# Verification Lanes — burn down the 27 UNVERIFIED go-live gates

Audience: AI coding agents. Goal tracker: `GOLIVE.md` (authoritative). This plan organizes the
UNVERIFIED/BROKEN gate closure into parallel-safe lanes. It creates no new features.

Baseline: `origin/master` (audit `cee8d2649`, plugin 0.9.67). Every lane MUST fetch origin/master
and work in a fresh isolated worktree. Every gate/test/browser run executes ONLY through the
sanctioned remote flow (`/ipz-e2e` on registry-selected debian1/2/3, wrapper
`/home/user/.claude/bin/e2e-remote`); the workstation is for editing/git only. Landing goes through
`.claude/scripts/ship.sh`. No deploys to dev1 without the owner's explicit request.

## Evidence rule (from GOLIVE)

A checkbox flips only on proof against the CURRENT release candidate. Therefore evidence collected
in Phase 1 closes engineering risk but the RC-stamped rerun happens once in Phase 2, after the code
surface freezes (PG-14 landed + landing sweep resolved). Do not skip Phase 1 — it finds the defects
while they are still cheap; Phase 2 is then a rerun, not a discovery pass.

## Phase 1 — parallel-safe now (do not wait for PG-14)

### Lane V1 — Connect/credential negative paths (PG-02, PG-06, PG-08, PG-09, PG-10)
- Browser E2E: fresh site → `#/onboarding` → social sign-in via Connect service → `/oauth/token` →
  `/connect/status` connected; assert no credential rendered/logged/exposed to JS (also closes PG-01 verify).
- Cancellation: submit async job, cancel, poll terminal `cancelled`; attempt cross-site cancellation → fail closed.
- Revocation: backend revokes site key → plugin gets 401 → blocks translation, purges state, offers reconnect.
- Entitlement failure: 402/inactive → paid ops blocked, no content mutation, actionable message.
- Rate limit: induced 429 on sync + bulk paths → Retry-After honored, no duplicate job/charge/mutation.
- Depends on backend cooperation endpoints (revoke/402/429 induction). If a test hook is missing,
  record the exact missing hook in the lane report as a `press-zone-core` handoff — do not fake it.

### Lane V2 — ACF + Yoast customer safety (PG-15, PG-16, PG-39, PG-40)
- Real ACF install: mirrored/original fields, field policy, translated values, rollback, regeneration;
  then ACF absent: activation/admin/translation clean.
- Yoast: SEO token partitioning at every call site, finalizer rollback symmetric with ACF, metadata
  survives/reverts; Yoast absent: no Yoast UI/data path appears.
- Both installed+absent runs on the remote fixtures; Chromium+Firefox for the admin surfaces.

### Lane V3 — Frontend routing + SEO ownership (PG-17, PG-18)
- Language-root switching, canonical localized URLs, hreflang/locale, translated front-page/page routing.
- Yoast robots/sitemap ownership for multilingual routes: no duplicate/missing/cross-language output.
- Coordinate with the active `site-entry-ux-completion` lane, which owns language-root switching and
  Yoast robots/sitemap implementation — this lane VERIFIES; if verification finds missing behavior it
  files findings to that lane rather than implementing.

### Lane V4 — Security review (PG-30) — **opus subagent per standing policy**
- Sellable surface: REST capability/nonce checks, PKCE state, credential secrecy, site/job
  authorization, stored XSS/escaping, CSRF, unsafe URL handling, package/update verification.
- Fresh adversarial pass (security-guard style), not a self-audit rerun. Output: findings with
  severity; P0/P1 must be fixed and re-reviewed before PG-30 flips.

### Lane V5 — Gate infrastructure repair (unblocks PG-26)
- Root-cause `remote-command-missing` on factory-gate remote dispatch; restore full gate
  (PHP syntax, PHPUnit/standalone/integration, PHPCS baseline, PHPStan, admin lint, production
  build, UI inventory/gate) green on a sanctioned buildbox. Nothing else can certify without this.

### Lane V6 — Identity/governance handoffs (PG-21, PG-23)
- Execute H-PG21-01..03 and H-PG23-01..05 from `docs/launch/LAUNCH-GOVERNANCE-AUDIT.md`:
  hide/gate deferred runtime features (WPML migration, Team/Workflow/My Assignments,
  Auto-translate on Publish), fix admin eyebrow "Press Zone" and menu "International", and surface
  the product/license URL 404s to the owner (web-side items are owner handoffs, not plugin code).

### Lane V7 — Compatibility fixtures (PG-38, PG-41, PG-42) — prep only
- Continue the READY `compatibility-qualification` plan: declared WP/PHP/DB matrix, first
  customer's actual stack fixture, theme/block/RTL/permalink smoke set. RC rerun deferred to Phase 2.

## Phase 2 — RC certification (existing WAITING plan `2026-08-19-final-rc-certification.md` owns this)

Preconditions: PG-14 landed; landing sweep resolved (every LAND or ARCHIVE decision executed);
Phase 1 lanes report no open P0/P1 findings. Then, on the frozen RC:
- PG-26 full factory gate; PG-28 all browser journeys Chromium+Firefox; PG-29 WP_DEBUG-clean run.
- PG-32..37 packaging chain: build exact ZIP → inventory/hash → clean install from ZIP → upgrade
  from previous supported version → signed update delivery (tampered package fails closed) →
  rollback artifact → version coherence.
- PG-44 first-customer acceptance script on a clone of the waiting customer's stack; PG-46 backend
  endpoint dependency proof.
- Stripe rows (PG-03, PG-07) remain WAITING_EXTERNAL; check them only when clearance evidence exists.

## Sequencing logic (why this order)

1. PG-14 is the only MISSING feature and is P0 content-integrity; until it lands, any RC is not
   final and Phase-2 evidence would be invalidated by its landing.
2. The landing sweep freezes the code surface the same way: every later-landing idle lane would
   invalidate RC evidence, so land-or-archive decisions come before certification.
3. Phase 1 runs NOW in parallel because engineering findings (a broken revocation path, an ACF
   rollback bug, a security P1) are cheaper to fix before the freeze than after.
4. Phase 2 is a single certification pass over a frozen candidate — run once, stamp GOLIVE, sign off.

## Lane rules

- One lane = one agent = one fresh worktree; no cross-lane file ownership overlaps. V3 verifies
  what site-entry-ux implements — findings flow as reports, not commits, to avoid collision.
- Model policy: sonnet default; V4 security on opus. No nested delegation inside lanes.
- Every lane ends with: evidence artifacts (screenshots/logs/receipts with SHAs), a GOLIVE status
  recommendation per owned gate (flip / keep with reason), and a one-paragraph report. GOLIVE edits
  land through the normal review flow, never direct pushes.
- Any lane that discovers missing implementation reports it; it does not silently expand its scope.