# Notatky closed beta acceptance checklist ## Prelaunch security and legal closeout — 2026-09-16 - [x] Owner and corporate archive identify `IKONBAI, Inc.` as the Delaware operator; corrected Terms/Privacy and landing candidates are prepared in a separate release branch. - [x] Prepared bilingual Subscription Terms, Accessibility Statement and Security Reporting pages plus privacy-rights, billing-support, vendor, copyright/DMCA and corporate-calendar runbooks. - [x] Prepared migration 022 and renewal handling for the immutable `beta-2026-09-16-1` release. It is not applied and the release is not active. - [x] Prepared the code-grounded [security/legal closeout](PRELAUNCH-SECURITY-LEGAL-CLOSEOUT.md), severity-based [incident runbook](INCIDENT-RESPONSE.md), [data/retention map](DATA-INVENTORY-RETENTION.md), [independent pentest brief](PENTEST-BRIEF.md), [U.S. counsel packet](US-COUNSEL-REVIEW-PACKET.md) and [state-review guide](STATE-REVIEW-GUIDE.md). - [x] Prepared isolated fixes/tests for legacy database privileges, unavailable AI allowance, Stripe Sandbox checkout ordering and synthetic three-part recovery. - [x] Completed the [local prelaunch verification](PRELAUNCH-VERIFICATION-2026-09-16.md): 295 Node tests, 17 database fixtures, container/browser/recovery checks and a clean post-fix Trivy HIGH/CRITICAL scan. - [ ] Owner-approved PR, exact-commit CI, merge and deployment receipts. Local preparation is not release evidence. - [ ] Production migration 020/021 catalog/function receipts. No production migration is authorized by this checklist. - [ ] Disposable-account deletion receipt and production-class database/private-object/AI-ledger restore receipt. - [ ] Independent penetration test, remediation and retest with no blocking High/Critical finding. - [ ] Written U.S. counsel decision for the actual operator, trademark/DBA, age/guardian model, launch states, privacy/retention, breach, copyright, accessibility and paid subscription. - [ ] Deploy the corrected IKONBAI, Inc. documents and activate the matching release only after exact-commit approval, migration receipt and signed-in device acceptance. - [ ] Complete trademark/DBA, California qualification/tax, provider-contract and corporate-execution decisions with counsel/CPA where indicated. Billing stays off or Sandbox-only until the paid-launch gates are complete. The 57-row state matrix remains pending; no checklist item represents “all U.S. laws certified.” ## Authentication email delivery gate — 2026-09-07 - [x] PR89 merged and deployed at `c927bd4`; all 17 required GitHub checks passed. - [x] Live English 14+ signup, email-code sign-in, private cloud note save and sign-out passed. - [x] Wrong-code recovery verified live after deployment; the same challenge remains available for correction within the bounded attempt limit. - [ ] Replace the Supabase built-in test mailer before external invitations. A new Spanish signup was blocked after the project sent two emails. - [ ] Verify `auth.notatky.com`, custom SMTP delivery, EN/ES OTP and two-account isolation, then update the EN/ES Privacy Notice release. Resend is the reviewed beta choice because it has a direct Supabase SMTP path, a published DPA and a free transactional allowance suitable for the first small cohort. No provider account, DNS record or secret is active merely because this choice is documented. Follow [the authentication email delivery runbook](AUTH-EMAIL-DELIVERY.md). ## B4 operations monitor — 2026-09-07 - [x] Added a read-only production smoke check for root routing, gateway health, processing availability, account/legal pages and public security headers. - [x] Scheduled it every six hours through the existing private GitHub repository, with manual dispatch and no secrets or user-data access. - [x] Documented incident ownership, private feedback triage, the disposable deletion drill, rollback and total-budget review in [BETA-OPERATIONS.md](BETA-OPERATIONS.md). - [ ] Merge the monitor, verify its first GitHub run and confirm repository failure notifications reach the operator. - [ ] Complete the disposable feedback/deletion drill and record counts only. - [ ] Confirm Railway/Supabase current spend and the scope of any Railway workspace hard limit before setting it. This is one part of the existing B4 gate. It does not close physical-device B3, activate the new legal release or prove provider-backup erasure. ## Gateway activation — 2026-09-07 - [x] PR75 unmodified cloud OCR/HTTP/isolation suites passed. - [x] Private HTTP processor and gateway deployed; same preview HTTPS address routes through gateway. - [x] Public capability200, private upstream health200, invalid-token401 and origin403 verified. - [ ] Real admitted-account processing/review/save and mobile acceptance. - [ ] Gateway-inclusive capacity/spend controls, AI/audio, family and operational launch gates. Processing is available through the account endpoint; this does not prove every account is admitted or that AI is enabled. See GATEWAY-ACTIVATION-RECEIPT.md. ## Private Railway worker checkpoint — 2026-09-07 - [x] Owner-authorized private deployment of merged PR73; actual 1CPU/512MiB, UID10001 and no public domain verified. - [x] Cloud network/filesystem containment tests passed using synthetic data. - [x] Diagnosed NPROC64 parser fork failure; seven OCR cases passed with diagnostic NPROC128. - [x] PR74 merged/deployed; unmodified OCR rerun exposed the same UID-limit contention at128. - [ ] Merge/deploy verified container PID-boundary fix and rerun unmodified cloud acceptance. - [ ] Authenticated private HTTP processing, gateway and real account/device acceptance. See [runtime evidence and limitations](RAILWAY-WORKER-ACCEPTANCE.md). Public processing remains disabled; earlier checkpoints below are delivery history. Status: IN PROGRESS · Last verified: 2026-09-06 UTC Audience: invited learners aged 14–17 with verified parents. Product languages: English/Spanish. Operating budget: up to $100/month total. This is the execution checklist for the existing beta plan, not a replacement product roadmap. Check a gate only after its acceptance evidence exists. Merged code, local checks and production activation are separate milestones. ## HEIC/HEIF checkpoint — 2026-09-06 - [x] Single-photo HEIC/HEIF code and tests across upload/recovery/download/delete and OCR. - [x] Migration010 prepared and locally tested after009; owner/isolation regressions pass. - [ ] Production migration009/010 verification and application deployment. - [ ] Real hosted and physical iPhone/iPad photo acceptance. - [ ] TXT/CSV/TSV vocabulary and remaining format families. [HEIF delivery and limitations](HEIF-DELIVERY.md). Hosted processing remains disabled. ## JPEG checkpoint — 2026-09-06 - [x] JPG/JPEG implemented across preflight, recovery, private download/deletion, local and portable OCR. - [x] Migration009 prepared; local SQL owner/role/immutability regression passed. - [ ] Operator migration009 installation and application deployment. - [ ] Real hosted JPEG account acceptance; phone orientation/handwriting checks. - [ ] HEIC/HEIF conversion and later format families. [JPEG evidence and activation sequence](JPEG-DELIVERY.md). Hosted processing remains disabled. ## Latest checkpoint — worker lifecycle PR59 merged at 6cb9598. The coordinator now uses a separate Linux worker process with a 190-second deadline, resource limits, minimal environment and process-group cleanup. Real PDF/scan/PNG container acceptance and 7 lifecycle tests supplement the earlier access tests. See [WORKER-LIFECYCLE.md](WORKER-LIFECYCLE.md). - [x] Local worker lifecycle and restricted-container extraction checked. - [ ] Authenticated HTTP and processing/review UI integration. - [ ] Hosted containment configuration and real account acceptance before activation. ## Current checkpoint — processing boundary PR58 is verified merged at f894082. Earlier entries below are dated delivery history. - [x] Account PDF/PNG upload UI and limited real-backend acceptance exist; see HOSTED-UPLOAD-UI-RECEIPT.md. OTP delivery was bridged in that acceptance run. - [x] PR55/57 invitation implementation is merged; migration 008 installation was previously catalog-verified. Actual invitation issuance/acceptance remains open. - [x] Server processing access boundary implemented: verified identity/admission before and after parsing, one active operation, bounded per-owner attempts, sanitized extraction receipt. - [x] 15 new processing-boundary tests, 7 portable-extractor tests and 164 Node tests pass locally. Provider responses are synthetic. - [ ] Wire the authenticated HTTP/isolated-worker boundary and account processing UI; hosted processing remains disabled. - [ ] Complete SMTP, family onboarding, cloud AI, cross-device/mobile acceptance and remaining lifecycle/operations gates before external teen beta. Contract and next integration: [CLOUD-PROCESSING-DELIVERY.md](CLOUD-PROCESSING-DELIVERY.md). Owner merges and deploys. This checkpoint does not authorize a production admission or enable processing. ## Verified foundation - [x] PRs through #38 merged. Upload migrations 005–007 applied and catalog-verified in production; see STORAGE-ROLLOUT-RECEIPT.md. - [x] 38 real local Auth/Storage API checks pass with migrations 005–007, including concurrent different payloads and exact winner download (storage-api-generated-results.txt). - [x] Production catalog inspected read-only; generated path compatibility corrected. Hosted Storage API reports 1.71.0; version-matched local API checks pass (STORAGE-PRODUCTION-PREFLIGHT.md). - [x] Account/note, manual local flashcard, writing coach and feedback foundations exist. This is not end-to-end external beta acceptance. ## Execution order and release gates | ID | Gate | Acceptance evidence required | Current status | |---|---|---|---| | U1 | Coordinate tabs | Two actual same-origin tabs cannot dispatch concurrently for one owner; stale journal reloaded; logout/cancel safe; unavailable locking fails closed | Verified locally in current PR; not activated | | U2 | Hosted Storage compatibility | Record hosted API behavior/version where available, versioning/delete compatibility and approved migration/rollback bundle | Version/schema and limited authenticated hosted acceptance verified; see HOSTED-STORAGE-RECEIPT.md | | U3 | Apply upload schema | Authorized application of 005–007; verify private bucket, guards and no changes to legacy files | Applied; authenticated upload/isolation/origin deletion and revocation verified | | U4 | File lifecycle | Explicit upload/download/delete receipts; interrupted request recovery; rejected-upload bytes and orphan cleanup verified; retention policy enforced | Hosted owner deletion/revocation verified; CDN invalidation is delayed; orphan cleanup/retention remain open | | U5 | Upload interface | EN/ES picker/progress/cancel/recover/delete; device-local recovery disclosure; no false success; correct signed-in owner | Implemented; limited real-backend UI acceptance recorded; hosted/mobile acceptance remains | | P1 | Bounded processing | PDF/PNG parsing and audio transcription in cloud; page/duration/size limits; timeout and cleanup; corrupt/encrypted inputs handled | Access boundary tested locally; authenticated HTTP/worker wiring remains; hosted processing off | | A1 | Educational AI | Provider configuration reviewed; grounded explanations with source references, uncertainty and student steps; EN/ES quality set passes | Hosted AI off | | A2 | Cost controls | Per-user quotas, server-side request limits, measured unit cost and enforceable spending controls within $100/month | Open | | M1 | Cross-device notes | Two independently signed-in devices: load/edit/save/conflict/export/delete and account switching verified | Code exists; acceptance open | | M2 | Flashcards | Decide and disclose beta scope; if cloud promised, cards/review progress sync and isolation tested; otherwise label local-only | Local cards include PDF vocabulary import and tap-to-flip; cloud sync acceptance remains open | | F1 | Family enrollment | Verified adult–learner link, age eligibility, learner assent, versioned agreements, revocation and no self-assigned parent privileges | Open | | F2 | Parent dashboard | Minimal authorized progress/access controls; no implicit raw-file/chat access; verified recipient handling | Not connected | | S1 | Safety behavior | Study boundaries, age-appropriate sensitive educational context, crisis support and adversarial EN/ES evaluations | Local foundations; hosted validation open | | S2 | Safety delivery | Document when alerts are appropriate; safe-recipient checks, delivery receipts, failure handling and human review; never claim alerts were sent without proof | Not connected | | L1 | Operator/legal details | Legal operator, address, support/privacy contacts, launch states, vendor terms, retention/deletion and final agreement review match actual behavior | Owner/corporate archive identify IKONBAI, Inc.; corrected document candidate prepared, provider/counsel/production receipts open | | O1 | Account/email reliability | Signup/login/recovery links and codes tested on desktop/mobile with actual deployment origins; email delivery plan | Partial | | O2 | Feedback handling | Tester sends real report; receipt and private operator queue verified; review owner/process defined | Queue foundation; acceptance open | | O3 | Operations | Error alerts without student content, health checks, backup/restore drill, incident/rollback instructions | Open | | D1 | Release | Approved Railway rollout of reviewed commit; domain/HTTPS and Auth redirect configuration; verify deployed commit | Hosted preview exists; current release not verified | | Q1 | Mobile and accessibility | iPhone/iPad/Android critical flow, microphone/file permissions, touch/keyboard, both themes and EN/ES | Open | | Q2 | Pilot acceptance | Invited student + parent complete login → upload → explanation → additions → second-device retrieval → deletion/feedback; no critical unresolved defects | Not started | No paid subscription in the first closed beta unless explicitly approved. Before billing is enabled: cancellation, renewal disclosures, receipts and support must be tested. Full web plagiarism checking and native extensions are not beta claims without a separately verified implementation. ## Current chunk contract (U1) GOAL: coordinate upload/reconciliation across same-browser tabs before journal writes. ALLOWED FILES: cloud-upload-transport.js, recovery tests, real-tab browser test, this checklist and existing beta plan link. DO NOT TOUCH: production data/schema/secrets, legacy files, AI provider flags, product-page activation. ACCEPTANCE: Web Locks keyed by Supabase origin and verified owner, held through operation; competing tab fails without dispatch; journal refreshed while locked; no locking support means no persistent upload. TESTS: full JS suite and isolated real Chrome tabs with synthetic Auth/Storage responses. These browser tests do not replace the separate real Storage API test. RISKS: locks coordinate cooperating pages of one browser origin only, not other devices, browser profiles or malicious callers. Server immutability remains necessary. Existing older clients must not be active during rollout. ROLLBACK: revert this unwired transport chunk; leave product uploads disabled. U1 local evidence: two real isolated Chrome tabs passed exclusion, zero competing dispatch, stale-journal refresh, cancellation release and reload recovery. 132 JS tests passed, including unavailable Web Locks and logout-before-lock handling. Product activation remains unchecked. ## Verification rerun See BETA-VERIFICATION-2026-09-06.md for the current pass/fail/not-tested split. Existing tests pass after repairing an outdated browser selector. This does not close external beta admission. ## Next chunk: hosted Storage acceptance - [x] PR #37 merge verified: 29498dd1e1e74a2b293b6d3861addc1bbbada041. - [x] Prepare opt-in hosted runner with fixed project, exact disposable identities, public key only, one-hour session bound and pre-dispatch cleanup journal. - [x] Provisioned two disposable fixture sessions and one-hour synthetic admission (A allowed, B denied). Both subsequently removed. - [x] Hosted PDF/PNG upload, byte download, metadata, other-user/public denial, replacement denial and origin cleanup passed. CDN invalidation delay separately observed. - [x] Grant revocation and retained owner read/delete verified; final catalog: zero fixture users/grants/objects. - [ ] Wire cloud upload UI only after hosted acceptance. Then continue processing, AI, family, sync and physical-mobile gates above. Runner: tests/hosted_storage_acceptance.py. Its guard tests are local simulations. Actual limited hosted evidence and cleanup are in HOSTED-STORAGE-RECEIPT.md. See HOSTED-ACCEPTANCE-RUNBOOK.md. ## Upload lifecycle continuation: origin deletion client - [x] Added an unwired owner-scoped deletion client with strict PDF/PNG path validation, no automatic retries, cancellation/session-change guards, and read-only recovery verification. - [x] Local tests verify exact delete requests, metadata + fresh-origin absence checks, other-owner rejection, lost responses, forbidden/malformed receipts, cancellation, and logout. 139 JavaScript tests pass. - [ ] Wire file list/upload/download/delete/recovery to the signed-in UI and verify it end to end. This client does not close U4/U5 or enable teen enrollment. - [ ] Verify this browser deletion client against disposable hosted fixtures before activation. Prior hosted-runner evidence informed the contract; it is not a live run of this new module. Deletion receipt deliberately distinguishes origin absence from CDN propagation and provider backup erasure. Retention/orphan cleanup and verified recovery across reloads remain open. ## Account file management — 2026-09-06 - [x] Added explicit owner-scoped PDF/PNG listing, bounded private downloads, confirmed origin deletion and read-only retry verification in the account UI (EN/ES). - [x] Logout/expiry cancels file operations and clears visible file state. No automatic listing or public download URL. - [x] 152 JavaScript tests pass. Isolated Chrome with synthetic Auth/Storage responses passed list → download → confirmed deletion → logout, Spanish labels and overflow checks at 390px and 1280px. - [ ] Run this UI against disposable hosted fixtures before deploying/activating this chunk. Mocked browser evidence is not hosted acceptance. - [ ] New upload UI, processing, AI, family admission, cross-device acceptance and physical mobile checks remain separate gates. Scope: account.html, account.css, account-workspace.js, account-library.js, account-files.js, cloud-file-reader.js and associated tests. No schema, secrets, AI flags, billing or production data changes. Rollback: revert this account file-panel commit; existing cloud notes are unaffected. Limitations: UUID filenames only; 50 entries per page; 20 MiB download cap. Origin absence does not prove CDN or backup erasure. An uncertain deletion target is held only in memory and is cleared on logout/reload; durable deletion recovery remains open. Existing note/card data and downloaded copies are not removed by deleting an original file. This chunk does not close U4/U5 or teen beta readiness. ## Account upload session integration — 2026-09-06 - [x] PR #48 and #49 merges verified on default branch (abbccf2). - [x] Account adapter now coordinates existing upload transport with the authenticated owner, server admission and opt-in device-local recovery metadata. - [x] Explicit cancel and logout abort the transfer. A lost response keeps the exact recovery record and prevents another upload until read-only reconciliation succeeds. - [x] 158 Node tests pass, including new account-level consent, owner, admission, receipt, lost-response, cancel and logout cases. - [ ] Browser picker/progress/cancel/recovery controls and real hosted UI acceptance remain open. This adapter is not loaded or activated as an upload UI by this chunk. GOAL: bind the existing upload transport to account lifetime without exposing session tokens. ALLOWED FILES: account-library.js, tests/account-upload.test.cjs, BETA-CHECKLIST.md. DO NOT TOUCH: production accounts, schema, secrets, AI/provider flags, existing student files. ACCEPTANCE: consent before local metadata access; verified owner; server admission before dispatch; no success after cancellation; durable uncertain-upload record; read-only recovery. REQUIRED TESTS: complete Node suite, including account-level failure scenarios above. RISKS: recovery metadata stays on this browser after logout; no file body, original filename or token is persisted. A missing object cannot yet be dismissed safely by this adapter; failed recovery stays blocked for follow-up. This is not physical-device or hosted UI evidence. ROLLBACK: revert this adapter commit. No migration or production changes were made. ## Accepted format roadmap and upload UI Decision: incorporate FILE-FORMAT-RESEARCH.md as the format rollout policy. Finish PDF/PNG first, then JPEG/HEIC photos, text/CSV/TSV vocabulary, DOCX/PPTX, and voice. Additional formats require coordinated storage and processing changes; they are not activated by changing the file picker alone. - [x] Account PDF/PNG picker, explicit recovery consent, indeterminate confirmation indicator, cancellation and unfinished-upload verification implemented in EN/ES. - [ ] Hosted disposable-account acceptance and release still pending. No claim of OCR, transcription or generated study notes from this upload panel. - [ ] Expand one format family at a time using the research acceptance gates. Rollback: revert this UI chunk; the underlying account/upload adapters remain available. No schema, secrets, paid services or production files changed. Upload UI local evidence: 158 Node tests pass. Isolated Chrome at 390px/1280px passed explicit consent, admission denial, successful receipt, lost response → reload → read-only recovery, cancellation, Spanish labels and logout clearing. Existing list/download/delete browser regression also passed. All browser network responses were synthetic; this does not close hosted acceptance or physical-device gates. ## Real backend account UI evidence See HOSTED-UPLOAD-UI-RECEIPT.md: PDF/PNG upload, real listing/download, lost-response recovery after reload, confirmed origin deletion and unadmitted-user rejection verified using the local UI and real Supabase. Exact fixture cleanup counts: 0 users / 0 grants / 0 objects. OTP delivery was bridged, not tested. The combined harness failed at the next login after sign-out; account switching remains open. Railway-origin acceptance, retention/orphan handling and family beta gates are still open. ## Account re-login cooldown The client deliberately retains its 60-second OTP request cooldown after sign-out. A rapid second login can therefore leave the code form hidden until another request is permitted. Added a live EN/ES countdown and disabled request button during that existing cooldown; no rate-limit weakening. Isolated Chrome verifies A login → logout → blocked resend → countdown expiry → B login using a virtual clock and synthetic Auth. This explains the earlier rapid-switch test assumption, but does not claim live email-delivery acceptance. 158 Node tests pass. ## Invitation acceptance UI - [x] EN/ES pending invitation, fixed expiry, explicit unchecked acknowledgement and acceptance control. - [x] Read-only reconciliation after uncertain acceptance; no automatic acceptance retry. - [x] 164 Node tests and isolated Chrome invitation/access scenarios pass (synthetic services; 390/1280px). - [ ] PR55 prerequisite merge (GitHub still OPEN at last verification), UI merge, migration 008 installation and hosted release. - [ ] Operator-issued adult invitation and real hosted acceptance; no new production grants issued. - [ ] Family onboarding and approved versioned agreements remain separate prerequisites for students. ## iPhone Safari Add material repair - [x] Identify hosted Add material interception; route to account upload instead of Mac-only notice. - [x] Separate mobile photo picker in account and local material dialog; preserve validation and recording/file selection behavior. - [x] 174 Node tests and synthetic Chrome photo/navigation scenarios pass. See MOBILE-PHOTO-DELIVERY.md. - [ ] Publish/review UI and HEIF prerequisite; owner deployment and migrations 009/010. - [ ] Physical iPhone Safari JPEG/HEIC selection and private upload receipt. - [ ] Hosted extraction to study notes remains separate and disabled. - [x] Explicit camera input in local/account material selectors; local recording delete action and permission reminder; 175 Node tests pass. - [ ] Hosted audio recording/upload/transcription and custom photo preview; physical Safari camera/microphone acceptance remain open. - [x] WebKit 26.5 synthetic mobile camera-picker/navigation and account upload boundary tests pass; physical iPhone acceptance remains open. ## Mobile release inclusion correction - [x] PR62 release merge verified at 766d48b. - [x] PR63 merged into intermediate branch only; mobile commit transferred unchanged onto release-based branch codex/mobile-camera-release. - [x] 175 Node tests rerun successfully. - [ ] Merge direct release integration PR before deploying camera/Add material fixes. ## Authenticated processing HTTP adapter - [x] PR64 release inclusion verified at 8951d62. - [x] Separate strict HTTP handler prepared around isolated DocumentProcessor; hosted preview remains disabled. - [ ] Merge adapter after CI/review; configure bounded TLS proxy/container runtime and explicit account UI. - [ ] Real disposable Auth + HTTP + worker acceptance and physical Safari check before activation. See PROCESSING-HTTP-DELIVERY.md for exact boundaries and remaining runtime limits. ## Account processing/review UI - [x] Explicit selection -> capability check -> authenticated processing -> review -> existing editor -> explicit save, implemented. - [x] 184 Node, 10 HTTP and 12 preview tests pass; Chrome/WebKit synthetic EN/ES 390/1280 flow passes. - [ ] Runtime mount/proxy/container limits and real disposable account + worker + UI acceptance. - [ ] Physical iPhone and actual production photo-format capabilities/migrations verified before rollout. See ACCOUNT-PROCESSING-DELIVERY.md. Processing remains off on hosted preview; audio/AI separate. ## Processing service runtime - [x] PR66 release inclusion verified at 6914b8c. - [x] Explicit Linux/non-root service entry and fail-closed configuration tests prepared; no default listener activation. - [ ] Complete runtime receipt, CI and review. - [ ] Same-origin bounded proxy/container deployment, real Supabase admission + OCR acceptance and physical phone check. See PROCESSING-RUNTIME-DELIVERY.md. No production activation performed. - [x] Local real HTTP/coordinator/isolated OCR acceptance: five formats, cleanup, quota and revoked admission pass; identity synthetic. 3 configuration and 184 Node tests pass. ## Same-origin processing gateway - [x] PR67 release inclusion verified at c655302. - [x] Fixed-route gateway prepared: exact host/origin, no retries, bounded connections/queue and header completion deadline. - [ ] Real HAProxy local/CI acceptance receipt and review. - [ ] Owner private-service/HTTPS setup, real gateway+Auth+OCR+UI acceptance and physical phone checks before activation. See PROCESSING-GATEWAY-DELIVERY.md; no Railway settings changed. - [x] Local HAProxy acceptance: routes/headers/body, rejection, incomplete-header deadline, queue503/no replay and rate429 pass. 2 config and184 Node tests pass. ## Live deployment gap — read-only verification - [x] PR68 release merge verified fa001d2. - [x] Railway still runs one preview deployment labelled PR53/54 (6c1e5d2), no GitHub source, no processor/gateway and no custom domain in returned state. - [x] Per-service config files, startup liveness and DNS refresh prepared. - [ ] Owner UI refresh deploy; verify image/release commit. - [ ] Confirm runtime containment/cost/platform support before creating or activating processing services. - [ ] Private routing, real account full-chain acceptance, migrations and physical phones. Exact operator plan: RAILWAY-RELEASE-CHECKLIST.md. No production settings changed. ## Worker privilege barrier — 2026-09-07 Code now sets and verifies Linux no_new_privs before parser imports/source reads. Failure rejects the job. Local 9 worker tests and real PDF/PNG/JPEG/HEIF extraction passed in a restricted container WITHOUT Docker no-new-privileges: the code installs the barrier and it persists across exec. This is not filesystem/network isolation and is not production activation. Remaining: bounded writable storage, network containment, runtime resource limits and real hosted acceptance. ## Worker filesystem boundary — 2026-09-07 Landlock ABI7 observed on Railway preview via read-only syscall probe. New worker policy requires ABI3 and limits filesystem access to job files and runtime dependencies; installation fails closed. Local writable-container denial tests and real OCR passed. Not deployed. Network/aggregate storage/process containment and real hosted acceptance remain open; see WORKER-FILESYSTEM-BOUNDARY.md. ## Beta execution checkpoint — 2026-09-07 - [x] Preview deployment and startup health settings verified on Railway. - [x] PR70 privilege and PR71 filesystem barriers merged and CI verified. - [ ] Network barrier merged/deployed: implementation and local acceptance ready in next PR; see WORKER-NETWORK-BOUNDARY.md. - [ ] Bounded aggregate temporary storage and process lifecycle enforced in hosted worker. - [ ] Private processing/gateway deployed and verified with real Auth. - [ ] JPEG/HEIF production migrations verified; full upload/process/review/save/delete flow. - [ ] Physical iPhone/Android acceptance and family admission/operations review. Cloud OCR/AI remain inactive. Code/CI completion is distinct from production acceptance. ## Process and scratch checkpoint — 2026-09-07 PR72 merged. Next chunk enforces <=96MiB tmpfs scratch with no disk fallback, RLIMIT_NPROC64 and process-group escape denial; local OCR/cleanup tests pass. Actual processing service still not deployed: next configure private runtime CPU/memory/PID, verify these guards there, then end-to-end Auth/OCR/mobile acceptance. Resource tests are not live-beta completion. ## Adult account acceptance — current checkpoint This supersedes historical unavailable-processing/adult-invitation statuses above. See ADULT-ACCOUNT-ACCEPTANCE.md for evidence and limitations. - [x] PR76 deployed; same-origin processing gateway active and production JPEG/HEIF capability migrations verified. - [x] Owner-approved adult invitation accepted; real JPEG OCR, review, addition, cloud save and explicit reload passed. - [x] Synthetic JPEG original upload and cloud listing passed. - [x] Eight isolated database policy suites and 184 Node tests passed on the current release-based checkpoint. - [ ] New hosted JPEG/HEIF two-account isolation, download/deletion and second-device acceptance. - [ ] Physical phone camera/gallery acceptance; family enrollment/notification, AI/audio and operations gates remain open. No complete family-beta readiness claim. QA note and original remain in the owner library. ## Self-service 14+ legal release candidate — 2026-09-07 - [x] Migration 015 installed; release and acceptance tables use FORCE RLS. - [x] External release check returns HTTP 200 with `[]`; signup remains closed. - [x] PR86 deployed at commit `03e6924b7e806dba2fa4e2f4cb42541c0d036e77`. - [x] Historical English/Spanish Terms and Privacy candidate prepared; superseded by the corrected IKONBAI, Inc. release candidate dated 2026-09-16. - [x] Registration links both documents and requires three unchecked confirmations. - [x] Guarded activation and retirement procedure prepared in `SELF-SERVICE-RELEASE-RUNBOOK.md`. - [x] 198 Node tests and WebKit 390/820 legal-entry acceptance pass. - [ ] Licensed U.S. counsel/owner approves exact version `beta-2026-09-07-1` and launch footprint. - [ ] Merge and deploy the legal release candidate; verify served commit and document versions. - [ ] Insert the approved release row, then verify EN/ES public RPC output. - [ ] Complete physical-phone new-user acceptance and operator deletion/retention drill. Until the last four items pass, do not invite new 14–17 testers. Parent Connect remains optional; automatic parent alerts, cloud AI chat, hosted audio transcription and billing remain off. ## Stripe Sandbox preparation · 2026-09-09 - [x] Historical isolated Stripe Sandbox product and $9.99 monthly price created; all objects verified `livemode=false`. This is a provider test receipt, not the current catalog. - [x] Test subscription, paid invoice, Customer Portal cancellation and full refund completed with provider receipts. - [x] Fail-closed server integration, signed webhook boundary and replay-safe private ledger prepared behind `NOTATKY_BILLING_TEST_ENABLED=0`. - [x] EN/ES account test panel prepared; hidden while the flag is off and explicitly labeled as test mode. - [x] Starter ($4.99) and Plus ($11.99) catalog, plan selection and one-time no-card Starter trial prepared in code. - [ ] Create the two new prices in an isolated Stripe Sandbox and repeat Checkout, Portal, cancellation and webhook receipts for both plans. - [ ] Enforce each plan's AI, material and audio allowances server-side before live billing. - [ ] Merge and CI review. - [ ] Apply migration 019 in a non-live environment, configure a restricted Sandbox key and webhook, then repeat the browser lifecycle. - [ ] Keep the closed beta free. Live billing remains a separate owner/legal/tax release decision. ## Resend privacy disclosure release — 2026-09-07 - [x] Prepared version `beta-2026-09-07-2` of the English/Spanish Terms and Privacy Notice. - [x] The notice now identifies Resend as the transactional authentication-email processor, states the exact data path, excludes study files/notes from that connection, and links the provider DPA and Privacy Policy. - [x] The retention text distinguishes Notatky-controlled diagnostic records from provider-controlled authentication delivery records. - [x] The replacement runbook atomically retires `beta-2026-09-07-1` and inserts the new release only when both dated review receipts are supplied and the expected prior release is active. - [x] Local validation: 206 Node tests and WebKit at 390px/820px passed; generated EN/ES documents have matching versions and no horizontal overflow. - [ ] Owner merges and deploys this candidate; production activation remains a separate reviewed database action. This chunk closes the implementation portion of the B4 Resend disclosure. It does not certify legal sufficiency or activate a new release. Rollback: revert the document PR before activation. After activation, retire the new immutable release using the runbook; do not rewrite acceptance history.