# Exit Criteria Signoff — V1 Launch Gate

> Gate owner: Release Captain + every domain owner named in §10 below. Required
> for §33.4. Each launch consumes one signed instance at
> `docs/releases/v1/verification/exit-criteria/YYYY-MM-DD.md`.

V1 is **not feature-complete** until every exit criterion below has a **PASS**
or **PASS-WITH-CONDITIONS** signoff with evidence committed to the repo. Lacking
that, GA cannot proceed regardless of other gates.

> **Release scope (2026-08-05).** This gate is scoped to what the release under
> signoff actually ships. For **V1.0** that is the four rooms — **Tara, Nyx,
> Arete, Nisaba** — on **web + PWA**, charging through the **crypto rail only**.
> Veritas and Metis are deferred to V1.2 and the native apps and fiat rails to
> V1.1 (see [`V1/BRAND.md`](../../V1/BRAND.md)).
>
> Read "every domain" below as "every domain this release ships". A criterion
> demanding coverage of a deferred room would either block a launch on a room
> nobody can open, or be signed off against evidence that proves nothing — both
> worse than an honest, narrower gate. The deferred rooms return to this gate in
> the release that opens them.

## 1. Customer web feels like one coherent product across every room this release ships

**Evidence:**

- Customer web app: `apps/oshun/web/` (Next.js).
- Customer mobile app: `apps/oshun/mobile/` (React Native + native shells).
- Shared design system: `apps/oshun/web/src/design-system/lilith` +
  cross-platform tokens distributed to mobile via the shared style package.
- Cross-domain shell tests:
  - `apps/oshun/web/e2e/critical-web-journey-coverage.spec.ts` (matrix of the
    shipped domains with keyboard / a11y / visual / resilience coverage
    references).
  - `apps/oshun/web/e2e/cross-domain-flows.spec.ts`.
  - `apps/oshun/mobile/e2e/flows/shell/deep-links-six-domains.yaml` — mobile
    evidence, and therefore V1.1 signoff rather than V1.0.
- Design-language audits: `apps/oshun/web/e2e/domain-readability.spec.ts`,
  `apps/oshun/web/e2e/home-domain-narrative-order.spec.ts`.

**Verification owner:** Product Lead + Design Lead.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 2. Tara is visibly the product center

**Evidence:**

- Home composition: `apps/oshun/web/src/components/lilith/CustomerToday.tsx` is
  documented as **"Lead column: today's Tara sit"** — Tara owns the lead column
  on the broadsheet front page.
- Home route: `apps/oshun/web/src/app/page.tsx` renders `CustomerToday`.
- Continuity tests:
  - `apps/oshun/web/e2e/home-tara-centering-continuity.spec.ts`.
  - `apps/oshun/web/e2e/home-tara-practice.spec.ts` (where present) and
    `home-domain-narrative-order.spec.ts`.

**Verification owner:** Tara PM.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 3. Nisaba and Metis are fully integrated, not just routed

**Evidence:**

- Cross-domain spec: `apps/oshun/web/e2e/nisaba-metis-study-prompts.spec.ts`.
- Arete bridge: `apps/oshun/web/e2e/arete-metis-study-prompts.spec.ts`.
- BFF cross-domain recommendations:
  `apps/oshun/bff/src/__tests__/cross-domain-recommendations-route.test.ts`.
- Search ranking cross-domain integration:
  `apps/oshun/bff/src/search/ranking.ts` (Nisaba + Metis signals).
- Continue-route surface: `apps/oshun/bff/src/__tests__/continue-route.test.ts`.
- Library and activity-route integration:
  `apps/oshun/bff/src/__tests__/library-route.test.ts`,
  `activity-route.test.ts`.

**Verification owner:** Nisaba PM + Metis PM.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 4. Sophia grounding is visible everywhere evidence matters

**Evidence:**

- Sophia core: `apps/sophia/`, `libs/sophia/`.
- Sophia store integration into Studio:
  `apps/yemaya/studio-web/src/stores/sophiaStore.ts`.
- Grounding visibility in Veritas:
  `apps/oshun/web/e2e/veritas-full-journey.spec.ts` (source drill +
  counterclaim).
- Assistant grounding-state surface:
  `apps/oshun/web/e2e/assistant-grounding-state.spec.ts`.
- Metis evidence emission:
  `libs/metis/models/src/assessment-evidence/assessment-evidence-pack.ts` and
  `.test.ts`.
- Iris evals for grounded-answer rate.

**Verification owner:** Sophia PM + Iris PM.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 5. Cross-domain continuity is useful, credible, and tested

**Evidence:**

- Integration test harness:
  `testing/integration/examples/cross-domain.integration.test.ts`.
- Cross-domain flows: `apps/oshun/web/e2e/cross-domain-flows.spec.ts`,
  `apps/oshun/web/e2e/activity-cross-domain-continuity.spec.ts`,
  `apps/oshun/web/e2e/home-mixed-domain-recommendations.spec.ts`.
- Continuity card surfaces: `apps/oshun/web/e2e/continuity-cards.spec.ts`.
- BFF continuity routes: `apps/oshun/bff/src/__tests__/continue-route.test.ts`.

**Verification owner:** Shell PM.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 6. Admin web + admin mobile operate every launch-critical workflow

**Evidence:**

- Admin web: `apps/oshun/admin/`.
- Admin mobile: `apps/oshun/admin-mobile/`.
- Admin E2E coverage (catalog in `apps/oshun/admin/e2e/`, 40+ specs):
  - Queue triage: `unified-inbox-flows.spec.ts`,
    `inbox-bulk-action-flows.spec.ts`.
  - Review/approve: `review-decision-flows.spec.ts`,
    `high-risk-approval-flows.spec.ts`.
  - Publish gate: `policy-approval-promotion-rollback-flows.spec.ts`.
  - Audit trail: `audit-log-explorer-flows.spec.ts`.
  - Persona promotion: `persona-approval-flows.spec.ts`,
    `persona-governance-editor.spec.ts`, `persona-release-flows.spec.ts`.
  - Model promotion: `model-governance-flows.spec.ts`,
    `model-promotion-flows.spec.ts`.
  - Privacy DSAR: `privacy-dsar-end-to-end.spec.ts`,
    `privacy-deletion-workflow-flows.spec.ts`.
  - Incidents: `incident-orchestration-flows.spec.ts`,
    `incident-impact-comms-flows.spec.ts`,
    `incident-runbook-postmortem-flows.spec.ts`.

**Verification owner:** Operations Lead.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 7. Oshun Studio supports authoring / editorial / asset / taxonomy / versioning / localization / collaboration / customer-curation with grounded source binding, persona/tone policy, and release-gate enforcement

**Evidence:**

- Authoring + editorial:
  `apps/oshun/web/e2e/studio-authoring-workspace-smoke.spec.ts`.
- Asset preview:
  `apps/oshun/web/e2e/studio-asset-preview-pipeline-smoke.spec.ts`.
- Taxonomy: `libs/oshun/analytics/src/admin-taxonomy.ts`,
  `customer-taxonomy.ts`, `assistant-taxonomy.ts`.
- Versioning:
  `apps/oshun/web/e2e/studio-hathor-entity-version-management-smoke.spec.ts`
  (representative per-domain version manager; coverage matrix in
  `apps/oshun/web/e2e/support/critical-web-journeys.ts`).
- Localization: route surfaced at
  `apps/oshun/web/src/app/studio/internationalization-localization/page.tsx`;
  glossary editor at
  `libs/oshun/studio-authoring/src/localization-workflow/glossary-editor.ts`;
  workflow runbook docs catalogued under `docs/releases/v1/runbooks/` (Studio
  i18n/L10n suite).
- Collaboration:
  `apps/oshun/web/e2e/studio-realtime-collaboration-substrate-smoke.spec.ts`.
- Source binding: `apps/yemaya/studio-web/src/stores/sophiaStore.ts` +
  `apps/yemaya/studio-web/e2e/studio-web.smoke.spec.ts`.
- Persona/tone policy: `libs/oshun/persona-policy-lilith/` (tone bands +
  cross-product harness), `libs/oshun/persona-registry/` (calibration rubric),
  `apps/oshun/admin/e2e/persona-governance-editor.spec.ts`.
- Release-gate enforcement:
  `libs/oshun/generation-control-isis/src/release-gate-model.ts` +
  `release-gate-model.test.ts`,
  `libs/isis/3d-quality-gates/src/delivery/release-gates.ts`,
  `apps/oshun/web/e2e/studio-launch-readiness-governance-smoke.spec.ts`.

**Verification owner:** Studio PM.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 8. Agentic AI Studio operational with governance gates enforced and tenant-scoped budgets honored

**Evidence:**

- Agentic store: `apps/oshun/bff/src/admin/admin-agentic-operations-store.ts`.
- Agentic panel UI: `apps/oshun/admin/src/components/AgenticOperationsPanel.tsx`
  (run table with `data-run-id`, `data-run-severity`, `data-run-approval`, cost
  ledger, kill switches).
- Tenant-scoped budgets:
  `libs/oshun/tenant-console/src/tenant-model/agentic-config.ts`.
- Approval gates: `apps/oshun/admin/e2e/high-risk-approval-flows.spec.ts`.
- Agentic ops flows: `apps/oshun/admin/e2e/agentic-operations-flows.spec.ts`,
  `copilot-lifecycle-flows.spec.ts`, `copilot-audit-invariants.spec.ts`.
- Library: `libs/oshun/agentic-studio` test suite.

**Verification owner:** Agentic AI PM + Operations Lead.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 9. Tenant Console operational with SSO/SCIM/OneRoster/role-customization/audit/bulk-ops/API-keys/webhooks/lifecycle-comms/help-authoring/status-banner — strictly isolated from operator Oshun Admin

**Evidence:**

- Tenant-admin app (customer-facing): `apps/oshun/tenant-admin/`.
- Identity:
  - SSO: `libs/oshun/tenant-console/src/identity/sso.ts` + `sso.spec.ts` (added
    in §33.3 remediation).
  - SCIM + OneRoster diff: `libs/oshun/tenant-console/src/identity/scim.ts` +
    `scim.spec.ts` (added in §33.3 remediation).
  - Federation:
    `libs/oshun/tenant-console/src/identity/federation-and-auth-policy.ts`.
- Roles: `libs/oshun/tenant-console/src/roles/`.
- Audit: `libs/oshun/tenant-console/src/audit-explorer/`.
- Bulk ops + OneRoster export:
  `libs/oshun/tenant-console/src/bulk-ops/bulk-export.ts` +
  `bulk-export.test.ts`.
- API keys + webhooks: `libs/oshun/tenant-console/src/integrations/api-keys.ts`,
  `webhooks.ts`, `webhook-simulator.ts`.
- Lifecycle comms: `libs/oshun/tenant-console/src/notifications/`.
- Help authoring: `libs/oshun/tenant-console/src/help-center/`.
- Status banner: `libs/oshun/tenant-console/src/status-page/` +
  `status-page-extras.test.ts`.
- Tenant isolation:
  `tests/security/tenant-isolation/bff-tenant-isolation.security.test.ts`.

**Strict isolation from operator Admin** — separate app surfaces:
`apps/oshun/admin/` (operators) and `apps/oshun/tenant-admin/` (customers).
Tenant-isolation tests enforce the data-plane separation.

**Verification owner:** Tenant Console PM + Security Lead.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 10. Iris / Psyche / Lilith / Sophia / Isis / Metis ownership boundaries true in implementation, not just in docs

**Evidence:**

- Domain matrix: `DOMAINS/` with `architecture.md`, `features.md`,
  `specifications.md` per domain.
- Domain ownership matrix: `DOMAINS/README.md` (assignments).
- Apps + libs partitioned by domain — verified by `nx` project graph and the
  `tsconfig.base.json` path mappings (each domain owns its own scope `@iris/*`,
  `@psyche/*`, `@lilith/*`, `@sophia/*`, `@isis/*`, `@metis/*`).
- Cross-domain integration is via published contracts only: `libs/contracts/` +
  per-domain contracts.

**Domain owners (responsible for confirming boundaries on signoff):**

- Iris — Iris PM
- Psyche — Psyche PM
- Lilith — Lilith PM
- Sophia — Sophia PM
- Isis — Isis PM
- Metis — Metis PM

**Decision (per-domain):** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 11. External model sources cannot bypass review / rights / safety / provenance / Isis release gates

**Evidence:**

- Isis release gates:
  - `libs/oshun/generation-control-isis/src/release-gate-model.ts` + tests.
  - `libs/isis/ai-providers/src/release-gates/` + tests.
  - `libs/isis/3d-quality-gates/src/delivery/release-gates.ts` + tests.
- Provenance tracking: `libs/sophia/ingestion/src/provenance/` +
  `libs/isis/ai-providers/src/provenance/` + `libs/isis/outputs/src/provenance/`
  - per-asset provenance audit (sampling 100 items per domain).
- Watermark verification: `docs/runbooks/watermark-verification-failure.md`
  drill; verifier code under `libs/aphrodite/stream-watermarking/`,
  `libs/aja/content-watermarking/`, and
  `libs/yemaya/living-scenes-runtime/src/provenance/audio-watermark/`.
- Safety gate: every external-provider call routes through
  `libs/iris/privacy/safety/` (privacy-class enforcement) and
  `libs/iris/agents/computer-use/safety/` (agent execution safety) before
  publication.
- Rights gate: `libs/isis/ai-providers/src/release-gates/` + Sophia
  source-credibility scoring (`libs/veritas/core/src/source.ts`).

**Verification owner:** Isis PM + Iris PM + Security Lead.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 12. Metis high-stakes outputs emit claim-level evidence and pass grounding / pedagogy / safety / rights / academic-integrity / standards / drift gates

**Evidence:**

- Claim-level evidence emission:
  `libs/metis/models/src/assessment-evidence/assessment-evidence-pack.ts` +
  `.test.ts`.
- Evidence requirements:
  `libs/metis/learning/src/mastery/evidence-requirements.ts`.
- Grounding eval: `docs/launch/quality-review.md` §1.8 (grounded-rate ≥ 0.95).
- Pedagogy eval: `docs/launch/quality-review.md` §1.8 (rubric pass rate ≥ 0.90).
- Safety eval: same §1.8 (crisis-flow 1.00).
- Rights eval: same §1.8 (violation rate ≤ 0.001).
- Academic integrity eval: same §1.8 (violation rate ≤ 0.001).
- Standards eval: same §1.8 (alignment ≥ 0.95).
- Drift eval: same §1.8 (KL ≤ 0.05).
- E2E: `apps/metis/web/e2e/critical-paths.spec.ts`, `assessments.spec.ts`,
  `apps/metis/admin/e2e/admin-critical-flows.spec.ts`.

**Verification owner:** Metis PM + Iris PM.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 13. Public website + app store listings + deep links + public status page ready for launch

**Evidence:**

- Public surfaces: `apps/oshun/web/public/` (favicon, icons, manifest, robots,
  screenshots, service worker).
- Deep-link associations: `apps/oshun/web/src/lib/deep-link-associations.ts` +
  `apps/oshun/web/src/__tests__/deep-link-association-files.test.ts`.
- Canonical deep links: `apps/oshun/web/e2e/canonical-deep-links.spec.ts`,
  `canonical-deep-links-metis.spec.ts`,
  `apps/oshun/mobile/e2e/flows/shell/deep-links-six-domains.yaml`.
- Lilith public routes: `apps/oshun/web/e2e/lilith-public-routes.spec.ts`.
- PWA install + update + offline:
  `apps/oshun/web/e2e/pwa-install-update-offline.spec.ts`.
- Status page: `libs/oshun/tenant-console/src/status-page/` + tests.

**Verification owner:** Marketing Lead + Mobile PM.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 14. Recommendation candidate generation, signal ingestion, offline evaluation, observability operational

**Evidence:**

- BFF recommendation routes: `apps/oshun/bff/src/recommendations/`.
- Cross-domain recommendation telemetry:
  `apps/oshun/bff/src/__tests__/cross-domain-recommendation-telemetry.test.ts`.
- Search ranking and candidate generation:
  `apps/oshun/bff/src/search/ranking.ts`.
- Experimentation: `libs/oshun/search-discovery/src/experiments/`.
- Observability: `libs/oshun/analytics/src/dashboards-*.ts`,
  `alerts-manifest.ts`, `tracing-manifest.ts`.

**Verification owner:** Search/Discovery PM + SRE Lead.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 15. Aja embodied-instruction services required by Metis are ready or explicitly deferred with approved scope boundaries

**Evidence:**

- Aja services: `apps/aja/svc-motion-ai/`, `apps/aja/svc-motion-pipeline/`,
  `apps/aja/svc-reference-video/`.
- Aja libraries: `libs/aja/` (40+ sub-libraries including motion-formats,
  motion-pipeline-sdk, content-moderation, content-security, privacy-protection,
  motion-validation, etc.).
- Aja CLI + docs: `apps/aja/cli/`, `apps/aja/docs/`.
- Scope boundaries: documented in `DOMAINS/aja/` (architecture + features).

**Verification owner:** Aja PM + Metis PM.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 16. All critical workflows have risk-tiered automated verification

**Evidence:**

- Automation matrix: `docs/testing/automation-matrix.md`.
- Critical-journey mapping: `docs/launch/critical-journeys.md`.
- Risk-tier evidence per workflow:
  - High-risk (publishing, model promotion, persona release, kill-switch, DSAR,
    tenant isolation): require Playwright E2E + library unit + integration
    tests + chaos drill.
  - Medium-risk (review queues, billing, content edits, cross-domain
    continuity): require Playwright E2E + library unit tests.
  - Low-risk (cosmetic, UX polish): require Vitest unit + visual regression.
- Verification: `libs/yemaya/production-verification/`,
  `testing/integration/contract-verification.test.ts`.

**Verification owner:** QA Lead.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 17. Accessibility, performance, security, resilience, observability, documentation, training, runbooks, canaries, rollback triggers, post-deploy monitors all satisfy launch gates

**Evidence:**

| Concern              | Evidence                                                                                                                                    |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Accessibility        | `libs/iris/accessibility/` + `apps/oshun/web/e2e/wcag-aa-signoff-v1-p2-3510.spec.ts` + per-surface a11y specs                               |
| Performance          | `docs/performance/`, Lighthouse budgets in CI, `libs/oshun/analytics/src/accessibility-and-lighthouse-ci-coverage.ts`                       |
| Security             | `docs/security/v1-release-security-gates.md`, `tests/security/`, `docs/security/pentest/signoff.md`                                         |
| Resilience           | `docs/runbooks/` (11 named runbooks) + chaos drills referenced in `docs/launch/dogfood-drill.md` §5                                         |
| Observability        | `libs/oshun/analytics/src/dashboards-*.ts`, `alerts-manifest.ts`, `tracing-manifest.ts`, `docs/launch/post-deploy-monitoring.md`            |
| Documentation        | `docs/adr/`, `docs/reference/architecture.md`, `docs/oshun/`, `docs/launch/`, `docs/runbooks/`, `docs/training/`, `docs/releases/v1/specs/` |
| Training             | `docs/training/oshun-v1-*.md` (10 programs)                                                                                                 |
| Runbooks             | `docs/runbooks/` (11) + `docs/releases/v1/runbooks/` (60+ Studio runbooks)                                                                  |
| Canaries             | `libs/oshun/search-discovery/src/experiments/canary.ts` + `docs/launch/canary-analysis.md`                                                  |
| Rollback triggers    | `docs/launch/go-no-go.md` §11 + `docs/launch/rollback-plan.md`                                                                              |
| Post-deploy monitors | `docs/launch/post-deploy-monitoring.md`                                                                                                     |

**Verification owner:** SRE Lead + QA Lead + Security Lead.

**Decision:** PASS / PASS-WITH-CONDITIONS / HOLD.

---

## 18. Signoff capture

```
# Exit-criteria signoff
date: YYYY-MM-DD
release tag: vX.Y.Z

| Criterion | Owner | Decision | Conditions | TS |
| --- | --- | --- | --- | --- |
| 1. Web/mobile coherence | Product Lead + Design Lead | PASS / HOLD | ... | ts |
| 2. Tara product center | Tara PM | PASS / HOLD | ... | ts |
| 3. Nisaba+Metis integrated | Nisaba PM + Metis PM | PASS / HOLD | ... | ts |
| 4. Sophia grounding visible | Sophia PM + Iris PM | PASS / HOLD | ... | ts |
| 5. Cross-domain continuity | Shell PM | PASS / HOLD | ... | ts |
| 6. Admin web+mobile critical workflows | Operations Lead | PASS / HOLD | ... | ts |
| 7. Oshun Studio | Studio PM | PASS / HOLD | ... | ts |
| 8. Agentic AI Studio | Agentic AI PM + Ops Lead | PASS / HOLD | ... | ts |
| 9. Tenant Console (isolated) | Tenant Console PM + Security Lead | PASS / HOLD | ... | ts |
| 10. Domain ownership boundaries | Per-domain PM × 6 | PASS / HOLD | ... | ts |
| 11. External-model gates not bypassable | Isis PM + Iris PM + Security Lead | PASS / HOLD | ... | ts |
| 12. Metis high-stakes evidence | Metis PM + Iris PM | PASS / HOLD | ... | ts |
| 13. Public/app-store/deep-links/status | Marketing Lead + Mobile PM | PASS / HOLD | ... | ts |
| 14. Recommendations operational | Search PM + SRE Lead | PASS / HOLD | ... | ts |
| 15. Aja services ready/deferred | Aja PM + Metis PM | PASS / HOLD | ... | ts |
| 16. Risk-tiered automated verification | QA Lead | PASS / HOLD | ... | ts |
| 17. A11y/perf/sec/resilience/obs/etc. | SRE Lead + QA Lead + Security Lead | PASS / HOLD | ... | ts |

aggregate decision: GO / NO-GO
```

A single HOLD on any criterion blocks GA until the criterion converts to PASS or
PASS-WITH-CONDITIONS with linked conditions tracked.

## 19. Re-opening conditions

Any of these auto-reopens the signoff:

- A criterion's referenced evidence file is deleted, broken, or regresses in a
  CI run between signoff and GA.
- A criterion's PM rescinds their PASS.
- A new beta-blocking issue is opened that maps to any criterion.

## 20. Cross-references

- Go/no-go: `docs/launch/go-no-go.md`.
- Critical journeys: `docs/launch/critical-journeys.md`.
- Quality review: `docs/launch/quality-review.md`.
- Safety review: `docs/launch/safety-review.md`.
- Dogfood drill: `docs/launch/dogfood-drill.md`.
- Private beta: `docs/launch/private-beta.md`.
- Beta-blocking remediation: `docs/launch/beta-blocking-remediation.md`.
- Rollout plan: `docs/launch/rollout-plan.md`.
- Rollback plan: `docs/launch/rollback-plan.md`.
- Post-deploy monitoring: `docs/launch/post-deploy-monitoring.md`.
- Canary analysis: `docs/launch/canary-analysis.md`.