# Beta-Blocking-Issue Remediation + Signoff — V1 Launch Gate

> Gate owner: Release Captain. Required for §33.1. Closes only when **every**
> open beta-blocking issue has a verified fix, a regression test, and a re-run
> by a different participant.

## 1. Definition of "beta-blocking"

A beta-blocking issue is **any** of:

- An S0 defect (crash on launch, data loss, security, cross-tenant leak).
- An S1 defect (core journey broken, grounding gate failure, kill-switch
  failure, persona rollback failure, DSAR failure).
- An S2 defect that recurs in ≥ 5 % of sessions over 48 h.
- A floor breach in `docs/launch/private-beta.md` §3 sustained ≥ 48 h.
- An exit-criteria failure surfaced by a cohort in `docs/launch/private-beta.md`
  §6.
- A failure of any drill listed in `docs/launch/dogfood-drill.md` §6.

Issues outside this set are tracked as backlog (P3 / P4); they are not
remediation gates.

## 2. Source of truth

All beta-blocking issues are recorded in
`docs/releases/v1/verification/beta/blockers/<id>.md`. The blocker file **must**
contain:

```
# blocker-<id>
opened: YYYY-MM-DD HH:MM TZ
opened-by: <name>
severity: S0 | S1 | S2 | floor-breach | exit-criteria-failure | drill-failure
class: crash | data-loss | security | grounding | crisis-flow | persona-drift
        | dsar | privacy | tenant-isolation | moderation-backlog | performance
        | accessibility | provenance | watermark | other
short-description: <one line>
journey-impacted: <Tara|Arete|Veritas|Nyx|Nisaba|Metis|Assistant|Studio|
                   Agentic-AI-Studio|Support/Billing|Privacy|Tenant|
                   Public-distribution|Admin|Shell>
reproduction-evidence: <HAR / trace / recording url>
detection-source: <dogfood | private-beta | red-team | eval-suite | sentry
                   | dashboard | runbook-drill | manual>
```

Plus the lifecycle entries in §3.

## 3. Lifecycle

```
opened → triaged → in-progress → fix-merged → fix-verified
       → regression-test-added → re-run-by-different-participant
       → closed | re-opened
```

Each lifecycle transition appends an entry:

```
- transition: <from> → <to>
  ts: YYYY-MM-DD HH:MM TZ
  actor: <name>
  evidence: <commit-sha | trace-url | rerun-evidence-url>
  note: <required for re-opened, optional otherwise>
```

A blocker can move only through transitions in this order; closing without
`fix-verified`, `regression-test-added`, and `re-run-by-different-participant`
is invalid.

## 4. SLAs

| Severity              | Triage SLA | Fix SLA | Verification SLA            |
| --------------------- | ---------- | ------- | --------------------------- |
| S0                    | 30 min     | 24 h    | within 24 h of `fix-merged` |
| S1                    | 4 h        | 5 d     | within 48 h                 |
| S2 recurrence ≥ 5 %   | 1 d        | 14 d    | within 5 d                  |
| Floor breach          | 4 h        | 7 d     | within 48 h                 |
| Exit-criteria failure | 1 d        | 14 d    | within 5 d                  |
| Drill failure         | 1 d        | 7 d     | within 48 h                 |

SLA breaches escalate to the release captain immediately; a second escalation
goes to the engineering lead and product lead.

## 5. Regression test requirement

Every closed beta-blocker requires a regression test that **would fail on a
build that does not contain the fix**. Required test surfaces:

| Class            | Required test                                                                                                                                          |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| crash            | Vitest unit + Playwright E2E with crash assertion                                                                                                      |
| data-loss        | Contract test + integration test that asserts persistence                                                                                              |
| security         | Tenant-isolation test + (where applicable) authZ test                                                                                                  |
| grounding        | `libs/iris/knowledge/rag/evaluation/` suite addition (e.g., `evaluation.spec.ts`)                                                                      |
| crisis-flow      | `libs/iris/emotional/response/src/crisis-support.ts` + `libs/iris/emotional/ethics/src/crisis-protocol.ts` test additions                              |
| persona-drift    | `libs/oshun/persona-policy-lilith/src/eval-tone-quality.test.ts` + `libs/oshun/persona-registry/src/persona-tone-calibration-rubric.test.ts`           |
| dsar             | `apps/oshun/admin/e2e/privacy-dsar-end-to-end.spec.ts` extension                                                                                       |
| tenant-isolation | `tests/security/tenant-isolation/...`                                                                                                                  |
| performance      | Lighthouse budget OR Playwright performance trace                                                                                                      |
| accessibility    | axe-core assertion in the relevant Playwright                                                                                                          |
| provenance       | `libs/sophia/ingestion/src/provenance/` + `libs/isis/ai-providers/src/provenance/`                                                                     |
| watermark        | `libs/aphrodite/stream-watermarking/src/` + `libs/aja/content-watermarking/src/` + `libs/yemaya/living-scenes-runtime/src/provenance/audio-watermark/` |

A blocker cannot close without the regression-test entry pointing to the file
and a CI run id showing the test passing on the fix and failing on the parent
commit.

## 6. Re-run-by-different-participant

To close, the journey impacted by the blocker is re-run **end-to-end by a
different participant** than the original reporter. The re-run participant adds:

```
- transition: regression-test-added → re-run-by-different-participant
  ts: YYYY-MM-DD HH:MM TZ
  actor: <re-run participant name>
  evidence: <recording / HAR>
  note: <one-line confirmation>
```

This protects against fixes that work for the reporter's data shape but fail for
others.

## 7. Daily report

Release captain posts a daily `#beta-blockers` summary:

- Open S0 / S1 / S2-recurrent count.
- New blockers opened in last 24 h.
- Blockers closed in last 24 h.
- SLA breaches.
- Floor-breach status (per `docs/launch/private-beta.md` §3).

The report is mirrored to `docs/releases/v1/verification/beta/daily/<date>.md`.

## 8. Beta freeze

A **beta freeze** halts all new feature merges and recruits. Freeze triggers:

- Any open S0 > 24 h.
- Any open S1 > 5 d.
- Any sustained (≥ 48 h) floor breach.
- Any unresolved crisis-flow incident.
- Any tenant-isolation regression.

The freeze lifts only when the trigger condition clears AND the release captain
logs `freeze-lift` to `docs/releases/v1/verification/beta/daily/<date>.md`.

## 9. Signoff

§33.1 signoff requires:

- [ ] Every blocker file in `docs/releases/v1/verification/beta/blockers/` is
      `closed` or explicitly `accepted-for-post-launch` with rationale, owner,
      and follow-up issue.
- [ ] Daily reports for every day of beta exist.
- [ ] No beta-freeze active.
- [ ] Release captain, product lead, support lead, security lead, privacy lead,
      and engineering lead each post `signoff: clear` to
      `docs/releases/v1/verification/beta/signoffs/<role>-<date>.md`.

`accepted-for-post-launch` is reserved for **non-launch-blocking** S2 issues
with documented rationale; it cannot be applied to any S0 / S1 class or any
floor-breach class.

## 10. Cross-references

- Private beta: `docs/launch/private-beta.md`.
- Dogfood drill: `docs/launch/dogfood-drill.md`.
- Safety review: `docs/launch/safety-review.md`.
- Quality review: `docs/launch/quality-review.md`.
- Go/no-go: `docs/launch/go-no-go.md`.
- Severity ladder: `docs/runbooks/oshun-v1.md`.
