Freeze Milestone-0 inventories, ownership, decisions, and ADRs

Parent epic: #10

PM disposition

GROOMED / P0 / SOURCE-ONLY MILESTONE-0 CLASSIFICATION GATE. #72 is ready for one bounded source implementation; it is not accepted or frozen yet.

#72 produces the immutable classification authority consumed by #76 and #77. It inventories and classifies what the migration must preserve, replace, own, authorize, and verify. It does not implement those product domains, produce live release evidence, aggregate a go/no-go report, or authorize rehearsal/cutover.

Do not create a duplicate broad inventory epic. Implement the package below in one isolated, uncommitted lane from the selected current main, then use the normal independent tester and PM gates.

Normative authority

• _docs/PROCESS.md
• _docs/specs/README.md and all ten numbered specifications
• _docs/specs/09-migration-rollout-roadmap.md, Milestone 0 and its exit gate
• _docs/specs/open-decisions.md, whose current authoritative index has 21 numbered sections
• _docs/architecture/app-boundaries.md
• accepted baseline/inventory inputs #30, #34, #150, #152, and #153
• accepted source-side workflow decisions #12/#226 and the current decision records linked by the 21-section index
• accepted deterministic verification foundations #75 and #104
• downstream ownership boundary established by #76 and #77

Specifications and accepted owner decisions are product authority. An issue label, open implementation epic, prospective upstream change, historical audit, or current runtime behavior cannot silently create or replace a decision.

Dependency and handoff DAG

accepted specifications + exact 21-section decision index
+ accepted #30/#34/#150/#152/#153 inventory slices
  -> #72 immutable requirement/decision/inventory classification
  -> #76 producer graph and evidence contracts
  -> #77 deterministic report/checksum/go-no-go consumer
  -> #73 authorized development rehearsal
  -> #74 separately authorized production cutover

#75 is a closed verification foundation, not an open dependency. #76 must not be pulled into #72: #72 says what is classified and who owns the destination; #76 later says which producer and evidence contract proves each release gate; #77 consumes that graph.

The 21 indexed decisions currently have normative dispositions. Open implementation epics such as #21, #38, #64, #66, #108, #109, and #227 remain destination work, not unresolved #72 product choices merely because they are open or carry a decision label.

The accepted product-scope portion of decision section 18 is distinct from #29's still-open operational cutover-threshold packet. #72 must link that packet as a required downstream owner/HUMAN input for #66/#73/#74 without choosing thresholds or claiming it complete. Likewise, external MFA for decision section 9 remains a separately owned HUMAN/infrastructure gate.

#149's four newer CMP behavior packets are not present in the accepted website pin. Classify them as prospective, unapplied, and excluded pending their own owner decision. They do not alter the frozen current-workflow inventory unless the selected CMP pin changes; if it does, #72 must fail drift and return to PM rather than infer adoption.

Outcome and exact package

Create one versioned, deterministic Milestone-0 package with:

1. a machine-readable schema and canonical classification manifest;
2. a human-review rendering generated from that manifest, never maintained as a second authority;
3. exact source/spec/decision-index/inventory identities and SHA-256 digests;
4. six ADRs required by specification 09: content sync, Course-to-Cohort/curriculum versioning, authentication, email semantics, search, and AWS topology;
5. a fail-closed validator and focused fixture corpus wired into the repository's uv-backed Make/CI contracts; and
6. one canonical package digest and handoff record for #76/#77.

The implementation may choose repository-native filenames consistent with the existing documentation/CI layout, but the schema, canonical manifest, generated review document, six ADRs, validator, tests, and handoff digest must be individually named in the engineer report. Historical #150/#152/#153 artifacts remain immutable inputs rather than being rewritten to look current.

Classification contract

Every manifest row has a stable ID and exactly one kind from the complete current Milestone-0 families:

• numbered specification requirement and numbered decision section;
• public route, alias/redirect, link, fragment, canonical/robots/sitemap/structured-data rule, and asset;
• source repository/content kind, legacy variant, renderer feature, relation, and projection;
• course HTML/API route, authenticated/public behavior, known consumer, command, export, workflow, and compatibility boundary;
• public/member/staff/service workflow or management action/capability;
• application model, source table, relationship, data class, migration overlay, and reconciliation boundary; and
• external/HUMAN/provider/protected-environment requirement that must remain explicit but is not executed here.

Each row records, as applicable:

• exact normative locator plus source commit/tree/artifact/schema identity and digest;
• disposition such as preserve, direct compatibility, redirect, retire, adopt, defer, reject, or required external gate;
• owning application/domain, source authority, target authority, allowed mutation path, actor/capability boundary, sensitivity/PII class, and retention/privacy authority;
• owning issue and role, implementation destination, focused test/verification destination, migration/rollback or compatibility reference, and supersession relationship; and
• explicit status and reason for any prospective, unavailable, externally owned, or not-yet-implemented item.

The package classifies requirements and destinations; it does not promote planned implementation, synthetic fixtures, source-only checks, or missing external evidence to a passed release gate.

Decision-index reconciliation

Bind the exact open-decisions.md bytes/digest, ordered section IDs, headings, disposition text, authority provenance, and linked issue(s). On the current index there are 21, not the obsolete 18 or 20 recorded in historical comments.

• A resolved normative decision may link to an open implementation issue without becoming unresolved again.
• Section 18 records the accepted narrowed article/non-article product scope and separately links #29's unresolved operational threshold work.
• Sections 19 and 20 must record the accepted specification provenance and their #108/#109 implementation destinations rather than being omitted because they lack a resolved by #N heading suffix.
• Section 21 records the accepted owner decision while #227 remains implementation work.
• Unknown, missing, duplicate, renumbered, retitled, contradictory, or digest-changed sections fail closed and require PM reconciliation.

Inventory and ADR requirements

• Reconcile current source-declared routes/models/files/commands/APIs/cadmin/generated artifacts against the accepted #30/#34/#150/#152/#153 inputs. Bind the implementation-head identities and explain every addition, removal, replacement, or stale historical count; never copy a historical count as proof of current completeness.
• Cover main/docs/FAQ/Wiki/course surfaces, content kinds/variants/assets, course consumers/workflows, management actions, models/tables/relationships/exports, and all source-to-target data ownership classes named by specification 09.
• The source-to-target and actor/capability/PII portions must include editorial content, accounts/member profiles, courses/cohorts/enrolments, events/registrations/attendance, email/Relay/legacy inputs, redirects/settings, audit/jobs/operations, and migration/reconciliation overlays.
• Each ADR records context, exact authority and decision, considered alternatives, consequences/tradeoffs, ownership/security/privacy effects, migration/rollback, dependencies, and supersession policy. ADRs may truthfully link implementation or external gaps; they may not invent an owner choice.
• Every discovered item is represented exactly once or linked through an explicit, validator-checked parent/child relation. No observed public route, source kind, current course workflow, or management action may remain unclassified.

Explicit non-goals and authority boundary

• No product/domain implementation, migration/import/apply, content sync, source-pin movement, redirect activation, report aggregation, rehearsal, deployment, provider call, email/Slack action, AWS/Terraform/DNS/CloudFront/WAF/Search Console action, credential use, or production/protected-data access.
• No production database/export/log/analytics probe. Closed #16's owner-approved consumer boundary is authority; #72 does not reinstate the waived per-route production probe.
• No inference of HUMAN/provider/production success. Such rows remain externally owned and required by their later producer/rehearsal/cutover gates.
• No rewriting historical accepted inventory artifacts, broad application tests, product UI, hosted report, or screenshot work.
• No duplication of #76 producer schemas/freshness/redaction/exception rules or #77 aggregation/verdict/receipt behavior.

Acceptance criteria

• One schema-versioned canonical manifest classifies every Milestone-0 family above exactly once and binds the exact implementation source/spec/inventory identities and digests.
• All ten numbered specs and the exact ordered 21-section decision index reconcile with stable IDs, authority provenance, dispositions, owners, destinations, and no missing/duplicate/contradictory row.
• Current route/link/SEO/content/variant/asset/course/API/consumer/workflow/action/model/table/relationship/export inventories reconcile to accepted inputs with every drift item explained and classified.
• Source-to-target ownership and actor/capability/PII/privacy classifications cover every named domain and identify authority, mutation boundary, owner, retention reference, implementation issue, and verification destination.
• The six required ADRs contain context, decision, alternatives, consequences, migration/rollback, dependencies, and supersession, with unresolved implementation or external gates represented honestly.
• A generated human-review rendering and one canonical SHA-256 package digest are reproducible from the manifest and form the exact #76/#77 handoff.
• The validator fails closed on omitted, duplicate, ambiguous, unowned, unknown-kind, invalid-disposition, source/spec/index drift, digest mismatch, stale historical identity, orphan destination, ADR omission, or unexplained inventory drift.
• Focused source-only verification passes under #75/#104 with no network/external side effect, prohibited sensitive value, unexplained skip, or browser/screenshot obligation.

Required verification scenarios

1. Generate the package twice from identical explicit inputs presented in shuffled order and prove byte-identical manifest, review output, diagnostics, and digest.
2. Add/remove/rename one fixture from every classification family and prove missing, duplicate, ambiguous, or unclassified items fail with bounded diagnostics.
3. Mutate a spec, decision count/order/title/body digest, accepted inventory identity, source pin, model/route/command/capability fixture, ADR field, ownership edge, or destination link and prove drift fails closed.
4. Exercise resolved decision plus open implementation, required external/HUMAN gate, prospective unapplied CMP packet, explicitly retired item, and superseded authority states; prove none is silently treated as implemented or release-green.
5. Inject representative secret, credential, raw email/profile/registration value, protected-source locator, and reversible identity digest canaries; prove validation/publication fails without echoing the value.
6. Verify the #76/#77 consumer fixture accepts only the exact schema/version/digest and rejects an older 18/20-decision package, changed 21-section index, missing row, or mismatched source identity.

Browser and lifecycle disposition

No product route or render surface changes. Playwright and screenshots are not_applicable only if the change remains source documentation/schema/validator work; any hosted or product-facing UI requires re-grooming.

Engineering leaves the candidate uncommitted with the required #104 verification plan. A separate tester independently recomputes identities/digests, validates every criterion and negative fixture, and posts the tester-final report. PM acceptance then reviews completeness and authority boundaries. Only after both gates pass may the focused commit use Closes #72, followed by local --no-ff merge/push and on-call observation.

Closing #72 freezes classification only. It does not close implementation epics, satisfy external MFA/HUMAN/provider/production evidence, accept #29's operational threshold packet, approve #149's prospective CMP behaviors, make #76/#77 green, authorize #73, or authorize #74.

Start with _docs/PROCESS.md, _docs/specs/README.md, specification 09, and _docs/specs/open-decisions.md, then inspect the accepted #30/#34/#150/#152/#153 inputs and verification foundations #75/#104. Done means a deterministic schema-versioned manifest, generated review output, six ADRs, fail-closed validator and focused tests reconcile all required identities and produce the canonical #76/#77 handoff digest.