# V3 Legal Docs Publication Gate

Manifest version: `v3-legal-docs-publication.v1`

Verifier: `pnpm verify:v3 legal-docs-publication` (proposed)

Evidence artifact: `V3/legal/legal-docs-publication-evidence.json` (proposed)

Owner: Legal owner, joint with Lilith-Privacy lead; release-captain sign-off
required at the GA release-readiness decision

V3 must not GA in a region where its user-facing legal documents are not
published in that region's launch locale. This gate enumerates the required
documents per wave-1 region, defines the evidence shape, and fails closed. The
wave-1 region list is the signed-off set in `V3/REGION_ROLLOUT_COMPLIANCE.md`
and `V3/docs/regions/`: `us-ca`, `de`, `gb`, `in`, `br`.

## Required Documents

Five core documents, each published at a stable URL under
`https://oshun.example/legal/<locale>/<doc>`, linked from the V3 landing footer,
the signup flow (acceptance checkboxes for ToS/EULA/privacy), and the store
listings where the platform requires it:

| Doc id                 | Document                                    | Acceptance point                                    |
| ---------------------- | ------------------------------------------- | --------------------------------------------------- |
| `tos`                  | Terms of Service                            | Signup, blocking checkbox                           |
| `eula`                 | End-User License Agreement (native clients) | First launch of any native client                   |
| `privacy-policy`       | Privacy Policy                              | Signup, blocking checkbox; store listing URL field  |
| `refund-policy`        | Refund Policy                               | Linked at every purchase confirmation               |
| `community-guidelines` | Community Guidelines                        | Signup; linked from every report/moderation surface |

## Locale × Region Matrix

Launch locales follow the localization sign-offs in the region dossiers. Every
cell below is required; a missing cell fails the gate for that region (the
region drops to the regional waitlist, not silently to English).

| Doc                    | `us-ca` (en-US) | `de` (de-DE) | `gb` (en-GB) | `in` (en-IN) | `br` (pt-BR) |
| ---------------------- | --------------- | ------------ | ------------ | ------------ | ------------ |
| `tos`                  | required        | required     | required     | required     | required     |
| `eula`                 | required        | required     | required     | required     | required     |
| `privacy-policy`       | required        | required     | required     | required     | required     |
| `refund-policy`        | required        | required     | required     | required     | required     |
| `community-guidelines` | required        | required     | required     | required     | required     |

Notes on locale choice: the `in` dossier signs off English launch strings with
Hindi support macros, so `en-IN` is the binding legal locale for India at GA;
the `br` dossier signs off Brazilian Portuguese, so `pt-BR` is binding for
Brazil — an English-only document set fails the `br` column.

## Region-Specific Supplements

Beyond the five core documents, these region-mandated supplements are part of
the same gate:

| Region  | Supplement                                                                                                                                             | Requirement source                           |
| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------- |
| `de`    | Impressum (provider identification) reachable within two clicks of every page; Widerrufsbelehrung (14-day withdrawal instruction) in the purchase flow | §5 TMG/DDG; EU consumer-rights directive     |
| `us-ca` | Notice at Collection + "Do Not Sell or Share My Personal Information" link in the footer                                                               | CCPA/CPRA                                    |
| `in`    | Grievance Officer name and contact published, complaint acknowledgment within 24 h and resolution within 15 days stated                                | IT (Intermediary Guidelines) Rules 2021      |
| `br`    | LGPD controller identification and DPO (encarregado) contact in the pt-BR privacy policy                                                               | LGPD Art. 41                                 |
| `gb`    | UK GDPR controller/representative identification in the en-GB privacy policy; consumer cancellation rights in the refund policy                        | UK GDPR; Consumer Contracts Regulations 2013 |

Refund-policy content must agree with the payment-provider sign-offs in each
region dossier (Stripe Connect refund evidence, VAT for `gb`, tax evidence for
`us-ca`/`in`/`br`) — a refund policy that contradicts the dossier's
refund-evidence model fails the gate.

## Evidence Shape

`V3/legal/legal-docs-publication-evidence.json` carries one record per (doc,
locale) cell plus one per supplement:

```json
{
  "docId": "privacy-policy",
  "locale": "de-DE",
  "region": "de",
  "url": "https://oshun.example/legal/de-DE/privacy-policy",
  "version": "1.0.0-ga",
  "sourcePath": "V3/legal/source/de-DE/privacy-policy.md",
  "sourceSha256": "<sha256 of the canonical source file>",
  "publishedSha256": "<sha256 of the rendered page main-content block>",
  "retrievedAt": "2026-06-12T00:00:00Z",
  "counselSignoff": { "by": "legal-owner", "at": "2026-06-10T00:00:00Z" },
  "acceptanceWiring": "signup-checkbox"
}
```

- `sourceSha256` pins the counsel-approved text; `publishedSha256` is taken from
  a live fetch of the URL's main-content block, so the gate detects a published
  page that drifted from the approved source.
- Store-listing cross-check: the privacy-policy URL submitted in
  `V3/public-web/app-store-listings.json` for each platform must byte-match the
  corresponding evidence-record URL.
- Version changes after counsel sign-off require a new record; the verifier
  rejects evidence whose `sourceSha256` does not match the file at `sourcePath`
  at verification time.

## Fail-Closed Criteria

The gate fails closed — and the affected region is excluded from GA wave-1
routing (sent to the regional waitlist via the existing
`tier: regional-waitlist` machinery) — when any of the following holds:

- any (doc, locale) cell in the matrix has no evidence record;
- any region-specific supplement has no evidence record;
- a live fetch of any `url` returns non-200, or its main-content hash does not
  equal `publishedSha256`;
- `sourceSha256` does not match the canonical source file (drift between
  approved text and repo);
- any record lacks counsel sign-off, or sign-off predates the latest source
  change;
- the signup flow does not block on ToS/EULA/privacy acceptance for the user's
  region locale (verified by the signup Playwright spec asserting the
  locale-correct document URL is the one linked);
- a store listing's privacy-policy URL disagrees with the evidence record;
- the refund policy for a region contradicts that region's dossier
  payment-provider sign-off.

Partial-region failure degrades only that region; it does not block GA for
regions whose columns are complete. Full-matrix verification runs in CI daily
during launch week, because published pages can break after the one-time check.