# DIREKT Live Integration Ledger

**Repository:** `kudzimusar/direkt`
**Last reconciled:** 2026-07-27 (Asia/Tokyo)
**Governing issue:** #261 — Runtime integration closure after W8
**Purpose:** Canonical cross-agent source of truth for integration existence, state, evidence, blockers and next actions.

> Every integration-related PR must update this ledger in the same change whenever provisioning, source integration, secrets, runtime binding, managed evidence, legal/commercial state, fallback/kill-switch or production authorization changes.

## Status vocabulary

| Status | Meaning |
|---|---|
| `ACTIVE` | Source/config/runtime evidence proves approved use. |
| `IMPLEMENTED_GATED` | Code exists but provider/real activation remains fail-closed. |
| `EXTERNALLY_PROVISIONED` | Account/API/product/credential exists, but runtime use is not proven. |
| `SANDBOX_PROVEN` | Real provider sandbox API flow succeeded, but DIREKT runtime/live activation is not approved. |
| `PENDING_PROVIDER` | Waiting on provider approval/onboarding. |
| `PLANNED` | Approved direction exists; implementation incomplete. |
| `DISABLED` | Intentionally off in the approved environment. |
| `SUPERSEDED` | Historical/fallback direction. |
| `BLOCKED` | Cannot progress without an external/legal/commercial/repository gate. |

No account, key, secret or dashboard project becomes `ACTIVE` by existence alone.

## Source-of-truth precedence

1. Exact current repository source and `WORKSTREAM_LOCK.md`.
2. Managed runtime evidence, CI and canaries.
3. This ledger and `CURRENT_INTEGRATION_STATUS.md`.
4. Provider dashboards and Secret Manager metadata.
5. Older plans, handoffs and conversation summaries.

## Core infrastructure

| Integration | State | Current role / evidence |
|---|---|---|
| Supabase PostgreSQL | `ACTIVE` | Canonical system of record; project `aeeuscifrxcjmnswqwnq`. |
| PostGIS | `ACTIVE` | Spatial/service-area foundation. |
| Supabase Storage | `ACTIVE` | Private evidence/media/export storage through server-side grants. |
| Supabase Data API/PostgREST | `QUARANTINED` | Not a privileged browser/client path. |
| NestJS DIREKT API | `ACTIVE` | IAM-private canonical REST/OpenAPI trust boundary. |
| Google Cloud application project | `ACTIVE` | `direkt-dev-502701`, project number `264358173369`. |
| Firebase Test Lab isolated project | `ACTIVE — SYNTHETIC TESTING ONLY` | `direkt-testlab-502701-20260726`, project number `482116157386`, Spark plan/billing disabled; existing GitHub WIF deployer has `roles/editor` only in this empty Test Lab project; no service-account key, participant data or production workloads. |
| Artifact Registry | `ACTIVE` | Immutable container images. |
| Cloud Run | `ACTIVE` | Private API/operations plus public synthetic-only browser/BFF runtime. |
| Secret Manager | `ACTIVE` | Runtime secret authority. |
| GitHub Workload Identity Federation | `ACTIVE` | Keyless GitHub Actions → Google Cloud. |
| GitHub Actions | `ACTIVE` | CI/security/release/infrastructure gates. |
| Cloud Logging/Monitoring | `ACTIVE` | Infrastructure/runtime observability baseline. |
| Firebase project | `ACTIVE foundation` | Attached to `direkt-dev-502701`. |
| Firebase App Distribution | `ACTIVE` | Controlled Android tester distribution. |
| `direkt.forum` | `ACTIVE` | Canonical owner-controlled root/domain and preserved `/preview/`. |
| `app.direkt.forum` | `ACTIVE synthetic-review host` | W8 canonical functional browser/BFF host; run `29802524466` passed. |
| Operations portal | `ACTIVE private staging` | Privileged operator UI through the API. |
| Native Android | `ACTIVE implementation` | Primary customer/provider native client. |

## AI provider foundation

| Integration | State | Evidence / boundary |
|---|---|---|
| Provider-neutral `AiProvider` backend contract | `IMPLEMENTED_GATED` | Gemini primary and Groq fallback adapters, synthetic-only input gate, bounded timeout/failover and non-authoritative AI rules implemented under Issue #264 / PR #265. |
| Gemini Developer API | `SANDBOX_PROVEN / RUNTIME NOT BOUND` | Synthetic canary returned HTTP 200 with `DIREKT_AI_OK`; server-only secret `direkt-gemini-dev-api-key` version 1 is enabled. |
| Groq hosted open-model fallback | `SANDBOX_PROVEN / RUNTIME NOT BOUND` | Synthetic canary returned HTTP 200 with `DIREKT_GROQ_OK`; server-only secret `direkt-groq-dev-api-key` version 1 is enabled. |
| Ollama local fallback | `PLANNED / LOCAL ONLY` | No-key developer/offline fallback; not a Cloud Run dependency. |
| OpenRouter free router | `PLANNED / OPTIONAL` | Development/emergency candidate only; not a core production dependency. |
| Production AI | `DISABLED` | No real participant data or authoritative trust/payment/dispute/publication decision may be delegated to AI. |

AI0 does **not** mark an AI provider `ACTIVE`: the proven API canaries were synthetic external checks, not a DIREKT Cloud Run runtime binding. AI remains fail-closed by default. Free-tier/external AI providers may receive only synthetic/non-sensitive data until privacy/data-use/legal review explicitly authorizes a broader boundary.

## Payment integration programme

### Approved initial business scope

- provider subscriptions;
- verification-processing fees;
- renewal/re-verification fees;
- invoices/receipts;
- refunds/adjustments;
- reconciliation and administrative finance operations.

Not currently authorized as MVP production flows:

- customer-to-provider service payments;
- escrow;
- marketplace/provider payouts;
- DIREKT wallet/stored value.

### Payment trust rule

```text
Payment intent
  -> provider adapter
  -> external provider
  -> callback/status API
  -> independent verification
  -> immutable payment event
  -> DIREKT ledger
  -> invoice/receipt
  -> subscription/entitlement state
```

Clients never decide payment success. Payment state never creates verification, publication eligibility or ranking authority.

### Provider status

| Provider | State | Evidence / next action |
|---|---|---|
| MTN MoMo Collections API | `SANDBOX_PROVEN` | OAuth, Request to Pay, status query and final `SUCCESSFUL` verified. |
| MTN Collection Widget / QR / USSD | `EXTERNALLY_PROVISIONED` | Separate widget subscription exists; runtime feature not wired. |
| Airtel Money Zambia Cash-In API 2.0 | `PENDING_PROVIDER` | Zambia Op-Co app created in TEST mode; Cash-In added; merchant code `LHE8TGNW`; credentials await Airtel approval. |
| DPO Pay / Network | `SANDBOX_PROVEN` | `createToken` result `000`; hosted checkout completed; `verifyToken` result `000 Transaction Paid`. |
| Stripe Checkout | `SANDBOX_PROVEN` | Account sandbox `sk_test_` authentication passed; Checkout completed; server verification `complete/paid`. |
| Stripe Link | `EXTERNALLY_PROVISIONED / NOT EXPLICITLY PROVEN` | Account sandbox exists; Link-specific checkout evidence remains optional/outstanding. |
| PayPal | `SANDBOX_PROVEN` | OAuth, order, Personal sandbox approval, capture and independent verification all `COMPLETED`. |
| Flutterwave | `BLOCKED / DEFERRED` | Zambia self-service onboarding unavailable; provider later rejected/deferred onboarding because capacity/full. |
| Real money movement | `DISABLED` | Requires legal/commercial/provider/pilot/release gates. |
| Escrow | `PLANNED LATER` | Not current MVP; requires separate legal/regulatory/payout/dispute/KYC architecture. |

### Payment Secret Manager receipts

Secret names only; never record values.

**MTN MoMo**

- `direkt-mtn-momo-collections-subscription-key` — version 1 enabled.
- `direkt-mtn-momo-api-user` — version 1 enabled.
- `direkt-mtn-momo-api-key` — version 1 enabled.
- `direkt-mtn-momo-widget-subscription-key` — version 1 enabled.

Evidence: OAuth HTTP 200; Request to Pay accepted; payment-status HTTP 200; final `SUCCESSFUL`; provider financial transaction ID returned.

**Stripe**

- `direkt-stripe-sandbox-secret-key`
  - version 1 disabled — obsolete organization-scoped `sk_org_...` key;
  - version 2 enabled — correct account sandbox `sk_test_...` key.

Evidence: API auth HTTP 200; Checkout session created; final server verification `status=complete`, `payment_status=paid`, PaymentIntent returned.

**PayPal**

- `direkt-paypal-sandbox-client-id`
- `direkt-paypal-sandbox-client-secret`

Evidence: OAuth success; Personal sandbox buyer approval; server capture; final independent order/capture `COMPLETED`; USD 1.00 sandbox amount.

**Airtel**

No usable credentials stored yet because Zambia TEST approval remains pending.

**DPO**

Public DPO sandbox credentials were used for sandbox proof only. No private production DPO merchant credential is provisioned in DIREKT Secret Manager yet.

### RC8 runtime proof — CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED CANARY

Provider-neutral adapters and immutable reconciliation were merged through PR #454. Exact source `ccc4e9463d810ddf554182b1607c22d3a7c8c8d3` passed private managed run `30241092949/1` with artifact `8643323319` (`sha256:bbb4600eb5a062552947e91c878dd09c6d1e4dc307ae4783c7fa1fb4cf6e4935`). MTN Request to Pay/status, Stripe unpaid Checkout retrieval, PayPal unapproved-order retrieval, balanced immutable reconciliation, duplicate suppression, mismatch review, two-person adjustment planning and temporary-job cleanup all passed. The application payment registry and real money remain disabled:

```text
PaymentProvider
  |- MtnMomoPaymentProvider
  |- AirtelMoneyPaymentProvider
  |- DpoPaymentProvider
  |- StripePaymentProvider
  |- PayPalPaymentProvider
  `- FlutterwavePaymentProvider (only if onboarding reopens)
```

Managed evidence history:

- attempt `30238926656/1` failed before image build/provider mutation because deployer secret metadata access was absent; artifact `8642560395` (`sha256:d64d9d1fc1934448a00c29ee6924ee34442d92a114ebdf2bb46bfb918404912e`);
- attempt `30238926656/2` reached the private job but MTN returned HTTP 500; artifact `8642921752` (`sha256:f78da1c133b7d7dfa0e8397657052bc178250dbe7322c2e5a5404234ba9e80d6`);
- terminal run `30241092949/1` passed on `ccc4e9463d810ddf554182b1607c22d3a7c8c8d3`; artifact `8643323319` (`sha256:bbb4600eb5a062552947e91c878dd09c6d1e4dc307ae4783c7fa1fb4cf6e4935`).

Every attempt preserved sanitized evidence, deleted any temporary job that was created, and kept participant data, production authorization, real money and customer-to-provider payments false.

Suggested routing intent:

- Zambia local provider subscriptions/verification fees: MTN / Airtel / approved aggregator.
- International/diaspora: Stripe + Link / PayPal.
- DPO: fallback/benchmark/local-card/mobile-money option after commercial onboarding.
- Flutterwave: deferred.

No payment provider secret is attached to the API service or public application runtime. The RC8 proof may attach only pinned numeric MTN, Stripe and PayPal sandbox secret versions to one private temporary Cloud Run Job using the existing runtime service account, followed by enforced job cleanup. DPO, Airtel and Flutterwave remain runtime-unbound.

## Communications and notifications

| Integration | State | Runtime closure required |
|---|---|---|
| Transactional outbox | `ACTIVE` | Canonical asynchronous delivery source of truth. |
| Resend | `ACTIVE — SYNTHETIC-ONLY MANAGED CANARY` | Managed Cloud Run execution `direkt-resend-canary-ct9mp` succeeded on exact source `8e367f47f16b3f9f28a26a62ee8bdd305a286153`, proving outbox insert → claim → Resend send → durable `published` state. Sending key is sending-only/domain-restricted to verified `notify.direkt.forum`; `direkt-resend-api-key` v1 enabled; runtime secret access proven. Continuous, controlled-pilot participant and production email remain disabled. |
| Firebase phone OTP | `IMPLEMENTED_GATED` | Real approved participant path, OTP canary, abuse/rate-limit/privacy/legal evidence. |
| FCM | `ACTIVE — SYNTHETIC-ONLY MANAGED CANARY` | RC4 exact-main run `29916381754` on `f05ff19105cb8dc7c4621c044c110b6029f63300` proved synthetic registration, private backend outbox → FCM HTTP v1 → Android foreground/background delivery, sanitized evidence publication and ordered cleanup. Fixed secret `direkt-fcm-canary-token` remains an empty owner-provisioned container between proofs; the temporary numeric token version was destroyed after Cloud Run Job deletion. Participant registration and participant/production push remain disabled. |
| WhatsApp Cloud API | `CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED CANARY` | RC6 exact-current-main run `30137700769` on source `8838b7a6d726a5aed44ce21a39506c1265a98d15` passed transactional outbox → Meta `hello_world` test-template send → authentic signed webhook receipt on retry. The initial pre-provider Google Cloud CLI setup failure remains preserved in Issue #404. Backend-only credentials, send-time synthetic approval/opt-out, hashed opt-out state, bounded retry/idempotency, HMAC verification, durable out-of-order-safe receipts and fail-closed kill switches remain enforced. Participant/production delivery, production phone registration and production templates remain disabled/gated. |
| Firebase Crashlytics | `ACTIVE — SYNTHETIC-ONLY MANAGED CANARY` | RC3 exact-source managed proof succeeded for `9098f7eb333baf096163f1564b3d8e5e5da3fcf0`; bridge run `29885635547` enforced marker-pinned source identity and terminal canary success for fatal delivery, focused input-dispatch ANR, historical `REASON_ANR`, restart pickup and post-ANR Crashlytics/DataTransport delivery. Automatic collection remains default-off; Firebase Analytics and stable participant user IDs are absent; participant/production telemetry remains disabled. |
| Firebase Test Lab | `CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED MATRIX` | Exact source `c3744430a7beb1cd47246d858df9ac1379a068ac` passed run `30183466799` in isolated Spark project `direkt-testlab-502701-20260726` on `MediumPhone.arm` API 26, 33 and 36 with zero flaky retries. Artifact `8626329335` digest `sha256:03a40951a23c937d8b0fd2990a7d2652afbd1172631c0b480af756aebd92a843` is schema-valid. Firebase-managed results remain synthetic/public-safe; production/participant authorization is false. |
| Cloudflare Turnstile | `PLANNED / WHERE NEEDED` | Only for reviewed abuse-sensitive public flows with server verification, accessibility fallback and kill switch. |
| Cloud Tasks / Pub/Sub / Scheduler | `PLANNED ON DEMAND` | Add only when retry/fan-out/scheduling needs justify them. |

Controlled-pilot participant and production FCM delivery remain disabled during RC4. Device-token registration is fail-closed unless a later controlled-pilot authorization explicitly enables the source-controlled registration gate. The 2026-07-22 owner bootstrap created no secret value and verified `roles/secretmanager.secretVersionManager` only for the GitHub deployer and `roles/secretmanager.secretAccessor` only for the runtime identity on the fixed canary secret.


### RC5 Firebase Test Lab closure receipt

```text
Integration: Firebase Test Lab Android device-matrix automation (RC5)
Previous state: IMPLEMENTED_GATED / MANAGED MATRIX PENDING
New state: CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED MATRIX
Isolated project: direkt-testlab-502701-20260726 (482116157386), Spark plan, billing disabled
Identity: direkt-github-deployer@direkt-dev-502701.iam.gserviceaccount.com through existing GitHub Workload Identity Federation; roles/editor scoped only to the isolated Test Lab project; no service-account key
Exact proven source: c3744430a7beb1cd47246d858df9ac1379a068ac
Managed execution: run 30183466799/1 completed SUCCESS
Matrix: MediumPhone.arm / API 26, API 33 and API 36; en; portrait; exactly three devices
Execution controls: flaky retries 0; orchestrator false; video false; performance metrics false; automatic Google login false; five-minute timeout
Artifact: 8626329335; digest sha256:03a40951a23c937d8b0fd2990a7d2652afbd1172631c0b480af756aebd92a843; schema direkt.rc5.isolated-test-lab-receipt.v1; result passed; exitCode 0; category PASSED
Data boundary: synthetic-public-safe-only; participantData false; productionAuthorization false; Firebase-managed default results storage inside isolated project
Historical evidence: failed v2/private-input and selector-newline attempts remain preserved in their GitHub issues and were not rewritten as passes
```

### RC6 WhatsApp Cloud API closure receipt

```text
Integration: WhatsApp Cloud API application adapter (RC6)
Previous state: IMPLEMENTED_GATED / MANAGED CANARY PENDING
New state: CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED CANARY
External provisioning: DIREKT Meta test/synthetic WABA 904315252104562; test phone-number ID 1146158541925026; explicit Graph API v25.0; Meta-provided hello_world template; one owner-controlled verified test recipient; callback and messages subscription owner-confirmed
Repo/source changes: backend-only provider-neutral Meta adapter, transactional outbox, send-time opt-out re-check, hashed contact state, template-only payloads, bounded retries/idempotency, raw-body HMAC SHA-256 webhook verification, durable out-of-order-safe delivery receipts, isolated webhook identity and exact-main managed proof bridge; exact proven source 8838b7a6d726a5aed44ce21a39506c1265a98d15
Secret Manager names/versions: direkt-whatsapp-access-token, direkt-whatsapp-app-secret, direkt-whatsapp-webhook-verify-token and direkt-whatsapp-synthetic-recipient resolved to enabled numeric versions at execution; values were never printed or committed
Runtime binding: public synthetic-only webhook uses direkt-whatsapp-webhook identity with no send-token/recipient access; private send job uses direkt-api-runtime; participant/production provider mode remains disabled
Managed canary evidence: run 30137700769 SUCCESS on retry; exact-source contract, OIDC, numeric secret resolution, immutable image, isolated webhook identity/secret verification, private send job, transactional outbox → Meta hello_world test-template send → authentic signed webhook receipt and sanitized receipt all passed; initial setup-gcloud failure remains preserved in Issue #404
Privacy/security checks: one owner-controlled test recipient; raw phone absent from outbox/receipt evidence; no identity/evidence documents, tokens, exact private coordinates, reviewer notes or unrestricted free text; HMAC authenticity and idempotent/out-of-order receipt guards enforced
Fallback/kill switch: WHATSAPP_PROVIDER_MODE defaults disabled; synthetic activation requires explicit non-production data mode and WHATSAPP_SYNTHETIC_SEND_APPROVED; bounded retries and durable failure evidence preserved
Production authorization: NOT AUTHORIZED; participant/production WhatsApp delivery, production phone registration and production templates remain disabled
Known blockers: none for RC6 synthetic-only closure; later participant/production activation remains separately gated
Next exact step: resume RC5 final owner-side Test Lab verification and exact-current-main managed matrix proof; do not start RC7 while RC5 remains open
Ledger updated: YES
```

## Observability

| Integration | State | Direction |
|---|---|---|
| Cloud Logging / Monitoring | `ACTIVE` | Infrastructure/runtime baseline. |
| Sentry API/portal | `ACTIVE — SYNTHETIC-ONLY MANAGED CANARY` | Source PR #275 merged at `15210c5b0bf1832e32f8c33a7618c69f61f65275`. Managed Sentry canary #1 completed SUCCESS in 4m15s for separate `direkt-api` and `direkt-operations-portal` projects. DSNs are separately bound through `direkt-sentry-api-dsn` v1 and `direkt-sentry-portal-dsn` v1; `direkt-sentry-auth-token` v2 is CI/release-only and absent from application runtime. Default PII, traces, SDK logs, breadcrumbs, local variables and replay are disabled; privacy scrubbers redact sensitive text/coordinates. Exact SHA release binding is required. Cloud Logging remains authoritative. Participant/production Sentry telemetry remains disabled. |
| Firebase Crashlytics | `ACTIVE — SYNTHETIC-ONLY MANAGED CANARY` | Android crash/ANR ownership is proven under RC3 on exact source `9098f7eb333baf096163f1564b3d8e5e5da3fcf0`; managed bridge run `29885635547` passed all exact-source and terminal-proof controls. Default collection remains off outside the bounded debug canary and production/participant telemetry is not authorized. |

Never send raw evidence, auth tokens, cookies, contact data, exact private coordinates or unnecessary free text to telemetry providers.

### RC3 Crashlytics closure receipt

```text
Integration: Firebase Crashlytics Android (RC3)
Previous state: IMPLEMENTED_GATED / SYNTHETIC CANARY PENDING
New state: CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED CANARY
External provisioning: Firebase project direkt-dev-502701; registered debug application package com.kudzimusar.direkt.debug
Repo/source changes: Crashlytics SDK/plugin integration, default-off collection/privacy guards, exact-source synthetic fatal+ANR canary, deterministic focus/input-dispatch and REASON_ANR proof harness, exact-source dispatch enforcement; exact proven source 9098f7eb333baf096163f1564b3d8e5e5da3fcf0
Secret Manager names/versions: no new Crashlytics application secret; GitHub OIDC and temporary Firebase app configuration retrieval remain managed and non-persistent
Runtime binding: debug/staging synthetic-only canary path; release/participant automatic collection remains disabled
Managed canary evidence: RC3 managed proof bridge run 29885635547 SUCCESS; marker-pinned SHA validation, exact-source canary dispatch, terminal success watch, sanitized receipt and success enforcement all passed; underlying canary proved fatal Crashlytics/DataTransport delivery, focused package-scoped Input dispatching timed out ANR, historical REASON_ANR, restart pickup and post-ANR delivery
Privacy/security checks: Firebase Analytics absent; no stable participant Crashlytics user ID; bounded non-identifying synthetic metadata only; no raw evidence/contact/auth token/private-coordinate payloads; release trigger remains absent
Fallback/kill switch: automatic collection default-off; build/canary/data-mode gates fail closed; Cloud Logging remains infrastructure authority
Production authorization: NOT AUTHORIZED; participant/production crash telemetry remains disabled
Known blockers: none for RC3 closure
Next exact step: RC4 FCM source/runtime closure
Ledger updated: YES
```

### RC4 FCM closure receipt

```text
Integration: Firebase Cloud Messaging (RC4)
Previous state: IMPLEMENTED_GATED / SYNTHETIC CANARY PENDING
New state: CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED CANARY
External provisioning: Firebase project direkt-dev-502701; registered Android debug application com.kudzimusar.direkt.debug; FCM API and least-privilege custom sender role verified; fixed direkt-fcm-canary-token container and secret-scoped deployer/runtime bindings owner-bootstrap verified on 2026-07-22
Repo/source changes: provider-neutral FCM HTTP v1 adapter; transactional push outbox; identity-bound token lifecycle; Android foreground/background handling and notification permission controls; source PR #339; registration stability PR #364; pre-provisioned secret lifecycle PR #371; proof-trigger/status reconciliation PR #373
Secret Manager names/versions: fixed empty container direkt-fcm-canary-token; proof used one temporary numeric token version pinned into the private Cloud Run Job; cleanup deleted the Cloud Run Job before destroying that version; no token value was logged or retained in artifacts
Runtime binding: synthetic-only managed canary; PUSH_PROVIDER_MODE=fcm only in bounded proof; PUSH_REGISTRATION_MODE remains disabled; participant registration source-controlled false
Managed canary evidence: SUCCESS — exact-main run 29916381754 on source f05ff19105cb8dc7c4621c044c110b6029f63300; synthetic Firebase registration passed; immutable backend image and private Cloud Run Job passed; foreground outbox → FCM → Android receipt passed; background outbox → FCM → Android receipt passed; sanitized artifact rc4-fcm-canary-29916381754; digest sha256:f45d1924ee6138f86ec15a222e97f28ff67bbe9c610ff75f57666fd03929526c; ordered cleanup passed
Privacy/security checks: no Firebase Analytics; no raw FCM token in API response/audit/logs/artifacts; bounded synthetic routing identifiers only; secret-scoped least privilege; temporary Firebase config removed; permanent lifecycle audit remains fail-closed
Fallback/kill switch: PUSH_PROVIDER_MODE defaults disabled; PUSH_REGISTRATION_MODE defaults disabled; PARTICIPANT_REGISTRATION_ENABLED=false; bounded retries/idempotency and invalid-token invalidation preserved
Production authorization: NOT AUTHORIZED; participant/production push remains disabled
Known blockers: none for RC4 synthetic-only closure
Next exact step: merge exact-head RC4 closeout, release the RC4 lock, then explicitly claim RC5 Firebase Test Lab from the resulting exact main baseline
Ledger updated: YES
```

### RC5 Firebase Test Lab source-phase receipt

```text
Integration: Firebase Test Lab Android (RC5)
Previous state: PLANNED
New state: IMPLEMENTED_GATED / MANAGED MATRIX PENDING
External provisioning: source-controlled owner bootstrap prepared for testing.googleapis.com, toolresults.googleapis.com, custom project role direktTestLabRunner, bucket-scoped role direktTestLabResultsWriter and dedicated gs://direkt-test-lab-results-264358173369; owner provisioning not yet claimed as complete
Repo/source changes: stale DirektAppSmokeTest aligned to current post-VC semantics; Android CI now executes the app/test APK pair; exact-source Firebase Test Lab workflow; live virtual-catalog matrix selector capped at 2–3 devices; permanent fail-closed RC5 contract verifier
Secret Manager names/versions: none; RC5 creates no application secret and prohibits service-account keys/static Google credentials
Runtime binding: test/evidence only; exact reviewed source already merged to main is required for managed proof; no participant or production runtime binding
Managed canary evidence: PENDING — exact-main Test Lab matrix must pass after owner bootstrap; source/local evidence alone does not promote ACTIVE status
Privacy/security checks: synthetic/public-safe test data only; automatic Google login disabled; no production Firebase config; no raw auth/FCM tokens, participant contact data, private evidence, reviewer notes or exact private provider coordinates; project-level Editor/Owner/Test Lab Admin and broad Storage roles prohibited
Fallback/kill switch: Test Lab is manual/exact-source only; any matrix/infrastructure/test failure blocks RC5; automatic flaky reruns are disabled; local instrumentation remains a permanent CI baseline
Production authorization: NOT AUTHORIZED
Known blockers: owner bootstrap and exact-main managed Test Lab matrix proof
Next exact step: complete exact-head source regression/review, perform the reviewed owner bootstrap, then dispatch exact-main managed Test Lab evidence without activating participant/production paths
Ledger updated: YES
```

## Maps and location

| Integration | State | Direction |
|---|---|---|
| PostGIS | `ACTIVE` | Canonical spatial/service-area model. |
| Manual area/list fallback | `ACTIVE` | Must remain available if map provider fails. |
| Google Maps Platform | `ACTIVE — SYNTHETIC-ONLY MANAGED CANARY` | RC7 closed on exact source `47285575862cbf08845eaeabe093afea1ea79bd1` through run `30234521983/1`. WIF, fresh owner budget attestation, 60/min Geocoding quota, immutable backend service-identity OAuth canary, clean no-cache APK build, one valid final APK certificate, exact final Android key restriction, API 36 Test Lab map-ready assertion (1/1, zero flaky retries), and Cloud Run cleanup all passed. Artifact `8641270327`, digest `sha256:24da53c0bd6fa885fa4a6814f70af090096192e6c5b7a03c89fba51416877fde`. Backend keys, Maps secrets, Direct VPC egress, Cloud NAT, Places, Routes, participant use, production authorization and private-coordinate publication remain prohibited/disabled. |
| Private provider coordinates | `DISABLED FOR PUBLICATION` | Exact private bases must not become public markers/ranking inputs. |

## API/client contract tooling

| Integration | State | Notes |
|---|---|---|
| OpenAPI | `ACTIVE` | Canonical backend contract generated/drift-checked in CI. |
| Android API boundary | `ACTIVE` | Backend API only; no privileged direct Supabase path. |
| Web/PWA BFF/API boundary | `ACTIVE reviewed architecture` | Canonical API remains IAM-private. |
| Fully generated Kotlin client | `CLOSED — BOUNDED RUNTIME ADOPTION` | Deterministic generated tree is committed and byte-drift enforced. Android adopts only the Firebase-to-DIREKT session exchange behind the DIREKT-owned HTTPS-only/no-redirect/no-retry wrapper. |
| Fully generated TypeScript client | `CLOSED — SERVER-ONLY TYPE ADOPTION` | Deterministic generated tree is committed and strict-typechecked. Generated auth request/response types are consumed only by the server-side BFF adapter; generated browser transport remains prohibited. |

## Verification authorities / registries

| Authority | State | Rule |
|---|---|---|
| PACRA | `MANUAL EVIDENCE SOURCE` | No fabricated API access/scraping. |
| NCC | `MANUAL EVIDENCE SOURCE` | Manual evidence where applicable. |
| TEVETA | `MANUAL EVIDENCE SOURCE` | Manual qualification/training evidence. |
| Automated registry APIs | `NOT AUTHORIZED` | Activate only through formal lawful access. |

## Runtime closure queue

The authoritative sequence is maintained in `WORKSTREAM_LOCK.md` and `RUNTIME_INTEGRATION_CLOSURE_PLAN.md`. At this checkpoint:

1. RC0 ledger/audit/permanent-gate sanity/payment evidence reconciliation — **CLOSED** in PR #263.
2. AI0 provider-neutral AI foundation — **CLOSED** in PR #265 at `eafee4e5f54df9b216365cf2b8217b9a52cb1ada`; Gemini/Groq remain runtime-gated.
3. RC1 Resend — **CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED CANARY**. Source PR #269 merged; least-privilege sending/domain restriction and runtime secret access proven; Cloud Run execution `direkt-resend-canary-ct9mp` succeeded on exact source `8e367f47f16b3f9f28a26a62ee8bdd305a286153`; workflow-reporting compatibility hotfixes #271/#272 merged. Real-participant/production email remains disabled.
4. RC2 Sentry API/portal — **CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED CANARY**. PR #275 merged at `15210c5b0bf1832e32f8c33a7618c69f61f65275`; managed API + private portal canary #1 completed successfully. Separate DSN v1 bindings proven; Sentry auth token v2 remained CI/release-only; participant/production telemetry disabled.
5. RC3 Crashlytics Android — **CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED CANARY**. Exact source `9098f7eb333baf096163f1564b3d8e5e5da3fcf0`; managed bridge run `29885635547` passed marker-pinned exact-source enforcement and terminal fatal+ANR delivery proof. Participant/production telemetry remains disabled.
6. RC4 FCM — **CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED CANARY**. Exact-main run `29916381754` on `f05ff19105cb8dc7c4621c044c110b6029f63300` passed foreground/background outbox → FCM → Android receipt proof, sanitized evidence and ordered cleanup. Participant registration and participant/production push remain disabled.
7. RC5 Firebase Test Lab — **CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED MATRIX**. Exact source `c3744430a7beb1cd47246d858df9ac1379a068ac`; run `30183466799`; API 26/33/36; zero flaky retries.
8. RC6 WhatsApp runtime adapter — **CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED CANARY**. Exact source `8838b7a6d726a5aed44ce21a39506c1265a98d15`; managed run `30137700769` succeeded on retry; initial failure preserved in Issue #404; participant/production delivery disabled.
9. RC7 Google Maps runtime — **CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED CANARY** through run `30234521983/1`.
10. RC8 sandbox-only payment adapters/evidence reconciliation — **CLOSED — ACTIVE SYNTHETIC-ONLY MANAGED CANARY**; exact source `ccc4e9463d810ddf554182b1607c22d3a7c8c8d3`; run `30241092949/1`; artifact `8643323319` (`sha256:bbb4600eb5a062552947e91c878dd09c6d1e4dc307ae4783c7fa1fb4cf6e4935`); MTN/Stripe/PayPal and immutable reconciliation passed; DPO/Airtel/Flutterwave and application runtime remain disabled; real money false.
11. RC9 OpenAPI generated Kotlin/TypeScript client adoption — **CLOSED — DETERMINISTIC GENERATED CLIENTS / BOUNDED RUNTIME ADOPTION**. Generator `7.22.0` JAR `3f1e6ce5c6ad4f15242c6170ab43aad4bad771622617eeece4a7d4f72ffaf329`; canonical OpenAPI `1c13b69a34c30b84347b02ecddcf4f5b55c21e1958f036d4dc29c9106784e063`; Kotlin `111` files/tree `ba3e4b7ab4f2eeaf3fafd96bdf2bbbddfd2feb8ebbbe71f4f309c825eb7991cc`; TypeScript `98` files/tree `04cecfb32400eac04d5818ee1bb22e8394d822e2d350c8cfcc4f3a64eee982fe`. PR #497 exact head `04ef57f31414ec5165e353abba74afb8dfdcc901` passed the full regression matrix and merged at `70de95c73128e921cd4d7c667de0e5a442a9e0c0`. Android generated imports are confined to the reviewed auth wrapper; TypeScript generated imports are confined to the server-only BFF type adapter. Production/participant authorization and privileged direct access remain false.
12. RC10 Turnstile decision — **CLOSED — NOT CURRENTLY REQUIRED / TURNSTILE NOT ACTIVE**. Claim merge `e0ee52564eef16cdec1d8eb0a85f17da456cb5b1`; implementation PR #502 exact head `cdab6622e0cc06e35cddca2bb5bc8ea70c027b38`; squash merge `620a99ba5465ad38ce012df0a8fa15e458de6505`. Public discovery assistance, public Help and search-area normalization use explicit fail-closed database rate limits; no site key, secret, widget, package or runtime binding exists.
13. RC11 full combined regression and lane release — **CLOSED — FINAL INTEGRATION RECONCILIATION / LANE RELEASED**. PR #505 exact head `66626d315a8d132dbf8f34749a2679e42c609d7c` passed the complete matrix and merged at `87f567fccfa92244c7951432436c7163c71d5fc7`; `RC11_MANAGED_EVIDENCE_INDEX.md` and `RC11_CLOSURE_RECEIPT.md` are canonical.


### RC11 final integration reconciliation

```text
Integration: Final combined runtime-integration reconciliation (RC11)
Previous state: RC0–RC10 closed; RC11 claimed
New state: CLOSED — FINAL INTEGRATION RECONCILIATION / LANE RELEASED
Claim merge: 7f0b6b76a78572b6bb90694814037c370935e3b9
Repo/source changes: canonical managed evidence index, permanent RC11 verifier, live ledger/current status/project status reconciliation and explicit retained blocked/provider states
Managed evidence: RC0–RC10 exact source/run/artifact identifiers indexed where available; no identifier fabricated for provider-managed evidence without a GitHub run
Privacy/security: no participant data, provider secret, production credential, exact private coordinate or raw evidence introduced
Fallback/kill switch: existing provider-specific fail-closed modes and manual fallbacks preserved
Production authorization: NOT AUTHORIZED
Known blockers: Phase 11 real entry, DPC/legal/notice/Firebase real canary, PRIMARY-PILOT evidence, participant communications/telemetry/Maps, real money and Phase 12 release
Next exact step: separately claim Phase 11C–11J execution preparation under Issue #112; do not start real participants until every hard entry gate passes
Ledger updated: YES
```

Airtel is revisited immediately when provider approval arrives. Flutterwave remains deferred until onboarding reopens.

### RC9 generated-client closure receipt

```text
Integration: OpenAPI-generated Kotlin and TypeScript client adoption (RC9)
Previous state: RC9A deterministic generated source merged; RC9B/RC9C bounded runtime adoption pending
New state: CLOSED — DETERMINISTIC GENERATED CLIENTS / BOUNDED RUNTIME ADOPTION
Claim base: 030cd577e179863b70f24d99ab237e74660b4325
RC9A merge: e43efc5050a792a902a1ca94113854541380b56e
Implementation PR/head: #497 / 04ef57f31414ec5165e353abba74afb8dfdcc901
Implementation merge: 70de95c73128e921cd4d7c667de0e5a442a9e0c0
Generator: OpenAPI Generator 7.22.0; JAR sha256 3f1e6ce5c6ad4f15242c6170ab43aad4bad771622617eeece4a7d4f72ffaf329
Canonical OpenAPI: sha256 1c13b69a34c30b84347b02ecddcf4f5b55c21e1958f036d4dc29c9106784e063
Generated output: Kotlin 111 files/tree ba3e4b7ab4f2eeaf3fafd96bdf2bbbddfd2feb8ebbbe71f4f309c825eb7991cc; TypeScript 98 files/tree 04cecfb32400eac04d5818ee1bb22e8394d822e2d350c8cfcc4f3a64eee982fe
Android adoption: generated AuthenticationApi/request/response used only through GeneratedPilotSessionExchangeClient; HTTPS-only; 10-second timeouts; redirects/retries disabled; consent, sign-out, encrypted session storage, push registration and API 23 preserved
Web adoption: generated auth request/response types only through server-side generated-auth-contracts adapter; Cloud Run IAM, DIREKT session headers, idempotency, timeout, no-store, redirect rejection and safe errors remain DIREKT-owned
Focused fixes: raw JSON date-time normalization; invalid date-time rejection; generated-import allowlist limited to the two reviewed adapters; compiler/build artifacts excluded from authored-source scan
Play/Data Safety: reviewed Retrofit/Kotlin serialization runtime dependencies inventoried; generated BODY logger is not activated because the DIREKT wrapper supplies its own safe OkHttp builder
Exact-head evidence: RC9 contract 30273733920; deterministic generation 30273733953; Phase 12B 30273729323; Android CI 30273725051; Android performance 30273725145; Backend CI 30273729628; Backend container 30273725018; W7 30273725334; PWA 30273725116 and 30273725164; supply-chain 30273729475; runtime audit 30273725181; Phase 12A 30273725138; Phase 12 final 30273725312; recovery 30273725407; Phase 11 synthetic 30273725194; RC5/RC6/RC7 30273725088/30273725104/30273725384; documentation 30273725186
Exact-main verification: squash merge commit exists at 70de95c73128e921cd4d7c667de0e5a442a9e0c0 with the reviewed PR content unchanged; relevant workflows are pull-request triggered and produced no separate push runs for the squash commit
Privacy/security: browser-direct private API false; privileged client credentials false; provider/database/payment secrets false; participant data false; production authorization false; payment-provider/real-money authorization false
Fallback/kill switch: existing DIREKT wrappers, BFF boundary, manual/error semantics and fail-closed configuration remain authoritative; generated transport defaults are not authorization, trust, payment, retry, idempotency or offline-success authority
Known blockers: none for RC9 closure; Phase 11 real evidence, 11J, legal/privacy and production-release gates remain externally open
Next exact step: RC10 Turnstile threat-model decision, only after a new explicit workstream claim; otherwise close as not currently justified
Ledger updated: YES
```


### RC10 Turnstile closure receipt

```text
Integration: Cloudflare Turnstile threat-model decision and public abuse-control closure (RC10)
Previous state: IMPLEMENTED / NOT CURRENTLY REQUIRED / RUNTIME NOT ACTIVE / EXACT-HEAD REGRESSION PENDING
New state: CLOSED — NOT CURRENTLY REQUIRED / TURNSTILE NOT ACTIVE
Claim merge: e0ee52564eef16cdec1d8eb0a85f17da456cb5b1
Implementation PR/head: #502 / cdab6622e0cc06e35cddca2bb5bc8ea70c027b38
Implementation merge: 620a99ba5465ad38ce012df0a8fa15e458de6505
External provisioning: none; no Turnstile site key, secret, widget, package, hostname binding or Cloudflare challenge runtime was created
Repo/source changes: explicit fail-closed database rate policies and focused tests for public discovery assistance 30/300s, public Help assistance 30/300s and search-area normalization 20/300s; written threat model and re-evaluation triggers
Secret Manager names/versions: none
Runtime binding: existing DIREKT abuse-control middleware and security.consume_rate_limit database authority only; Turnstile runtime false
Exact-head evidence: RC10 30279827057; backend 30279827068; backend container 30279826976; runtime audit 30279831964; deterministic clients 30279826827; RC9 30279829353; W7 30279829473; W8 30279826788; functional PWA 30279829352; PWA 30279826525; recovery 30279826679; staging 30279826805; Phase 11 synthetic 30279829444; RC5 30279829654/30279829433; RC6 30279829956; RC7 30279829618; RC8 30279826638/30279829561; documentation 30279827241
Privacy/security checks: raw IP addresses are not durable keys; network subjects are HMAC-SHA-256 hashed; protected-route dependency failure returns 503; exhaustion returns 429; no challenge token or new third-party browser data exists
Fallback/kill switch: first-party rate controls, authenticated scope, provider kill switches, deterministic/manual Help and discovery fallbacks remain authoritative; future Turnstile activation requires a new claim and can be omitted entirely
Production authorization: NOT AUTHORIZED; real participants, production authentication, external communications, production AI/Maps, payment-provider activation, real money and formal Phase 12 release remain blocked
Known blockers: none for RC10 bounded closure; Phase 11 real evidence, 11J, legal/privacy and production-release gates remain externally open
Next exact step: RC11 combined integration regression/evidence index, only after a new explicit claim
Ledger updated: YES
```

## Evidence / receipt discipline

For every checkpoint record:

- provider/product;
- environment (`sandbox`, `test`, `staging`, `pilot`, `production`);
- safe account/app/project identifier;
- Secret Manager names and enabled numeric versions, never values;
- API result/status codes;
- managed workflow/run ID where applicable;
- exact commit/PR;
- runtime service/revision;
- privacy/legal/commercial gates;
- fallback/kill switch;
- blocker and owner.

Never store secret values, OAuth/access tokens, raw sensitive webhook payloads, full payment credentials or participant private data here.

## Mandatory agent handoff template

```text
Integration:
Previous state:
New state:
External provisioning:
Repo/source changes:
Secret Manager names/versions:
Runtime binding:
Managed canary evidence:
Privacy/security checks:
Fallback/kill switch:
Production authorization:
Known blockers:
Next exact step:
Ledger updated: YES
```

If `Ledger updated` is not `YES`, the integration handoff is incomplete.
