# Remaining production work

Updated 2026-09-12. Provider activation and pilot onboarding are intentionally
excluded from this pass.

## Product functionality

The current product pages are reviewable pilot prototypes. They now expose
their boundaries in the production-readiness dashboard and fail closed when a
real runtime is not configured.

The local consoles now add deterministic, privacy-safe fingerprints for
DeepFake Shield media metadata and LegacyVault plan metadata. These are local
integrity aids only; they are not biometric scores, signatures for custody, or
proof of authenticity.

- DeepFake Shield needs a reviewed local media runtime, quality/privacy
  benchmarks, accessibility testing, and a retention decision before any frame
  processing is enabled.
- GazeGuard needs a browser-extension or OS integration, false-positive tests,
  and a user-visible escape hatch.
- LegacyVault needs specialist cryptographic review, key-custody design,
  restore/revocation rehearsals, and legal/estate review. Real secrets remain
  out of scope.
- RepairTrail needs an independent cloud backup/restore test, deletion/support
  runbook, and production entitlement QA. A signed synthetic backup → restore
  → delete rehearsal is now available from the RepairTrail cloud controls; it
  never touches a real passport.
- Qurmmius Palimpsest/EraWeaver need rights-cleared reconstruction assets, curator
  verification, and VR performance/motion-safety testing.
- Apex Academia needs the vendor-approved wheel/game adapter matrix, console
  connectivity design, and device/audio/accessibility QA.

## ClearGrant

ClearGrant now supports a local owner-attestation record for a zero-revenue,
zero-expense period. It is explicitly labeled `self-reported-not-verified`,
does not change the readiness score, and does not replace a bank statement,
tax filing, or lender review. A current statement can be supplied later through
an approved secure channel.

## Production hardening

Configured in this release: signed workspace sessions, tenant isolation,
durable metadata audit, request IDs/rate limits, no-store API responses, and
security headers including HSTS, frame denial, cross-origin isolation, and a
restricted permissions policy.

Still required before a production claim: independent accessibility review,
external uptime/error alerting, disaster-recovery restore rehearsal, and
privacy/legal sign-off for each production data path. Inline scripts also need
to be migrated to external files before a strict CSP can be claimed.

## Verification surface

Use `GET /api/qi/readiness` or open `/production-readiness/` for the current
non-secret status. Run the product consoles with synthetic or redacted inputs,
retain request IDs and exported artifacts, and keep provider traffic disabled
until its separate commercial/self-hosted decision is complete. A repeatable
smoke check is available as `npm run smoke:production`.