider/version, tool calls, confidence, evidence and human outcomes recorded?

For the CEO / Operations

01Which lender, vendor agencies, geography, assignment types, volume, duration and operating hours define Trial 1?
02Which events are absolute stopping conditions, who may pause immediately, and which named people must approve resume?
03What assignments are excluded: disputed authority, bankruptcy/legal hold, post-custody transfers, special assets, high-risk locations or after-hours work?
04What response times can Operations actually staff for lender cancellation, vendor compromise, identity conflict and scheduler outage?
05What RTO and RPO are acceptable for active recovery operations, and what manual continuity is safe during restoration?
06Which lender rules, documents, rates, approvals, communications and reports are essential for the first lender versus intentionally deferred?
07Who is the accountable Security owner, Data/Measurement owner and executive Trial owner?
08What baseline data can be collected before Trial without delaying the decision, and which claims are prohibited until earned?
09What lender/vendor communication promises will be made about availability, incident notification, analytics/privacy and support?
10Will the company postpone onboarding/cutover during the Manus transition window unless the provider impact is resolved in writing?

For qualified counsel

01What forwarding/recovery/licensing boundaries apply to the company and vendors in each Trial jurisdiction?
02What evidence establishes lender authority to assign, cancel, recall, direct transport/disposition and share consumer/vehicle information?
03Which state-specific repossession, cure, bankruptcy, law-enforcement, notice, storage, transport and post-recovery duties must become hard gates or deadlines?
04What privacy laws, contractual duties and breach-notification rules apply to borrower, location, account, VIN, photo, document and authentication data?
05What retention, litigation hold, correction, deletion, access and disclosure rules apply to assignments, communications, audit, documents and AI records?
06What vendor contracts, insurance, bonds, licenses, W-9/tax, indemnity and ongoing monitoring are required?
07Which communications can AI draft/send, and what consumer/lender/vendor notices require approved language or human authorization?
08What restrictions apply to analytics, AI providers, cross-border processing, subprocessors and Manus-hosted authentication/operations?
09What audit records/electronic signatures/timestamps are required to establish authority and defensibility?
10What financial, money-transmission, accounting, sanctions/fraud and consumer-protection controls would apply before any future payment execution?
11What regulatory reporting, insurer/lender notification and interstate operation requirements apply to incidents or expansion?

Counsel items are decision questions for counsel, not legal conclusions from this technical audit.

Section 18 · Roadmap

Five horizons, and eight things not to build

Live Trial blockers

Prevent foreseeable unsafe/silent failure.

Scheduler/monitoring; stop-work proof; MFA/privilege; tenant/external accounts; analytics; malware; audit grants; backup/restore; domain/auth; incident/on-call; ownership; baseline; Trial charter; independent security review.

Trial hardening

Operate a small live cohort with evidence.

AI decision records/calibration; document access logging; communication delivery/ack; environment/CI proof; lender/vendor onboarding; geographic structure; scorecard/data quality; runbook refinement.

Post-Trial

Convert observed gaps into product.

Broader lender configurability; integration adapters; stronger capacity/routing; workflow exceptions from real cases; vendor scorecards with sufficient sample.

Scale

Support more lenders/vendors/volume.

Multi-region/tenant capacity; mature APIs/webhooks; disaster recovery cadence; SLO/error budgets; national geographic model; formal compliance change management.

Future / deferred

Avoid distracting from first proof.

Autonomous payments; broad multi-vertical workflows; advanced ML vendor optimization; national abstraction without demand; extensive custom workflow builder.

Do not build autonomous payment execution. Preserve invoice validation/reconciliation and a hard technical execution boundary.

Do not build a universal AI confidence percentage. Calibrate per task and retain human review for material effects.

Do not build a generic workflow-builder platform before the first lender.

Do not build national geography optimization before Trial geography is structured and proven.

Do not allow performance scoring to influence compliance eligibility; collect sufficient Trial data before automated ranking consequences.

Do not add multiple lender-system integrations if manual/CSV intake can safely prove the first Trial; build the adapter pattern and one needed connector.

Do not expand AI tool authority to compensate for missing deterministic workflow; close evidence and controls first.

Do not create more overlapping master documents. Maintain this audit as the readiness register and link to authoritative architecture/runbooks.

Section 19 · Controlled rollout

Six stages, each with entry and exit evidence

Stage	Entry evidence	Exit evidence
1 · Internal simulation	Current synthetic environment.	P0 scenarios repeatable; evidence capture works; no unresolved critical simulator defect.
2 · External sandbox	Isolated non-production lender/vendor identities; synthetic data; auth continuity understood.	Tenant/RBAC/usability/portal tests pass; training/runbook gaps closed.
3 · Controlled external test	Production-like deployment; no field action; lender/vendor acceptance scripts.	Domain/OAuth/analytics/monitoring/incident exercises pass.
4 · Tiny live cohort	All non-waivable go/no-go gates GREEN; signed Trial charter.	Daily review shows safe operation; no critical incident; metrics trustworthy.
5 · Limited lender Trial	Expansion criteria met; capacity/on-call proven.	Trial success/risks measured; independent review accepts residual risk.
6 · Expanded volume	Post-Trial decision and scale controls approved.	SLO, DR, security and operating evidence support growth.

Section 20 · Documentation

One index, ten decision records

Master Company Readiness Audit

Status, risk, blocker, action and proof register.

Authoritative for readiness status after board approval.

Architecture overview + data flow

System boundaries, trust zones, services, storage, integrations and ownership.

Authoritative technical overview.

Lifecycle/guard catalog

States, transitions, actors, guards, effects, deadlines, notices and tests.

Generated from/validated against server source.

AI Workforce contracts

Per-role tools, data, authority, confidence, fallback and evaluation.

Versioned policy tied to enforcement.

Runbook index

Scheduler, pause/resume, incidents, restore, auth/domain, secrets and integrations.

Authoritative operating procedure.

Data dictionary/privacy map

Fields, classifications, flows, retention and metric definitions.

Authoritative data governance record.

Trial protocol + Go/No-Go board

Scope, contacts, stages, success/stopping conditions and signed decision.

Authoritative Trial admission record.

Architecture decision records

ADR · Single protected state-write path and atomic effects.
ADR · Deterministic guards and last-moment eligibility snapshots.
ADR · AI confidence versus authority and no protected state writes.
ADR · Append-only audit/canonical serialization/database grants.
ADR · Durable scheduling, external freshness and no silent green.
ADR · Tenant identity/scope and external account isolation.
ADR · Document original/version/hash/quarantine model.
ADR · Cancellation, stop-work and post-custody semantics.
ADR · No money movement in Trial 1.
ADR · Connector/adaptor pattern for external systems.

Closing position

The next phase is proof and hardening. A real recovery assignment should not enter until the Go/No-Go board is GREEN on durable scheduling and monitoring; stop-work propagation; MFA and privileged actions; external tenant isolation; analytics privacy; upload quarantine; database audit permissions; backup/restore; domain/OAuth/session and auth-provider continuity; incident/on-call readiness; company ownership; metric baseline; and current critical-bug status. Until then, no polished interface, summary statistic or test claim should be allowed to convert UNKNOWN into GREEN.