Mira implementation checklist

October 26 current state: Aryan deployed647b549 as dba28f7d; health/schema/Discord startup pass, one running instance, optional features/automatic deploy off. #86's authorized existing-synthetic reopen/close smoke passes with one notice per event and the issue closed again; this does not finish #51 or #85. Main a9c9508 adds only the reviewed Mira repository guide. #83 source provenance/conflict handling is a separate draft; no paid run, new public Omi test issue, agent deployment or memory enablement.

#83 source provenance and conflict handling — draft

Observe missing publisher provenance across ingestion/chunks/evidence before implementation; preserve fetch time as a separate operational field.
Carry bounded publisher dates and explicit product/surface/version scope through production persistence/search/formatting; unknown/invalid/ambiguous metadata remains unknown and an undated refresh clears stale provenance.
Add source/article-title/section/explicit-scope/date ordering only for equivalent relevance/corroboration, plus one shared applicability/conflict policy in answer and both reviewer attempts. Preserve identifier punctuation and complementary safety details; the independent generic-heading displacement is reproduced and repaired.
Fourteen original synthetic regressions pass, including full-cap topic separation, stronger-match/query-corroboration guards, policy transport and six simultaneous fetches with10-second deadlines for two-/three-part questions. No provider call or protected case.
Runtime 42619cf passes full 1,216/no-model 8/isolated SQL, exact-head hosted Node 20/24/real PostgreSQL and independent 69-check code review plus all four original reproduction assertions. Later documentation-only heads still need their required CI/review; unchanged runtime evidence is reusable.
Obtain authorization before the necessary generated-answer checks. A policy reaching a model is not proof of compliance. Keep #83 open and draft until its actual accuracy gates pass.

Current audited execution — October 26, 2026

Reconcile main c6f482d and completed #59/#28/#84 decisions with the retained comparison/CI/review/release receipts. Four bounded combined-release scenarios are verified, not universal accuracy.
Audit fixed25×4 progress:16 main +16 tested +16 reviewed +8 verified operations =56/100;44 left. Main milestone implementation coverage64/100; full A–E2/21. Ledger and four automatic consistency checks preserve definitions.
Audit12 open issues; close only speculative stored summaries #52 not planned. Preserve11 unresolved issues, existing assignments and closed-branch evidence. Disposition.
#86 lifecycle implemented locally:30-day bounded/non-starvable expiry, payload subject-time rejection, erasure of owned receipt rows with a minimal replay cutoff; red-before synthetic checks,1202/no-model8/isolated SQL pass.
#86 hosted real PostgreSQL/Node20/24 CI, final independent85-test/signed HTTP/SQL/two-migration-probe review and merge647b549; merged-main CI passes.
#86 authorized existing-synthetic reopen/close smoke passes on 647b549 / dba28f7d: one notice per event, ordered open checkpoint then closure, and no extra notice at the follow-up read. Issue #23602 ends closed not planned. No memory enablement or new public test issue; limits.
#88 merged884fb46 with1174/offline8/current CI/independent35 checks and unchanged reply bytes; #62 remains separate from deployment/customer resolution.
Step5 preparation and revised AI-provider-disclosing notice wording approved. Publication, processor/backups and explicit enablement remain unchecked; no memory flag changed.
Then #83 general source conflicts and #65 accuracy; remaining C/D/E and #51/#53/#56 operational reliability stay required. No automatic paid evaluation, customer data use, issue assignment, merge or deployment.

Older dated checklists below are retained implementation history, not current pending work or renewed authorization. The master plan controls the current queue.

#62 evidence-only implementation — #88 merged

Observe a failing actual draft/presentation instrumentation assertion before wiring; preserve the existing filter/presentation behavior.
Add explicit per-turn evaluation collection, fixed text-free records, ephemeral keyed hashes, bounded overflow and closed late-work handling; no production logger/store or default activation.
Wire actual generation/review/safety/presentation/clipping/handoff/send projection, plus opt-in harness collection and missing-baseline compatibility. No duplicate formatter or judge/prompt/source change.
Focused synthetic real-function/reviewer/handler/handoff/harness, byte-parity, concurrency, bounds and failure checks pass without paid calls or Discord.
Full1174/no-model8/exact-head CI and independent35-check review passed before merge884fb46. No paid rerun, customer-data use or separate deployment.
Keep #62 open: integrated main still loses independent synthetic symptom/attempt context joined to narration. Redirect repairs and merged diagnostics do not complete the general narration/context-preservation requirement; prerequisites and safety conditions must remain attached.

Current October25 finish status

Step1 decided: #59 merged38337e7 and subsequently operator-deployed7b41e119; #75 closed unmerged, evidence/branch retained. No further paid run.
Step2: #28 merged0986b75 with both repairs,1086/offline8/SQL, exact-head Node20/24/real PostgreSQL CI and independent final review. Retention issue85 opened; App configuration names verified, not publication authority.
Step3 local implementation: shared deterministic presentation/escalation/final-send privacy boundary, localized availability/confirmed-delivery private next step, actual-output regressions and question-aware handoff names. Initial32 tests fail before implementation; additional independently found echo/URL/intake/preservation cases are observed red then repaired. Planner injection removed, one short answer/review rule retained; staff guidance delegates private intake to the application. No paid comparison.
Step3 local verification: final frozen runtime passes1165/1165 full tests, offline8/8, disposable SQL integration and diff checks. All concrete independent findings have observed-red output regressions and repairs, including preserving custody/masking warnings. No provider run or customer-data access.
Step3 independent final review:134 focused checks plus7 actual-handler checks pass, no skipped checks or remaining actionable finding in scope. Reviewed11-file manifest SHA256 0aa820a48b9079c3d1ba5286c26ec54a8201f9d050b87e21ef9171ad64a1ab82. This is bounded-pattern enforcement, not universal private-data recognition or live acceptance.
Step3 readiness: exact-head Node20/24/PostgreSQL CI and final identity check before merge. Re-run required checks before pushing; no failure is waived as a rerun. No release/optional enablement yet.
Step4/5: gated combined exact-GitHub release and Aryan's prescribed inputs; then notice/checklist preparation, no memory flag until notice approval plus explicit enablement.

Earlier October25 finish contract and verification snapshots

Step1: exact frozen main d550dc1 plus current-main #59/#75; fresh full/offline/current CI, reviewed safe launch, ONE simultaneous81×2×3 run, full independent reading, strict per-arm gates, then merge-or-close. No rerun/rework or paid preflight.
Step2: #28 pending-comment/card dedup and GitHub App+encryption readiness; red-before/SQL/CI/independent gates, retention issue, names-only auth report, unknown-publication manual-link runbook, then merge. Review-comment file only if supplied.
Step3: #84 shared deterministic public-output filter/echo protection and localized availability/delivery-gated private path; output regressions replace prompt-only gates, remove planner injection, no paid comparison; verify/review then merge.
Step4: one exact GitHub combined release with verified current rollback, optional controls off/no settings changes; Aryan's how-to/damage/order/private-preview-stop/correction smokes; rollback on failure.
Step5: implementation-accurate customer notice and test-forum pilot checklist, approval required; no flags or implicit enablement.
Only at≤3 open PRs: queued #62 evidence-only presentation fingerprints and #83 deterministic conflict handling. #65 remains open. See full accepted scope; preserve all other product requirements.

October25 accepted review and private-intake draft

Earlier dated checkpoints below are history; these decisions supersede their pending C/A/B instructions, not unfinished product requirements.

October25 — approved queue, Step1 complete

Reconcile Aryan's subsequent main38337e7 deployment7b41e119: SUCCESS/latest/one healthy instance, optional controls off, automatic deployment off. #59 now deployed by the operator, not newly smoke-accepted; fresh rollback verification still precedes the combined release.
One simultaneous main/#59/#75 comparison,81×2 each/concurrency3 per arm; all486 final and6 earlier replies independently read. Original artifacts retained; no invalid rows or paid rerun. Actual first case starts differ by3ms; the original internal1000ms process-launch failure at1507ms remains documented, with independent concurrent-window qualification and full historical-power/source audit.
Step1 cutoff: merge reviewed #59 as 38337e7; close #75 unmerged for four new material findings despite numerical passes. Preserve its branch/tests/evidence and unfinished owner-intent scope. Production was then d550dc1, superseded by Aryan's later deployment recorded above.
#28 local repair: atomic unpublished-comment creation and creator-only first-card attempt; immutable source/ciphertext/revision and filing/unknown fences preserved. Three distinct serial/concurrent follow-ups yield one card in the real handler. Red-before unit/handler/SQL evidence retained; full1086 and disposable SQL pass. Hosted multi-connection PostgreSQL remains required.
#28 local repair: GitHub App identity plus encryption required for approval readiness, fixed value-free boot diagnostic, token-only/incomplete-config tests; ordinary handoff remains usable. Configuration readiness is not proof of provider permissions.
Unknown-result manual-reconciliation runbook updated; metadata-retention issue #85 opened without implementation.
Offline8/final diff and independent code review pass:103 approval/workflow tests,5 handler tests and8 transaction-failure probes. No runtime/security finding; configuration readiness is not live provider authorization and elected card creation is not guaranteed delivery.
Exact committed-head Node20/24/real PostgreSQL CI and final review identity before merge. No release/publication or optional enablement yet.
Then rework #84 once with shared deterministic public-output privacy enforcement, output regressions and no paid comparison; one combined exact-SHA release and Aryan's prescribed smokes follow both decisions. Memory notice/checklist preparation only; no flag until notice approval plus explicit enablement.

October24 — existing #28 current-main integration

Integrate deployed main d550dc1 with both boot workflows, both exported recovery/publication seams and combined approval/reference-memory SQL checks preserved.
Full1063/offline8/diff and disposable PGlite SQL pass. No customer database, Discord/provider call, GitHub publication or settings change.
Independent review reproduced a shared-forum scope inconsistency in automatic staging and missing-source webhook notices. Both actual-owner regressions fail before repair. One shared customerThreadScope predicate now composes matching thread/binding/owner with an unfiltered unique case/customer lookup in all three paths; missing/ambiguous/unavailable proof refuses. Original-source replies remain usable in shared channels.
Repaired tree passes1069/offline8/isolated SQL; scoped independent re-review passes362 affected checks with no remaining finding. Positive fixtures now supply real thread/lookup proof; no existing assertion weakened.
Exact-head hosted Node20/24/multi-connection PostgreSQL, independent privacy/authorization review and affected-flow integration before readiness. Keep draft; decision dueOctober27 does not waive safety.

October24 — existing #59 current-main integration

Integrate deployed main d550dc1, retaining the existing shared persona diff and current source, language, redirect and runtime safeguards.
Full979/offline8 and diff check pass on the integrated tree; source/language/redirect/runtime safeguards remain unchanged by the persona.
Exact-head hosted CI and independent code review, then its own representative generated-answer comparison/functional checks. Keep draft; no evidence or release gate waived.

October24 production fix B — rejected-review language

Reproduce de/fr/es English-body/localized-footer failure with original real-handler and evaluation-wrapper tests; unknown language retains English by design.
One shared copy table/helper; use the existing replyLanguage in the handler and same planner language/script in the evaluation mirror. No provider/network/protected inputs in regressions.
Full suite, no-model evaluation, exact-head Node20/24/Postgres CI and independent review before readiness/merge.
Integrate the separately reviewed production fix A/main 16ee8ca with a merge commit; both document scopes preserved. Rerun affected/current gates before publishing.
Only after A/B merge: verified-current rollback, exact GitHub deploy, optional features off; Aryan's German-handoff and redirect-cleanup smokes. Failure means rollback.
C accuracy/excerpt guard remains separate: review before the single simultaneous three-arm comparison; #71 is not approved. #28 and memory-pilot gates remain separate.

October24 reviewer follow-up — deterministic production fixes first

Record #71 NOT APPROVED in the PR; retain conditional latency waiver and all outputs without unchanged paid rerun.
A: reproduce orphaned redirect clauses/following sentences on main with original synthetic red-before tests; implement shared reference cleanup preserving sources, warnings, noun-led context and prior attempts.
A/#80: full965/offline8, exact-head Node20/24/Postgres CI40085949902 and independent review198 focused/23 adversarial assertions pass; merged 16ee8ca, not deployed.
B: separate draft for shared de/fr/es/unknown-safe review-rejection copy and real handler/eval parity; same offline/CI/review gates, then merge commit.
After both merge: exact GitHub deployment, verified current rollback, optional features off; Aryan sends German handoff and redirect-cleanup smoke. Roll back on failure.
C after A/B merges: general excerpt/absence/customer-data-claim fix; review before provider run, then one simultaneous three-arm comparison with result-only flagged-answer package.
Preserve #28 October27 decision and separate memory-pilot gates. Cap exceptions are the explicitly authorised production fixes, not a general queue waiver.

Current October23 — release smoke accepted

English sourced ordinary answer, private refund delivery and controlled same-commit Redeploy pass. One reply after SIGTERM, clean drain, old instance observed gone after69.197s, stable30s; live6a815fbf/GitHub6b6d97d, optional features off.
Merge approved #67 as94e4f57 after verifying automatic deploys remain off; no code deploy.
Integrate #67 into #74 as7860417; reviewed privacy files unchanged,952/offline8/SQL and independent298-check integration review pass.
Pass exact-head hosted checks, then merge approved #74. No privacy enablement or new code deployment from this alone.
Finish #71's guarded/shared-page repair and simultaneous-arm comparison; fix the named timing test separately without wall-clock-dependent expectations.

October23 local integration — #74, not released

Integrate released main6b6d97d without changing the reviewed owner/forum erasure semantics or the answer/recovery/provider controls. Resolve five document conflicts while preserving the dedicated privacy design and main's current requirements.
Preserve owner-derived nullable case scope/non-rebinding, commit-before-ack opt-out, independent facts/other scopes, late/new-case writer fences, mandatory retry, bounds and strict legacy/orphan refusal. Original red-before evidence remains atdfc1398.
Local916 tests/offline8/combinedSQL pass, including scoped privacy, retention, two-worker recovery and eight reference-reader groups. No customer data, protected file, provider call or production write.
After the pending release smokes, publish the integration for current-head CI and integration review before readiness. Original notice/privacy/security/backup/processor/pilot gates remain; do not enable memory from this preparation.

Latest October23 #67 review correction

Integrate released main6b6d97d via merge commitdc79d80; preserve code and unfinished scope.
Confirm frozen comparison main5bafe93/candidatef2781eb share the exact base; record full SHAs in the PR/design.
Twenty-five new original regressions fail against pre-repair utilities, then pass: four languages, ordinary/delivered helpers and actual handlers, Source/secret-warning/failed-delivery preservation, intake-tail safety and shared source-label emptiness.
Full943, offline8, isolated SQL and final independent185-check review pass. Routing/prompts/evidence budgets/recovery fences and optional defaults unchanged.
Publish current-head hosted checks in the draft PR. No merge/deploy until deferred release smokes pass.
Leave #77 draft until #67 merges, then remove overlapping redirect work; leave #78 untouched until drain review. Keep #62's narration/stage-evidence remainder.

Separate no-email-redirect draft

Observe red-before ordinary-answer, redirect-only handoff, clause-preservation and follow-up regressions; implement in the existing delivery/routing pipeline.
Focused checks prove ordinary response → still-failing current-post feedback → actual staff delivery; preserve sources, warnings, failed-delivery fallback, localization and unknown-language safety.
Local full 850/850, offline 8/8 and isolated SQL pass before push.
Publish hosted CI; independent comparison/review remain required. No deploy or memory pilot while the combined-release smoke findings #65/#66 are unresolved.
Keep #62 open for its remaining narration and evaluation-stage evidence requirements; do not auto-close it from this partial repair.

October 23 finish queue

Merge reviewed #69/#73/#49 safely; production unchanged.
Repair #68 fallback-language metadata and final-review mismatch; current-head tests/CI and independent code review pass. Targeted generated-answer evidence remains before readiness.
Reproduce #70 duplicate-send and blocked-sweep failures, then repair ownership-unknown deferral/no-replay and independent recovery dispatch in the existing PR.
Complete #70 final checks, real PostgreSQL two-worker failure/recovery evidence and independent review. Keep #29 receipts/held alerts and remaining queue explicit; no new PR or rollout.

October 23 answer-quality priorities

Finish every existing PR, without count-driven decisions

Audit all 13 open PRs, their exact heads/checks and dependency/conflict state. Preserve existing local #29 edits.
Complete independent #69/#73 review and appropriate documentation/integration verification; no bot deployment or memory enablement required for those scopes.
Independently review #68's full existing output package: timing passes; no new protected-handoff miss or clipped item found; language fallback and factual-quality disposition remain open. Keep draft.
Independently review #70 and reproduce duplicate-delivery/recovery-loop gaps with synthetic workers. Keep draft; existing green checks do not cover these failures.
Independently review #49 as a disabled foundation under the updated risk-based policy: no actionable findings, focused/isolated SQL/exact-head hosted PostgreSQL pass. Separate unfinished enablement gates remain.
Complete #74's disabled-foundation privacy review: no actionable findings, fresh 76 affected tests/isolated SQL pass and exact-head real PostgreSQL execution confirmed. Parent integration/current-head checks still precede merge; enablement remains separately gated.
Continue the remaining reviews serially. Correct actual findings in existing PRs; merge verified useful work or close obsolete/duplicated work with durable rationale, never simply to lower the count.
Verify that main merges cannot trigger an unapproved deployment. Current Railway branch lookup/CLI session cannot establish an explicit OFF state; no settings or deployment changes made.

The master plan controls the finish-existing queue and all nine answer-quality themes. #68's independent grade is now HOLD, so its fallback gap needs repair; #70 also has reproduced recovery/delivery findings. Finish existing PRs with risk-appropriate verification and review, not new feature drafts. Customer-intent work #75 is not live; all remaining ownership, diagnostic, source, safety, hardware/surface and humane-copy requirements remain. No raw audit/transcript is published or release/privacy gate waived. Score 47/100 records milestone 18's independent foundation review only, not answer accuracy or enablement.

October 21: scoped forgetting draft, stacked on #49

Publish draft #74 dfc1398 from #49 3f83024, keeping the parent review head separate. Store only additive case server/forum metadata from current configured-post owner scope; preserve known scope and existing case state.
Persist forum memory erasure/opt-out first, then remove verified correction links/extra owned markers. Preserve facts and other scopes; fence late/new-case references and let mandatory cleanup retry scoped opted-out links. Unknown legacy/post/orphan scope and partial/error results never confirm complete deletion.
Restore interrupted uncommitted work into a permanent workspace and rerun evidence: local 887/offline8/PGlite pass. Nine new tests include eight observed baseline failures; SQL baseline and additional strict-scope/orphan-marker regressions fail before repair. SQL covers 101-fact batching, real memory-command/service/store composition, new/late/concurrent writers, retry, idempotence and legacy refusal.
Exact-head Node 20/24/real PostgreSQL CI 39554963703 passes. The database log confirms the new privacy checks ran at dfc1398; PGlite alone is not claimed as multi-connection proof.
Parent/child disabled-foundation review completed October 23 with no actionable findings; current review evidence is recorded above. This supersedes the October 21 review-pending checkpoint.
Resolve remaining legacy/privacy/security/backup/data-use/pilot gates. Real ingestion/validator, signals/UI and nightly/weekly jobs remain unfinished. No provider/protected run, main merge, deploy or enablement. Current score is 47/100 for #49's foundation review only; full acceptance 2/21.

October 21: reviewed-fact draft integration and mandatory retention

Merge deployed main 5bafe93 into existing draft #49 as 141e718, preserving reference-only memory, closing-language schema/checks and the off-only prompt guard. Integrated baseline 869 tests/isolated SQL pass.
Push 3f83024: mandatory tracked startup/minute expiry, at most 100 facts/1,000 expired barriers per pass, active-barrier protection, fresh-row locking, fixed failure retry and shutdown checks. Approved facts and concurrent revocation survive; optional publication stays off. Transaction-local server deadlines are not a whole-operation/network guarantee.
Local 878/offline8/PGlite and exact-head hosted Node 20/24/real PostgreSQL run 39549961373 pass; the database log confirms global batching/restart/active-barrier/concurrent-revocation checks ran. Nine new focused checks include eight observed red assertions; static wiring/query assertions are not live tests.
Independent review of #49's disabled foundation completed October 23; focused/SQL/hosted evidence is recorded above. No daily-inbox or enablement approval follows.
Remaining D1–D6 implementation: real official-evidence/regression validator, minimized owner-scoped signals/drafts, staff controls, ownership-verified privacy adapter integration, nightly alerts and weekly counts. No new comparison, fact publication, merge to main, deploy or enablement; current score 47/100, acceptance 2/21.

October 21: test-only memory SQL/reader preparation

Publish draft #73 c2953f2 from main: existing guarded verifier now composes SQL storage/service and live-context reader against synthetic fixtures. Eight groups cover scope/role boundaries, uncached edits, reader recreation, deleted-reference outcome invalidation, off-switch forgetting, persistent opt-out/expiry and text-free rows before erasure.
Local 839/offline8/PGlite pass. Real PostgreSQL plus Node 20/24 CI run 39546418506 passes at the exact head; its database log confirms all eight groups executed. Five in-memory faults are rejected while the baseline passes; runtime files stay untouched.
Independent review of #73 c2953f2 found no actionable issues; exact-head PostgreSQL/Node 20/24 CI and execution of all eight groups were independently confirmed. October 23 fresh 839 tests, isolated SQL/reader baseline and five deliberate-fault checks pass without runtime edits or external calls. Record final readiness evidence in the PR.
C1–C4 remain open: no enabled generated answers, full bot restart/pilot, processor/backup/security/notice approval or memory switch change is implied. Keep all earlier comparison and later learning/reliability gates intact; score remains 46/100.

October 21: separate redirect and planner comparisons

Fresh exact-head local checks: #67 f2781eb 850 tests; #68 1ffae62 845; both offline8, isolated SQL and hosted Node 20/24/Postgres pass. Preserve clean frozen source and identical baseline harness/judge/lockfile.
Aryan confirms two more hours open/plugged in. Launch one sequential keep-awake supervisor: #67 five-case timing check starts 07:51:48 IST, fresh main/candidate arms follow, then independent #68 check. No overlapping provider jobs or Discord posts.
Reproduce the shared response-body timeout gap locally, without credentials/customer/protected inputs. Save wider coherent answer/review deadline work as parked #72; do not assign it as the proven historical slowdown cause.
Finish #67's complete same-day 81×2 arms/concurrency3 and export both JSONs, all five changed cases, word counts and audits in a twelve-file private ZIP. Zero invalid rows or interruption; full host coverage records no system sleep. Preserve the failed p50 gate (30.255→32.455 s, +2.200 versus +2 allowed) and increased missing-handoff flags (4→6); independent grade and a passing release gate remain required.
Finish #68's own fresh main/candidate comparison: both 162 rows, zero invalid/unscored, no interruption/retry. p50 34.503→32.450 s; p95 57.020→54.446 s meets no-rise rule. Missing-handoff flags 5→6 still require independent review; numerical success is not a grade.
Audit both complete runs, generate twelve-file private review ZIPs with all changed replies/signals/problems and words, and update the simple master status. Both full host histories record no system sleep; immutable hashes/archive/known-secret scans pass. Read-only production is still accepted 13ead500 / 5bafe93, healthy/one instance/optional off. No merge/deploy/settings/memory changes; #71 not rerun.
Record #68's four deadline fallbacks separately from two generic planning failures. Per-row planning totals sum turns; maximum single-turn stage 20.007 s. Keep all rows and state the whole-answer budget remains #72, not solved by this draft.
Obtain independent grades of #67/#68, including increased missing flags and protected topics; clear #67's failed p50 gate before any rollout. Keep #70/#71 and memory/pilot gates distinct. No new provider run is authorized by this checklist.

October 21: multipart comparison complete, release held

Both full arms complete on October 20 UTC/IST: 162 rows each, 81 cases/two runs/concurrency three, no invalid/unscored rows, no process signal/stop, normal structural-failure exit 1. Source/input-metadata/lockfile guards hold; known-secret scan zero.
Audit full power history: zero recorded system sleep/wake/DarkWake events; max clock drift 45 ms, longest heartbeat gap 54.104 s. Preserve every slow/error row.
Generate and verify both JSONs, all five changed cases' verbatim replies/signals/problems, word counts and an eleven-file private review ZIP. No protected case file or raw logs attached.
Record the failed p95 gate: 42.508 → 61.332 s (+18.824 versus +6 allowed). Pass-both 71→72, unwanted flags 10→10, missing flags 5→5; no independent safety/quality approval inferred.
Read-only production recheck October 21: accepted 13ead500 / GitHub 5bafe93 remains healthy/latest/one instance; all optional controls off. No deploy/settings/permission/Discord writes.
Diagnose remote timeouts/transport failures before any rerun; existing logs do not prove whether patch, remote services or local scheduling explain the aggregate slowdown. Do not tune from protected cases.
Obtain independent per-case grading and clear the failed timing gate before any #71 merge/deploy. #70 review, #67/#68 comparisons, memory/pilot and remaining product checks retain their separate gates.

Historical implementation checkpoints — not the current work queue

Unchecked steps and "not started" statements here describe their dated checkpoints. Later completion records above supersede them; they do not undo completed work or authorize reruns. Preserve the remaining release/security requirements after this archive.

October 20: post-release multipart preparation — historical checkpoints

Preserve the first complete six synthetic rows: main 5bafe93 complete answers 0/3; candidate 21b21b1 2/3; zero provider-invalid rows. Full comparison not started.
Trace actual answer/reviewer evidence, reproduce overlapping match loss with two general non-phone tests and repair within the same four-page/eight-chunk/9,000-character/search limits. Draft baec24d: 850 local, offline8, isolated SQL and hosted Node 20/24/Postgres pass.
Complete and review all six fresh synthetic rows against frozen revised candidate: main 0/3, candidate 3/3, zero invalid rows and identical official corpus fingerprint; files and manual assessment in /Users/astar/omi-eval/multipart-recheck-20261020/. No selective failed-row retry.
Launch under caffeinate after AC/open-lid checks and five serial timing cases all below 90 s; zero invalid rows, normal exit 1 for structural flags, not a crash. Main full arm started 22:46 IST; candidate follows.
Main finishes all 162 rows at 23:10:40 IST: zero invalid rows, no signal/interruption, normal structural-failure exit 1, max clock drift 9 ms. Candidate starts at that checkpoint; its completion/grade are pending. One preflight structural permission-concept failure is retained, not presented as five quality passes.
Finish and preserve the standard fresh same-day comparison; it fails the p95 threshold as recorded above. Independent review and a passing release gate are still open; completion of the run is not approval.

Current October 20 retry and separate drafts

Latest regression/restart diagnosis — October 19

Run the exact operator-authored multipart phone-only smoke 3 times each against frozen 7fe0e0a and 5bafe93, same live harness/corpus; no Discord/private/protected input. All six fail phone-only startup, zero invalid rows. Preserve planner parts, selected URLs/projection limits, replies and timings privately.
Classify #65 as pre-existing under the requested rule; no merge bisect. Keep the general fix forward separate from the reviewed combination.
Write three structurally different two/three-part regression variants with generated synthetic URLs; observe all three red on both sources before any repair. Local branch fix/phone-only-multipart; no runtime edits, commit/push or passing-fix claim yet.
Read both restart windows/configuration/snapshots/events. Draining is 100 s in both and current service; no environment override. Record identifiable old-process markers and replacement logins, same-tag limit, absent historical exit reason, and documentation's lack of manual-Restart grace guarantee. Do not assert proven 20 s SIGKILL or change a setting blindly.
Report Steps 1–2 before any faster-pickup implementation. No Discord posts/deploys/restarts/settings changes. #67/#68 remain drafts; comparisons use 5bafe93 after baseline decision, none started.
Then separate fix/faster-abandoned-pickup: ~45 s dead-owner recovery, live 30 s stall not taken over, delivery-started never resent; preserve assertOwned/markDelivering/uncertain fences and run verify-support-db. Not started at this checkpoint.

Evidence: /Users/astar/omi-eval/phone-only-20261019/comparison-and-restart-report.md plus both result JSONs. Product score remains 45/100 and full A–E acceptance 2/21. No new acceptance or production change is inferred.

Current combined-release integration — October 19

Latest operational checkpoint — October 19

Stop the health-only wait at Aryan's request; pause the existing report through the app and verify PAUSED. No replacement schedule.
Produce final counts-only partial-duration report: /Users/astar/omi-eval/health-summary-20261019-final.md; 19 h 49 min after restart, nine answer events, zero staff-failure lines, one known read error, p50/p95 44.625/101.520 s. Current health OK; exact sends/fallbacks/crashes unavailable. Not a full-day pass.
Resume approved #60 → #48 → #61 integration and final-SHA tests/hosted CI/SQL, exact GitHub commit/rollback verification, then approved release/smoke. No feature merge/deployment performed by the health report. Other release, privacy and memory-pilot gates remain; older 15:55 health-wait text below is superseded by the explicit stop request.

Latest review checkpoint — October 18

Run Aryan's early read-only health comparison now; preserve counts/coverage/limitations in /Users/astar/omi-eval/health-summary-20261018-interim.md. Only 6 h 11 min after restart, not a full 24-hour pass. Current health OK, optional flags/auto-deploy/PR previews off; no production or GitHub mutations. The full October 19 report and release gate remain unfinished. #60/#48/#61 are already ready; #44/#35 closed; parked labels remain unapplied.
Independent reviewer approved #64; merge test-only repair into main now with a merge commit (adf016c). Automatic deployment disabled; no deploy/runtime change. Fresh local 755/offline8 and hosted checks pass.
Merge exact main adf016c into #61 as bc793cc with snapshot guard intact, preserve both records in documentation conflicts, then verify/push full 792/offline8/isolated SQL; fresh hosted Node 20/24/Postgres run 39142032614 passes. This is not the later #61-to-main merge; no deploy or enablement.

Main's test-only follow-up (#63/#64) is preserved here: controlled callbacks replace the typing test's wall-clock assumption while retaining interval, notification, unref/clear, late-stop and cleanup coverage. No customer behavior changes. Earlier review-pending entries below are historical; #64 needs no repeated approval.

Record independent approvals: #60; #48's completed comparison with accepted non-protected flags; #61 code with memory off. Published heads/hosted checks were reverified; no merge or deployment.
Read the live product source: Apple Watch recording support is explicitly present. Diagnose available short-answer evidence without opening protected inputs; reproduce two unchanged whole-sentence filter erasure paths in four synthetic checks and track #62.
Exact historical answer-loss stage: unavailable from saved final-only logs; do not claim the synthetic path proves it. Preserve the evidence limit for release review.
Record the explicit off-only #61 comparison waiver; no provider run is claimed passed. Add one baseline-snapshot regression for histories 0/3/24/30/60 and all five requested boundaries. Eight focused/full 792/offline8/isolated SQL pass; five in-memory mutations each trigger the guard.
Commit/push the parity regression as #61 9dfd18a; it passes in hosted Node 20/24. No runtime behavior change; enabled memory scenario/pilot remains mandatory.
Overall CI: review/integrate separate test-only #64 (#63), not a third blind rerun. The existing typing timer-count assertion fails twice on Node 20. Repair branch 8b6dc75 passes local 755/focused2/offline8/SQL and hosted Node 20/24/Postgres run 39140603602; independent review/integration remains. No main merge approval follows from the other reviewed PRs.
October 19 after 15:54 IST, health summary first; then merge #60 → #48 → #61, verify final-SHA tests/CI/SQL and deploy from GitHub with rollback e1f76a93, flags off. Aryan submits five live smoke scenarios; failure rolls back.
After release, one-problem no-email-redirect PR with truthful same-thread follow-up escalation, red-before tests and separate new-baseline comparison; persona comparison stays separate.
No earlier than 24 clean hours after that release and required data-use checks, enable test-forum-only memory/context for the scripted pilot. Public expansion still needs 48 clean pilot hours, functional checks, notice and review.

This supersedes older pending-review/no-timer statuses below, not the full A–E product checklist. Score 45/100 reflects three review points; full acceptance remains 2/21 and nothing new is live.

The controlling product acceptance checklist is SUPPORT_MASTER_PLAN.md. This file maps implementation details; checked engineering work does not complete the product's live acceptance. Maintain the A–E workstreams across reviews and preserve unfinished work and gates. Release 1 (#47) is deployed from approved main 7fe0e0a as e1f76a93; all six requested smoke checks pass, including observed typing and a one-reply graceful in-flight restart. This documentation does not change its runtime or establish global exactly-once delivery.

Current serial order: report Release 1 first; then fix/closing-language-no-case (language codes only, durable owner-bound thread scope, 30-day expiry, English fallback on database failure, draft review only); then #48's fresh comparison against deployed 7fe0e0a; then #59's requested calm/warm/practical revision, with its comparison held for #48 grading. #28/#29/#49 are held until items 1–3 finish. This explicitly supersedes the earlier parking of #50, without discarding other backlog work. No new deployment before October 19 after 15:54 IST without Aryan's exception.

Latest October 18 override: reviewer accepted Release 1 6/6, and Aryan explicitly waived the fixed 24-hour wait. No new candidate is ready yet; tests, quality grading and review still apply. The closing-language branch is in inspection, not implemented/tested. A one-off read-only 24-hour health comparison is scheduled October 19 at 15:55 IST. Future releases deploy from the GitHub commit so Railway records the hash; no local upload.

Subsequent evidence: closing-language draft #60 (7b15974) is implemented, with 771 local tests, offline 8/8, isolated SQL and hosted Node 20/24/Postgres passes. Eight behavior regressions failed before repair and schema verification failed before registration; independent review/merge/live smoke remain open. Language-only owner-scoped persistence, existing script selection, case precedence, fallback, deletion and expiry are covered without enabling memory. #48's separately frozen comparison is running the timing preflight; no completed arm or quality grade yet. Keep #59's comparison held until that grade and preserve the other queued work.

The ranking timing preflight has since completed (5/5 below 90 seconds, no provider-invalid rows); the baseline full arm is running. The private result-only report formatter passes six synthetic integrity checks, including both runs' verbatim replies/signals and rejection of incomplete coverage, changed source, sleep or known-secret matches. No frozen harness/judge/runtime was modified, no sealed input inspected, and this does not complete the quality gate or change the 38/100 delivery score.

Baseline is now complete: 162 valid rows covering 81 cases × two, no process interruption; two slow rows remain included. Candidate arm is running under the same verified process handle. Do not mark the comparison/grade complete or start #59's comparison from this intermediate state.

Subsequent final checkpoint: both ranking arms completed 162 rows, zero provider-invalid rows, frozen provenance and continuous host evidence. Result-only formatter and secret scan passed; both JSONs, seven changed cases with verbatim replies/signals/problems and word-count summary are ready privately. Numerical limits pass, but pass-both is 73 → 71, flakiness 1 → 5 and missing-handoff flags 2 → 5. Independent grade is still required; no merge/deploy. Next is #59's calm/warm/practical wording and visible AI label, with its own comparison held until #48 is graded. #60 also still requires independent review. No score or optional-flag change.

Deferred work has durable GitHub issue links and resumption gates, #50–#58. #50 is now the next scoped draft, not completed; #51–#58 remain parked. Existing queued PRs remain their trackers. Do not resume deferred access, retention, security or delivery work merely because its issue is open. Older checkpoints remain implementation history.

#59 wording correction — local preparation complete, release held

Replace elegant/charming instructions with calm, warm and practical in the existing shared answer/reviewer contract; keep all safety, serious-case, source, language and concise-answer boundaries.
Retain visible Mira · Omi AI support; no avatar or live-profile change. Six observed red assertions, then eight focused, 760 full and offline 8/8 passes, including two new regressions.
Push runtime 698609f with a fresh full npm test; hosted Node 20/24/Postgres run 39125817220 passes.
Independent review. Run its own answer comparison only after #48 is graded; no merge/deploy from local/hosted tests or the waived deployment timer alone. Test-only CI follow-up (#63): replace the typing regression's wall-clock callback-count assumption with a controlled interval in test/index.test.js. Preserve initial notification, periodic refresh, default 8-second interval, stop/late-callback and cleanup assertions; keep the separate cosmetic-failure answer test. No runtime, routing, prompt, source, memory or release behavior changes. Verify full tests/offline/hosted checks and obtain independent review before merging this repair; do not mask either failed hosted attempt.
Independent reviewer approved #64; merge test-only repair into main now with a merge commit (adf016c). Automatic deployment disabled; no deploy/runtime change. Fresh local 755/offline8 and hosted checks pass.
Merge that exact main commit into #61 with its snapshot guard intact, resolve documentation-only conflicts, then verify/push fresh full tests/offline/SQL and hosted CI. This is not the later #61-to-main merge.

Record independent approvals: #60; #48's completed comparison with accepted non-protected flags; #61 code with memory off. Published heads/hosted checks were reverified; no merge or deployment.
Read the live product source: Apple Watch recording support is explicitly present. Diagnose available short-answer evidence without opening protected inputs; reproduce two unchanged whole-sentence filter erasure paths in four synthetic checks and track #62.
Exact historical answer-loss stage: unavailable from saved final-only logs; do not claim the synthetic path proves it. Preserve the evidence limit for release review.
Record the explicit off-only #61 comparison waiver; no provider run is claimed passed. Add one baseline-snapshot regression for histories 0/3/24/30/60 and all five requested boundaries. Eight focused/full 792/offline8/isolated SQL pass; five in-memory mutations each trigger the guard.
Commit/push the parity regression as #61 9dfd18a; it passes in hosted Node 20/24. No runtime behavior change; enabled memory scenario/pilot remains mandatory.
Overall CI: review/integrate separate test-only #64 (#63), not a third blind rerun. The existing typing timer-count assertion fails twice on Node 20. Repair branch 8b6dc75 passes local 755/focused2/offline8/SQL and hosted Node 20/24/Postgres run 39140603602; independent review/integration remains. No main merge approval follows from the other reviewed PRs.
October 19 after 15:54 IST, health summary first; then merge #60 → #48 → #61, verify final-SHA tests/CI/SQL and deploy from GitHub with rollback e1f76a93, flags off. Aryan submits five live smoke scenarios; failure rolls back.
After release, one-problem no-email-redirect PR with truthful same-thread follow-up escalation, red-before tests and separate new-baseline comparison; persona comparison stays separate.
No earlier than 24 clean hours after that release and required data-use checks, enable test-forum-only memory/context for the scripted pilot. Public expansion still needs 48 clean pilot hours, functional checks, notice and review.

This supersedes older pending-review/no-timer statuses below, not the full A–E product checklist. Score 45/100 reflects three review points; full acceptance remains 2/21 and nothing new is live.

#59 wording correction — local preparation complete, release held

Replace elegant/charming instructions with calm, warm and practical in the existing shared answer/reviewer contract; keep all safety, serious-case, source, language and concise-answer boundaries.
Retain visible Mira · Omi AI support; no avatar or live-profile change. Six observed red assertions, then eight focused, 760 full and offline 8/8 passes, including two new regressions.
Push runtime 698609f with a fresh full npm test; hosted Node 20/24/Postgres run 39125817220 passes.
Independent review. Run its own answer comparison only after #48 is graded; no merge/deploy from local/hosted tests or the waived deployment timer alone.

October 18: #28 integrates deployed main 7fe0e0a; 844 unit tests, offline 8/8, isolated SQL, hosted Node 20/24/Postgres at runtime merge 758808a and the fresh production-configured read-only staff audience gate pass. Independent re-review remains pending. Earlier October 12 audience rejection is historical, not a request for another permissions change. Release 1 live smoke still precedes another deployment. All memory/context/inbox switches stay off.

The controlling product acceptance checklist is SUPPORT_MASTER_PLAN.md. This file maps implementation details; checked engineering work does not complete the product's live acceptance. Maintain the A–E workstreams across second-opinion reviews and preserve unfinished work, authorization blockers and the next concrete step. The current combined runtime candidate is #47; this documentation update does not alter its frozen comparison.

Implement the architecture incrementally, retaining the working answer/review, official retrieval, public commands and private staff delivery. The roadmap is the authoritative progress record. Reports 1–3 passed. The retained #43 release record has localization deployed at dad2505, but its live close/reopen smoke is still pending; this branch does not recheck production. The support-experience foundation below is a separate draft. Each runtime change needs regression checks and release verification. No cloud access grants accompany this work.

Release and security prerequisites

The dated implementation evidence below does not authorize a new deployment or enablement. Remaining privacy, security, review and pilot prerequisites still apply; use the current master plan to distinguish completed code from open acceptance work.

Release 2 bounded reader checkpoint — local checks pass

Integrate at most two other same-owner/forum/guild posts with uncached live validation, role-ranked last three owner messages/last bot reply, deletion retirement and explicit unknown outcomes after supporting-message deletion.
Bound extra work to 1.5 seconds and three underlying operations, including timed-out ones. Preserve current-post context on DB/Discord errors, timeout, opt-out or disabled switches, with fixed metadata logs only.
Retain application-owned context markers through clipping; isolate earlier posts from routing/search/official evidence and label them in answer/review. Verify real handler plumbing and a normal reply during an optional DB failure.
Observe 17 red-before checks across 27 new tests; 62 focused plus two handler checks, full 791, offline 8/8 and isolated SQL pass. Bounded-reader Built/Tested only: 42/100; full acceptance stays 2/21.
Publish draft #61 at runtime d447f6f; hosted Node 20/24/Postgres run 39128548042 passes after fresh 791-test/offline/isolated-SQL evidence.
Read-only synthetic parity prescreen against clean deployed main: 21 identical prompt pairs and six identical stubbed intent/reviewer request-body pairs, zero network calls. This does not replace the full comparison.
Required fresh memory-off comparison and independent review. Generated answer quality, enabled two-post scenario, data-use gates and test-only pilot remain unproven; no merge/deploy/enablement.

Release 2 storage checkpoint — local only

Create feat/memory-references from verified deployed/current main 7fe0e0a, preserving held branches and dirty documents.
Store reference fields only; remove memory's key dependency without changing identity/order encryption. Upgrade legacy-shaped rows repeatedly and retain text-free outcomes/opt-outs safely.
Serialize forum-wide erasure against capture/signals; erase attributable deletion markers and retain only minimal opt-out. Verify creation-based expiry, disabled-feature cleanup and persistent suppression.
Observe red-before checks, then 764 local tests, focused 37, offline 8/8 and isolated SQL passes. Store milestone Built/Tested only: 40/100; no new full A–E acceptance.
Complete owner-validated two-post live context, 1.5-second deadline/fallback and explicit conversation_only prompt separation. Then hosted CI/local multi-connection SQL, authorized comparison and independent review before any merge/rollout.
Controlled test-only context scenario and 48-hour clean pilot with functional checks, followed by reviewed public expansion. Nothing is pushed, merged, deployed or enabled at this checkpoint.

October 18 current order and closing-language draft

Release 1 deployed from approved main 7fe0e0a; reviewer accepted all six live checks. Optional flags off, rollback retained.
Reproduce no-case Spanish/Chinese closure and missing language-save/delete handling before the fix; register an additive text-free preference schema.
Reuse planner language and existing Hindi script rule, scoped to the post owner; case → thread → English fallback, never staff locale or process memory.
Language-save/read failures cannot cause a second answer or fail closure; fixed metadata logs only. Preserve existing case-state no-archive safeguards.
Thread-delete erasure, bounded expiry pruning and restart/owner-isolation SQL checks, with no optional memory dependency.
Local 771 tests, offline 8/8 and isolated SQL pass.
Hosted CI, independent draft review and separate rollout/smoke. Not merged/deployed.
Next: #48 fresh same-day deployed-main comparison, then #59 calm/warm/practical wording; personality comparison waits for ranking grade. #28/#29/#49 remain held.

Aryan waived the 24-hour timer, not the other gates. The counts-only read-only 24-hour health comparison is scheduled October 19 at 15:55 IST. Future deployments use the GitHub commit for recorded provenance, not a local upload. The detailed older unchecked Release 1 checkpoints below are historical, superseded by its accepted rollout above.

Mira's identity and personality — requested October 18

Apply the specifically authorized short account/server name and fictional portrait, preserving explicit AI disclosure in the profile; verify by fresh REST reads. No runtime deployment or data-use change.
Revise the shared persona to calm, warm and practical, retaining visible Mira · Omi AI support and all safety, evidence, language, serious-case and truthful-capability limits. Six observed red assertions before this correction; eight focused, 760 full tests and offline 8/8 pass afterward. This supersedes the earlier short-name/elegant-persona preparation.
Record primary conversation-design research, fictional-image prompt/provenance and the limitations of prompt-presence tests.
Push correction runtime 698609f after full npm test; hosted Node 20/24/Postgres run 39125817220 passes.
Independent review, required quality checks and controlled release before claiming the changed voice is live. Release 1's accepted restart already restored the full AI-labelled nickname. Hold #59's comparison until #48 is graded; the waived 24-hour delay removes no other gate.

Combined Release 1 (updated October 17 brief)

Recheck and merge #46 with a merge commit, without deploying.
Merge #45 and #42 into an isolated release candidate; preserve live closing-card localization and quiet/mention behavior.
Replace competing character-budget instructions with the shared concise voice; navigation/conditional and actual-failure regressions pass.
Preserve whole-item clipping, evidence caps, multipart coverage and damage intake; memory stays disabled.
Fresh same-day main/candidate 81×2 comparison, concurrency three, awake host, exact provenance and actual per-case signals/replies; provide all artifacts and word-count summary.
Independent grading before release merge/deployment. Private memory pilot and fix inbox remain later releases with their own approval/privacy gates.

October 17 support-experience draft

The encrypted-text implementation below is historical implementation evidence, not the Release 2 enablement plan. Aryan's October 18 references-only brief supersedes it; keep it off until replaced.

Release 2 references-only replacement — after Release 1 deployment

Record Aryan's 30-day memory approval and assignment as daily fix-card reviewer; inspect that saved text is not used as the reply context.
Create feat/memory-references from deployed main, one customer failure per PR: repeating earlier attempts in a new post.
Replace encrypted text with expiring scoped references/text-free outcomes; idempotently remove old text/ciphertext/IV/tag. Preserve unrelated identity encryption and never require its key for support memory.
Retrieve at most two other same-owner posts in the same forum/guild; live title, three owner messages and last bot reply only, plus outcome; conversation_only, never official evidence. Total extra-work deadline 1.5 seconds; database/Discord failure uses current-post history and does not affect /health.
Customer/forum-wide erase plus persistent opt-out, including queued writes/restart; deletes, bulk/thread deletes and 30-day expiry remain active with all switches off. Verify no memory table retains text and no other customer's context is used.
Observe red/green behavior tests; full suite, hosted CI, local Postgres; fresh same-day main/branch 81×2/concurrency-three comparison with memory off. Independent grade before merge/deploy; keep protected inputs sealed.
Verify the scripted two-post attempted-step scenario in an explicitly approved isolated candidate runtime or post-review test-only deployment; never bypass review with a second production worker. Report enabled-context results separately from memory-off quality results.
Test-only rollout after review, at least 48 clean hours plus deletion/restart/timeout/switch checks, then reviewed help-forum expansion and the exact published notice. No reference-memory code or rollout exists yet.

Isolated confidence/source-fit correction — draft preparation

Phase 1 Durable workflows without new backend access

Acceptance: restart during OTP, overlapping copies, provider slowdown, failed/uncertain sends, repeated webhooks, staff-button use after restart and termination during a reply produce neither false completion nor uncontrolled duplicate work. Existing customer routing/privacy regressions stay green.

Access prerequisites before metadata diagnostics

After #26 and separately verified #28, add the reviewed public known-issues/releases list and product facts sheet, with official sources, versions, review/freshness ownership and deployment evidence.
Use AGENTS.md's support voice without inventing access, receipt, acceptance, investigations or outcomes. Runtime prompt/canned-answer changes require the full protected gate.
For each new adapter, define a fixed allowlist, customer/case authorization where needed, consent, limits, kill switch and metadata-only audit; validate synthetically, then pilot in the private staff card before reviewed customer enablement.
Extend order facts only through exact-owner-verified private/ephemeral delivery, never a normal customer-thread message or model prompt. Keep existing /order self-service enabled; do not add order/account writes.
Obtain backend-team agreement and privacy review before linked-account metadata/sign-in implementation. Define available/stale/unknown states for device/version/sync/plan and any provable unsynced count; exclude content and unrelated customers.
Follow the remaining staged order: reviewed/gated #42 → reviewed closing-card localization → reviewed/private-preflight #28 → reviewed #29 → reviewed #30. The previous two-week go/no-go order is superseded, not a reason to bypass review. Keep deployments separate, with 24 clean hours unless Aryan explicitly says go; add only the authorized phase corrections. Other open queue/monitoring/retention work remains deferred.

Phase 2 Verified metadata diagnostics

Implement Omi sign-in and a short-lived support diagnostic grant with customer, case, scope, expiry, consent and revocation. Do not substitute Shopify OTP or a chat-supplied UID.
Add backend-owned, pure read projections for recording-session bindings, upload/sync jobs, conversation finalization and storage metadata. Reads must not decrypt content, download audio, enqueue work or mutate stale-job state.
Define a typed response with observation time, status, evidence and uncertainty. Return only allowlisted fields; exclude raw logs, content, URLs to private objects and credentials.
Authenticate the bot to this one capability. Avoid broad backend/MCP keys and cloud roles. If log correlation becomes necessary, authorize the gateway identity to an approved log view, not the Discord/model process.
Make identity, ownership and output checks deterministic. Reject cross-customer handles and excessive time/result windows. Rate-limit verification and diagnostics independently.
Deliver verified private results ephemerally or through an authenticated support page. Public posts contain only a minimal safe acknowledgment and next step.

Acceptance: valid owner succeeds; unverified, expired, revoked, wrong customer, arbitrary UID, guessed job, prompt injection and unauthorized tool requests fail closed. Canary secrets and transcript/audio content never enter model prompts, public replies or bot logs. No-result diagnostics remain unknown rather than declaring data lost.

Phase 3 Helpful communication backed by real case state

Incorporate the standing support preference into answer/reviewer contracts and deterministic personal-action replies: empathy, remembered attempts, concise uncertainty and one delivery-controlled support next step.
Normalize localized source labels and fullwidth punctuation without dropping real prose or unknown evidence groups.
Test before/after verification, staff delivery success/failure, staff acceptance, known/unknown recovery, and repeated follow-ups in several languages.
Distinguish attempted action, completed lookup, delivered case, accepted case and confirmed resolution in every reply.
Add an approved incident/release record with affected versions, supported workaround, deployment evidence and freshness. A merged PR is background, not a shipped-fix claim.

Acceptance: no invented access, investigations, human ownership, deadlines, outcomes, or diagnostic certainty; no repeated “I can't” loop when a supported next step is available. Tone improves without removing safety warnings or factual limits.

Phase 4 Restricted rollout and operations

Run unit/integration tests, privacy/authorization probes, restart/overlap tests and offline customer evaluation. Run live/held-out evaluation only under its agreed rules; never open or tune against the held-out questions.
Pilot new diagnostics in development with synthetic accounts, then a small explicitly authorized staff/customer pilot. Keep the capability disabled server-side for other users.
Verify private replies, staff receipt, acceptance and closure end to end. Record capability success, resolution/reopen rate, handoff reasons, answer quality and p50/p95 latency without raw customer content.
Add PR CI with secret-free rules checks and a disposable Postgres integration service.
Add capability-level monitoring. Keep alert destinations consistent with the existing email/in-app preference unless separately changed.
Document the operator runbook for current capabilities, provider/verification/delivery failure, queued and uncertain work, reopening and release gates.
Expand only after review and approval. Refunds, deletions, account changes, recovery and reprocessing remain human-authorized; broader access is a separate decision.

Scope of this change

This milestone includes actual runtime coordination, case, verification and communication changes with tests. No Railway variables, IAM policies or external customer records are modified during implementation, and production is not considered changed until rollout is verified. Omi Support Bot is the product name; existing repository, domain and channel identifiers stay unchanged.

FilesExpand file tree

IMPLEMENTATION_PLAN.md

Latest commit

History

IMPLEMENTATION_PLAN.md

File metadata and controls

Mira implementation checklist

#83 source provenance and conflict handling — draft

Current audited execution — October 26, 2026

#62 evidence-only implementation — #88 merged

Current October25 finish status

Earlier October25 finish contract and verification snapshots

October25 accepted review and private-intake draft

October25 — approved queue, Step1 complete

October24 — existing #28 current-main integration

October24 — existing #59 current-main integration

October24 production fix B — rejected-review language

October24 reviewer follow-up — deterministic production fixes first

Current October23 — release smoke accepted

October23 local integration — #74, not released

Latest October23 #67 review correction

Separate no-email-redirect draft

October 23 finish queue

October 23 answer-quality priorities

Finish every existing PR, without count-driven decisions

October 21: scoped forgetting draft, stacked on #49

October 21: reviewed-fact draft integration and mandatory retention

October 21: test-only memory SQL/reader preparation

October 21: separate redirect and planner comparisons

October 21: multipart comparison complete, release held

October 20: post-release multipart preparation — historical checkpoints

Current October 20 retry and separate drafts

Latest regression/restart diagnosis — October 19

Current combined-release integration — October 19

Latest operational checkpoint — October 19

Latest review checkpoint — October 18

#59 wording correction — local preparation complete, release held

#59 wording correction — local preparation complete, release held

Release and security prerequisites

Release 2 bounded reader checkpoint — local checks pass

Release 2 storage checkpoint — local only

October 18 current order and closing-language draft

Mira's identity and personality — requested October 18

Combined Release 1 (updated October 17 brief)

October 17 support-experience draft

Release 2 references-only replacement — after Release 1 deployment

Isolated confidence/source-fit correction — draft preparation

Phase 1 Durable workflows without new backend access

Access prerequisites before metadata diagnostics

Phase 2 Verified metadata diagnostics

Phase 3 Helpful communication backed by real case state

Phase 4 Restricted rollout and operations

Scope of this change