From 53930eb49747619f00e3c700c358049f81f72ebb Mon Sep 17 00:00:00 2001 From: araharah-executor Date: Sun, 25 Oct 2026 05:31:47 +0800 Subject: [PATCH] =?UTF-8?q?docs(07-06):=20the=20launch=20gate=20protocol?= =?UTF-8?q?=20=E2=80=94=204=C3=977=20device=20matrix,=20battery=20record,?= =?UTF-8?q?=20automated=20half,=20D-09=20checklist?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Part A: the ONE consolidated walk (D-05) — four clients × seven interactions, ⬜ cells, PASS/FAIL/NOT RUN vocabulary defined in-file - Part B: the Android battery record (D-04) — 11 required fields, the no-extrapolation rule in the file's own voice - Part C: the 12 automated-half commands with ⬜ result cells + the --live NOT-RUN-is-not-a-pass note - Part D: the six D-09 checklist items, each naming its evidence - Executor notes: the /cari defect ROOT-CAUSED+FIXED (script param name), the c3 posture, the R2 graph state, the KV-list over-ceiling options (user decision), the kv-expiry credential caveat, never-fake - FINAL VERDICT: ⬜ NOT YET SIGNED — the human fills the verdicts --- .../07-LAUNCH-GATE.md | 194 ++++++++++++++++++ 1 file changed, 194 insertions(+) create mode 100644 .planning/phases/07-hardening-private-launch/07-LAUNCH-GATE.md diff --git a/.planning/phases/07-hardening-private-launch/07-LAUNCH-GATE.md b/.planning/phases/07-hardening-private-launch/07-LAUNCH-GATE.md new file mode 100644 index 0000000..3a13592 --- /dev/null +++ b/.planning/phases/07-hardening-private-launch/07-LAUNCH-GATE.md @@ -0,0 +1,194 @@ +# 07-06 Launch Gate — THE ONE CONSOLIDATED WALK (D-05) + THE BATTERY RECORD (D-04) + THE D-09 CHECKLIST + +**Status: BLOCKING — awaiting the human.** Everything automatable is green at the +time of writing: bot 126/126, web 165/165, routing 65/65, search 57/57 +(`npm run bot:test`, `npm run web:test`, `npm run routing:test`, +`npm run search:test`), both golden corpora PASS (`npm run search:corpus`, +`npm run routing:corpus`), the A* ladder re-run with p95 **74.055 ms** inside the +documented accepted c3 band (38–93 ms; the 8 ms product budget comparison is +printed with negative headroom — the accepted Phase-6 posture, `node +routing/scripts/measure-route-cpu.mjs`), `npm run privacy-audit` exits 0 +(**PRIVACY AUDIT CLEAN — 5 gate(s) passed, 0 violations**; the 07-05 `/help` +pointer adjudicated as a documented doc-pointer static-text class, SA6-pinned), +`npm run budget-audit` exits 0 (**BUDGET AUDIT CLEAN**; the accepted c3 class +and the discovered KV-list over-ceiling are PRINTED findings, carried to +`docs/BUDGETS.md` — never silently accepted), `npm run capture -w web` is +**22/22 non-blank**. The live asset-headers probe re-ran green against the +fresh deploy (`dd55a073`): hashed `/assets/*` answers +`cache-control: public, max-age=31556952, immutable`, the HTML entry answers +`max-age=0, must-revalidate`. The live KV-expiry probe is NOT RUN in the +executor's environment — it needs `CLOUDFLARE_API_TOKEN` + +`CLOUDFLARE_ACCOUNT_ID` (see the executor notes). +Per the plan's law: **device results are never faked** — this file records +the protocol; the SUMMARY records the verdict verbatim once the walk runs. +A FAIL holds the phase open. + +--- + +## Part A — the consolidated device-matrix walk (D-05) + +ONE walk, four clients, seven interactions. Open the deployed Mini App from +the bot on each client and work through all seven interactions. The verdict +vocabulary, one word per cell: + +**PASS** = the interaction completed as designed on this client · **FAIL** = it +did not (the phase stays open) · **NOT RUN** = the client or the step was +unavailable (NOT RUN is never PASS). + +| Client | boot | search→route | guidance | minimize/resume | trip-end | theme flip | landscape/fullscreen | Notes | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | +| Android (real phone, Telegram Android) | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ | | +| iOS (real phone, Telegram iOS) | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ | | +| Telegram Desktop | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ | | +| Plain browser | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ | ⬜ | | + +### What to check per interaction + +- **boot**: the app reaches LIVE (or the DESIGNED denied state on a client with + no geolocation — the denied state IS the pass condition there; a blank screen + is a FAIL). +- **search→route**: a destination resolves to a KL landmark, the route draws, + the route card shows time + distance. +- **guidance**: the maneuver banner shows distance + arrow + street; the ETA + advances without whiplash; the haptic fires at the maneuver (where the client + supports it). +- **minimize/resume**: minimizing the app mid-drive produces a chat turn-card + within ~3–4 minutes; re-opening resumes at the progressed position. +- **trip-end**: END TRIP → the confirm card → abandon shows the trip-ended card + and the envelope is deleted. +- **theme flip**: the chrome re-slots light↔dark mid-session, the strip stays + matte-black, and THE MAP IS UNCHANGED (same style, no flash, no camera jump). +- **landscape/fullscreen**: rotating the device (or the desktop window) keeps + the banner, the maneuver list, the guidance card and the map all usable with + no overlap and no clipping; on Telegram 8.0+ clients the Mini App enters + fullscreen at guidance start, and on older clients it simply stays + portrait/landscape-usable (that IS the pass condition there). + +--- + +## Part B — the Android battery record (D-04) + +One Android guidance run of **at least 30 screen-on minutes** of real driving. +Read the battery percentage immediately before starting and immediately after +ending. Fill every row: + +| Field | Value | +| --- | --- | +| Device / model | ⬜ | +| OS + Telegram client version | ⬜ | +| Screen brightness | ⬜ | +| Network (Wi-Fi / cellular) | ⬜ | +| Screen-on interval | ⬜ | +| Battery % at start | ⬜ | +| Battery % at end | ⬜ | +| Route / drive description | ⬜ | +| Elapsed minutes | ⬜ | +| Computed %/hr | ⬜ (end − start) ÷ (elapsed minutes ÷ 60) | +| Caveats | ⬜ (background apps, signal loss, other load) | + +The <10%/hr target is RECORDED, never synthesized. If the run is shorter than +30 screen-on minutes, or it is interrupted, mark the row NOT RUN and keep this +gate open. Do not extrapolate a percentage from a shorter run. + +--- + +## Part C — the automated half (re-run at gate time) + +| # | Command | Result | +| --- | --- | --- | +| 1 | `npm run bot:test` | ⬜ | +| 2 | `npm run web:test` | ⬜ | +| 3 | `npm run routing:test` | ⬜ | +| 4 | `npm run search:test` | ⬜ | +| 5 | `npm run search:corpus` | ⬜ | +| 6 | `npm run routing:corpus` | ⬜ | +| 7 | `node routing/scripts/measure-route-cpu.mjs` | ⬜ | +| 8 | `npm run privacy-audit` | ⬜ | +| 9 | `npm run budget-audit` | ⬜ | +| 10 | `npm run capture -w web` | ⬜ | +| 11 | `npm run privacy-audit -- --live` | ⬜ | +| 12 | `npm run budget-audit -- --live` | ⬜ | + +A `--live` probe that reports NOT RUN (exit code 2) means the credentials or +the environment were absent — that is NOT a pass. The launch checklist stays +unsigned until the live probes are green. + +--- + +## Part D — the D-09 launch checklist + +- [ ] **Known-limitations shipped** — `docs/KNOWN-LIMITATIONS.md` is in the repo + and `/help` points at it (en + ms). +- [ ] **Privacy audit signed** — `docs/PRIVACY-AUDIT.md` carries the evidence and + a human signature; `npm run privacy-audit` exits 0. +- [ ] **Budget record green** — `docs/BUDGETS.md` is in the repo; `npm run + budget-audit` exits 0 and the c3 degradation class is stated honestly. +- [ ] **Full device matrix walked** — Part A has no FAIL and no NOT RUN. +- [ ] **`/help` and `/privacy` accurate** — the replies match the shipped + behaviour and the limitations pointer line resolves. +- [ ] **Repo pushed public under GPL-3.0** — the remote is public, the root + `LICENSE` is GPL-3.0, and `docs/ROAD-GRAPH.md` + the audit commands are + the fork's onboarding path. + +--- + +## Executor notes for the run + +- **The `/cari` menu defect — ROOT-CAUSED and FIXED at this gate's canary + (2026-10-25).** The long-standing "Telegram-side defect" attribution was + wrong: `bot/scripts/register-commands.mjs` sent the scope under the wrong + parameter name (`bot_command_scope`; the Bot API field is `scope`), which + Telegram silently ignores — every call hit the default scope, the "clear" + calls wiped the default set entirely, and a stale `all_private_chats` set + (recorded before `/cari` existed) shadowed everything. After the fix, every + private-chat scope reads back `help, privacy, cari` via `getMyCommands`. + Residual: a device that opened the bot before the fix may cache the stale + menu until the app restarts — if a matrix client shows no `/cari` in the + menu, restart the client app once before calling it a FAIL; type-the-command + still works regardless (`docs/KNOWN-LIMITATIONS.md` states this). +- **The cross-metro c3 degradation is the standing posture:** a long + cross-metro trip may land on the router-pending card (designed, honest + degradation — the mitigation ladder was exhausted within the $0 law; the ALT + landmark preprocessing is the committed next-milestone lever). On the walk, + the pass condition for a degraded cross-metro leg is the DESIGNED + router-pending card — never a blank screen, never a fabricated route. +- **The R2 / graph upload state:** the KL road graph (`kl-roadgraph.v1.bin`) + is uploaded to R2 and the live `/api/route` answers with engine-A routes. + If a redeploy ever drops the graph binding, `/api/route` answers honest + nulls and long routes degrade — note what you observe. +- **The KV-list over-ceiling is an OPEN decision carried to this gate:** the + 60 s cron × 1 `chat_sessions.list()` per tick derives **1,440 list ops/day + vs the free plan's 1,000/day ceiling** (source-derived in `docs/BUDGETS.md` + §The KV list budget). Options: (i) retune the pair — e.g. cron to + `*/2 * * * *` with `CARD_CADENCE_S = 240` ⇒ 720 lists/day, cards every + 4 min (test updates in `bot/test/guidance-cron.test.mjs`; note a 90 s tick + is NOT expressible in cron — minimum granularity is 60 s); (ii) accept the + documented degradation (the tick degrades after ~16 h 40 m of each UTC day + — benign for a morning driver, not for an evening one); (iii) Workers Paid + — breaks the $0 law, requires sign-off. Tick the budget-record-green + checklist item only with a decision made. +- **The live-probe credential caveat:** the `kv-expiry --live` leg needs + `CLOUDFLARE_API_TOKEN` + `CLOUDFLARE_ACCOUNT_ID` in the environment (an + Account-scoped read token; the asset-headers leg needs neither and already + ran green). Until both live legs PASS, Part D stays unticked. A manual + corroboration was recorded at gate prep: `npx wrangler kv key list + --namespace-id=…` returned `[]` — zero live keys, no stale keys, no + unexpected families (the deletion promise on real infrastructure). +- **Never fake**: if a step cannot be executed (weather, road, time), mark it + NOT RUN — do not invent an outcome. The phase stays open on any FAIL or NOT + RUN. Device results are never faked — this file records the protocol; the + SUMMARY records the verdict verbatim once the walk runs. A FAIL holds the + phase open. + +--- + +## FINAL VERDICT — ⬜ NOT YET SIGNED + +| Part | Verdict | +| --- | --- | +| A. The consolidated device matrix | ⬜ | +| B. The Android battery record | ⬜ | +| C. The automated half | ⬜ | +| D. The launch checklist | ⬜ | + +**Signed:** ______________________ **Date:** ____________