Coordinate V1 sandbox rollout and human-gate closeout

Esto es un rastreador de coordinación y preparación, no un issue de implementación. Empieza revisando las dependencias #166, #182 y #146 y, después, inspecciona los issues vinculados que requieren intervención humana para consultar sus resultados aceptados. Se considera hecho cuando el candidato estable de lanzamiento del sandbox, las comprobaciones de provenance, las disposiciones sobre capacidades opcionales y la aceptación final del operador están registrados para un único SHA exacto.

Coordinate V1 sandbox rollout and human-gate closeout

Status: blocked — the stable launch candidate waits for #166/#182 storage activation and cleanup, then #146 sandbox provenance; shared Telegram, assistant/Podcast scope, optional Trello import, and final operator acceptance retain explicit HUMAN gates
Tags: enhancement, portal, work-engine, assistant, podcast, infra, data, testing, human, P0
Depends on: #166 with #182 for the canonical deployed Card/Task sequence; #146 for truthful sandbox runtime/export provenance; #128 staged Telegram disposition; #158 if assistant-output review remains in launch scope; #41 only if the real Trello import is included
Blocks: final V1 sandbox rollout acceptance
Next owner: #166 orchestrator/credentialed operator for the reviewed A → B → C → #182 preflight → D → cleanup sequence; HUMAN product owner may classify Telegram, Podcast/assistant, and Trello scope in parallel without performing those actions
Resume condition: #166 and #182 record accepted live sandbox phase outcomes, cleanup removes every temporary phase control and restores a successful ordinary push-triggered OIDC deployment, and #146 completes its reviewed provenance rollout. Then freeze the exact launch SHA and perform only the remaining issue-owned HUMAN gates and final operator pass.

Product boundary

This issue coordinates final DataOps V1 sandbox acceptance. It is a readiness tracker, not an implementation, migration, deployment, provider, or data-operation issue. No production target is authorized. Future production work requires a separate product decision and separately groomed infrastructure/data gates.

The historical standalone Podcast Assistant Telegram smoke in #7 was cancelled as superseded, not passed. Do not repeat it. #30 is closed as a completed historical assistant-job baseline; it is not an open launch dependency and does not prove a live shared Podcast executor. Current assistant-output review hardening is owned by #158.

Historical launch comments remain audit context only:

• launch candidate and restore evidence
• human-gate audit
• CI notification triage
• DataOps Assistant framing deployment

They do not prove the final post-#166 launch candidate, current provenance, or any pending HUMAN rollout. Do not copy historical private archive locations, identifiers, item data, credentials, or provider payloads into new public evidence.

Current dependency and ownership map

Stable application/data baseline

• #166 is the active P0 storage rollout. Its repaired A/B/C chain and Phase D preparation are local/unshipped; no live sandbox phase has run. It must replace the disposable transitional Tasks table, deploy the accepted #179/#168 writer contracts in the reviewed order, and then delete all temporary phase machinery while restoring ordinary push-triggered OIDC deployment.
• #182 is not a second table migration. The stack-owned Cards table was audited empty and already has the final physical contract. After #166 Phase C, repeat the bounded strongly consistent preflight. PASS preserves the existing Cards table and authorizes #168 activation through Phase D; deletion/recreation is not authorized.
• #146 runs only from the stable post-#166-cleanup SHA. It changes deployed/runtime/export provenance to exact sandbox, requires the reviewed non-executing no-add/remove/replacement preview, normal CI deployment, sanitized readback, and one bounded private product export check.
• #158 owns current assistant-output review safety/lifecycle hardening. The HUMAN product owner must either keep that surface in V1 and require its accepted rollout, or explicitly defer the surface and record the limitation before final operator acceptance.

HUMAN product rollouts and optional data

• #128 owns the shared private-Telegram conversational rollout. Its source, OIDC policies, and default-off normal deployment are proven; its staged provider canaries, optional voice/photo scope, observability, and reverse rollback remain HUMAN-owned. #71 links the sanitized result and never duplicates the canary procedure.
• #30 is complete historical delivery. Sandbox Podcast execution must still be classified as deferred, launch-blocking, or implemented under a separately named accepted owner. Telegram ingress, imported Podcast code, and the assistant-job model are not proof of live Podcast execution.
• #41 owns the optional real Trello source/redaction/import decision. Retained raw Trello/CSV import tooling is one-off operator tooling for a later explicit data-model/import decision, not a shipped runtime feature or permanent migration framework.
• #144 is relevant only if Podcast operational knowledge/runtime activation is included. It does not block the Podcast-excluding #128 MVP or a launch that explicitly defers Podcast execution.

No permanent migration framework

Completed one-shot migrations do not remain in the product. Migration-only workflows, API routes, reconcile/rollback/orphan endpoints, guards for completed migrations, and their ongoing CI suites must be deleted after their bounded operation. #136's one-shot Sponsor GSI workflow/migrator was deleted under #174.

Raw source import/export scripts such as Trello/CSV are retained for the future data-model import decision, but they remain manual one-off tools:

• never invoked by normal CI, deploy, seed, scheduled jobs, or runtime API routes;
• never treated as supported product behavior;
• no permanent migration state, reconcile, rollback, orphan-management, or compatibility API;
• focused one-off verification is operator-invoked only when that import is explicitly authorized, consistent with #187;
• no import, export-source, restore, or migration action is authorized by #71.

#166 may use reviewed temporary phase controls only for its one bounded table replacement. Its cleanup must remove them before the launch candidate is frozen.

Acceptance criteria

Stable launch candidate

• Historical V1 core work and the completed #30 assistant-job baseline remain accepted; #7's obsolete standalone Telegram smoke is removed and is not represented as passed.
• #166 completes reviewed A/B/C, #182 passes its final no-replacement Cards preflight, Phase D deploys the accepted canonical writers, and cleanup removes every temporary phase workflow/control/test while restoring ordinary push-triggered OIDC deployment.
• The first ordinary post-cleanup main deployment reaches terminal stack success, completes the shipped runtime seed path and deployed smoke, and becomes the only candidate baseline used by downstream acceptance.
• #146 completes against that stable SHA: exact sandbox parameter/function provenance, no-add/remove/replacement preview PASS, normal-CI deployment/readback, and bounded private export manifest/key/checksum PASS.
• Final accepted source contains no completed-migration framework, migration-only API support, or ongoing one-off import verification in normal CI. Retained raw source import scripts remain manual-only and unexecuted unless their owning HUMAN gate authorizes them.
• Current launch-candidate checks, normal OIDC deployment, deployed application smoke, sanitized recovery/rollback readiness, and public-safe evidence are linked for the exact accepted SHA. Historical June evidence is not substituted.

Shared Telegram rollout

• #128's normal-CI default-off prerequisite is proven without manual application deployment or Lambda patching: normal run 31545689094 created the accepted dark resources and reached terminal success, and later run 31711997388 reconfirmed the all-off OIDC deploy path.
• [HUMAN] #128 completes, aborts, or explicitly defers its authoritative staged rollout, including bounded canaries, voice/photo controls where selected, observability, and reverse rollback.
• Sanitized #128 evidence is linked here; no secrets, chat identities, provider payloads, private links, or operational paths are copied into #71.

Assistant and Podcast scope

• [HUMAN] Classify #158 assistant-output review as included or intentionally deferred. If included, its full accepted rollout and operator evidence are required; if deferred, record the unavailable/limited user path and do not present it as launch-ready.
• [HUMAN] Classify sandbox Podcast execution as deferred, launch-blocking, or implemented under a separately identified accepted owner.
• If Podcast execution is deferred, record that imported code and #30 do not constitute a live executor and perform no credential/provider smoke.
• If an accepted Podcast execution owner is identified, that owner—not #7 or #71—defines and passes the bounded HUMAN canary with safe artifact/log/secret handling.

Optional Trello import

• [HUMAN] Classify the real Trello import as included in this sandbox launch or intentionally deferred.
• If included, #41 records the approved source/export time/lists, redaction and attachment rules, exact sandbox target, fresh recoverability evidence, one bounded dry-run summary, skipped/error report, cost/load boundary, rollback plan, and explicit write authorization before any write.
• If included and executed, use only the retained one-off raw importer; verify resulting work and privacy through normal operator surfaces, then keep no migration API/framework or ongoing CI path.
• If deferred, perform no source read/import/dry-run and record the user impact and why the core launch remains useful without it.

Final HUMAN acceptance

• [HUMAN] Every open human-gated capability is classified as completed, launch-blocking, or intentionally deferred with its owning issue linked; silence is not deferral.
• [HUMAN] On the exact deployed launch SHA, the operations manager can log in, identify current work, open and act on Cards/Tasks, complete or block with required proof, see waiting/follow-up state, and use process context. Exercise only capabilities classified in scope.
• [HUMAN] The operator confirms rollback/recovery ownership and that no private evidence, credentials, raw data, or archive locations were published.
• PM confirms the exact dependency outcomes, accepted/deployed SHA, explicit deferrals, absence of obsolete migration machinery, and that no superseded or unimplemented capability was claimed as passed.

Test scenarios

Storage rollout completes

Given #166's repaired chain and accepted #168 ancestry
When HUMAN-gated A/B/C, #182 preflight, D, and cleanup complete
Then the final empty canonical Tasks schema and existing empty Cards table are stack-owned, canonical writers are active, old rows are not imported, temporary phase controls are gone, and ordinary deployment is restored before #146 starts.

Shared Telegram rollout is classified

Given the accepted dark deployment is already live-capable
When #128's authorized HUMAN stages, aborts, or defers the provider rollout
Then #71 records only its sanitized disposition and never reruns #7 or infers Podcast readiness.

Optional Trello import is included or deferred

Given retained raw import tooling is manual one-off tooling
When the HUMAN owner classifies #41
Then an included import follows #41's bounded approval/verification and leaves no permanent migration support, while a deferred import performs no data action.

Final operator workflow

Given storage/provenance gates are complete and every optional capability has an explicit disposition
When the operations manager performs the exact deployed sandbox workflow pass
Then the result, rollback owner, and limitations are recorded without exposing private evidence.

No-mutation and privacy boundary

#71 authorizes no repository implementation, AWS/IAM call, workflow dispatch, deploy, provider call, Telegram message, credential use, import/export/restore, queue action, feature enablement, or data/infrastructure mutation. Every external action requires its owning issue, accepted immutable artifact, and explicit HUMAN gate. Public evidence is limited to sanitized statuses, counts, digests, timestamps, and links that expose no private operational material.

Out of scope

• Any production environment or production-data cutover.
• Reopening #7 or treating its cancelled standalone smoke as passed.
• Claiming Podcast execution from imported code, Telegram ingress, or #30 alone.
• Implementing features, migration frameworks, compatibility paths, or operational APIs in this tracker.
• Running retained one-off import/export/restore/migration tools without their owning explicit HUMAN gate.
• Manual application deployment, Lambda patching, or bypassing normal CI/CD.