Control boundary: Dedicated Cloud is active for tenant-scoped schema reads. Demo or local records remain visible until tenant identity and operational write policy are verified. No email, social, booking, payment, or CRM mutation is executed.
QualiSift operations · release gate
Make the production boundary explicit.
A controlled release gate for the QualiSift engine. It shows what is verified in Dedicated Cloud, what is ready for activation, and what still needs owner-authorized access.
Foundation ready
8/8
Contracts complete or ready for activation
Cloud blockers
0
Infrastructure or policy gates held by design
Access gates
4
Owner or provider access still required
Live effects
0
No external mutation in Preview
Current state snapshot
Dedicated Cloud active · external effects gated
Dedicated Cloud is live with an RLS-enabled schema. Worker runtime, tenant identity, connectors, CRM mapping, operational writes, and external effects remain separately gated.
Foundation verification
Verified foundation checklist
These controls separate verified schema and policy contracts from the remaining identity, connector, worker, and external-effect gates.
Project and environment scope locked
The QualiSift build is isolated to this dedicated project and primary web app.
Project 77792 · web target · primary Site
Preview build and route surface
Client and operator routes are rendered in the controlled preview with no external writes.
Preview reachable · Vite compile clean
Lead intelligence vertical slice
Manual and CSV intake stays tenant-scoped and rejects missing provenance or lawful-basis fields.
Staging ledger · evidence · scoring · next action
Approval and outbound boundary
Email, social, calls, ads, payments, and customer-facing messages remain disabled by policy.
Drafts and approval cards only
Event-driven runtime contract
The contract is ready for a durable queue and worker; no production worker is active in preview.
Schemas · transitions · idempotency · retry policy
Verified outcome contract
Bookings, opportunities, and revenue remain zero until system-of-record evidence is ingested.
ESTAGE source event required
Controlled extension runway
SEO & Search Console is the first access-gated lane; later lanes remain planned.
Eight ordered lanes · one-at-a-time policy
Cloud-enforced security boundary
Tenant isolation and retention are defined as contracts and still require production enforcement.
No secrets in source, prompts, browser storage, or preview logs
Current cloud and access posture
Cloud and access gates
Dedicated Cloud is active for this project. It does not replace the separate access required for ESTAGE, booking, Search Console, tenant identity, or worker secrets.
Dedicated Cloud provisioning
InfrastructureDedicated Cloud is provisioned and active for this project on the starter tier.
Durable schema and RLS
InfrastructureThirteen RLS-enabled tables are live. Operational INSERT and UPDATE policies are not verified, so app writes remain gated.
Server-side secrets and worker runtime
InfrastructureNo worker or external connector is deployed in the current founder preview, so no runtime secret is required yet.
Tenant and operator authorization
AccessUse the approved host/community identity boundary; do not add a local signup or hand-rolled auth flow.
ESTAGE system-of-record mapping
AccessVerify exact contact, consent, booking, order, revenue, and lifecycle fields before any write.
Booking capability
AccessA verified booking capability and lifecycle event contract are required before a booking counts.
Search Console property
AccessOwner-authorized property, connector, tenant mapping, and source timestamps are required.
Live Dedicated Cloud schema
Tenant-scoped schema contract
The live schema is RLS-enabled and tenant-scoped. Operational writes remain gated until the authenticated tenant and server-side policy boundary are verified.
prospects
id · tenant_id · company_nameTenant-scoped staging record for a prospect before CRM verification.
Tenant RLS · provenance and lawful-basis fields · retention policy
lead_evidence
id · tenant_id · prospect_idSource references that explain fit, intent, and qualification decisions.
Tenant RLS · source timestamp · immutable reference metadata
lead_compliance
id · tenant_id · prospect_idPurpose, lawful basis, consent, and suppression state for each prospect.
Tenant RLS · purpose limitation · suppression precedence
approvals
id · tenant_id · prospect_idHuman decision boundary for qualification and any future external effect.
Tenant RLS · explicit actor · decision timestamp
outreach_drafts
id · tenant_id · prospect_idPrepared, compliant drafts that cannot send without approval.
Tenant RLS · channel policy · no credentials · approval binding
operational_tasks
id · tenant_id · prospect_idNext-best actions and human work items created by the orchestrator.
Tenant RLS · owner boundary · due-date and status transitions
workflow_runs
id · tenant_id · prospect_idBounded orchestrator execution state for lazy capabilities.
Tenant RLS · timeout budget · retry ceiling · dead-letter reference
workflow_dead_letters
id · tenant_id · workflow_run_idQuarantine for exhausted or non-retryable workflow failures.
Operator-only read · bounded replay · resolution timestamp
audit_events
id · tenant_id · event_idTraceable record of important workflow, access, and approval actions.
Tenant RLS · idempotency key · actor and timestamp · no secrets
lifecycle_outcomes
id · tenant_id · prospect_idVerified booking, opportunity, and revenue events from ESTAGE.
Tenant RLS · system-of-record verification · dedupe · amount validation
tenants
id · name · slugTenant boundary and lifecycle status for the application.
Tenant membership policy · operator role boundary
tenant_memberships
tenant_id · user_id · roleMembership and role relationship used by tenant RLS policies.
Self-read boundary · role checks for operator actions
profiles
id · display_name · avatar_urlMember display metadata kept separate from authentication identity.
Own-row access · no credentials · profile metadata only
Security controls
Safe defaults before persistence
Validate at every trust boundary
Intake, CSV rows, connector payloads, webhook events, and future model output require schema validation.
Authorize tenant scope in code
Client-supplied tenant identifiers are never an authorization proof; production RLS and server checks must enforce scope.
Keep credentials server-side
No API key, OAuth token, owner credential, or session secret belongs in prompts, logs, browser storage, or bundles.
Require human approval for external effects
Sending, publishing, calling, spending, and CRM writes remain disabled until the relevant contract and approval exist.
Define retention and deletion before persistence
Retention periods must be owner-configured and accompanied by export/delete behavior before durable PII storage.
Go / no-go gate
Release evidence
Preview compile and route smoke
Current Preview is reachable and Vite reports no compile error.
Production configuration
Dedicated Cloud is active; connectors, CRM mapping, tenant identity, and custom-domain attachment remain separate gates.
Live lifecycle journey
No real booking, CRM lifecycle, revenue, or outbound journey has been executed.
Rollback and manual fallback
The controlled preview remains the safe fallback while tenant identity, operational writes, and external effects are gated.