Beta RC Baseline — Nougat DevPay

Reading guide

This is the baseline used to plan a past Beta RC wave, not the current release verdict.

Read its date and branch SHA first, then follow newer gate evidence for the latest status.

Baseline: feat/pg-magician @ 6c7e49908611b0e1975cedb1b862508625bde745

Current verdict

NOT_READY for Public Beta. The application is deployed, but implementation, live negative authorization, browser E2E, and launch-gate evidence are incomplete.

Verified baseline evidence

• git status --short: clean at baseline creation.
• FE typecheck: cd fe && pnpm exec vue-tsc --noEmit -p tsconfig.json — PASS on baseline.
• FE static builds: pnpm build:staging, pnpm build:production — PASS on baseline.
• Staging Pages: https://staging.nougat-devpay.pages.dev serves apiBase=https://api.staging.devpay.chu.plus.
• Production Pages: https://devpay.chu.plus serves apiBase=https://api.devpay.chu.plus.
• Worker health: staging and production /api/v1/health were previously verified 200 {"ok":true}.
• Deployed Pages configuration is local-build/direct-upload; no Cloudflare remote build was used.

Evidence that is stale or insufficient

• docs/final-*.md, implementation-status.md, and roadmap-progress.md contain useful context but are not current release proof.
• Axum/SQLite tests do not prove Cloudflare Worker/D1 behavior.
• Local Playwright tests do not prove deployed Pages/Worker browser flows.
• Worker/D1 route-level automated tests are absent or insufficient.
• Human vendor/product sign-off and independent human QA sign-off are not represented by AI subagent reviews.

Product policy decisions for Beta RC

Policy	Decision	Enforcement
Real paid payment in production	Disabled until a real PG integration is approved	PAYMENT_MODE=production must fail closed with explicit 402/NOT_LIVE_PAYMENT
Email delivery	Mock adapter only	No real email provider may be added without new approval
Email ownership	Not automatically verified by mock email	Unverified email must not claim prior purchases/licenses
Free feedback	Supported with abuse controls	Public widgets must be public, bounded, and rate/abuse aware
Platform operator vs Seller	Separate roles	/admin/** requires platform admin identity, not seller fallback
Public launch scope	Only verified supported features	Mock-only or unverified flows must be hidden or clearly disabled

Beta exclusions

• Real PG payment capture, settlement, payout, refund through a payment provider.
• Real email provider, email deliverability, and email ownership proof.
• Claiming historic purchases/licenses solely from an unverified email.
• Production database reset, seed, destructive migration, or destructive tests.
• MCP server completion.
• Automatic remote publication from the local Control Plane.

Deployment targets

Environment	Frontend	API	Status
Local development	http://127.0.0.1:3000	http://127.0.0.1:8080	Development only
Staging	https://staging.devpay.chu.plus (official target; current alias https://staging.nougat-devpay.pages.dev)	https://api.staging.devpay.chu.plus	Candidate environment
Production	https://devpay.chu.plus	https://api.devpay.chu.plus	Guarded; explicit approval required

Source of truth

• Runtime config contract: fe/nuxt.config.ts, fe/package.json, fe/.env.example.
• Cloudflare deployment contract: be-cloudflare/wrangler.toml.
• Local execution/gate tracking: .devpay-control/ and tools/devpay_control/.
• This directory: docs/agent/ is the current Wave 0 coordination source.