# Qurmmius pilot readiness

This bundle adds small, reviewable pilot surfaces across the current Qurmmius lanes, including DeepFake Shield, GazeGuard, LegacyVault, RepairTrail, Qurmmius Palimpsest, EraWeaver, GridPulse, SchemaForge, EcoEcho, SkySprout, and Heartbeat Handoff. The controls are deliberately metadata-only: they do not upload media, collect eye data, accept live location identifiers, store secrets, or make production security, safety, medical, environmental, or historical claims.

## Completion pass: four additional lanes

GridPulse, SchemaForge, EcoEcho, and Heartbeat Handoff now have focused local pilot consoles. Each console validates bounded inputs, produces a deterministic preview, runs the same protected `/api/qi/product-pilot` contract, and exports a review artifact. These are pilot workflows—not production routing, schema enforcement, environmental sensing, or custody services.

## What to test before inviting pilots

1. Open each product route from the homepage and run its local console once.
2. Run **Server contract check**. A successful response returns a request ID, a product status, and `audit_status: metadata_only`.
3. Confirm that a rejected input returns `needs_review` and does not echo the supplied identifier or file name.
4. Repeat the same checks on desktop and a narrow mobile viewport. Local previews should remain usable if the server function is unavailable.
5. Record one screenshot and the request ID for each lane in the pilot log. Do not put real customer, biometric, GPS, credential, or private-key data into these checks.

## Product-specific acceptance gates

- **DeepFake Shield:** use an audio or video sample with explicit consent; the check remains research-only and processes metadata, not frames.
- **GazeGuard:** test block, notify, and allow decisions against a harmless URL; decisions must be visible and reversible.
- **LegacyVault:** choose a future unlock date and a reviewed cipher label; never enter plaintext, passwords, recovery phrases, or keys.
- **RepairTrail:** use coarse asset classes and redacted maintenance event metadata; identifiers are rejected before review.
- **Qurmmius Palimpsest:** provide a source citation, coordinate reference system, uncertainty estimate, and at least three control points.
- **EraWeaver:** provide an archival source citation; sky repair is a local visual interpretation, not recovered ground truth.
- **GridPulse:** use a coarse corridor label, bounded roadwork metadata, and a weather context; forecast pressure is an operator review cue, not turn-by-turn navigation.
- **SchemaForge:** use synthetic JSON only; the contract receives field names and counts, never raw values, credentials, or identifiers.
- **EcoEcho:** use aggregate station readings within the displayed bounds; microphone/camera frames and operator identity are out of scope.
- **SkySprout:** use an aggregate plot reading with at least three stations; precise location, device identifiers, raw frames, and operator identity are out of scope.
- **Heartbeat Handoff:** use a future-facing policy with at least two reviewers; packet contents and recovery secrets are never entered.

## Release gate

Pilot invitations should wait until all six checks have a recorded request ID, product owner sign-off, and a human-reviewed result. This bundle is not a production deployment and does not replace legal, privacy, cryptographic, accessibility, or independent quality review.