Customer implementation — qualification

Record status

Record ID

project:customer-implementation

Parent lifecycle

candidate

Page lane

qualification

Lane lifecycle

proposed

Owner

Not separately recorded

Owner role

Not separately recorded

Owner status

Not separately recorded

Qualification result

NOT RUN · held for evidence and human review

Working browser surface: Project templates & workflows — overview — Create a local project from this template and validate its forms. This route is local-only; provider, credential, database, customer, publication, deployment, and production effects remain held.

Qualification status

Result

NOT RUN

Disposition

HELD

Reviewer

Not recorded

Receipt

Not recorded

This page defines proposed acceptance criteria for the qualification lane. It does not execute tests, establish compliance, qualify the subject, or authorize an effect.

Outcome definitions

Verified

All stated evidence and acceptance requirements passed for the exact reviewed revision; this still does not authorize deployment or an external effect.

Failed

One or more deterministic acceptance requirements failed with an inspectable reason.

Needs review

Evidence or interpretation is incomplete, conflicting, or awaits an identified human reviewer.

Held

Authority, required evidence, safe execution conditions, or a principal gate is absent.

The current record remains NOT RUN / HELD. These definitions describe candidate outcomes only.

Proposed deterministic acceptance tests

Route-resolution and distinct-content checks apply only to the admitted canonical routes in this record. Held source-proposed extensions are non-resolving proposals and are excluded.

• FORM-001: Submitting without project title, owner, purpose, tenant label, or lifecycle is blocked; each missing field receives a programmatically associated, specific error.
• FORM-002: Tenant labels containing only whitespace, unsupported control characters, or an unapproved cross-tenant reference are rejected; the error explains the boundary violation without exposing another tenant's data.
• FORM-003: A required-by timestamp without timezone, or with an invalid date-time, is rejected and announced to assistive technology.
• FORM-004: A successor deadline earlier than its blocking predecessor plus declared duration is rejected or visibly marked as a blocking conflict; no silent correction occurs.
• FORM-005: Saving a valid form creates or updates one canonical project revision, preserves the prior revision, and reports the canonical ID and lifecycle.
• DEPEND-001: Removing a blocking dependency requires an explicit reason, actor, revision, and approval or Held state; downstream tasks remain blocked until resolved.
• DEPEND-002: A dependency cycle is detected deterministically and prevents qualification, with the cycle members named in the error.
• REV-001: Editing an approved project creates a new revision and returns the approval state to Needs review; the previously approved revision remains readable.
• REV-002: Concurrent or stale revision submission is rejected without overwriting newer data, and the user is offered reload, compare, or save-as-new-revision choices.
• ACCESS-001: Every field has a visible label, accessible name, error association, and instruction where needed; keyboard-only navigation reaches all controls in logical order.
• ACCESS-002: Focus moves to the first invalid field or an error summary after failed submission; focus is never trapped in a modal or contextual room.
• ACCESS-003: Status changes such as Saved, Blocked, Held, Overdue, and Needs review are available to assistive technology and are not conveyed by color alone.
• ACCESS-004: The workflow remains usable at increased text size, narrow viewport, and reduced-motion settings; no essential content depends on hover or drag-only interaction.
• PRIV-001: A record from tenant A cannot be selected, linked, searched, or displayed in tenant B's project context; denied access produces a generic boundary-safe message.
• PRIV-002: Source locators, attachments, credentials, and customer-sensitive values are minimized; held upload or protected-storage states do not expose file contents or paths unnecessarily.
• PRIV-003: Search and PointGuard context respect visibility and partition private, held, and public records; no customer record is treated as indexed without evidence.
• DEST-001: Deleting a project, dependency, attachment reference, or schedule item requires an explicit confirmation naming the target, scope, and consequences.
• DEST-002: Destructive actions support cancel, do not execute on Enter from an unrelated field, and preserve an auditable tombstone or held deletion record where deletion is proposed.
• AUTH-001: A user without project-owner or approver authority cannot approve, waive a blocking dependency, cross a tenant boundary, publish, send, connect a provider, or authorize production effects.
• AUTH-002: Approval is scoped to a specific project revision and action; changing the revision or action invalidates the prior approval.
• EFFECT-001: Provider, credential, database, customer, publication, indexing, and production effects remain visibly Held unless separately verified; a local approval cannot be presented as external execution.
• FAIL-001: Save failure preserves entered values locally where safe, identifies that no canonical update was confirmed, and offers retry without duplicate creation.
• FAIL-002: Schedule conflict, dependency failure, stale revision, denied authority, and tenant-boundary denial each produce distinct, actionable states with no false success.
• FAIL-003: Partial completion records which steps passed, failed, or are blocked; retrying a failed step is idempotent or creates a clearly new revision.
• QUAL-001: Qualification is blocked by any failed, missing, stale, unauthorized, privacy, accessibility, dependency-cycle, or held-required-action test.
• QUAL-002: A qualification summary lists test IDs, evidence records, project revision, unresolved hazards, held effects, and the authorized reviewer; it makes no deployment or connectivity claim.

Negative and held-state tests

• A local prototype route may be mistaken for a connected customer implementation.
• Tenant labels or source locators may expose sensitive customer information through search, PointGuard context, attachments, or error messages.
• Unreviewed schedule changes may create missed deadlines or conflicting workbacks.
• A revision may be approved while a newer revision is being edited.
• A destructive action may remove the wrong project, record, attachment reference, or deadline.
• An Agent or interface may appear to act beyond its authority.
• Provider, credential, database, customer, publication, indexing, or production effects may be falsely represented as complete.
• Missing or ambiguous timezones can produce incorrect workbacks.
• Failure after partial save may create duplicate records or an apparent success without canonical evidence.
• Accessibility failures may prevent keyboard, screen-reader, zoom, reduced-motion, or low-contrast users from completing qualification.

Qualification claim boundary

Potentially allowed only after the stated evidence

• A proposal for qualifying a bounded customer-implementation project.
• The observed native contract includes project collections, deadlines, revisions, provenance, lifecycle, and held external effects.
• The listed prototype or indexed routes can serve as proposed local review surfaces.
• Qualification requires deterministic validation, explicit ownership, human review, and evidence.

Still held

• Deployment or production readiness.
• Connected provider, credential, database, customer, publication, or indexing behavior.
• Successful tenant isolation in production.
• Completion of a customer implementation.
• External scheduling, messaging, upload, storage, or publication.
• Qualification, approval, or customer acceptance before the listed tests pass with preserved evidence.

Sources and evidence

These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment.

• source_record:project:customer-implementation
• NotebookCollectionKind.project
• NotebookTodoPayload.dueAt
• Notebook Agenda deadlines/workbacks
• Observed native contract: project_and_field_guide_collections
• Observed native contract: deadlines
• Observed native contract: records
• Observed native contract: pointguard
• App routes: /app/notebook/projects/
• App routes: /app/notebook/approvals/
• App routes: /app/notebook/agenda/
• App routes: /app/notebook/to-dos/
• App routes: /app/notebook/files/
• App routes: /app/notebook/messages/
• App routes: /app/pointguard/