STATIC PAGE Interactive levers, live recompute, and Record decision run in the app build; every figure, formula, evidence row, and WHY below is the real render, pre-computed. Evidence panels are opened for review.
Users, security, and the plan
Viewing as Admin: 3 users mapped to roles, security posture on the record, tiering per the platform packaging, pricing awaiting sign-off.
Support and delivery staff occasionally need to work inside a customer's tenant. That is an operator instrument, not a product feature, so it is off unless someone turns it on and it is stated in the chrome while it runs. Turning it on reveals the company selector in the header; turning it off returns the session to this company and hides it again.
Isolation is unchanged by this switch. A tenant user's visible set is exactly their own company, enforced at the selector and again at the change handler, so no company name a session may not see can enter its page. Enabling operator mode does not widen what a tenant user can see; it widens what a platform operator can reach, and every reach is a ledgered read.
Architecture, restated on the Technology board as a holding rule.
Wording carried verbatim; the suite asserts the exact string.
Console wiring lands with the first enterprise tenant; the entitlement model is already server-shaped.
AR-12 in conformance: stale and unsigned calls reject with named codes.
AR-15 mechanism shipped; the independent public log remains PLANNED at its trigger.
The three platform tiers render as specified; commercial figures stay MODELED until signed, and this flag clears the day you sign.
M. Keller: Functional; R. Osei: Executive; T. Ando: Operational
SOC 2 Type II in progress (report estimated 2027)
Tiering follows the strategy corpus: packages of the platform, not a module marketplace.
$50M to $250M companies
Command Center · Supply Intelligence · AI Analyst · Basic connectors
$250M to $2B companies
Everything in Starter · Operations · Finance · Knowledge · Workflow
current plan$2B+ companies
All domains · Enterprise integrations · Dedicated environment · Advanced AI agents
One platform, three packages, never per module; commercial figures MODELED until the founder signs, and the PRICING_UNSIGNED flag above clears on that signature.
| M. Keller | mkeller@tenant-one.example | Supply Leader | Functional | |
| R. Osei | rosei@tenant-one.example | CFO | Executive | |
| T. Ando | tando@tenant-one.example | Analyst | Operational |
Saved views persist per user in tenant mode; this session keeps them in memory. Exports serialize the filtered view. 3 of 3 rows shown.
10 of 15 requirements are open. 1 can be closed by another release. 9 cannot: they need a founder decision, a credential, an auditor, a lawyer, or a customer.
This gate does not grade effort and cannot be argued into a pass. A requirement is met when the thing it describes exists, and not when a plan for it exists.
| Requirement | Owner | State | What closes it |
|---|---|---|---|
| PR-01 The build is verifiable end to end by a stranger | ENGINEERING | MET | Already closed. The release ships a harness that re-derives the receipt root, regenerates the master specification, and recomputes product identities from a cold extraction. |
| PR-02 Every surface passes a declared contract | ENGINEERING | MET | Already closed. The crawl asserts each route renders its declared markers, and a route without a contract fails rather than passing quietly. |
| PR-03 No capability ships unreachable | ENGINEERING | MET | Already closed. Reachability is derived from the import graph with no allowlist, so a module nothing imports fails the build. |
| PR-04 Audit events reach a customer SIEM | ENGINEERING | MET | Pull export of the hash-chained record exists. Push forwarding is a build, and it is the single most requested item in an enterprise security review that this platform does not yet have. |
| PR-05 The interface serves non-English users | ENGINEERING | BLOCKED | A build. Registered absent with its gate rather than left silent, and it matters because the stated buyer profile is a manufacturer with facilities across regions. |
| PR-06 Identity federation, SSO and SCIM | ENGINEERING | MET | A build, and one whose integration point already exists: tenant provisioning mints the first administrative user. |
| PR-07 A live instance exists | FOUNDER | BLOCKED | Run the deploy against the confirmed project with the model and transport credentials. No release closes this. It has been the highest ranked open action in every session of this program and remains open. |
| PR-08 Commercial terms are signed | FOUNDER | BLOCKED | The pricing signature. The assessment instrument now derives an engagement bar, so a list price is no longer required, but the tier structure still needs a founder line before any figure is published. |
| PR-09 The route consolidation is countersigned | FOUNDER | BLOCKED | The countersign on the parity disposition. Unsigned for roughly forty releases, and R92 demonstrated the unanswered question was concealing six enterprise functions that had no route. |
| PR-10 Data residency position is decided | FOUNDER | BLOCKED | A deployment decision rather than an architecture one, because the platform holds no customer system of record. It needs a founder position before a buyer asks, not after. |
| PR-11 A completed penetration test | THIRD_PARTY | BLOCKED | A tester. The scope is published so a test can be commissioned against a defined target rather than an assumption, which is the part that was in our control. |
| PR-12 A SOC 2 Type II report | THIRD_PARTY | BLOCKED | An auditor and an observation window. Stated everywhere as in progress with an estimated report date, and never as a certification. |
| PR-13 Executed data processing and master agreements | THIRD_PARTY | BLOCKED | Counsel. Drafts exist and are in review; they are not executed and are not represented as final. |
| PR-14 An availability commitment backed by measurement | THIRD_PARTY | BLOCKED | A deployment and time. Any figure offered before that describes a test environment, so none is offered. |
| PR-15 A first tenant on real data | THIRD_PARTY | BLOCKED | A customer. Every gap that money or engineering can close is downstream of this one, and no amount of architecture substitutes for it. |
Sorting by owner is the point. A readiness list that mixes writing an adapter with obtaining an audit report invites a reader to believe both are a sprint away. The single highest-leverage open item is the deploy run, because every gap that money or engineering can close sits downstream of a live instance and a first tenant.
15 requirements across 3 owner classes, so nobody waits on a party that was never going to act.
Security answers and readiness rows read the same source, so the two cannot disagree about the same fact.
This gate does not grade effort and cannot be argued into a pass. A requirement is met when the thing it describes exists, and not when a plan for it exists.