Project delivery / Implementation plan

Snapshot · 27 September 2026

From planning to production

BizTrust implementation plan

One delivery path for the customer experience, operations console and authoritative backend. Explore the phases, follow the module flows, and track the evidence needed to launch.

Plan source ↗

Production activation is blocked

The application rejects DEMO_MODE=false. Local verification and release artifacts do not authorize real payment, insurer issuance or coverage. Review the boundary.

Gate closed
Tracked outcomes18Across demo and production work
Verified locally4 / 18Demonstration scope only 4 of 18
Blocked5Decision or external evidence needed
Planned / in progress9Implementation or acceptance pending

Done, today and remaining

Plan snapshot · 27 September 2026

Today's plan

Bounded engineering loop PAUSED after the dated 38-file, four-patch local integration snapshot. The user authorized the bounded five-priority documentation and review preparation recorded below; the recurring schedule was not restarted. The 45-test isolated full verifier passed on the current application candidate, and no further concrete dependency-ready local engineering package is identified within the current authorization. Resume only with a bounded scope, named owner, exact candidate/environment and verifier after the relevant owner or hosted decision evidence arrives. The dated patches remain snapshots; local technical proof does not grant integration or production acceptance.

  1. BT-09
    Review D01–D07 recovery decisions and five-step plan; name target, custodians and pilot limits. Skills: ecc:living-docs-governance now; conditional skill routesInfrastructure / security · D: source archives verified; portable drill and G4 decisions pending
  2. BT-12, BT-14
    Review the dated four-patch handoff and scoped integration review with owners. Skills: ecc:git-workflow now; conditional skill routesGit / ADF · Four-patch replay and 38 captured blobs passed; later board edits are outside snapshot; owner/hosted review pending
  3. BT-12, BT-14
    Fill AP-01/02 appointments and candidate review records. Skills: ecc:living-docs-governance; skill routesProject Sponsor / named reviewers · Register prepared; names and human decisions pending
  4. BT-04, BT-05, BT-10
    Fill AP-03–05 and OD-04/05/10 decisions for product, wording and identity. Skills: ecc:living-docs-governance now; conditional skill routesBrokerage / legal / identity owners · Decision register prepared; authority and acceptance pending
  5. BT-17
    Review PR #13 and remaining hosted proof cases. Skills: ecc:git-workflow; conditional skill routesRepository administrator · Main rule/check passed; PR blocked for human review; other proof cases pending

How many more steps?

5 workstreams

In the next working sequence; these are not a time estimate.

14 open outcomes

4 in progress · 5 blocked · 5 planned

Production activation remains gated by owner decisions and acceptance evidence.

Repository reuse plan21 upstream entries · 5 existing · 5 next candidates · 8 later options · 3 references
Fork/clone approach, licenses, integration work and phase/module links.View repositories →

Current scope

Release boundary · local demonstration

Customer demo

Verified locally: synthetic catalogue, comparison, flexible quote, application and tracking

Next: Approved products, wording and real identity acceptance

Staff demo

Verified locally: isolated, tenant-scoped, read-only /ops console

Next: Authorized roles, actions and staff identity acceptance

Payment and insurer

Signed simulator and durable payment inbox; explicit insurer simulation

Next: Provider contracts, adapters, workers and reconciliation

Data recovery

Same-machine restore/30 DB tests and D: source archive readback passed

Next: Off-host/key recovery, targets and G4 owner acceptance

Release

0.2.0 prerelease source and container workflow

Next: Hosted CI evidence, staging and production acceptance

Public progress board

Refreshed static board and collapsible sidebar verified at the exact Pages URL

Next: Manually republish after future source changes

Planning → production

8 phases · evidence before promotion

Each bar counts linked milestones marked Verified in the local demonstration; it is not a phase completion score or production approval. P2 has local demonstration evidence. Business decisions in P0/P1 and production work remain open. Expand each phase for work, accountable roles and exit evidence.

00

P0 Discovery & authority

Confirmed operating model and authorized product/distribution scope; business decisions remain blocked

Locally verified milestones0 / 4
0 of 4
BT-04, BT-07, BT-08, BT-10
Work, dependencies & exit evidence

Work and dependenciesBrokerage/product lead owns insurer agreements, products and publication authority; finance owns payment/refund rules; insurer liaison owns binding and policy evidence; legal owns Lao/English wording and notices

Exit evidenceApproved decision register, contracts, product/rate versions, distribution scope and named decision owners

01

P1 Architecture & UX

Accepted system boundaries, role model, module contracts and customer/staff journeys; local design baseline exists

Locally verified milestones0 / 10
0 of 10
BT-04, BT-05, BT-06, BT-09, BT-10, BT-11, BT-12, BT-13, BT-14, BT-15
Work, dependencies & exit evidence

Work and dependenciesEngineering maps modules and lifecycle states; operations defines role/action/assignment matrix; identity and infrastructure owners confirm clients, audiences, hosting, gateway and exact routes; UX/legal review responsive bilingual screens

Exit evidenceReviewed architecture and API/event contracts, authority matrix, data classification, page inventory and design acceptance; confirmed hosting/identity decision

02

P2 Local foundation

Verified synthetic customer and read-only staff demonstration with durable payment intake

Locally verified milestones3 / 3
3 of 3
BT-01, BT-02, BT-03
Work, dependencies & exit evidence

Work and dependenciesEngineering maintains catalogue/quote/application/tracking, separate staff API and sessions, shared tenant-scoped services, forced RLS, append-only audit and signed simulator receipt recovery

Exit evidenceExisting linked local verification supports this limited scope; subsequent changes require matching domain, isolation, contract and browser evidence

03

P3 Staff workflows

Bounded read-only synthetic inspection in progress; authorized workflows remain planned

Locally verified milestones0 / 4
0 of 4
BT-05, BT-06, BT-12, BT-14
Work, dependencies & exit evidence

Work and dependenciesOperations and engineering implement case assignment/review, information requests, governed catalogue/rating changes, tenant onboarding and agent/broker delegation, support and auditor views; identity owner supplies provisioning/MFA; action authority depends on P0/P1

Exit evidenceApproved role policy, negative role/tenant/assignment tests, audited state transitions, customer-visible outcomes and staff journey acceptance

04

P4 Partner integrations

Contracted payment and insurer paths with recoverable processing; external dependencies blocked

Locally verified milestones0 / 4
0 of 4
BT-07, BT-08, BT-13, BT-15
Work, dependencies & exit evidence

Work and dependenciesFinance and insurer liaison supply sandbox contracts; engineering adds adapters, authenticated insurer intake/polling, durable inbox/outbox workers, backoff/dead letters, settlement ledger, reconciliation/refunds, distinct submission/response/broker-decision/policy records, authorized renewal/endorsement/cancellation, customer notices and claim intake/referral with insurer decisions retained by the insurer

Exit evidenceProvider-specific sandbox acceptance, duplicate/out-of-order/failure recovery tests, reconciled settlement evidence, authorized refund tests and authoritative insurer artifacts

05

P5 Security & operations

Isolated synthetic restore and restored-database tests passed; wider security/operations acceptance pending

Locally verified milestones0 / 6
0 of 6
BT-05, BT-09, BT-11, BT-14, BT-15, BT-16
Work, dependencies & exit evidence

Work and dependenciesSecurity/infrastructure implement restricted key service, encryption, secret rotation, secure document upload/scanning/storage, consent/retention/export controls, operational reporting, telemetry/alerts, backup and restore; define incident ownership and recovery targets

Exit evidenceLive identity/MFA acceptance, independent security review, key access/rotation evidence, classified storage controls, restore drill against agreed RPO/RTO and exercised runbooks

06

P6 Staging & acceptance

Rehearsed release candidate in confirmed deployment topology; gated by P0–P5

Locally verified milestones0 / 12
0 of 12
BT-04, BT-05, BT-06, BT-07, BT-08, BT-09, BT-10, BT-11, BT-12, BT-13, BT-14, BT-15
Work, dependencies & exit evidence

Work and dependenciesRelease owner deploys immutable candidate behind APISIX or confirmed edge gateway/TLS with private database/workers; run customer, agent/broker and specialized staff acceptance, provider contracts, load and recovery checks; review bilingual/legal content

Exit evidenceObserved hosted CI and staging results, owner acceptance records, tested migration/rollback, alerts and restoration; documented go/no-go with all production dependencies resolved

07

P7 Production & ongoing service

Approved controlled launch followed by accountable service operation; currently blocked

Locally verified milestones0 / 13
0 of 13
BT-04, BT-05, BT-06, BT-07, BT-08, BT-09, BT-10, BT-11, BT-12, BT-13, BT-14, BT-15, BT-16
Work, dependencies & exit evidence

Work and dependenciesBusiness and release owners authorize promotion; engineering removes the startup gate only in a reviewed implementation change, promotes the accepted artifact and verifies exact routes; operations monitors reconciliation, partner queues, access reviews, incidents and releases

Exit evidenceExplicit production approval, deployment/health and transaction acceptance evidence within authorized scope, rollback readiness, operational ownership and recurring access/recovery reviews

Repository reuse plan

Reviewed 2026-09-26

Reuse the existing stack first. Next candidates support identity, durable workers, forms and staff queues; later services depend on the hosting and data decisions. The register maps recommendations to phases and acceptance evidence. Listing a project does not mean it is installed or production-accepted.

21Upstream entries
5Existing
5Next
8Later
3Reference

Existing = present in the local project. Next = proposed for the next relevant phase. Later = conditional on demonstrated need. Reference = guidance for engineering decisions. A topic page or workflow file is a reference, not a standalone repository.

Showing 21 of 21 entries

RepositoryNext

Logto

Upstream service

Reuse identity, sign-in, organization and permission capabilities.

Phases
P1 P3
Milestones
BT-05 BT-14

Current positionThe application has Logto-oriented OIDC configuration; no accepted live identity deployment is recorded.

Integration, acceptance & reuse policy
Integration
Use Logto Cloud or a pinned official service image after hosting selection. Configure separate customer/staff applications and resource audiences. If self-hosted, use a dedicated identity database/role. Map membership to BizTrust tenant rules.
Acceptance
Prove provisioning/offboarding, required MFA, session revocation and wrong-audience/cross-tenant denial. Upstream quickstart Compose is not a production deployment.
License
MPL-2.0
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Select a compatible reviewed release at implementation; commit the package lock or service image digest. No floating main/latest in a release.
RepositoryExisting

openid-client

Package

Keep the OAuth/OIDC client already used by both server identity adapters.

Phases
P2 P3
Milestones
BT-05

Current positionpackage-lock.json pins 6.8.8; imported in server/auth.ts and server/staff-auth.ts.

Integration, acceptance & reuse policy
Integration
Extend existing discovery and code-flow adapters with PKCE/state/nonce and isolated sessions; keep tenant/object authorization in BizTrust.
Acceptance
Run real issuer login/logout, replay, expiry, revocation and audience-separation tests.
License
MIT
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Retain locked 6.8.8 baseline. Upgrade compatible v6 releases only with identity regression evidence.
Upstream evidence
Upstream source
RepositoryNext

pg-boss

Package

Candidate for durable background jobs using the PostgreSQL service already in the design.

Phases
P4
Milestones
BT-07 BT-08 BT-15

Current positionNot installed. Current payment recovery needs webhook redelivery; no autonomous worker exists.

Integration, acceptance & reuse policy
Integration
Run a worker from the application image, with separate queue schema and migration privileges. Enqueue minimal record IDs. Retain the authoritative inbox/outbox and atomic domain transactions; recover missed enqueue operations by durable scanning or a transaction-aware enqueue.
Acceptance
Spike Node 24/PostgreSQL compatibility, least-privilege roles, restarts, concurrent workers, bounded retries and dead letters. Business and provider operations remain idempotent; queue claims alone do not prove exactly-once outcomes.
License
MIT
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Select a compatible reviewed release at implementation; commit the package lock or service image digest. No floating main/latest in a release.
Upstream evidence
Upstream source · Requirements
RepositoryNext

React Hook Form

Conditional package

Reduce repeated form state and validation work for product capture and staff editing.

Phases
P3
Milestones
BT-06 BT-12

Current positionNot installed; current React forms already work for the demo.

Integration, acceptance & reuse policy
Integration
Trial one new product/staff form with react-hook-form and a compatible Zod resolver. Keep existing controls and shared schemas; server validation and approved product versions remain authoritative.
Acceptance
Accept only if the pilot simplifies nested/repeated inputs and preserves keyboard errors, bilingual labels, consent and server rejection handling.
License
MIT
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Select a compatible reviewed release at implementation; commit the package lock or service image digest. No floating main/latest in a release.
Upstream evidence
Upstream source · Resolvers source
RepositoryNext

TanStack Table

Conditional package

Reuse table state for growing case, reconciliation and audit work queues.

Phases
P3
Milestones
BT-06 BT-15

Current positionNot installed; the console has a small read-only table.

Integration, acceptance & reuse policy
Integration
Use @tanstack/react-table when server paging/filtering and column controls are needed. Retain BizTrust layout and call staff APIs for scoped data.
Acceptance
Verify server-side sort/filter allowlists, tenant-safe pagination, accessible headers, keyboard actions and mobile containment. Client filters never authorize records.
License
MIT
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Select a compatible reviewed release at implementation; commit the package lock or service image digest. No floating main/latest in a release.
Upstream evidence
Upstream source
RepositoryExisting

node-postgres

Package

Keep direct PostgreSQL transactions and tenant isolation contracts.

Phases
P2 P3 P4
Modules
data audit events
Milestones
BT-03 BT-09

Current positionpg 8.23.0 is locked and used by server/db.ts.

Integration, acceptance & reuse policy
Integration
Extend existing migrations and parameterized queries. Set tenant scope transaction-locally; preserve domain/audit/outbox atomicity.
Acceptance
Preserve forced RLS and prove pool reuse cannot leak tenant context, with rollback and negative authorization coverage.
License
MIT
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Retain locked pg 8.23.0 baseline; review runtime and database compatibility before upgrades.
Upstream evidence
Upstream source
RepositoryExisting

Zod

Package

Reuse typed boundary validation for API inputs and provider mapping.

Phases
P2 P3 P4
Milestones
BT-06 BT-12

Current positionzod 4.6.5 is locked in the application.

Integration, acceptance & reuse policy
Integration
Version approved product schemas and validate commands on the server. Derive UI validation where useful; keep exact premium calculations in shared/pricing.ts.
Acceptance
Test invalid fields, payload bounds, product versions and consent; reject unknown or unsupported provider state.
License
MIT
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Retain locked Zod 4.6.5 baseline; align any form resolver to the selected Zod version.
Upstream evidence
Upstream source
RepositoryExisting

Playwright

Package

Extend the existing browser verification instead of introducing another E2E framework.

Phases
P2 P3 P6
Milestones
BT-01 BT-02 BT-11

Current positionplaywright 1.63.0 and the CLI are already installed; local smoke journeys exist.

Integration, acceptance & reuse policy
Integration
Add accepted role/customer/provider scenarios to the existing scripts and hosted CI using controlled fixtures.
Acceptance
Record exact release/browser versions and reproducible tenant, session, accessibility and workflow evidence.
License
Apache-2.0
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Keep package/browser binary versions aligned to package-lock.json and the CI artifact.
Upstream evidence
Upstream source
RepositoryExisting

axe-core

Package

Continue automated accessibility checks alongside browser journeys.

Phases
P2 P3 P6
Milestones
BT-01 BT-02 BT-11

Current positionaxe-core and @axe-core/playwright resolve to 4.13.0 in the lockfile.

Integration, acceptance & reuse policy
Integration
Reuse existing integration and add checks for staff actions, forms and document flows.
Acceptance
Combine automated results with manual keyboard, assistive-technology and Lao/English review; automated scans do not prove full accessibility.
License
MPL-2.0
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Keep the engine and Playwright integration versions compatible and locked.
Upstream evidence
Upstream source
RepositoryLater

Apache APISIX

Upstream service

Use a supported edge gateway once the deployment topology is confirmed.

Phases
P6
Modules
gateway delivery
Milestones
BT-11

Current positionNo gateway, production DNS or operations hostname has been adopted.

Integration, acceptance & reuse policy
Integration
Use a pinned official image and project-owned routing configuration. Evaluate standalone file-driven mode before adding etcd. Keep application audience/tenant checks and private upstreams.
Acceptance
Confirm DNS/hosting/TLS, exact customer/staff routes, raw webhook bodies, trusted proxies, private Admin API, request limits and rollback.
License
Apache-2.0
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Select a compatible reviewed release at implementation; commit the package lock or service image digest. No floating main/latest in a release.
Upstream evidence
Upstream source · Deployment modes
RepositoryLater

OpenTelemetry JavaScript

Package

Reuse standard tracing and metrics across API, database and worker operations.

Phases
P5
Milestones
BT-09 BT-16

Current positionNot installed; existing request IDs and health counts are the baseline.

Integration, acceptance & reuse policy
Integration
Select compatible API/SDK/exporter and Express/HTTP/pg instrumentation packages. Initialize before ESM application imports and propagate correlation into jobs.
Acceptance
Verify runtime support, redaction, sampling and shutdown flush. Keep personal data and secrets out of telemetry; retain the business audit separately.
License
Apache-2.0
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Select a compatible reviewed release at implementation; commit the package lock or service image digest. No floating main/latest in a release.
RepositoryLater

OpenTelemetry Collector

Conditional service

Receive, filter and export telemetry if a local collector is needed.

Phases
P5
Milestones
BT-09 BT-16

Current positionNo collector or storage/query backend has been selected.

Integration, acceptance & reuse policy
Integration
Choose a supported distribution only after required processors/exporters are known. A hosted OTLP endpoint may remove the need for this service.
Acceptance
Verify private authenticated transport, batching/resource limits, redaction, backend outage behavior and alert ownership. Select telemetry storage and dashboards separately.
License
Apache-2.0
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Select a compatible reviewed release at implementation; commit the package lock or service image digest. No floating main/latest in a release.
Upstream evidence
Upstream source · Deployment choices
RepositoryLater

pgBackRest

Package

Use established backup and point-in-time recovery tooling for self-managed PostgreSQL.

Phases
P5 P6 P7
Modules
data delivery
Milestones
BT-09 BT-11 BT-16

Current positionNo production restore acceptance recorded; managed database recovery remains an alternative.

Integration, acceptance & reuse policy
Integration
Install the supported OS package/binary on the selected Linux database host; configure WAL archiving, encrypted off-host repository, retention and restricted credentials.
Acceptance
Restore in isolation and measure agreed RPO/RTO, including tenant/audit checks. Test document-store and key-service recovery separately.
License
MIT
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Record the exact OS package version or released binary checksum/signature; record an image digest if containerized. Verify compatibility with the selected PostgreSQL version.
Upstream evidence
Upstream source · License · User guide
RepositoryLater

ClamAV

Conditional service

Candidate scanner for uploaded customer and insurer artifacts.

Phases
P5
Modules
documents events
Milestones
BT-09 BT-15

Current positionNo upload endpoint, quarantine store or scanning pipeline exists.

Integration, acceptance & reuse policy
Integration
Use an upstream scanner process/container with current signatures behind a private document adapter, or an accepted managed scanning service. Quarantine before any download/release.
Acceptance
Exercise clean/malicious test fixtures, stale signatures, timeouts, size/archive limits and unavailable scanner; incomplete scans must remain quarantined.
License
GPL-2.0 (see COPYING.txt and release notices)
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Select a compatible reviewed release at implementation; commit the package lock or service image digest. No floating main/latest in a release.
RepositoryLater

OpenBao

Conditional service

Candidate secret and encryption-key service when hosting requires self-management.

Phases
P5
Modules
kms data documents
Milestones
BT-09 BT-15

Current positionNo KMS adapter or classified field encryption exists; managed KMS remains an alternative.

Integration, acceptance & reuse policy
Integration
Use a pinned official image/binary through a backend adapter, scoped workload credentials and transit key versions. Resolve operations/unseal/recovery ownership first.
Acceptance
Prove restricted decrypt, rotation, revocation, outages and recovery. Installing the service does not encrypt current JSONB or stored objects.
License
MPL-2.0
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Select a compatible reviewed release at implementation; commit the package lock or service image digest. No floating main/latest in a release.
Upstream evidence
Upstream source · Transit · Install and verify
RepositoryLater

Uppy

Conditional package

Reuse upload UI and resumable transfer if real document capture needs it.

Phases
P4 P5
Milestones
BT-15

Current positionNot installed; the demo only downloads synthetic evidence.

Integration, acceptance & reuse policy
Integration
Add selected Uppy packages after authorized upload APIs, private storage and quarantine are designed. Prefer a native file input for a simple single-file pilot.
Acceptance
Verify tenant-bound upload tokens, MIME/size validation, interruption recovery, keyboard/Lao labels and scan-before-release. Do not put object-store credentials in the browser.
License
MIT
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Select a compatible reviewed release at implementation; commit the package lock or service image digest. No floating main/latest in a release.
Upstream evidence
Upstream source
RepositoryLater

Nodemailer

Conditional package

Use an SMTP transport if email is an approved customer/staff notification channel.

Phases
P4
Milestones
BT-15

Current positionNo delivery adapter is installed; channel/provider selection remains open.

Integration, acceptance & reuse policy
Integration
Send approved templates from a durable notification job through restricted provider credentials; store delivery correlation and preferences.
Acceptance
Verify retries/deduplication, TLS, bounce handling, approved wording and privacy. SMTP acceptance is not customer receipt and cannot alter coverage state.
License
MIT-0
Fork policy
Use upstream releases. Fork only for a documented patch that cannot be delivered by configuration or an adapter, with an owner and upstream-sync plan.
Version policy
Select a compatible reviewed release at implementation; commit the package lock or service image digest. No floating main/latest in a release.
Upstream evidence
Upstream source · Package license · License text
RepositoryNext

Markdown ADR templates

Clone to inspect

Use a small architecture-decision template to record choices and reduce repeated design discussions.

Phases
P0 P1
Modules
delivery
Milestones
BT-05 BT-09 BT-11 BT-12

Current positionReference selected; no upstream template has been copied or workflow enabled.

Integration, acceptance & reuse policy
Integration
Copy only a reviewed minimal template into docs/adr with source revision/license. Record context, alternatives, owner, outcome and affected milestones.
Acceptance
Engineering decisions retain explicit human owner acceptance and link to technical evidence; the document cannot grant business or production authority.
License
MIT OR CC0-1.0
Fork policy
No full fork needed. Keep the adapted project template with provenance; clone only to inspect the chosen revision.
Version policy
Reviewed source revision ba75bb1b20d42af5746b246ad348c202419ae681; this is provenance, not an installed dependency.
Upstream evidence
Upstream source · License
RepositoryReference

ceaksan/decision-gate

Clone to inspect

Optional AI-assisted review rubric for proposals and architecture decisions.

Phases
P0 P1
Modules
delivery
Milestones
BT-06 BT-09 BT-11 BT-12

Current positionA Claude Code skill, not an insurance rules or authorization engine. Small history: three commits; latest observed 12 March 2026.

Integration, acceptance & reuse policy
Integration
Inspect the pinned source and adapt the rubric if useful. Keep external AI/MCP jurors disabled unless their access and data use are explicitly configured. Treat results as advisory evidence.
Acceptance
A score or GO verdict must not publish products, approve payments, bind policies, grant roles or open the production gate.
License
MIT
Fork policy
Optional fork only for a deliberately maintained customized skill. A small attributed checklist in this project is simpler.
Version policy
Reviewed revision 322dab6c6eaba6cafa12b45909801af9f2bb9194; clone for inspection only, without installing or executing the skill.
Upstream evidence
Upstream source · Reviewed revision
WorkflowReference

GitHub Agentic Workflows design gate

Reference only

Reference for checking architecture-decision documentation during engineering review.

Phases
P1 P6
Modules
delivery
Milestones
BT-11

Current positionThe supplied URL is one repository-specific Markdown workflow, not a standalone application.

Integration, acceptance & reuse policy
Integration
If later adopted, adapt its imports, paths, triggers, engine and outputs to BizTrust. Compile and inspect generated lock YAML and test effective permissions/branch checks before enabling it.
Acceptance
Workflow prose is not proof of branch protection. Use a patched reviewed release; recorded token-exposure advisory affects versions >=0.83.3 and <0.85.4. No live financial/identity authority is delegated.
License
MIT (parent repository)
Fork policy
Reference or adapt a pinned workflow. Fork the parent repository only when maintaining a required compiler/tool patch.
Version policy
Reviewed parent revision 0f371720744ba6d850fcb1519405381c6ee5751e; choose a patched released tool version if adopting later.
TopicReference

Decision-gate topic index

Reference only

Bookmark for finding projects to assess individually.

Phases
P1
Modules
delivery
Milestones
BT-11

Current positionThe supplied link is a GitHub topic page, not a cloneable repository.

Integration, acceptance & reuse policy
Integration
Evaluate any chosen project by its own source, license, integration fit and maintenance evidence; a shared topic does not establish compatibility.
Acceptance
Select a specific upstream before acquisition. No topic-listed project is automatically included.
License
Not applicable — discovery index
Fork policy
Cannot clone or fork a topic page.
Version policy
No package/revision applies to a topic index.
Upstream evidence
Upstream source

Plan and acquisition decisions: repository reuse guide · structured source. The inventory records adoption intent; installation, cloning or a passing check does not satisfy the linked production acceptance boundary.

System & module flows

Choose a flow · select a node for module detail

Solid: local pathDotted: partial / live acceptance pendingDashed: planned

System overview

Target topology: two frontends and separate identity boundaries reach one authoritative domain layer. Gateway routes and production hosting still need confirmation. The local demo connects directly to its application server.

System overview Target topology: two frontends and separate identity boundaries reach one authoritative domain layer. Gateway routes and production hosting still need confirmation. The local demo connects directly to its application server. Each node links to its module details. Connections are also listed in the module contract table below. TLS TLS customer staff use case use case scoped tx authorize customer authorization durable work key access Customer / distribution React frontend LOCAL DEMO Operations console /ops · separate bundle LOCAL DEMO Confirmed edge gateway APISIX is a candidate PLANNED Customer API /api · customer session LOCAL DEMO Staff API /ops/v1 · staff audience LOCAL DEMO Authoritative domain layer Catalogue · quotes · cases Payments · insurer · audit PARTIAL PostgreSQL / tenant data Transaction-local forced RLS LOCAL DEMO Identity & authorization Client, role, tenant, object PARTIAL Durable events Inbox / outbox + idempotency PARTIAL Restricted key service Keys, secrets, rotation PLANNED

Identity and tenant authorization apply to both APIs. Frontends have no database connection. Production storage encryption, restricted key access and autonomous workers remain to be built.

Frontend → API → domain

8 customer, distribution and staff journeys

Separate customer and operations experiences use the same authoritative domain services. Current screens use synthetic data. Planned actions require server authorization, tenant scope and audit evidence before activation.

Customer discovery

  1. FrontendCurrent catalogue, filtering, cover finder and comparison
  2. API boundaryPublic GET /api/catalog; approved product visibility remains a server concern
  3. Domain modulescatalog, rules

To complete for productionApproved products/wording, eligibility disclosure, versioned publication and reviewed Lao/English content

Customer application

  1. FrontendCurrent sign-in, flexible quote, consent and application submission
  2. API boundaryCustomer /api/session, /api/auth/*, POST /api/quotes, POST /api/applications
  3. Domain modulesidentity, rules, quotes, audit

To complete for productionLive customer identity acceptance, product-specific questions/documents and approved consent records

Customer payment and tracking

  1. FrontendCurrent application list/detail, non-payable QR, simulator controls and synthetic download
  2. API boundaryOwner-scoped /api/applications/*; verified payment events enter server webhook ingress
  3. Domain modulesquotes, payments, insurer, events, documents

To complete for productionReal provider payment evidence and insurer lifecycle, customer notifications/information responses, verified documents and authorized cancellation/refund journeys

Agent and broker distribution

  1. FrontendTarget delegated quote/application, assigned customer/case tracking and broker decision journeys
  2. API boundaryAuthorized distribution capabilities to be defined on application APIs; no implemented agent/broker routes claimed
  3. Domain modulesidentity, catalog, quotes, cases, audit

To complete for productionApproved delegation and tenant/customer relationships, assignment checks and end-to-end agent/broker acceptance

Operations workbench

  1. FrontendCurrent /ops overview, queue/filter, case detail/timeline, payment exceptions and integration health
  2. API boundarySeparate staff /ops/auth/* and /ops/v1/session, /overview, /cases, /cases/{id}, /integrations
  3. Domain modulesidentity, cases, payments, insurer, events, audit, telemetry

To complete for productionLive staff identity acceptance; role/tenant/object restrictions; assignment, review and information-request actions through domain services

Product and insurer operations

  1. FrontendTarget catalogue/rule drafts, review/publish/withdraw and insurer submission/response work
  2. API boundaryPlanned action-specific staff endpoints under the staff boundary
  3. Domain modulescatalog, rules, cases, insurer, documents, audit

To complete for productionApproved publication/binding authority, version history and rollback, authenticated insurer evidence and audited use cases

Finance and customer support

  1. FrontendTarget settlement/reconciliation resolution, authorized refunds, support information requests and notification review
  2. API boundaryPlanned role-scoped staff use cases with tenant/object checks and financial authority
  3. Domain modulespayments, cases, notifications, events, audit

To complete for productionFinance-approved ledger/refund rules, support data minimization, step-up/approval controls where policy requires, provider acceptance and negative tests

Security administration and audit

  1. FrontendTarget membership/access review, session response, scoped audit search/export and incident views
  2. API boundaryPlanned restricted staff APIs; key operations use a restricted backend service
  3. Domain modulesidentity, audit, data, kms, telemetry

To complete for productionApproved admin/auditor separation, provisioning/offboarding, export policy, immutable evidence and reviewed privileged actions

Module responsibilities & connections

20 logical modules · 40 contracts

The backend starts as a modular monolith. These are logical responsibilities, not 20 independent services. Each module lists its current scope, production work, incoming/outgoing connections and source.

Open all 40 module-to-module contracts
Local = synthetic path exists. Partial = implemented in part. Planned = target contract.
From To Contract / data Delivery
Customer and distribution frontend Customer application API Current same-origin catalogue, quote, application and tracking requests; owner checks on private records Local
Operations console Staff application API Read-only staff session, overview, cases, exceptions and integration health Local
Customer and distribution frontend Edge gateway and routing Target customer ingress through confirmed TLS/edge routing Planned
Operations console Edge gateway and routing Target staff route or confirmed hostname with separate identity boundary Planned
Edge gateway and routing Customer application API Confirmed customer routing and request controls; application retains authorization Planned
Edge gateway and routing Staff application API Separate staff API boundary; tenant and role enforcement stays in application Planned
Identity and tenant authorization Customer application API Customer session and server membership; live issuer/client acceptance pending Partial
Identity and tenant authorization Staff application API Separate staff client/session, audience contract and role/tenant membership; live provisioning/MFA pending Partial
Customer application API Product catalogue and governance Public synthetic catalogue and product versions; publication governance pending Partial
Customer application API Quotes and applications Authenticated quote/application commands and owner-scoped reads Local
Customer application API Documents and evidence Owner-checked synthetic document download Local
Staff application API Casework and policy lifecycle Tenant-scoped read models; assigned staff action use cases still planned Partial
Staff application API Payments and reconciliation Masked payment exceptions in overview/case readouts; financial action authority pending Partial
Staff application API Product catalogue and governance Authorized product draft, review, publish and withdrawal workflows Planned
Staff application API Identity and tenant authorization Restricted membership/provisioning and access-review use cases Planned
Product catalogue and governance Eligibility and pricing rules Versioned synthetic rating configuration; governed activation pending Partial
Eligibility and pricing rules Quotes and applications Server-calculated premium and eligibility inputs stored with immutable quote Local
Quotes and applications Casework and policy lifecycle Idempotent application and invoice creation from accepted quote/consent Local
Quotes and applications Tenant data and classified storage Tenant-scoped transaction persists quotes, applications and invoices Local
Casework and policy lifecycle Payments and reconciliation Linked invoice state and payment evidence; settlement/refund lifecycle pending Partial
Payments and reconciliation Durable event processing Verified raw-body HMAC simulator receipt committed to durable inbox before processing Local
Durable event processing Payments and reconciliation Idempotent receipt processing with invoice checks; autonomous recovery worker pending Partial
Payments and reconciliation Casework and policy lifecycle Validated event updates payment/application state and records delivery intent atomically Local
Payments and reconciliation Tenant data and classified storage Atomic invoice, application, provider-event, audit and outbox writes Local
Durable event processing Insurer adapters and intake Transactional outbox intent exists; contracted delivery/retry worker pending Partial
Insurer adapters and intake Durable event processing Authenticated partner callback or scheduled poll mapping into durable insurer inbox Planned
Insurer adapters and intake Casework and policy lifecycle Explicit simulator maps status; authoritative submission/policy evidence pending Partial
Insurer adapters and intake Documents and evidence Verified insurer artifacts linked to distinct policy/evidence records Planned
Durable event processing Customer and staff notifications Approved event-triggered customer/staff delivery with retries and preferences Planned
Casework and policy lifecycle Tenant data and classified storage Tenant/owner-scoped reads and state transitions; expanded policy records pending Partial
Casework and policy lifecycle Audit and accountability Staff timeline exposes scoped evidence; future writes require append-only audit Partial
Documents and evidence Tenant data and classified storage Synthetic download reads authorized application; private object storage/retention pending Partial
Tenant data and classified storage Audit and accountability Runtime writes append-only evidence in the same domain transaction Local
Tenant data and classified storage Restricted key and secret service Restricted encryption/key access for classified fields, storage and backups Planned
Documents and evidence Restricted key and secret service Restricted key access for private classified artifacts Planned
Identity and tenant authorization Audit and accountability Privileged membership/key/access actions with immutable reviewable evidence Planned
Staff application API Observability and incident control Local health and queue counts; central service metrics and alerts pending Partial
Durable event processing Observability and incident control Queue age, retry/dead-letter metrics, correlations and alert ownership Planned
Verification and release promotion Edge gateway and routing Tested candidate routing, TLS, exact public/staff URLs and rollback in staging Planned
Verification and release promotion Tenant data and classified storage Approved migrations, backup restoration and release rollback rehearsal Planned
Frontend

Customer and distribution frontend

Current implementationCatalogue, comparison, flexible quote, application, account/tracking and synthetic document journey

Production completionApproved content, live identity, product-specific capture, agent/broker journeys, information responses and lifecycle actions

Connections & source

Sends to / callsCustomer application API · Edge gateway and routing

Source / designCustomer UI, cover finder

Frontend

Operations console

Current implementationSeparate /ops bundle: overview, cases/detail, payment exceptions and integration/system health; read-only demo

Production completionCatalogue administration, broker operations, insurer liaison, reconciliation, support, security administration and auditor screens with action-specific permissions

Connections & source

Sends to / callsStaff application API · Edge gateway and routing

Source / designStaff UI, operations

Access

Edge gateway and routing

Current implementationLocal same-origin HTTP application; no APISIX deployment

Production completionConfirm APISIX or alternative gateway, DNS/hosting, TLS, routing, ingress restrictions and webhook ingress policy before adopting any hostname

Connections & source

Receives fromCustomer and distribution frontend · Operations console · Verification and release promotion

Sends to / callsCustomer application API · Staff application API

Source / designSystem boundary, release gate

Access

Customer application API

Current implementation/api routes for catalogue, session, quotes, applications, QR and documents; owner/tenant checks

Production completionVersioned agent/broker capabilities, complete customer lifecycle contracts and release compatibility

Connections & source

Receives fromCustomer and distribution frontend · Edge gateway and routing · Identity and tenant authorization

Sends to / callsProduct catalogue and governance · Quotes and applications · Documents and evidence

Source / designHTTP routes, API contract

Access

Staff application API

Current implementation/ops/v1 session, overview, cases/detail and integrations; independent staff authorization

Production completionAction endpoints for approved roles and object assignments, step-up where required, denial tests and scoped audit/export

Connections & source

Receives fromOperations console · Edge gateway and routing · Identity and tenant authorization

Sends to / callsCasework and policy lifecycle · Payments and reconciliation · Product catalogue and governance · Identity and tenant authorization · Observability and incident control

Source / designStaff use cases, HTTP routes

Access

Identity and tenant authorization

Current implementationSeparate customer/staff OIDC clients and cookies, server memberships, CSRF, request-time tenant/role checks; live IdP unverified

Production completionConfirm staff API audience/client configuration, provisioning/deprovisioning, agent/broker roles, MFA/step-up and access recovery; verify customer/staff separation against live identity

Connections & source

Receives fromStaff application API

Sends to / callsCustomer application API · Staff application API · Audit and accountability

Source / designCustomer identity, staff identity

Domain

Product catalogue and governance

Current implementationVersioned synthetic product fixtures, eligibility descriptions and coverage/exclusion comparison

Production completionPersist approved insurer products, distribution authority, wording, rates and publication/withdrawal approval history

Connections & source

Receives fromCustomer application API · Staff application API

Sends to / callsEligibility and pricing rules

Source / designCatalogue, discovery

Domain

Eligibility and pricing rules

Current implementationShared deterministic synthetic rating, flexible benefits/limits and versioned inputs

Production completionProduct-specific schemas, approved rating/underwriting rules, reason/referral codes, review, activation and rollback

Connections & source

Receives fromProduct catalogue and governance

Sends to / callsQuotes and applications

Source / designPricing, domain

Domain

Quotes and applications

Current implementationExpiring immutable quotes, idempotent application/invoice creation and product/consent snapshots

Production completionApproved submissions and corrections, complete customer inputs/documents, consent/wording versions and lifecycle validation

Connections & source

Receives fromCustomer application API · Eligibility and pricing rules

Sends to / callsCasework and policy lifecycle · Tenant data and classified storage

Source / designDomain services, flex pricing

Domain

Casework and policy lifecycle

Current implementationPersisted application/payment/insurer states and masked tenant-scoped staff case readouts

Production completionCase assignment, information requests, broker decisions, separate submission/response/policy/coverage evidence and authorized renewal/endorsement/cancellation workflows

Connections & source

Receives fromStaff application API · Quotes and applications · Payments and reconciliation · Insurer adapters and intake

Sends to / callsPayments and reconciliation · Tenant data and classified storage · Audit and accountability

Source / designCase readouts, coverage assessment

Integration

Payments and reconciliation

Current implementationNon-payable QR, signed simulator events, invoice checks, idempotent outcomes and exception visibility

Production completionContracted payment adapter, financial settlement ledger, fees/allocations, reconciliation resolution and controlled refunds

Connections & source

Receives fromStaff application API · Casework and policy lifecycle · Durable event processing

Sends to / callsDurable event processing · Casework and policy lifecycle · Tenant data and classified storage

Source / designPayment services, system boundary

Integration

Insurer adapters and intake

Current implementationExplicit synthetic insurer simulator and mapped application states; no partner callback or poll

Production completionPer-insurer request/response mapping, authenticated webhook or scheduled poll, durable insurer inbox, unknown-state review and authoritative policy evidence

Connections & source

Receives fromDurable event processing

Sends to / callsDurable event processing · Casework and policy lifecycle · Documents and evidence

Source / designInsurer simulation, system boundary

Integration

Durable event processing

Current implementationImmutable verified payment receipt inbox and transactional insurer outbox; recovery uses redelivery or explicit simulation

Production completionAutonomous processing/delivery workers, idempotency, backoff/dead letters, controlled replay, correlation and provider-specific delivery contracts

Connections & source

Receives fromPayments and reconciliation · Insurer adapters and intake

Sends to / callsPayments and reconciliation · Insurer adapters and intake · Customer and staff notifications · Observability and incident control

Source / designPayment inbox, inbox migration

Domain

Documents and evidence

Current implementationAccess-controlled synthetic document download; no upload endpoint or private object store

Production completionClassified private storage, malware scanning, insurer artifact verification, access/retention controls and customer information-request documents

Connections & source

Receives fromCustomer application API · Insurer adapters and intake

Sends to / callsTenant data and classified storage · Restricted key and secret service

Source / designDocument route, coverage assessment

Integration

Customer and staff notifications

Current implementationNo delivery adapter; state is visible by reopening application tracking or staff case detail

Production completionApproved templates and channels, consent/preferences, event-triggered delivery, retries, delivery audit and escalations

Connections & source

Receives fromDurable event processing

Source / designCoverage assessment

Data

Tenant data and classified storage

Current implementationPostgreSQL, least-privilege runtime, transaction-local forced RLS and persisted synthetic records

Production completionComplete policy/document models, retention/export/deletion rules, encrypted storage/backups and proved restoration

Connections & source

Receives fromQuotes and applications · Payments and reconciliation · Casework and policy lifecycle · Documents and evidence · Verification and release promotion

Sends to / callsAudit and accountability · Restricted key and secret service

Source / designDatabase, data inventory

Data

Restricted key and secret service

Current implementationServer-only configuration and hashed session identifiers; application field encryption and KMS adapter absent

Production completionChoose managed secret/key service, restrict workload access, implement classified field encryption, key rotation/revocation and recovery evidence

Connections & source

Receives fromTenant data and classified storage · Documents and evidence

Source / designConfiguration, data protection

Delivery

Observability and incident control

Current implementationRequest IDs, safe API errors, database health check and console queue counts

Production completionCentral redacted logs/traces/metrics, service objectives, alert routing, reconciliation/queue aging dashboards and incident runbooks

Connections & source

Receives fromStaff application API · Durable event processing

Source / designOperations, HTTP health

Delivery

Verification and release promotion

Current implementationRepository verification commands and versioned container/release workflow; production startup intentionally blocked

Production completionObserved hosted CI, protected release process, staging topology, migration/rollback drills, approved immutable promotion and ongoing recovery exercises

Connections & source

Sends to / callsEdge gateway and routing · Tenant data and classified storage

Source / designRelease workflow, production gate

Backend transactions & recovery

Current commits → target delivery

The payment inbox commits before business processing. Browser sessions authorize customer requests; independently verified provider events enter through a separate boundary. Production still needs autonomous workers, finance records and authoritative insurer evidence.

Backend transaction and recovery boundaries A creates the application and invoice. Independently, signed payment intake commits durable receipt B before domain transaction C. C validates the locked invoice and writes payment outcome, audit and insurer outbox. Redelivery recovers crashes. Planned workers and authoritative insurer evidence are required before policy notification. Payment does not mean coverage. 01 · CUSTOMER REQUEST Authenticate and quote Validate · price · snapshot 02 · TRANSACTION A Submit application Application + invoice + consent + audit AUTHORITATIVE INVOICE Expected payment Reference · currency · amount · expiry Invoice correlation and lock 03 · INDEPENDENT PROVIDER EVENT Verify payment callback Raw-body signature · timestamp · schema 04 · TRANSACTION B Commit durable receipt Commit immutable event identity + digest 05 · TRANSACTION C Apply business outcome Payment outcome + outbox + audit Rejected intake: no receipt or state mutation. Same-event redelivery recovers crashes before / after C. Late or mismatched payments require reconciliation. Valid outcome → outbox 06 · TARGET WORKER · PARTIAL Deliver to insurer Today: explicit manual insurer simulation 07 · TARGET POLICY · PLANNED Establish policy evidence Separate insurer / broker / policy records 08 · Tracking exists locally. Notices + ledger reporting are planned. Payment received ≠ insurer accepted ≠ coverage in force.
Eight backend stages: endpoints, records and recovery checks
Step Stage State Backend behavior Record / transaction Acceptance / recovery
01 Authenticate and quote Local /api/quotes validates session, membership and product inputs; server prices configured coverage Owned quote snapshot with rule/product versions, amount and expiry Invalid coverage is rejected; different customer/tenant cannot use the quote
02 Submit application Local /api/applications validates quote, answers, consent and idempotency key Transaction A: application, invoice and outcome audit Same-key retry returns the same outcome; failed transaction leaves no partial invoice
03 Verify payment callback Local /api/webhooks/payment checks raw-body signature, timestamp and schema No business mutation for rejected intake Reject malformed or forged event before persistence; validate provider-specific contract in P4
04 Commit durable receipt Local Persist normalized event, provider event identity and digest Transaction B: immutable payment_inbox receipt Duplicate same digest reuses receipt; changed payload conflicts; receipt survives processing failure
05 Apply business outcome Local Lock invoice; validate reference, amount, currency and expiry; apply allowed transition Transaction C: payment outcome, insurer outbox and audit; inbox processing result follows Redelivery recovers pre/post-domain-commit crash windows; late/mismatched events need reconciliation
06 Deliver to insurer Partial Demo uses explicit simulator action; production worker must deliver outbox and retry safely Target: leased work, delivery attempts, insurer inbox and correlated response Recover timeout and unknown status without duplicate binding; no autonomous worker exists yet
07 Establish policy evidence Planned Interpret insurer evidence under agreed authority; write separate policy/broker decisions Target: policy lifecycle and authoritative document references Paid, submitted and pending are distinct from bound coverage; synthetic document proves no insurance
08 Notify and operate Partial Local read-only tracking and /ops show state; target sends notices and reconciles ledger Target: notification outbox, delivery record, finance reports and retained audit Retry messages separately; authorized staff handle exceptions; monitor queue age and totals

Paid is not insured. Keep payment, submission, insurer response, broker decision and policy evidence distinct. The current synthetic document proves no insurance.

All 15 architecture domains mapped

15 mapped · 0 fully complete

Multi-insurer brokerage across all insurance lines remains the scope. The 12-category synthetic catalogue is the demo baseline. Every real product/version and partner needs approved terms, rates, authority and acceptance evidence. Mapping a domain to work does not complete its implementation.

BIZTRUST-IB-ARCH-001: current coverage, remaining work and phase mapping
Domain Architecture scope Current position Remaining acceptance Phases Milestones
01 Product objective and operating model Partial: multi-insurer demonstration Approved operating model, product inventory, agreements, authority and service targets P0, P7 BT-04, BT-10, BT-16
02 Actors, authority and tenants Partial: customer and read-only operations Agent, broker, insurer, support and administrator scope; lifecycle and delegation P0, P1, P3 BT-05, BT-06, BT-14
03 Customer journey and service states Partial: synthetic browse-to-tracking flow Product forms, referrals, document capture, notices and exception servicing P3, P4 BT-01, BT-13, BT-15
04 UX/UI and brand Partial: responsive branded demo and draft Lao Reviewed Lao/English content, accessibility and staff workflow acceptance P1, P3, P6 BT-02, BT-10, BT-11
05 Catalogue and comparison Partial: static synthetic catalogue Approved product versions, comparison disclosures and publication/withdrawal P3 BT-04, BT-12
06 Quote, submission, authority and lifecycle Partial: quote/application and simulator Separate authoritative records, binding decisions, renewal, endorsement and cancellation P3, P4 BT-06, BT-08, BT-13
07 Identity and authorization Partial: separate OIDC code, demo sessions, RLS Real identity/provider acceptance, provisioning, MFA/step-up and role policy P3, P5 BT-05, BT-14
08 Eligibility, pricing and decisions Partial: deterministic flexible demo premium Approved effective rules, eligibility/referral reasons and version governance P3 BT-12
09 Payments and reconciliation Partial: simulator, durable inbox and exceptions view Live adapters, workers, ledger, allocation/commissions, settlement and refunds P4, P7 BT-03, BT-07, BT-16
10 Insurer and partner integrations Partial: explicit insurer simulator Contracted adapters, authenticated intake, retries and native state mapping P4, P6 BT-08
11 API, events and contract versions Partial: local OpenAPI and idempotency contracts Provider schemas, compatibility/deprecation policy and delivery correlation P1, P3, P4, P6 BT-07, BT-08, BT-11, BT-12
12 Data, documents and analytics Partial: PostgreSQL RLS, audit, isolated restore and 30 restored-DB tests Classified objects, encryption, retention, export/reporting and restoration P4, P5 BT-09, BT-15
13 Layers, modules and deployment Partial: working modular monolith Gateway, private runtime, workers, topology and staging deployment acceptance P1, P4, P6 BT-08, BT-09, BT-11
14 Security, resilience and operational control Partial: local controls, read-only staff and restored-DB validation, scoped health correction Privileged workflows, KMS, SLOs, alerting, recovery and incident drills P3, P5, P7 BT-06, BT-09, BT-16
15 Engineering lifecycle and CI/CD Partial: local checks and release workflow code Hosted CI evidence, reviewed artifact promotion, rollback and production approval P1, P2, P6, P7 BT-11, BT-16

Production acceptance gates

Six acceptance records pending

Attach dated acceptance to the exact product, provider, release and environment. Owners define service and recovery targets before testing. Follow the P0–P7 roadmap above; a release artifact alone does not authorize activation.

G1 · Product and legal

Signed insurer agreements and authority, approved rates/terms/forms and Lao/English notices for every enabled product

Brokerage / product / legal

G2 · Identity and staff

Live customer/staff OIDC acceptance, role matrix, provisioning, MFA policy, assignment and negative authorization tests

Identity / operations

G3 · Money and coverage

Sandbox contract acceptance, worker crash/replay tests, reconciled ledger/refunds and authoritative insurer policy evidence

Finance / insurer liaison

G4 · Data and recovery

Classified encrypted storage, key/secret rotation, document controls, retention/export policy and measured restore drill

Security / infrastructure

G5 · Release and service

Hosted CI on exact artifact, staging UAT/accessibility/security/load results, migration and rollback drill, SLO dashboards and on-call runbooks

Release / service owner

G6 · Activation and pilot

Signed promotion decision, reviewed production-gate change, rollout/rollback thresholds, restricted initial scope and accepted live pilot evidence

Brokerage / finance / release owner

Next implementation sequence

Product/rating governance + tenant/role foundation → authorized staff work → payment/insurer processing → policy lifecycle and servicing → staging → approved production pilot.

Collect business/provider decisions first; prepare contracts and infrastructure in parallel. Record dated evidence in progress updates. The backend and domain plan is the source for these sections.

Milestones & accountable owners

Showing 18 of 18

BT-01Verified

Customer demo

browse, compare, calculate configured synthetic premiums, submit and track a demo application

OwnerEngineering

Evidence / dependencyVerification, flex pricing

BT-02Verified

Staff demo

separate session and read-only tenant-scoped cases, payment exceptions and health at `/ops`

OwnerEngineering

Evidence / dependencyOperations, verification

BT-03Verified

Payment simulator

verified receipt survives processing failure and duplicate redelivery

OwnerEngineering

Evidence / dependencySystem boundary, verification

BT-04Blocked

Product governance

approved insurer agreements, product terms, eligibility, rates and publication/withdrawal authority

OwnerBrokerage / product lead

Evidence / dependencyBlocked because signed insurer/distribution authority and approved product terms, eligibility, rates and publication rules are not evidenced; the catalogue is synthetic. Unblock for governed work when the Brokerage / product lead records scoped agreements and an approved product/version decision; BT-10 legal content approval is also needed before real-product publication. Discovery

BT-05Blocked

Customer and staff identity

live Logto setup, provisioning, role policy, MFA where required, and acceptance tests

OwnerIdentity administrator

Evidence / dependencyBlocked because accepted live customer/staff OIDC setup, provisioning, role policy and MFA decision are not evidenced. Unblock for identity work when the Identity administrator approves separate customer/staff issuer and client registration plus role/MFA policy; live sign-in and positive/negative authorization acceptance still need verification. Operations

BT-06Planned

Controlled staff work

case assignment, review and authorized financial/insurer actions with audit and negative authorization tests

OwnerOperations / engineering

Evidence / dependencyRole and delegation matrix from BT-04 and BT-05; coverage assessment

BT-07Blocked

Payment production path

provider sandbox, durable autonomous processing, settlement ledger, exceptions and refunds

OwnerFinance / engineering

Evidence / dependencyBlocked because a payment-provider sandbox contract, settlement/refund authority and reconciliation rules are missing. Unblock for integration work when Finance supplies those decisions and approved sandbox access; adapters, autonomous worker, ledger, recovery and provider acceptance remain to be built and verified. System boundary

BT-08Blocked

Insurer production path

at least one contracted sandbox, authenticated intake, delivery/retry worker and authoritative policy evidence

OwnerInsurer liaison / engineering

Evidence / dependencyBlocked because a contracted insurer sandbox, native state mapping and binding/policy-evidence authority are missing. Unblock for partner work when the Insurer liaison supplies an approved partner contract, sandbox and authoritative state/evidence rules; authenticated intake, delivery/retry and per-partner acceptance remain pending. System boundary

BT-09In progress

Data and operations

classified storage, key management, retention, telemetry, backup restoration and incident ownership

OwnerInfrastructure / security

Evidence / dependencyBT-09-S1 same-user/machine synthetic restore and 30/30 restored-database checks passed; current application candidate passed 45/45 isolated full tests, build/startup, 34 accessibility checks and audit zero. D01–D07 recovery decision register now records proposed offline portable drive, separate key custody and different-machine drill; no device/key setup or portable drill occurred. Dated evidence. D: development backup verified two same-user/machine source archives (97 and 105 files); no off-host recovery. G4 remains open: recovery target, portable key/restore, retention, incident ownership and human security acceptance pending

BT-10Blocked

Reviewed Lao and English product/legal content, notices and licensed distribution scope

OwnerBusiness / legal reviewer

Evidence / dependencyBlocked because reviewed Lao/English product and legal wording, notices and licensed distribution scope are not approved. Unblock for content work when a qualified Business / legal reviewer records approved wording, translations, notices and scope for each proposed product; publication still depends on BT-04 product authority. Discovery

BT-11Planned

Staging and release promotion

hosted CI evidence, APISIX/TLS, private runtime, rollback drill and explicit production approval

OwnerInfrastructure / release owner

Evidence / dependencyBT-04 through BT-10 and release gate

BT-12In progress

Catalogue and rating governance

versioned product forms, rates, eligibility, comparison disclosures, review, publication and withdrawal

OwnerProduct / engineering

Evidence / dependencyBT-04 and BT-10; BT-12-S1 uncommitted synthetic inspector/preview candidate; dated acceptance evidence: isolated migrations and focused 7/7 passed, current-candidate full npm run verify passed (45 tests, build/startup, 34 accessibility checks, eight browser journeys, audit zero high-severity findings); product governance, human/security review and hosted integration remain pending

BT-13Planned

Policy lifecycle

separate submissions, insurer responses, broker decisions and authoritative evidence; renewal, endorsement and cancellation

OwnerBrokerage / engineering

Evidence / dependencyBT-06, BT-08 and binding authority from BT-04; implementation plan

BT-14In progress

Tenant and distribution administration

onboarding, agent/broker assignments, delegated permissions, suspension and access reviews

OwnerPlatform / identity administrator

Evidence / dependencyBT-04 and BT-05; existing operations/tenant boundary exercised by BT-12-S1; dated acceptance evidence: isolated expiry and seven-table non-persistence passed, full verify/browser accessibility passed after navigation-focus repair; new role/tenant administration, owner acceptance and hosted integration remain pending

BT-15Planned

Documents and servicing

secure uploads, consent records, notices, claim intake and referral, export and operational reporting

OwnerService operations / engineering

Evidence / dependencyBT-09, BT-10 and BT-13; insurer retains claim decisions; implementation plan

BT-16Planned

Production operation

monitored pilot, reconciled daily totals, incident and recovery drills, access reviews and controlled product expansion

OwnerService owner / finance / infrastructure

Evidence / dependencyBT-11 and evidence for each enabled product and provider; implementation plan

BT-17In progress

Repository collaboration

shared agent rules, Git workflow, lifecycle skill routing/discovery, PR template and evidenced hosted review/check enforcement

OwnerEngineering / repository administrator

Evidence / dependencyContribution workflow, skill routing, dated evidence; scoped integration review records the historical three-patch check and proposed strict current-base protection; current four-patch handoff replayed 38 captured files locally. Original checkout retained its pre-existing PR template; implementation checkout template repaired. Hosted BT-17 execution and proof PR #13: main protection readback confirms strict unique CI check, one human approval, stale-review dismissal, conversations and admin enforcement; hosted check passed for two-file proof baseline; PR blocked for missing review. AI security/code reviews found no blocking issue but do not fill AP-01/AP-02. Isolated missing-check, stale-review, positive approval and unpublished feature-candidate hosted proof remain open

BT-18Verified

Public progress board

publish a static docs-only snapshot and verify the exact Pages URL, assets and gate wording; no application deployment

OwnerEngineering / project manager

Evidence / dependencyCorrected docs snapshot a86cc821e6920b720adbbefbc23d805061ecb50c on codex/docs/progress-pages; hosted build/deploy/report passed; live HTTPS page, logo, anchors, phase bars and BT-18 search observed; dated evidence; collapsible Preline navigation, eight phase bars and gate wording verified at the exact public Pages URL after hosted build/deploy run 36309855641; subsequent source changes require manual republishing

This board is a generated view. Change progress.md, the supplemental backend plan or repository register, add evidence to progress-updates.md, then run npm run progress:build. Counts describe tracked outcomes, not production readiness.