Acceptance journeys

Target edition: 20 October 2026, expanded for buyer reviews 1, 2, 3, 4, 5, 6 and 7. This checklist covers the complete CONTRACT.md destination. All 87 clauses are missing: 78 target and 9 push-further. No code, deployed app or implementation evidence is claimed. Status and gaps mirror CONTRACT.md. Original PEG-001–070 titles and IDs, including every desk ID PEG-001–030, remain unchanged; new IDs continue at PEG-071.

Use the actual Cloudflare/Base product through its browser, API, mobile, integration or import/CLI public doors. Every browser journey runs and is personally inspected at 1440 and 390 CSS pixels with realistic US data and accessibility checks. Fakes are allowed only at model/network/provider edges and use official schemas; label schema-fake versus live/sandbox evidence. Quality and coordination benchmarks require the actual configured model and human review, not mocked model outputs. Include concurrent edits, permission denial, provider errors and restart where named. CI is the full wall for implementation; these documents specify checks builders must make pass.

Approval semantics follow CONTRACT.md: company-only notifications/posts use standing scoped policy. A human-reviewed current guest share is approval for fixed assignment, due, digest, comment and proof system notices/reply routes within that share, under the guest’s own preferences, with no per-message review. Agent-written guest messages, client/executive publications, client-shared channel posts and new/outside-share disclosures need exact review; review cannot bypass current access. An authorized editor’s previewed drag/drop or Apply is their schedule-change approval and needs no second sign-off. PEG-012’s current Admin-reviewed deterministic activation is standing approval for its in-scope dates/assignments on new or existing tasks; changed/out-of-scope/AI-produced/agent commitments still wait for exact review. Tests cover delivered guest notices, privacy/revocation and the separate pending agent/outside-share paths. Guided setup completes only with a passing live model test or an explicit recorded “continue without AI” choice; that same condition applies to the 30-minute bar. No-model and revoked-model tests cover every AI entry point and link to browser recovery while ordinary work continues.

Round 3 adds PEG-079–081 for release-owned public mobile apps/push, guided owner-registered provider connections and whole-account Asana API migration. The new 15-minute provider walkthroughs, public-store/live relay evidence and complete 300-project/125-person/10-GB account journey are additional required checks; earlier small/export/browser cases remain. No implementation or hosted qualification is claimed by these draft specifications.

Round 4 adds PEG-082/083 for stated attachment limits, resumable Base R2 custody and team/project discovery/access requests. PEG-047/048 now each require a whole-account 300-container/125-person/10-GB migration, in addition to every earlier smaller case. These are future acceptance obligations, with no implementation claim.

Round 5 adds PEG-084/085 for authenticated and inbox-qualified mail plus Run Edit Run-published Zapier/Make apps. PEG-012 adds deterministic activation-approved date/assignment actions and the complete requested work-action catalogue; PEG-061 requires exact published Run Edit Run software/push/security-update price lines before installation. Every prior journey remains except the explicitly superseded per-run deterministic-date approval expectation and clarified built-in-web-URL mail case.

Round 6 replaces the superseded universal two-inbox buyer gate with owner/actual-MX-platform probes and path-specific requalification; the separate real Gmail plus real Microsoft 365 product qualification remains mandatory. Transient DNS errors never pause verified mail. PEG-086 requires persistent owner passkey/TOTP plus printed-code recovery, honest delayed sign-in and 125-person work continuity. PEG-037 adds the default last-blocker Ready to start notice. These are target checks; no new implementation tests or passing product claims are added.

Round 7 supersedes default platform holds/raw-DNS fingerprints: placement checks are advisory, chosen holds have a one-decision release, and only actual evaluated DMARC failure confirms a DNS mail pause. Aligned DKIM alone keeps mail flowing when SPF fails. Recovery delegation/Cloudflare re-enrollment and all requested carried items have explicit journeys; PEG-087 adds work conversion. The real Gmail/Microsoft 365 qualification and the original provider 15-minute elapsed bar remain; a documented propagation overrun is an honest unmet timing qualification, not a pass or a changed threshold.

Clause journeys

• PEG-001 — One work graph. Status: missing. In Projects, build a campaign and launch project, move a task and add it to both, complete a subtask and inspect one task ID, shared changes and one history in both views. A guest on one project cannot discover the other's name, private fields or attachments through UI, API or exports. Create a no-project personal task and a MKT-prefixed task, move/multi-home the latter and change its project prefix; old and current references find the same task for authorized users and reveal nothing to others. Run PEG-083’s public-team join/team-project and private-link request journeys against the same multi-project graph. Existing evidence: none. Gap: No implementation exists for one work graph; the complete behavior and public-door acceptance journey remain required.

• PEG-002 — Fields, statuses and shared definitions. Status: missing. Create every field type through project settings, add one library field to three projects, edit inputs and compare formula/rollup results through task, report and API reads. Try a cycle, hidden input and incompatible type change; see a safe explanation and no leaked input or lost data. Create a campaign tag independent of a dropdown, tag work across three projects, rename it once and filter by the tag. A Viewer cannot tag or edit values, an Editor cannot alter definitions, and a guest cannot enumerate internal/personal tags. Existing evidence: none. Gap: No implementation exists for fields, statuses and shared definitions; the complete behavior and public-door acceptance journey remain required.

• PEG-003 — Every work view on the same records. Status: missing. Open a realistic project in all six views in two signed-in browsers, filter and group it, move a card and edit a due date in the table. Observe identical persisted records without reload and restored saved views after sign-in; a shared-view recipient sees only permitted rows and fields. Create a team-scope due-this-week view over 30 projects in list, board, table, calendar and timeline, including one hidden project and one multi-homed task. Check exact permitted counts, move a card and edit a date, and observe the same single record in its home project and all saved views. Sharing never grants access to the hidden project. Measure 100 remote real edits on each fixed profile and compare commit-to-painted-value p95 with 2 seconds; hidden records never arrive, and an offline view is labeled stale rather than counted live. Existing evidence: none. Gap: No implementation exists for every work view on the same records; the complete behavior and public-door acceptance journey remain required.

• PEG-004 — Dependencies and believable schedules. Status: missing. Through Timeline, exercise all four dependency types, delay a predecessor over a US holiday/weekend and DST boundary, inspect the critical path and baseline variance, then approve the reviewed shift. Reject a cycle and a stale plan; no unapproved downstream date changes occur. Drag a predecessor as a project Editor after viewing the knock-on preview: dependants shift exactly once, attributed to that editor with undo and no second approval. Repeat as an autonomous agent and require pending approval; a viewer or stale edit cannot shift any task. Exercise PEG-012’s in-scope date propagation and out-of-scope hidden-dependant case, with immediate authorized effects only when coherent and no unauthorized partial schedule. Run PEG-037’s two-blocker/concurrent completion and hidden-predecessor readiness cases on this same dependency graph. Existing evidence: none. Gap: No implementation exists for dependencies and believable schedules; the complete behavior and public-door acceptance journey remain required.

• PEG-005 — Recurring work and human decisions. Status: missing. Complete a weekly recurring task and recur an onboarding project, restart during generation and inspect one next occurrence. Through an approval task, request changes, revise and approve; historical decisions remain attributed and a copied or changed revision cannot inherit sign-off. Existing evidence: none. Gap: No implementation exists for recurring work and human decisions; the complete behavior and public-door acceptance journey remain required.

• PEG-006 — Useful reusable templates. Status: missing. Instantiate each gallery family through New project, choose start date and role mapping and inspect correct dates, owners, fields, dependency edges and rules. Leave a role unresolved and require an explicit choice; updating the template leaves an existing project unchanged until reviewed. Duplicate an active project with options first excluding members/rules and then selecting them; compare exact chosen work/assignees/dates, new IDs and source backlinks, review staged shares/rules and confirm no copied sign-off, duplicate notification or broadened visibility. Instantiate a pinned template from an activated deterministic rule and inspect immediately applied new-task dates/assignments; change the template/mapping and keep the next run pending until the Admin reviews/reactivates. An AI-chosen template/date still requires exact human approval. Existing evidence: none. Gap: No implementation exists for useful reusable templates; the complete behavior and public-door acceptance journey remain required.

• PEG-087 — Convert work without losing its history. Status: missing. At 1440/390 and through the API, convert an intake task with nested work, file/proof versions, comments, a time entry, dependency and source alias into a project, then convert a populated project into a task with reviewed nested-work mapping. Resolve old links to the authorized survivor/linked record and reconcile all counts, authorship, durations, version digests and scopes. Promote a subtask to a task and demote another task, retaining IDs/history and refusing a cycle, private-scope disclosure, stale preview and unauthorized target. Keep unrepresentable rule/report settings visible as linked inert repair items; replay once without duplicates and undo after a human edit without deleting that edit or resurrecting old approvals. Existing evidence: none. Gap: No implementation exists for convert work without losing its history; the complete behavior and public-door acceptance journey remain required.

• PEG-031 — Find and safely change work at scale. Status: missing. Find an old approval by comment text, save its filtered view, then bulk-change a mixed-permission, concurrently edited task selection through the UI. Inspect exact per-row outcomes, undo unchanged effects and retain later edits; hidden records never appear in search suggestions, counts, API or downloads. Mark and merge two ordinary tasks with conflicting owners and fields, a dependency and separate comments/time entries. Inspect the chosen survivor, one conserved history/time total and safe alias redirects; concurrent edits force re-review and a private-task merge cannot expose either task or its fields. Run the stated cold/warm searches on both fixed profiles, measure query-submit-to-painted-results p95 against 1 second and compare exact permitted result IDs after revocation, with no loading skeleton or hidden-row cache shortcut. Existing evidence: none. Gap: No implementation exists for find and safely change work at scale; the complete behavior and public-door acceptance journey remain required.

• PEG-033 — Visual business-work planning. Status: missing. In a project planning canvas, two members rearrange a mind map, create a task from a note and edit that task in List. The canvas reflects one task ID and state, exported content restores, and a guest cannot see internal-only notes. Existing evidence: none. Gap: No implementation exists for visual business-work planning; the complete behavior and public-door acceptance journey remain required.

• PEG-034 — Reusable workflow bundles. Status: missing. Apply a campaign bundle to three projects, locally modify one rule, then preview a new version. Adopt only chosen compatible changes, preserve the override and work history, and disable the bundle during queued work without executing an obsolete action. Existing evidence: none. Gap: No implementation exists for reusable workflow bundles; the complete behavior and public-door acceptance journey remain required.

• PEG-035 — Risks, decisions and change requests. Status: missing. In a project, raise a dependency risk, assign mitigation and propose a scope/date change. Require the right human to accept it, retain its rejected alternative and original baseline, and trace the risk into the portfolio update and linked work. Existing evidence: none. Gap: No implementation exists for risks, decisions and change requests; the complete behavior and public-door acceptance journey remain required.

• PEG-007 — Request intake and triage. Status: missing. Submit branching internal and public forms and a signed Pencil response, including an attachment and duplicate source ID. Inspect one mapped task, acknowledgment and triage clock; advance beyond its deadline to flag/escalate it, and reject malformed, abusive or forged submissions without leaking private fields. Run PEG-082’s exact-boundary and one-byte-over form cases from public and internal intake without private-field leaks or partial submitted attachments. Submit PEG-012’s ten form requests, compare exact five-business-day due dates and fixed designer assignments without pending per-run approval, and distinguish a separately pending AI-proposed assignment/date. Existing evidence: none. Gap: No implementation exists for request intake and triage; the complete behavior and public-door acceptance journey remain required.

• PEG-082 — Resumable attachments with owned byte custody. Status: missing. Through browser/public API upload-session doors at 1440/390, the installed macOS/Windows desktop app and both native iOS/Android apps, upload and finalize an exact 100,000,000-byte fixture on every ordinary path, including task, comment, proof revision, browser/sidebar upload and guest upload; compare stored bytes/digest and one version. A member, guest Editor and external proof approver with the explicitly reviewed revision-upload grant each upload a valid 95-MB MP4 and 80-MB PDF through web and both native apps, then annotate the MP4 at a specific frame/timecode and the PDF on its page. An approver without that extra grant cannot upload, and an upload-only contributor cannot approve without a separate current human approval grant. Interrupt a chunk and the receiver/app, restart and resume to exactly one matching version; replay part/finalize, revoke the share mid-transfer and cancel another session, checking no unauthorized completion or orphaned reservation/part. Refuse a 100,000,001-byte file and a 25,000,001-byte form file before any file-data request; accept three 25,000,000-byte files in one form submission and refuse an added byte before that selection transfers. Inspect exact limits and the Drive/OneDrive option on web, desktop, guest, phone and API responses, including a disconnected-provider guide link. Exercise visible lower remaining quota, two competing reservations and dishonest size metadata; no failed/partial object appears in Files or proof review. Re-upload a migrated 100,000,000-byte Asana attachment as proof v2, preserve source v1 history and refuse stale v1 approval. Through Base’s actual archive/export and restore API/CLI doors with a real R2 sandbox, interrupt/resume archive restoration of these files into a fresh installation, compare exact bytes/digests/links including the large MP4/PDF, and prove no old upload capability executes. Erase one proof and an interrupted upload and verify original/derived/version/partial-object cleanup and released PEG-061 storage usage. Existing evidence: none. Gap: No implementation exists for resumable attachments with owned byte custody; the complete behavior and public-door acceptance journey remain required.

• PEG-008 — Capture where the team already works. Status: missing. Forward a real-format email with attachments, invoke each of Slack, Teams and Nook message actions and capture a web page with the installed extension. Read persisted tasks with source links, replay an event and revoke source access; no duplicate task, unauthorized excerpt or hidden project is created. Create a personal intake address, forward authorized mail with an attachment and find one private My Tasks item; replay it without duplication. Another member cannot read/search the task or its raw route, and messages to a rotated, revoked or cross-installation route create no work or share. Existing evidence: none. Gap: No implementation exists for capture where the team already works; the complete behavior and public-door acceptance journey remain required.

• PEG-009 — My Tasks and useful notifications. Status: missing. Assign work, mention a follower and a muted user, snooze an approval and cross a DND boundary. In My Tasks and Inbox, inspect correct priority and only expected notices; receive one configured daily email digest with no hidden or muted content and no lost actionable approval. Compare My Tasks ordering with PEG-073’s stated order; reply to an ordinary comment notification and verify PEG-072’s one attributed comment, then verify an internal digest sends under policy and a guest digest containing only currently shared work sends without per-message approval. An agent-composed client-guest message still remains pending exact review. Assign shared work to a guest Editor with email and push enabled and receive exactly one of each without an approval queue; deliver a due-soon reminder, comment notice and daily digest with no internal-only field/comment, then mute/DND and verify the guest’s choices suppress or defer the expected notices. Exercise PEG-084’s unauthenticated-domain block, signed bounce/complaint suppression and throttle/restart cases for this email path without duplicate, silent-drop or false-delivered outcomes. Exercise PEG-037’s no-rule default last-blocker completion, replay/mute/reassignment/guest privacy cases through Inbox and configured channels. Existing evidence: none. Gap: No implementation exists for my tasks and useful notifications; the complete behavior and public-door acceptance journey remain required.

• PEG-010 — Collaboration with a complete history. Status: missing. Two browsers edit a brief and comment on a task, mention a teammate, attach a file and react. Inspect live updates, field-level actor/time history and conflicting edits after reconnect. A restricted guest's UI, API, exports and mention picker reveal only permitted content. Publish a project and team announcement to a reviewed audience, receive one in-app/email notification and reply in-thread from email. Embed each named media type in a brief and task context, revoke source access and confirm a restricted guest sees no protected preview or content; keyboard users can use the link alternative. Complete PEG-082’s task/comment limit, interruption and no-duplicate finalization cases. Measure 100 remote comment/brief edits per fixed profile, including a revoked reader and reconnect conflict, with p95 at most 2 seconds for online authorized views and no private payload. Existing evidence: none. Gap: No implementation exists for collaboration with a complete history; the complete behavior and public-door acceptance journey remain required.

• PEG-011 — Version-specific creative proofing. Status: missing. Review two versions of an image, PDF, video and webpage through Proofs at both widths. An external guest pins a comment on PDF v2, compares v1/v2 and approves v2; change the underlying file and observe old proof/approval retained with new review required, including unavailable-source and expired-share states. Use PEG-082’s 95-MB video timecode/frame and 80-MB PDF paths, a migrated 100-MB file re-uploaded as v2 and the current-version approval refusals. Existing evidence: none. Gap: No implementation exists for version-specific creative proofing; the complete behavior and public-door acceptance journey remain required.

• PEG-012 — Explainable local work rules. Status: missing. Build a conditional status-change rule through Settings, trigger it across two projects and inspect the run. Fail its provider webhook, restart, retry and replay the trigger; one local effect persists, failure/uncertainty is visible, scope denial is enforced and no rule signs a human approval or sends an unapproved external message. Have an Editor attempt rule/field/template configuration via UI and API and refuse each, then have an Admin configure an AI intake-classification step and a Slack/Teams internal-channel post. Inspect the permitted dropdown result and step input/output log, one internal post without per-message approval, and a pending outside-share/arbitrary external send or AI-produced date proposal; a fixed assignment/reminder notice to a current guest inside their share delivers without another approval. Trigger two rules for the same guest: one ordinary due reminder inside their share and one disclosure of an unshared task. The reminder sends once under their preferences; the unshared disclosure remains pending review with no payload delivered, and refusal remains if required access is not granted. At 1440/390 an Admin previews/activates one form rule (assign the fixed designer, due in five business days on the selected US holiday calendar) and one section-move rule (assign the fixed editor, due in two calendar days). Submit ten requests and move ten existing tasks: all twenty runs apply the expected dates/assignments once with no pending per-run approval, and every log names the activated version/Admin and exact source/computed values. Replay a trigger and restart mid-run without duplicate effects; undo one run, preserving a later human edit as a named conflict. Create template work and a meeting-agenda subtask two weeks before a custom event date under activation; inspect correct new-task dates, negative offsets, a holiday, DST/end-of-month policy and missing-date no-op. Edit the offset without reactivation and require the next run to wait; reactivate after preview, then apply once. Revoke the activating Admin and refuse a later run. Make a date change reach a hidden dependant outside the reviewed project scope: keep the unauthorized cascade (or its inseparable change set) pending without hidden data, and require that project’s authorized approval. An AI-extracted date, AI-chosen routing/template that determines a date/assignee, and an agent re-plan each remain pending exact review. Exercise every added action via builder and public API: complete an ordinary task, add one comment, add a permitted collaborator, multi-home one task, create one subtask and add one tag; compare one intended effect after replay/restart and scoped undo. Refuse approval-task auto-signoff, hidden-project multi-homing and a collaborator who would gain unreviewed access. Add a US company holiday used by 30 rules across permitted projects, including two unrelated-calendar/calendar-day controls. Preview all affected future dates once, bulk approve the unchanged authorized rows and resume their pending deterministic runs without per-run approval; controls and existing dates are untouched. Change one rule or revoke one project grant between preview/apply and hold only that row. As an Editor follow Ask your project Admin, submit a rule suggestion and inspect the responsible person/request state, with UI/API config writes still refused. Import an Asana Editor who authored a rule, inspect source attribution and proposed project-Admin mapping, and activate only after the independently reviewed grant/activation. Existing evidence: none. Gap: No implementation exists for explainable local work rules; the complete behavior and public-door acceptance journey remain required.

• PEG-036 — Approval routing and external review custody. Status: missing. Route a creative proof through internal then external reviewers, deny an unauthorized reviewer, expire and revoke an external link, delegate a stage and submit changes. Inspect quorum, human identity, time and exact version; a stale tab or replay cannot approve a replacement asset or reveal other project content. Give an external approver a reviewed PDF-v2 share, advance to its configured reminder time and receive the ordinary proof reminder once without a per-message review. It identifies only their permitted version and safe fields; a hidden internal comment is absent and the decision remains pending until the human’s version-bound action. Existing evidence: none. Gap: No implementation exists for approval routing and external review custody; the complete behavior and public-door acceptance journey remain required.

• PEG-037 — Durable follow-up and delivery outcomes. Status: missing. Make an approval overdue, reassign it during a queued reminder, simulate provider rejection and lost acknowledgment, restart and then receive a valid reply. Inspect one correctly routed reminder, visible exception and stopped escalation after the actual decision; no duplicate send, muted notice or fabricated response appears. With a guest Editor and external proof approver on reviewed shares, deliver assignment email/push, due-soon/overdue and comment notices, a digest and an on-schedule proof reminder without per-message approvals. Inspect one intended notice per event/recipient/channel and no internal-only material; recheck a queued notice after revocation. In the same run keep an agent-drafted guest chase and an outside-share rule disclosure pending exact review, with no external payload submitted. Exercise PEG-084’s unauthenticated-domain block, signed bounce/complaint suppression and throttle/restart cases for this email path without duplicate, silent-drop or false-delivered outcomes. With no PEG-012 rule configured, give one waiting task two blockers and a member assignee. Complete the first: no Ready to start notice. Complete the last (including concurrent/replayed/out-of-order completion) and receive one default readiness notice opening that task. Reassign before a queued send, mute/DND or revoke access, and verify current-recipient delivery or suppression with no hidden dependency details. Repeat for a scoped guest and a hidden predecessor, reopen/add a blocker before dispatch to cancel obsolete readiness, then complete a fresh blocked-to-ready transition and receive only its current notice. No task/date/proof decision changes as a side effect. At the fixed 10k-task/500-member profiles, timestamp 100 ordinary notice events including a guest and Ready to start: every happy-path inbox notice is visible within 5 seconds and mail is provider-accepted within 60 seconds, without counting a skeleton/outbox row as visible delivery. Cross DND/digest/quota/auth/chosen-hold cases, inspect explicit deferral/deadline and resume timing, no duplicate send and no fabricated mailbox receipt. Existing evidence: none. Gap: No implementation exists for durable follow-up and delivery outcomes; the complete behavior and public-door acceptance journey remain required.

• PEG-072 — Reply to ordinary notification email. Status: missing. Generate an ordinary task/comment/approval notification and an announcement, reply from the verified authorized member address through the official-schema inbound mail door and read one comment with its attachment and original source ID. Replay it and test inline text amid quotes. Spoof the From address, forward the reply route to a stranger, revoke the member and use a Viewer’s address; each produces no comment, access grant or decision. Reply /complete and /reopen to an ordinary task notification as its authorized assignee and inspect one human-attributed state change per message; deny the same command from a Viewer. Reply “approved” or /complete to a proof approval email and keep its human approval pending until the explicit version-bound action. Exercise PEG-084’s unauthenticated-domain block, signed bounce/complaint suppression and throttle/restart cases for this email path without duplicate, silent-drop or false-delivered outcomes. Existing evidence: none. Gap: No implementation exists for reply to ordinary notification email; the complete behavior and public-door acceptance journey remain required.

• PEG-039 — Meetings become reviewed actions. Status: missing. Connect each meeting service at its official-schema boundary, ingest an authorized transcript with uncertain ownership and prepare actions. A person edits and approves them once through the meeting review page; tasks link back to the source, duplicate delivery does not duplicate work, and revoked access removes unavailable context from later agent reads. Existing evidence: none. Gap: No implementation exists for meetings become reviewed actions; the complete behavior and public-door acceptance journey remain required.

• PEG-013 — Portfolios that roll up truthfully. Status: missing. Create a two-level portfolio of 20 projects, including shared tasks and a private project. Change a blocker and completion through Tasks and see correct live rollups, at-risk flags and source drill-down; a limited stakeholder sees only authorized totals and no private project names. At a controlled clock, cross each default threshold independently, including exactly 20% overdue and just over seven days stale; observe the expected flag and reason, then resolve it and change the policy to inspect recalculation. Compare manual health separately. Inspect timeline/workload/dashboard tabs for the nested portfolio and confirm no double-counted work or hidden-project leakage. Existing evidence: none. Gap: No implementation exists for portfolios that roll up truthfully; the complete behavior and public-door acceptance journey remain required.

• PEG-014 — Goals and OKRs linked to execution. Status: missing. Create company/team/personal goals, complete linked work, update a numeric source and inspect computed progress and check-ins through Goals and API reads. Replay or age the numeric event, change permissions and inspect deduplication, stale labeling and restricted rollups. Existing evidence: none. Gap: No implementation exists for goals and okrs linked to execution; the complete behavior and public-door acceptance journey remain required.

• PEG-015 — Stakeholder status with a publishing decision. Status: missing. Draft an update from three projects, exclude a private risk from a client's version, approve and publish exact content to each channel. Inspect subscriber receipt outcomes and immutable published history; revise a source before approval and require a new review rather than publishing stale or private material. Generate an on-demand project and portfolio status draft for a chosen window, reject/edit one sourced assertion and publish as an authorized human. Confirm one publication decision, expected internal deliveries and a still-pending client version until its exact recipient/content review. Publish a project and portfolio update, add member and guest comments/replies at 1440/390, edit/correct the update and retain revision-bound conversation/notifications. Revoke a guest, replay an email/chat reply and refuse hidden/internal comments across UI/API/digest without changing the publication decision. Existing evidence: none. Gap: No implementation exists for stakeholder status with a publishing decision; the complete behavior and public-door acceptance journey remain required.

• PEG-016 — Capacity across all committed work. Status: missing. Overload a person across three projects, add approved time off and an unfilled role, then inspect week/day capacity. Compare a staffing scenario and reassign a task through Workload to clear the real overload. A stale HRIS feed shows unknown freshness and a hidden task does not leak its title. Without any integration, declare three local out-of-office days and a half day, inspect assignment/mention warnings, daily workload and an agent plan excluding unavailable capacity; cancel/extend the declaration with attributed history. Overlay approved Willow leave and verify union/no double subtraction and no private reason leak. For a 10-hour monday item assigned to two people, reconcile Split as 5/5 and Sum as 10/10 participant-hours while preserving a single 10-hour task estimate. For a ClickUp 3/7 per-assignee estimate preserve both allocations and total 10; a multi-homed task remains one allocation per person. Missing source semantics are an explicit reviewed choice/repair before any lossless workload claim. Existing evidence: none. Gap: No implementation exists for capacity across all committed work; the complete behavior and public-door acceptance journey remain required.

• PEG-017 — Task time and approved timesheets. Status: missing. Track and manually enter time across two tasks, reconnect an interrupted timer, submit/return/correct/approve a timesheet and attempt a forbidden edit. Export to each named time service and CSV through official-schema edges, then reconcile exact durations and project/task references without duplicates. Existing evidence: none. Gap: No implementation exists for task time and approved timesheets; the complete behavior and public-door acceptance journey remain required.

• PEG-018 — Included reporting and export. Status: missing. Build a dashboard over three projects, reconcile each widget with its source rows and download CSV/XLSX/PDF. Schedule an authorized email report over a DST transition, inspect one correct window and delivery result, then deny a private-data subscription and verify no count or export leaks. For every named widget, use a dated work history with added scope, completion, reopening and a removed task. Reconcile every point/bar/slice/number/table row and both burn curves to source events over the selected range, including a DST boundary; inspect unknown history instead of invented trend points. Schedule a report across DST and restart, record scheduled instant, generation, provider acceptance and controlled mailbox receipt and require at most 15 minutes lateness in the available-provider case. Fail the provider and inspect the overdue cause by the same deadline; no duplicate delivery or unapproved client publication is labeled on time. Exercise PEG-084’s unauthenticated-domain block, signed bounce/complaint suppression and throttle/restart cases for this email path without duplicate, silent-drop or false-delivered outcomes. Existing evidence: none. Gap: No implementation exists for included reporting and export; the complete behavior and public-door acceptance journey remain required.

• PEG-019 — Free guests and scoped client views. Status: missing. Share one client project with each guest role, preview their portal, approve an asset and remove a guest. Attempt internal record IDs, hidden fields, attachment URLs, exports and old links through UI/API; all refuse while the manager retains the historical signed decision and free-guest accounting. As a freelancer guest Editor, create a shared-project task, assign it within the shared participant set, complete assigned work, upload its deliverable and submit time. Refuse internal fields, unrelated projects, member enumeration and invitations through UI/API and email/chat actions; an assignee-only guest cannot edit a peer task, and comment-only/approve-only guests retain those exact limits. After the reviewed invite, assign a shared task to the freelancer and receive one email and push without another approval; receive a comment notice, due-soon reminder and digest omitting a planted internal-only field/comment. Queue another notice, revoke the share before send and prove it and its reply route are canceled. An agent-drafted chase to the same guest and a rule disclosure outside the share both remain pending exact review. Run PEG-082’s guest Editor and explicitly granted external proof-uploader web/iOS/Android cases; approve-only guests without that grant remain unable to upload or edit work. Existing evidence: none. Gap: No implementation exists for free guests and scoped client views; the complete behavior and public-door acceptance journey remain required.

• PEG-020 — Server-enforced roles and administration. Status: missing. Use a role matrix through real sign-in, task/project routes, API, exports and webhook registration. Change permissions while a user has an open tab and show immediate server refusal and an audit event; try to remove the last owner and expose private fields through aggregate/formula responses, with no unauthorized effect. Give one member Viewer on project A and Editor on B: deny A comments/edits via UI/API while B task edits pass. Give a Commenter direct and Editor team grant on B, observe Editor access, then revoke the team grant and require immediate Commenter restrictions. B Editor cannot edit rules/fields/templates/settings that B Admin can; personal/internal-only work remains undiscoverable through either grant. Exercise PEG-083’s join/request/approve/deny/expiry/replay/deactivation matrix and compare exact role/effective-grant audit rows across UI/API. Existing evidence: none. Gap: No implementation exists for server-enforced roles and administration; the complete behavior and public-door acceptance journey remain required.

• PEG-083 — Discoverable teams and accountable access requests. Status: missing. At 1440/390 browse/search all three team types as a new active member and guest. Join a public team at its configured Viewer default and open its team-visible project at that project’s stated default; no Admin or hidden-project access appears. Request a membership-by-request team with a message, receive email as its chosen Team Admin, sign in from that email and approve Editor; UI/API reflect only that reviewed scope immediately. Paste a private project link into Slack as a second member: its refused unfurl/page contains no private name/fields/counts but offers Request access; approve Commenter from the project Admin’s inbox and prove read/comment succeeds while edit/settings fail in UI/API. Repeat narrow task and private portfolio requests, delivery/decision through connected Teams and mobile, denial with a safe reason, and project-owner/team-Admin fallback without granting unrelated access. Choose each of Viewer/Commenter/Editor/Admin as an authorized delegator, refuse an unauthorized Admin delegation and inspect exact grants/audit/access-review rows. Concurrent duplicate submissions produce one pending request; expire it, replay approved/denied decisions, deactivate the requester, revoke the approver and change the previewed policy in separate cases: every stale action grants nothing. Mail GET/prefetch, forwarded or unsigned callbacks cannot approve. Compare invalid and undiscoverable target refusals/acknowledgments through UI/API/unfurls without private metadata or existence leaks. A guest sees no request option and cannot POST an internal request; a private no-project task creates no request, notification or grant, even when its ID is submitted. Import an Asana fixture containing all three team privacy types and all three project visibility levels, mixed defaults and direct/team/guest grants through PEG-046 and the full PEG-081 account journey; reconcile source/effective permissions, review staged audience decisions and repeat directory/join/refusal checks after cutover with no broadened share. Existing evidence: none. Gap: No implementation exists for discoverable teams and accountable access requests; the complete behavior and public-door acceptance journey remain required.

• PEG-021 — Enterprise identity and US custody. Status: missing. Qualify each named IdP using its official schema or sandbox, sign in under enforced SSO/MFA, then SCIM-deactivate a member and refuse every active session, token and mobile write within five minutes. Inspect actual deployment/storage/backup placement and configured processor routing rather than inferring US custody from an app URL. As a non-technical owner enable each Google/Microsoft method through the timed PEG-080 guide/live check, sign in an invited member and find their existing identity. Refuse an uninvited, unverified-email, wrong-tenant or wrong-issuer account and show the named connection/recovery link if the method is not ready. Existing evidence: none. Gap: No implementation exists for enterprise identity and us custody; the complete behavior and public-door acceptance journey remain required.

• PEG-022 — Native iOS and Android daily work. Status: missing. On real iOS and Android clients, open assigned work from push, comment and queue an approval offline. Reconnect for a valid sync, then repeat after an asset change and after deprovisioning; inspect conflict/refusal, no duplicate decision and no accessible revoked cache. Web screenshots alone do not satisfy this clause. On both real OS clients, cache the authorized project directory without opening project B, go offline, create a task in B, complete a cached task in A and change another due date. Reconnect and inspect exactly those three changes with one history each. Also create/edit a project, reopen work, change assignee/status/custom fields, attach a camera/photo item and read list/board/calendar/status/dashboard. Test denied reconnect, widget quick-add, dark appearance and lock-screen privacy with no unauthorized cache access. On stock iOS/Android devices, follow the public listing and installation invitation as PEG-079 requires, sign in to the fresh installation and receive a real assignment push; none of these steps asks the owner or member for developer tools or a developer account. On both native apps complete PEG-082’s exact-limit, interrupted-resume, pre-transfer oversized refusal and shared-proof upload cases. Existing evidence: none. Gap: No implementation exists for native ios and android daily work; the complete behavior and public-door acceptance journey remain required.

• PEG-079 — Public mobile apps and Run Edit Run push service. Status: missing. A tester with a stock iPhone and stock Android phone and no developer tools installs from the real public store listings, follows a fresh PEG-055 installation’s reviewed invitation/QR/URL, confirms its origin and signs in by native email link and each configured web IdP. The owner’s recording shows one Settings confirmation and no Apple/Google developer/signing/push-console step; receive one real assignment push per enabled device through the production relay and act directly on the installation. On every release also qualify the signed TestFlight/Play internal-testing builds against the declared oldest supported installation and a current edition; verify each app’s exact minimum value and the named upgrade message/refusal against an older installation. A relay fixture built from the published relay schema rejects unsigned, cross-key/cross-device, revoked and replayed attempts; capture only allowed payload fields, ID-only omission and no retained payload after forwarding, with no planted comment/customer/attachment content. Cross-installation invitation/code replay cannot read data; deprovision/sign out and confirm deregistration, stopped push, denied quick actions and inaccessible revoked cache. Test quiet hours and share revocation before queued delivery without duplicate notices. Existing evidence: none. Gap: No implementation exists for public mobile apps and run edit run push service; the complete behavior and public-door acceptance journey remain required.

• PEG-076 — Installable desktop access and notification control. Status: missing. Install the desktop web app on macOS and Windows from its actual browser door, quick-add a task, open an allowed task deep link and receive an assignment notification. Deny notification permission, mute/DND, revoke the session and inspect suppressed/private notifications and denied cached/deep-link reads. Switch light/dark/system, inspect the changed screens at 1440/390 and run the same keyboard/contrast/reflow checks; an app update preserves pending edits or shows a named conflict. Run PEG-082’s exact-limit/one-byte-over and interrupted upload on each installed desktop app, preserving one version across update/restart. Existing evidence: none. Gap: No implementation exists for installable desktop access and notification control; the complete behavior and public-door acceptance journey remain required.

• PEG-023 — Speed and continuity at buyer scale. Status: missing. Use the built app with the stated dataset and published timing method at both widths; measure loads/filters, edit during disconnect and concurrent remote change, reconnect and verify persisted work or an explicit conflict. Record actual timings and profile; a skeleton or cached empty list is not a pass. Measure both fixed device/network profiles with those sample counts and time origins at the 10k-task/500-member dataset; publish observed p95 cold/warm loads and filters, device/browser versions and shaping settings, with no skeleton/empty-cache shortcut. Any profile that exceeds the existing one-second/300-ms bars remains unmet rather than redefining the profile. Existing evidence: none. Gap: No implementation exists for speed and continuity at buyer scale; the complete behavior and public-door acceptance journey remain required.

• PEG-073 — Private personal work and a predictable day. Status: missing. Create a private no-project task and custom section through My Tasks, then search/read its ID as owner, another member and an administrator’s ordinary session: only the owner succeeds. Inspect default order using overdue, today, equal-date priorities, next-seven-day and no-date tasks; mark Today manually and compare with the stated tie breakers. Advance local midnight across DST so due-tomorrow work promotes once, set a manual section rank, reconnect and verify persistence. Adding the private task to a project requires a visibility preview and grants only the reviewed access. Existing evidence: none. Gap: No implementation exists for private personal work and a predictable day; the complete behavior and public-door acceptance journey remain required.

• PEG-032 — People leave without orphaning work. Status: missing. Remove a manager with active projects, queued sends and pending approvals through Admin. Review each affected set, transfer work and inspect revoked sessions/keys, canceled old sends, new accountable owners and preserved history; a concurrently added assignment forces a fresh review. Existing evidence: none. Gap: No implementation exists for people leave without orphaning work; the complete behavior and public-door acceptance journey remain required.

• PEG-045 — Identity lifecycle and access review. Status: missing. Provision and move a user between IdP groups, map a restricted role, invite an external guest and inspect the access review. Deactivate/reactivate the user, revoke an app and transfer installation ownership; old sessions, API/MCP keys, proof links and personal automations stay invalid until explicitly renewed. Deactivate/reactivate a pending requester and revoke a pending approver, then refuse their stale access decisions and inspect the access review. Existing evidence: none. Gap: No implementation exists for identity lifecycle and access review; the complete behavior and public-door acceptance journey remain required.

• PEG-025 — Calendars and task time blocks. Status: missing. Through Calendars, schedule a task into free time on each provider using Google event and Microsoft event schema edges. Move/delete the event, cross DST and simulate a simultaneous task edit; inspect exact mapping, preserved deadline, conflict state and one event after replay/reconnect. Subscribe Apple Calendar and a second ICS client to a selected project/My Tasks feed, update a due date and cancel a task, then inspect stable UID and correct dates/cancellation without duplicates. Revoke the feed/share, require failed later fetches and verify no hidden task/field or raw capability enters logs or archives; acknowledge previously cached client copies explicitly. Existing evidence: none. Gap: No implementation exists for calendars and task time blocks; the complete behavior and public-door acceptance journey remain required.

• PEG-026 — The full integrations hub. Status: missing. Install every named adapter through the hub and exercise its named job in PEG-007/008/016/017/021/025/039–045: source event/read → allowed Pegboard effect → provider acknowledgment or authorized return update. Also execute Zapier, Make and Crank task-create/task-change webhook recipes and a Willow time-off update. For each, record schema/sandbox or live-account qualification, denial, disconnect and reconciliation; no unchecked listing passes. Qualify PEG-071’s chat and mail round trips and each PEG-077 service’s declared journey, including rejection/revocation/replay, rather than treating capture or an integration logo as sufficient. Complete all four provider guides against official-schema network edges plus one live connection for each, then use each sign-in/chat/mail/calendar/file door required by PEG-080. A disconnected subfeature explicitly names the missing connection and guide rather than presenting a nonfunctional control or silently dropping a chase. Find/connect both PEG-085 public apps and run the native-template/live-account journeys in addition to the retained webhook recipes; unapproved/private listings remain unmet. Existing evidence: none. Gap: No implementation exists for the full integrations hub; the complete behavior and public-door acceptance journey remain required.

• PEG-080 — Guided owner-registered provider apps and first live connection. Status: missing. At 1440/390 the PEG-055 non-technical tester completes four timed browser-only walkthroughs using official-schema provider fakes, then one live Slack workspace, one live Teams tenant, one live Google Workspace and one live Microsoft 365 connection, each within its 15-minute bar. Begin without the provider apps/clients already registered and retain registration/package/consent and signed callback/test evidence without secrets. After Slack setup, an invited member links their own account and comments/completes one task from Slack. After Teams setup, install its generated tenant app and receive/act on a task notice. After Google setup, an invited verified member signs in and uses Calendar, the deployed Gmail sidebar and Drive; after Microsoft setup, do the same for Microsoft sign-in, Outlook Calendar/sidebar and OneDrive. Uninvited and cross-tenant identities are refused and member setup-management attempts are denied. Disconnect each feature, visit every named dependent surface and trigger its chase/job, and verify the specific missing-connection guide state, no provider call or false successful job, ordinary work continuity and safe single resume after repair. Repeat denied consent, bad redirect, missing scope, admin app-policy rejection, expired client and origin change without inventing success or restarting a duplicate registration. Invite a Gmail guest and a guest from a second Workspace domain. With an Internal-only client show the named restriction and complete native sign-in; configure/qualify External access through the guide and sign each into the same invited identity, refusing an uninvited/wrong-subject account. Simulate Google publication/test-user/consent restrictions with official schemas and inspect recoverable native access, not a broken invite. For Microsoft, measure a fast live connection against the original 15-minute wall clock; separately simulate an add-in unavailable for 24 hours after successful tenant submission. Show pending propagation with owner-work and wall times, preserve ordinary work/native mail sign-in, perform the real sidebar test when it appears and record that this delayed run did not meet the 15-minute qualification. Never count the submitted manifest alone as a working sidebar. Existing evidence: none. Gap: No implementation exists for guided owner-registered provider apps and first live connection; the complete behavior and public-door acceptance journey remain required.

• PEG-071 — Work inside chat and mail tools. Status: missing. In each installed Slack/Teams/Nook app, unfurl a task, list My Tasks, query a permitted project, comment, complete/reopen, assign and preview/apply a due-date change under current rights. Link a project feed and receive one personal notification and one rule-triggered internal-channel post without per-message approval. Human-approve PDF v2 in chat, replace it with v3 and refuse the old button/replay. Revoke the actor and inspect refusal and non-leaking private unfurls. In both Gmail and Outlook sidebars create a task from an open email with all mapped fields, enable reply sync, deliver/replay a later reply and see one source-attributed comment/attachment; stop sync, revoke mail access and verify no subsequent ingest or automatic external share. Receive a fixed personal assignment/proof notice as a scoped guest without per-message approval in each configured chat adapter; remove the share and cancel a queued notice. Keep an agent-composed guest chase and a feed/rule post to a client-shared channel pending exact review even when the guest can see the source task. Start with unconnected Slack/Teams/Gmail/Outlook and inspect explicit connection/guide states at each tool entry point and Pegboard action door; finish PEG-080’s guide and first live test, link a member account and perform the actual in-tool actions. Revoke the client, keep the intended action visible as blocked and reconnect without a duplicate task/comment or disclosure. Run PEG-083’s Slack refusal-to-request/inbox approval and Teams request/decision, compare guest/invalid/private-task refusals and reject replayed or unmapped decision callbacks. Existing evidence: none. Gap: No implementation exists for work inside chat and mail tools; the complete behavior and public-door acceptance journey remain required.

• PEG-085 — Published Zapier and Make apps for every installation. Status: missing. In real Zapier and Make accounts find Pegboard in the public directory/catalogue, record Run Edit Run’s publisher identity/listing/version and create a native Pegboard connection to each of two separate owner-run installations through its address plus scoped credential guide. A buyer writes no generic webhook URL, custom JavaScript or JSON payload for the native cases. From published templates/blueprints, map a Google Sheets/form request into one task, react to its change/completion into one permitted Slack/external record update and add a comment/subtask through each platform’s native modules; exercise every listed trigger/search/action with source IDs and a limited project/field set. Use official-schema platform/network fakes for throttle, polling checkpoint gap, duplicate/out-of-order delivery, lost acknowledgment and restart, and separately qualify the same round trip live in both platforms. Revoke/rotate credentials and show an actionable failed/reconnect state, preserve event watermarks and resume each still-authorized effect once. Refuse a hidden project/field, wrong installation, unsafe base address, redirect to another origin, unauthorized share/proof decision and AI-produced date action without exact human approval. Rebuild a representative inactive Asana Zap and Make scenario using PEG-046/081’s mapped local IDs, compare trigger/field/output mappings and activate only by the authorized buyer’s explicit action. Compare actual required platform plans/classification/task credits with the estimate; a private/unapproved app or generic Webhooks/HTTP workaround leaves this distribution clause missing. Existing evidence: none. Gap: No implementation exists for published zapier and make apps for every installation; the complete behavior and public-door acceptance journey remain required.

• PEG-027 — Public API, events and MCP. Status: missing. Using the published OpenAPI and MCP doors, create/update a task, paginate a project, read a report and receive a signed task event. Connect each named client, deny out-of-scope access, stale edits, expired credentials and forged webhooks; replay a valid event without duplicate effects and refuse an agent attempt to approve itself. List a personal task as its owner and deny the same ID to an administrator’s ordinary key; try a guest-editor mutation and Viewer comment, proving transport-independent permission results. Existing evidence: none. Gap: No implementation exists for public api, events and mcp; the complete behavior and public-door acceptance journey remain required.

• PEG-038 — Connector failures are recoverable work. Status: missing. Through an installed connector, create work while its provider returns 429, later 401 and then loses a response; restart Pegboard, reconnect and replay events out of order. Inspect visible health and exact per-object outcomes, one intended effect, retained later edits, no leaked credential and no false delivered state. Change the installation origin or rotate a provider client secret during a timed-setup fixture, repair exact callbacks/manifests through the saved guide and require a new live event/test before connected status. Preserve source links and queued action identity, and expose unresolved provider-policy failures. Existing evidence: none. Gap: No implementation exists for connector failures are recoverable work; the complete behavior and public-door acceptance journey remain required.

• PEG-040 — Engineering handoff without a second issue tracker. Status: missing. Link one campaign dependency to each of Vector, Jira and GitHub, update its source status and reconcile it in Pegboard, then return an authorized mapped update. Deny an unmapped closure, revoke a source grant and replay the event; retain one link, visible stale state and a still-pending human launch approval. Existing evidence: none. Gap: No implementation exists for engineering handoff without a second issue tracker; the complete behavior and public-door acceptance journey remain required.

• PEG-041 — Commercial and service work becomes delivery. Status: missing. For each of the six source products, deliver a qualifying event through its authorized schema edge, review/adopt one project and return a permitted delivery-status update. Replay, reopen, decline the handoff and fail the return write; inspect one project, source identity, restricted customer fields and accountable unresolved exception. Existing evidence: none. Gap: No implementation exists for commercial and service work becomes delivery; the complete behavior and public-door acceptance journey remain required.

• PEG-042 — Reconciled time handoff to specialist systems. Status: missing. Export an approved timesheet to each named service using its official schema/sandbox, including QuickBooks Time's official API reference. Reject an unknown job code, fix its mapping and resume; replay and adjust an entry and verify one acknowledged entry plus a traceable correction, exact hours and no invoice or payroll action. Using Gauge’s actual public reviewed import/API door or its official-schema edge, map the Asana handoff into finance drafts and compare exact amounts, currencies, dates, billable flags and frozen approved-time provenance. Receive per-type IDs/acknowledgments, replay without duplicates, refuse unsupported mappings visibly and retain the full pending/exportable packet until repaired; no invoice or new approved budget is issued. Existing evidence: none. Gap: No implementation exists for reconciled time handoff to specialist systems; the complete behavior and public-door acceptance journey remain required.

• PEG-043 — File and creative-tool continuity. Status: missing. Through each named file provider, attach a permitted file, deny an unauthorized file and replace/revoke the source. Through Figma, Canva and an installed Adobe panel, open a brief, submit an asset and read its review result. Inspect exact version and return update, no broadened share and a clear unavailable state after revocation. Open Files on a project with multi-task attachments, two proof versions and one internal-only asset; inspect one entry per permitted source version and its task links, filter/open the proofs and compare member versus guest counts and denied-source states. Complete PEG-082’s upload/provider-link refusal and Base R2 round trip, then compare permitted Files entries and version digests. Existing evidence: none. Gap: No implementation exists for file and creative-tool continuity; the complete behavior and public-door acceptance journey remain required.

• PEG-077 — Agency and operations service handoffs. Status: missing. Install each service and use its actual supported sandbox or official-schema edge: refresh a three-project Google Sheet after edit/deletion and revoke its grant; view/revoke each named embed; create a task from a selected Miro item and follow its backlink; escalate/replay a ticket from each of Zendesk/Freshdesk/Intercom and return one internal progress note. Human-approve one DocuSign envelope handoff, verify signed/declined/voided events, reject a forged event and leave an unapproved send pending. Process Calendly booking/reschedule/cancel without duplicate tasks or calendar events. For every service inspect denied scope, source deletion/revocation, unavailable state and reconciled outcome; external disclosure never bypasses recipient review. Existing evidence: none. Gap: No implementation exists for agency and operations service handoffs; the complete behavior and public-door acceptance journey remain required.

• PEG-044 — BI without private-data shortcuts. Status: missing. Connect each BI tool using its supported connector protocol, build a three-project report and compare exact counts/durations with the same Pegboard snapshot. Incrementally update and erase a task, refresh and inspect removal, then revoke the key and deny hidden fields and cached new fetches. Existing evidence: none. Gap: No implementation exists for bi without private-data shortcuts; the complete behavior and public-door acceptance journey remain required.

• PEG-074 — Ask, summarize and use AI in rules. Status: missing. Through Ask, query “what’s blocking the launch?” as a limited member, summarize a 60-comment task thread and a date-bounded project/portfolio, and compare each answer’s factual claims/citations with only authorized rows. Deny a named private project and remove access mid-request; output and retained answer reads must exclude revoked data. Create an AI rule step that classifies a known intake request into an allowed dropdown, extracts a date and drafts a comment; inspect input/output logs and one permitted application. Return an out-of-schema category or injected approval instruction from the model edge and inspect visible refusal without extra writes or disclosure. An ordinary summary or status draft cannot auto-publish to clients/executives. On the explicit no-AI installation, visit every named entry point at 1440/390 and invoke its public API/job door: inspect the exact no-model message and connection link, structured blocked reason, zero inference calls, no invented output and retained pending work. Revoke a working model credential, invoke Ask, a summary/status draft, an AI rule step and assigned teammate, and inspect visible recoverable failures with ordinary task/edit/guest-notification journeys still passing. Reconnect through the link, pass a live test and resume once with current scope, logged model/budget and no duplicate task change or send. Extract a date and choose a routing/template with AI, feed each into a later deterministic step and require exact human schedule/assignment approval before applying; a fixed non-AI rule in the same fixture applies immediately under its reviewed activation. Existing evidence: none. Gap: No implementation exists for ask, summarize and use ai in rules; the complete behavior and public-door acceptance journey remain required.

• PEG-075 — Define and govern a custom teammate without code. Status: missing. As Admin, build a marketing-copy teammate with named style knowledge, allowed task/comment tools, assignment and scheduled triggers, a PEG-028 rubric and cost cap; dry-run with the actual configured model edge, review and activate it. Trigger one task from assignment and one rule, replay the trigger and inspect exact versioned inputs, output and cost/action log. As Editor attempt instruction/trigger changes and refuse them; revoke the style source, change the instructions, disable mid-run and verify no new out-of-scope read, paid action or stale-version write. Choose “continue without AI,” save a disabled custom teammate and attempt dry-run/activation: inspect “No AI model connected,” the connection link and no paid call or task mutation. Connect/retest a permitted model, then explicitly activate and run the same version with observable usage; revoke its credential and inspect the named recoverable blocked state. Existing evidence: none. Gap: No implementation exists for define and govern a custom teammate without code; the complete behavior and public-door acceptance journey remain required.

• PEG-024 — Migration as a complete buyer journey. Status: missing. Through Import, ingest a real authorized Asana export augmented with official-schema API data for comments/files and compare sections, custom fields, dependencies, comments and attachments. Inspect per-record failures and unmapped data, apply once, re-import and undo without removing later native edits. Complete every source-specific journey below before claiming migration parity. Alongside the retained file-import cases, have the non-technical owner start the whole-account Asana API job in PEG-081, approve its estimated scope/time, interrupt/resume it and complete account-wide reconciliation and the reviewed invitation/delta cutover. Complete both PEG-047/048 full-account fixtures in addition to their retained export/small-source journeys. Existing evidence: none. Gap: No implementation exists for migration as a complete buyer journey; the complete behavior and public-door acceptance journey remain required.

• PEG-046 — Asana account migration. Status: missing. In Import Asana, migrate a campaign already in approval and a 20-project portfolio from real export and official-schema paginated source reads. Compare identity counts, shared tasks, dates, custom fields, dependency graph, author/time history and file digests; source export omissions appear in the fidelity report and block an unqualified complete-cutover decision. Migrate an Asana project containing tags, branching intake, a brief and key resource, Messages/replies, a task template, saved search/chart, My Tasks sections and Viewer/Commenter/guest-editor grants. Compare per-type/source-ID counts for every listed item; each is mapped or appears in an explicit counted rebuild item, and no form/share silently disappears or activates. Paste migrated Asana task/project URLs through search and the public resolver door, including a multi-homed task, and reach the correct local ID. Repeat as a restricted guest and refuse without revealing hidden names; an unmapped URL yields the authorized repair item without creating work. Run PEG-081’s Advanced-tier account fixture through the browser in addition to this 20-project/export journey; reconcile every source type and file digest across 300 active/archived projects, 85 members and 40 guests, then apply an edited-source delta and reviewed bulk member invitations without silent shares/sends. Add all three team privacy types and all three project visibility levels with mixed defaults to both source-export and PEG-081 fixtures; reconcile source settings and staged/effective grant paths, then repeat PEG-083 discovery/join/request checks after reviewed cutover. Import rule-author/Editor metadata plus approved time, billable flags, rates and a USD project budget. Compare hours/approval/source IDs in Pegboard and exact financial artifacts in the restricted handoff, review project-Admin elevation separately and reject unreviewed activation. A non-finance guest cannot read amounts; when Gauge is unavailable the manifest stays pending with counts and an exportable repair packet. Existing evidence: none. Gap: No implementation exists for asana account migration; the complete behavior and public-door acceptance journey remain required.

• PEG-081 — Whole-account Asana extraction and accountable cutover. Status: missing. The PEG-055 non-technical tester uses only browser setup/OAuth to migrate an authorized Asana Advanced account or an official-schema network-edge fake with at least 300 active/archived projects, 85 members, 40 guests, multi-homed tasks, portfolios/goals, multi-year comments and at least 10 GB of actual streamed attachment bytes. The fake rejects Enterprise+ organization export, enforces 1,500/minute token quota, five-job limit where relevant, documented search/read/write concurrency limits and 429/Retry-After, and includes expired cursors/token refresh/expiring attachment URLs; retain a separate scheduler case that reaches the five-job boundary even if the main path uses no export jobs. Show the owner a preflight estimate, pause/interrupt the actual extraction and receiver, resume after restart and compare per-type IDs/counts, graph edges, identity/permission mappings and every stored file’s digest/byte count across the full account. Fail one blob, inspect named unresolved custody, reacquire/repair it and reconcile before success; a declared Content-Length or synthetic metadata counter cannot substitute for transferring/digesting the 10-GB corpus. Edit source records/files/permissions and native work during a delta pass, inspect conflicts and updated totals and complete or roll back the reviewed cutover without lost native edits or repeated effects. Review and bulk-invite 85 mapped members plus chosen guest shares, compare one decision/delivery per invitation, skip matched members, reject a changed-address row and prove unreviewed identities receive nothing. Record screen/timestamp evidence, measured requests/bytes/rates, retries/throttled time and total elapsed versus the saved estimate; require accurate unresolved status or estimate-overrun explanation rather than an unmeasured speed claim. Include every Asana team privacy/project visibility type with mixed default roles and source grants across the 300-project account. Compare settings/counts before review and effective discovery/default access after approved cutover; no private team/project becomes discoverable inadvertently. Upload a migrated exact-100-MB file as proof v2 through PEG-082 and require fresh current-version review. Run PEG-084’s 125-person mail-capacity queue at this source’s reviewed cutover, including one suppressed address, a corrected/re-reviewed row, provider throttle and restart; reconcile each invitation to one accepted or visible failed outcome with no unreviewed send. Existing evidence: none. Gap: No implementation exists for whole-account asana extraction and accountable cutover; the complete behavior and public-door acceptance journey remain required.

• PEG-047 — monday.com account migration. Status: missing. Migrate an active multi-board campaign with subitems, cross-board links and private client work. Inspect mapped values, supplemental updates/files, reconstructed dependencies and reconciled board/dashboard counts; repeat after source changes and retain one mapped record with conflicts and source-only omissions visible before cutover. Include labels, a form, brief, saved view/report and mixed member/guest grants in this source migration fixture; compare per-type counts and reconstruction decisions, inspect every held item and require a resolved or explicitly accepted loss before cutover. In addition to the retained smaller fixture, a non-technical tester completes browser OAuth and a full source-account run at 1440/390 against an authorized source account or official-schema network-edge fake, with at least 300 active/archived work containers, 85 members, 40 guests, multi-year comments/history and at least 10 GB of actually transferred/digested file bytes. Show/save the preflight estimate; throttle requests, expire a credential/file URL, interrupt extraction and the receiver, restart/resume, repair a failed blob and compare every type/ID/count, edge, identity/permission/time total and stored file digest across the account. A metadata-only 10-GB counter cannot pass. Change source records/files/grants and native work during a repeat delta; inspect conflicts and complete or roll back without losing native changes or replaying effects. Review/invite 85 mapped members and 40 chosen guest shares once, skip matched locals, invalidate a changed address/role and prove unreviewed rows receive nothing. Record measured requests/bytes/rates, throttle/retry time and elapsed versus the saved estimate and explain overrun/unresolved work honestly. For monday.com the 300 containers are boards spread across multiple workspaces, including private/shareable and archived boards, archived items/subitems, connected-board links, formula/mirror definitions, updates/files and dashboards. Include more than one item page and board page. The fake enforces the documented Pro plan daily/minute/app-token complexity/concurrency limits and retry timing, active-only items_page behavior and separately authorized archive-list capture plus official ID reads; a separate live authorized archive-list capture proves the browser door without fabricated archive APIs. Require archived source IDs/bytes and mixed source grants in reconciliation, with missing archive capture visibly unresolved rather than silently skipped. No per-board export or source unarchive is required. Run PEG-084’s 125-person mail-capacity queue at this source’s reviewed cutover, including one suppressed address, a corrected/re-reviewed row, provider throttle and restart; reconcile each invitation to one accepted or visible failed outcome with no unreviewed send. Add a multi-assignee source fixture, select the one accountable owner and preserve every remaining person/ID as a scoped collaborator/allocation. Exercise PEG-016’s monday 10-hour Split (5/5) and Sum (10/10), and ClickUp 3/7 estimates on a shared task. Compare every person/week total, task estimate/count and membership edge with the source-defined semantics, re-run without duplicates and inspect an explicit allocation-repair item when the source setting is absent. No source assignee is lost or silently invited and a changed interpretation cannot be called an exact workload match. Existing evidence: none. Gap: No implementation exists for monday.com account migration; the complete behavior and public-door acceptance journey remain required.

• PEG-048 — ClickUp workspace migration. Status: missing. Migrate an agency workspace with a shared-list task, approved timesheet, private asset and linked document/whiteboard. Compare IDs, nesting, status history and time totals, verify attachment bytes or named unresolved custody, and inspect the reviewed Slate/Nook handoff without granting imported guest access. Include labels, a form, brief, saved view/report and mixed member/guest grants in this source migration fixture; compare per-type counts and reconstruction decisions, inspect every held item and require a resolved or explicitly accepted loss before cutover. In addition to the retained smaller fixture, a non-technical tester completes browser OAuth and a full source-account run at 1440/390 against an authorized source account or official-schema network-edge fake, with at least 300 active/archived work containers, 85 members, 40 guests, multi-year comments/history and at least 10 GB of actually transferred/digested file bytes. Show/save the preflight estimate; throttle requests, expire a credential/file URL, interrupt extraction and the receiver, restart/resume, repair a failed blob and compare every type/ID/count, edge, identity/permission/time total and stored file digest across the account. A metadata-only 10-GB counter cannot pass. Change source records/files/grants and native work during a repeat delta; inspect conflicts and complete or roll back without losing native changes or replaying effects. Review/invite 85 mapped members and 40 chosen guest shares once, skip matched locals, invalidate a changed address/role and prove unreviewed rows receive nothing. Record measured requests/bytes/rates, throttle/retry time and elapsed versus the saved estimate and explain overrun/unresolved work honestly. For ClickUp the 300 containers are active/archived Lists across multiple Spaces and Folders with folderless Lists, archived/closed tasks, deep subtasks, a task in multiple Lists, custom item fields/statuses, comments/files, goals, time entries and private guest assets. Include more than 100 tasks in a List so paging is compulsory. The fake enforces the documented Business plan 100-requests/minute token limit, 429/reset headers, zero-based task paging and default omission of closed/subtask/multi-list work; only explicit traversal can reconcile every source identity/List edge. Include reviewed task-linked content and the existing counted Slate/Nook handoff without inventing missing source data or granting imported access. Run PEG-084’s 125-person mail-capacity queue at this source’s reviewed cutover, including one suppressed address, a corrected/re-reviewed row, provider throttle and restart; reconcile each invitation to one accepted or visible failed outcome with no unreviewed send. Add a multi-assignee source fixture, select the one accountable owner and preserve every remaining person/ID as a scoped collaborator/allocation. Exercise PEG-016’s monday 10-hour Split (5/5) and Sum (10/10), and ClickUp 3/7 estimates on a shared task. Compare every person/week total, task estimate/count and membership edge with the source-defined semantics, re-run without duplicates and inspect an explicit allocation-repair item when the source setting is absent. No source assignee is lost or silently invited and a changed interpretation cannot be called an exact workload match. Existing evidence: none. Gap: No implementation exists for clickup workspace migration; the complete behavior and public-door acceptance journey remain required.

• PEG-049 — Wrike creative-work migration. Status: missing. Migrate a creative project between PDF v1/v2 approval rounds with time entries and a Gantt baseline. Compare source attachment digests, annotations and decision attribution, then continue review in Pegboard on the correct version. The report names every absent pin/approval artifact or unsupported mapping and the buyer approves its resolution before cutover. Existing evidence: none. Gap: No implementation exists for wrike creative-work migration; the complete behavior and public-door acceptance journey remain required.

• PEG-050 — Motion work and calendar migration. Status: missing. Extract an active Motion project through the documented source API, including an unscheduled overloaded task and a moved calendar block. Preview and approve owners, deadline versus time-block mapping and recurring behavior; compare counts/effort with the source and reconnect calendars without duplicate events, copied credentials or automatic unapproved rescheduling. Existing evidence: none. Gap: No implementation exists for motion work and calendar migration; the complete behavior and public-door acceptance journey remain required.

• PEG-051 — Dart workspace migration. Status: missing. Migrate two Dart spaces with custom properties, a dependent task and an agent-owned draft. Reconcile raw records and file availability, rebuild a saved business view, inspect linked engineering handoff and refuse imported bot authority. Re-import a changed task and report the conflict without cloning it. Existing evidence: none. Gap: No implementation exists for dart workspace migration; the complete behavior and public-door acceptance journey remain required.

• PEG-052 — Taskade project and workflow migration. Status: missing. Migrate multiple Taskade projects with nested tasks and agent/automation references, reconcile exported and API-visible records and identify absent history/assets explicitly. Continue one business project in Pegboard, inspect the approved sibling handoff and show that imported automations or paid/external actions cannot run until freshly authorized. Existing evidence: none. Gap: No implementation exists for taskade project and workflow migration; the complete behavior and public-door acceptance journey remain required.

• PEG-053 — Trello, Smartsheet and spreadsheet migration. Status: missing. Import a live Trello campaign export, a Smartsheet dependency sheet and US CSV/XLSX work files through Import. Compare hierarchy, deadlines, files and graph edges, fix an ambiguous date and unmapped owner, inspect a named history limitation and re-run without duplicates; unrelated database sheets are handed to Cradle with an explicit report. Existing evidence: none. Gap: No implementation exists for trello, smartsheet and spreadsheet migration; the complete behavior and public-door acceptance journey remain required.

• PEG-054 — Mid-stream cutover, reconciliation and rollback. Status: missing. Run a two-pass cutover of an active campaign for every source in PEG-024, create changes on both sides, interrupt/resume apply and compare source/project/task/file/time totals and exact residuals. Approve cutover only after resolved or explicitly accepted named losses; exercise rollback with native edits and demonstrate no lost work, broadened share or replayed notification. Review a migration with 40 guests, bulk-adopt the compatible staged shares and individually correct a Viewer/Editor conflict and internal-field exception. Change a source/local share before Apply; require fresh review for that exception, no broadened scope and one auditable decision per applied grant. Review 85 mapped members and 40 guests at account cutover, approve chosen invitations/share adoptions and change one source address after review. Only current approved recipients get one invitation, matched local identities are not recreated and the changed row requires re-review while full-account delta totals/rollback remain reconcilable. Run the source-specific 300-container/85-member/40-guest/10-GB cases for monday.com and ClickUp, preserving native edits and current invitation decisions on resume/delta/rollback. Run PEG-084’s 125-person mail-capacity queue at this source’s reviewed cutover, including one suppressed address, a corrected/re-reviewed row, provider throttle and restart; reconcile each invitation to one accepted or visible failed outcome with no unreviewed send. Existing evidence: none. Gap: No implementation exists for mid-stream cutover, reconciliation and rollback; the complete behavior and public-door acceptance journey remain required.

• PEG-055 — Owner-run Cloudflare installation through Base. Status: missing. Starting with an empty authorized Cloudflare account, install via documented Base steps, configure mail/domain and sign in as the first owner. Create a project, upgrade the deployed Worker and recover from an interrupted upgrade; work/history remain intact and an unconfigured installation or unauthenticated public route reveals no workspace data. A non-technical tester using only a browser starts with an empty authorized Cloudflare account, reviews the estimate, completes mail-verified setup, sends two reviewed invitations and creates the first project in under 30 minutes of elapsed time; keep start/end timestamps and a screen recording including provider waits. A built-in verified web URL can establish owner setup/first use while custom web DNS remains visibly pending; invitation/sign-in/notification mail still waits for PEG-084’s separately authenticated sender and a passing evaluated sender authentication outcome; platform placement checks remain advisory unless the owner expressly enabled a hold. Separately inject each missing grant, billing prerequisite, mail failure, DNS error and failed model connection/test, follow its browser recovery and resume without duplicate data; if a provider delay exceeds the bar, the run is not called passed. During the same under-30-minute browser-only run, connect the chosen model, pass the real live test, ask a cited question about the first project, summarize an authorized seeded thread and generate a status draft; compare logs to model/configuration revision and the USD budget. Separately complete a fresh timed run only by explicitly choosing “continue without AI” and inspect the actor/time record plus “No AI model connected” and Connect model link on Ask, summaries/status drafts, AI rule steps and agent teammates. Verify missing/failed model, invalid credential, failed inference, denied processor consent or budget failure cannot pass setup without a successful retest or that explicit recorded choice. The 30-minute bar counts as met only with the passing model test or the recorded choice as well as all other setup outcomes; provider/model waits remain inside elapsed time. From the fresh setup completion screen, open Mobile, Connections and Asana migration; verify the owner can follow the named guides with the exact generated installation address/values and separate measured provider clocks, while unfinished connections have explicit states. Record that no mobile signing or Apple/Google developer-account step appears in the owner journey. Present a valid and forged release/security notice, inspect applicability and guide, enable a bounded automatic security-patch window and apply one eligible signed patch after backup. Reject a forged/incompatible/out-of-policy update, simulate failure and recover with intact work and an owner-visible result; no secrets or new grants arrive via the update. Complete PEG-084’s evaluated sender-authentication checks plus PEG-086 recovery enrollment in the same timed setup, send the two reviewed invitations/sign-in links to the platforms actually used and offer placement help without blocking the buyer on it. Retain the separate real Gmail/Microsoft 365 product qualification without imposing it on every buyer. A fresh sender whose DMARC would fail cannot pass mail-verified setup or send invitations; an isolated missing DKIM with valid aligned SPF, or failed SPF with valid aligned DKIM, remains a warning while DMARC passes; show the named records and repair, and retain all provider waits inside the 30-minute bar. Inspect the complete Run Edit Run/provider quote before any spend decision. Finish with four unprobed gateway/consumer guests as PEG-084 requires, then demonstrate the separate chosen-hold/manual-release path without changing the 30-minute basic setup bar. Existing evidence: none. Gap: No implementation exists for owner-run cloudflare installation through base; the complete behavior and public-door acceptance journey remain required.

• PEG-084 — Authenticated mail and a cutover that reaches inboxes. Status: missing. On a fresh Google-only installation, evaluate/show SPF/DKIM/DMARC and invite one guest each behind official-schema Mimecast and Proofpoint MX routes and at iCloud and Yahoo, without having a probe mailbox on those platforms. With default settings all four invitations and subsequent sign-in mail dispatch under passing authentication, labeled placement not confirmed; a Google/Microsoft licence or consenting gateway mailbox is never required. Then opt into Hold until probed, queue a fresh recipient per platform and release each with one audited owner/Admin decision; all four become provider-accepted once without new membership/share identity. Follow an ordinary task link as one recipient and accept/sign in as the others; record Received by a recipient on each path, without claiming Inbox placement or treating a GET/scanner as an authenticated session. Simulate one gateway quarantine: invitation age increases, copy the complete domain/IP-range/include/DKIM-selector IT request, allow-list through the controlled provider edge and resend once with one active invitation. A held guest and unknown/inactive addresses receive identical delayed-sign-in notices on web and both native apps. Product qualification separately retains actual probes, reviewed invitations and sign-in links in real Gmail and real Microsoft 365 Inboxes with trusted SPF/DKIM/DMARC-pass headers; the buyer can finish setup with placement unconfirmed. With Google, Microsoft and Other recipients, add another sender’s SPF include, move DMARC from p=none to quarantine/pct=25 and reject, and change rua/ruf; after each passing evaluation request zero placement re-checks and hold zero invitations/notices/sign-in mail, showing changed; still passing. Change provider/From/signing identity with passing authentication: ask for advisory re-checks and keep all mail flowing; the optional hold remains visibly owner-chosen and releasable. Restore against DNS with only unrelated includes/policy/report-address differences and reuse evidence without probes or automatic holds. Remove the SPF include/exceed its lookup limit while aligned DKIM still passes: warn but send normally. Break all aligned mechanisms so DMARC actually fails, confirm twice at least 60 seconds apart and pause every platform despite manual release; a transient timeout/SERVFAIL never supplies that confirmation. Repair/revalidate and resume current jobs once. Deliver/replay a signed hard bounce for a guest invitation and a complaint for a member notice; inspect inviter/admin undeliverable cause and per-address suppression, with zero further sends from invitations/sign-in/notices/agent email even after restart or a later delivered event. Refuse forged/cross-tenant events, keep sign-in responses indistinguishable, review a corrected guest address and deliver exactly one newly reviewed invitation. Run a controlled day for 85 members/40 guests: 125 invitations, 125 requested sign-in links, 250 assignments, 125 due notices and 125 digests (750 emails, plus explicitly counted probes/reply mail). First show an insufficient free-plan preflight; then use an owner-approved plan with capacity for that total and exercise published rates, 429/reset/Retry-After, shared-account use, restart and an ambiguous acknowledgment through official-schema network edges. Also complete this paced corpus through the actual configured provider to controlled consenting test mailboxes/aliases; report per-recipient outcomes, live provider IDs, remaining counts falling to zero and measured completion versus estimate. On the healthy-provider live path all 125 distinct cutover invitations and the remaining non-fault corpus are accepted exactly once; a wholesale failure cannot be called a completed cutover. In the separate fault cases every expected message reconciles to one provider-accepted or visible terminal-failure outcome, with no silently dropped or stale-link mail. Export/restore suppression and demonstrate that queues/credentials stay inactive and no suppressed address is revived. Existing evidence: none. Gap: No implementation exists for authenticated mail and a cutover that reaches inboxes; the complete behavior and public-door acceptance journey remain required.

• PEG-086 — Mail-independent owner recovery and team continuity. Status: missing. At 1440/390 the first owner completes passkey enrollment plus offline printed-code confirmation; repeat a fresh setup choosing TOTP instead, with no SSO configured. Sign out/expire the normal session, pause mail through two confirmed DMARC-failing answers with both aligned mechanisms broken, open Owner recovery and reach the repair screen via each enrolled method and an unused printed code in separate cases, without email. Repair/revalidate sender authentication and offer affected-path placement help without a default gate, inspect the redacted per-member sign-in delivery status and resume current jobs once; the recovery session/repair appears in audit. Refuse a wrong-origin passkey, bad/replayed TOTP, reused/revoked code, foreign origin, uninvited caller and expired recovery session; normal project/private-task/member-invitation doors remain denied even for a valid recovery-only session. Download/archive/log inspection reveals no code, TOTP seed or active proof; destination restore requires new recovery enrollment while retaining unchanged platform probe data. With 85 member sessions and 40 scoped guest sessions on web/iOS/Android, simulate a 60-minute resolver timeout/SERVFAIL window through official-schema DNS edges: no DNS mail pause, original permissions/tasks/comments/assignments continue, real qualified mailbox notices/sign-in mail arrive, and owner warnings show last authoritative success, backoff and escalating stale age. Then break aligned DKIM and SPF so DMARC fails and confirm two fresh authoritative failures at least 60 seconds apart: mail pauses, while all 125 active sessions continue their permitted work and assignment push is delivered. Known, unknown and inactive sign-in requesters see exactly the same delayed notice and enabled alternatives on web and both native apps. Queue one still-valid link and another whose normal lifetime elapses; expire the owner’s normal session, recover without mail, repair the failing authentication and offer only advisory placement re-checks for genuine changed paths. Deliver the still-valid request once, discard the expired request without sending/auto-extension, accept a new explicit request normally and reconcile the 125-person workload/queues with no lost edits, new grants, duplicate notices or suppressed-address mail. Record elapsed DNS/edit/pause/recovery times, session continuity, provider outcomes and privacy refusals. Enroll a second owner and a delegated Admin with distinct methods/codes, expire the first owner’s session during a real mail pause and repair with the second person at the same restricted scope; revoke the delegation and refuse their later challenge. Then lose every method/code for the original owner and use the generated Cloudflare-account-holder re-enrollment guide through official account/Worker/secret schemas plus one real authorized Worker recovery. Wrong account/Worker/installation, expired/replayed challenge and a caller without actual Worker control fail. A valid challenge re-enrolls only the selected existing owner, invalidates old methods/codes, logs the full redacted audit chain and allows repair without mail; project/member/private-task doors remain refused. Simulate Cloudflare unavailability and show the named external prerequisite and enrolled second-person alternative without inventing a bypass. Existing evidence: none. Gap: No implementation exists for mail-independent owner recovery and team continuity; the complete behavior and public-door acceptance journey remain required.

• PEG-056 — Native sign-in and accountable sessions. Status: missing. Through the native sign-in route, request/confirm a valid link, test unknown/inactive, expired/reused links, scanner GET, foreign-origin confirmation and unsafe return locations. Sign out/revoke and exercise optional IdP sign-in; every private UI/API/export refuses old or missing authority with no product mutation. Before connection, select each provider method and inspect the named missing-connection/guide state with no session. After the live test sign an invited member in through web and app with the same account; invalid state/nonce/redirect, unknown provider tenant and revoked client produce explicit recoverable refusal without falling into a new account. With a virtual WebAuthn authenticator through the browser door, enroll a passkey as a guest, sign out/in and find the same identity; deny a wrong-origin/foreign challenge and reused challenge. Revoke/deprovision and refuse later sign-in, then enforce SSO-only and confirm passkeys cannot bypass it. Qualify the equivalent system-browser return on both native apps. Receive the separate live Gmail/Microsoft 365 qualification links in PEG-084 and refuse actual DMARC-failing or suppressed-address sends without an enumeration difference or session grant; queue delay cannot turn an expired link into valid authority. Run PEG-086’s expired-owner-session passkey/TOTP/code recovery and 125-person DNS-edit window. Known/unknown/inactive requesters see identical delayed notices in web/iOS/Android, active sessions/push remain usable and no expired queued link is delivered or refreshed automatically. Request sign-in on unprobed Mimecast/Proofpoint/iCloud/Yahoo destinations and dispatch by default; enable a hold, compare held guest/unknown notices and release with one audited Admin decision. Existing evidence: none. Gap: No implementation exists for native sign-in and accountable sessions; the complete behavior and public-door acceptance journey remain required.

• PEG-057 — Durable audit distinct from editable activity. Status: missing. Change a role and task, approve a proof, run a rule/agent, import/export and attempt a failed external send through public doors. Erase an actor and restore an archive; audit remains complete and attributable as allowed, anonymized where required, without planted names, email addresses, token values or asset bodies in permanent audit metadata. Existing evidence: none. Gap: No implementation exists for durable audit distinct from editable activity; the complete behavior and public-door acceptance journey remain required.

• PEG-058 — Whole-workspace portable archives and inactive restore. Status: missing. Export a populated 500-member installation with a 10,000-task project and its real retained file/history corpus, interrupt/resume transfer and restore to a new owner's empty Base installation. Compare all declared counts, relationships and digests; corrupt/nonempty imports write nothing and no restored credential, notification, approval capability or agent job executes. Include PEG-082’s exact-limit files and migrated proof v1/v2 in the real R2 multipart round trip; reconcile byte digests, version links and inactive upload authority. Round-trip PEG-084’s suppression/outcome data and prove restored queues cannot mail before sender validation/explicit reauthorization or unsuppress an address through an older restored delivered event; evaluated passing outcomes reuse platform evidence despite text-only record differences and genuine sender changes ask for advisory re-checks without a default hold. Existing evidence: none. Gap: No implementation exists for whole-workspace portable archives and inactive restore; the complete behavior and public-door acceptance journey remain required.

• PEG-059 — Erasure with honest external limits. Status: missing. Erase a project with proof versions, comments, search hits and agent outputs through Data settings; inspect completed database/object/index removal and receipt. Try stale writes, replayed intake and an old archive with the later journal; data stays erased, audit stays redacted and external retained copies are accurately identified. Existing evidence: none. Gap: No implementation exists for erasure with honest external limits; the complete behavior and public-door acceptance journey remain required.

• PEG-060 — US defaults and accessible daily use. Status: missing. Complete request → project → assignment → proof → approval → report and admin/export journeys at 1440/390 with keyboard and screen reader, run automated accessibility checks and inspect manual focus/contrast/reflow. Cross US DST with an all-day deadline, report and recurrence; verify local display, holiday calendar and Letter PDF output. As a new member and guest, complete the getting-started task/review guidance, find model connection/help and follow the support path with redacted diagnostics. Open a teammate profile as an authorized colleague and inspect only permitted assignments; a guest cannot enumerate the directory and no profile exposes private no-project tasks. Existing evidence: none. Gap: No implementation exists for us defaults and accessible daily use; the complete behavior and public-door acceptance journey remain required.

• PEG-061 — Included capabilities and transparent operating costs. Status: missing. Add one member, many free guests and scoped agents, then use reporting/workload/time without an upgrade gate. Inspect itemized measured versus estimated usage, cross a configured agent budget and observe an explicit pause and accountable queued work while ordinary tasks and full export remain available. Before installing, compare an 85-member/40-guest profile with a 120-member profile and inspect itemized USD estimates and assumptions; proceed only through the owner’s explicit spend decision, then compare measured usage with the saved estimate. Compare the estimate’s default/edited AI cap with the saved budget, run the setup live model test and reconcile its usage/reservation once. Exercise budget exhaustion and recorded no-AI choice: the former visibly pauses AI jobs and the latter makes no model call; ordinary tasks, guest notices and export still work and no extra provider/model is invoked. Reconcile upload reservations, completed/aborted/erased object bytes and displayed remaining capacity/cost estimate, including two concurrent uploads at a quota boundary. Before installation compare the quote with the actual release’s public software, push-relay and security-update terms: every line has an exact amount including numeric $0 where offered free, period and included scope, and the saved USD total reconciles with provider estimates and chosen options. An unpublished/missing amount blocks the purchase/install decision with a named terms error, not a guessed $0. Change the 85-member/40-guest mail profile, inspect volume/quota and any required provider-plan repair, accept optional spend explicitly and prove no undisclosed Run Edit Run or third-party fee is added after completion. Existing evidence: none. Gap: No implementation exists for included capabilities and transparent operating costs; the complete behavior and public-door acceptance journey remain required.

• PEG-062 — Agents are scoped credentials with human accountability. Status: missing. Create a scoped agent, give it an allowed task and adversarial instructions in an attachment, then request a hidden record, an unapproved external send, spend and self-approval through API/MCP. All refuse without leaks; rotate/revoke mid-run and stop further actions. Undo its allowed edits while preserving a human's later change, and show that a sent message cannot be falsely unsent. Configure a permitted internal status-post policy and show that an agent can post within it, then add a client guest to the channel and require pending approval before disclosure. A custom-agent instruction attempting to expand its grant changes no credential or permission. Disconnect the model during a scoped agent task and inspect its blocked run, recovery link and zero additional model calls/effects; reconnect/retest and recheck both work scope and budget before any continuation. Existing evidence: none. Gap: No implementation exists for agents are scoped credentials with human accountability; the complete behavior and public-door acceptance journey remain required.

• PEG-063 — Restart-safe business operation and recovery. Status: missing. In the deployed product, interrupt each named job class before and after an external effect, restart and inspect safe completion or explicit uncertainty. Restore a backup into an inactive installation, reconcile work/job totals and reauthorize chosen jobs; demonstrate no duplicate project, approval, timesheet entry or external message. Drop the installation while its independently hosted status link remains reachable, inspect the member-facing degraded/reconnect message and work-free status page, recover and reconcile pending edits. With controlled independent probe observations, compute the stated monthly availability and show unavailable/missing observations explicitly rather than improving the denominator; distinguish model/provider outage from installation outage. Complete PEG-086’s transient and confirmed DNS windows, inspect warning/backoff and platform-specific queue health, preserve all 125 existing sessions and open mail-independent recovery after owner session expiry. Keep mail/session/push work flowing through PEG-084’s passing SPF/DMARC edits and DKIM-only aligned pass, inspect advisory labels, then exercise the chosen hold and actual two-confirmation DMARC failure separately. Existing evidence: none. Gap: No implementation exists for restart-safe business operation and recovery; the complete behavior and public-door acceptance journey remain required.

• PEG-064 — Trash, revisions and conflict-preserving undo. Status: missing. Archive/restore a project, trash/restore a task and proof version, compare a brief revision and undo a bulk change after another member edits it. Inspect the restored graph, preserved later work, explicit conflicts and inaccessible erased objects through browser/API/archive reads. Undo the date/assignment and added-work-action runs from PEG-012, retaining later human edits and refusing a stale or unauthorized undo. Existing evidence: none. Gap: No implementation exists for trash, revisions and conflict-preserving undo; the complete behavior and public-door acceptance journey remain required.

• PEG-065 — Retention and processor custody are explicit. Status: missing. Through Data settings, configure different retention classes, apply a hold, expire eligible records and erase an unheld project. Inspect product/object/index/processor outcomes and unresolved external deletions, confirm held content is disclosed as retained and verify an old archive plus current erasure journal cannot silently resurrect erased material. Existing evidence: none. Gap: No implementation exists for retention and processor custody are explicit; the complete behavior and public-door acceptance journey remain required.

• PEG-028 — Assignable teammates do the work. Status: missing. Assign campaign-copy and sourced-research tasks through Tasks to a scoped agent using an actual configured model edge. Inspect complete attached drafts, cited references and action log; deny hidden context and injected instructions, stop a run and undo an unchanged edit. Only a named human can accept the deliverable or approve its client publication. Use a fixed authorized brief set covering a creative brief, campaign copy, research report, project plan and creative concept, each with its required sections/format/length/audience/style version and factual-source checklist. Run through the real task/agent/review doors and check every rubric item, sources and unsupported flags; exercise accept, edit and reject, compare persisted revisions and measured edits, and leave nonconforming output pending/rejected rather than accepted. Existing evidence: none. Gap: No implementation exists for assignable teammates do the work; the complete behavior and public-door acceptance journey remain required.

• PEG-029 — Plan from a brief within real capacity. Status: missing. Submit a real launch brief with a holiday, time-off conflict and constrained designer. Review a complete feasible draft or explicit infeasibility with alternatives, edit role/date choices and approve once through Plan review. Nothing is created before approval; a stale review refuses, and a repeated accepted request produces one project. For fixed campaign-launch, client-onboarding and event briefs, check required phases/deliverables, every owner/estimate, graph/calendar constraints and aggregate capacity before approval. One feasible case must fit its deadline; one impossible case must name the shortage and await a human decision to change the brief/capacity. Compare edited/accepted/rejected plan revisions and ensure an unresolved owner or unapproved deadline change cannot publish. Existing evidence: none. Gap: No implementation exists for plan from a brief within real capacity; the complete behavior and public-door acceptance journey remain required.

• PEG-030 — Coordinate through actual updates and proposed re-plans. Status: missing. Make a task stale, approve a chase and reply through each chat/mail adapter; inspect the attributed update and stopped reminder. Delay its predecessor and review a capacity-checked re-plan awaiting approval. Open the weekly status draft, follow citations and reject a wrong assertion; no unapproved date/publication change occurs. Run an internal stale-task chase without an individual send approval under policy, then attempt the same chase to a client guest and require review. Check the status draft’s required health/highlights/risks/next-steps sections against its date window and source tasks before the person publishes. Schedule the same internal chase with Slack, Teams or Gmail/Outlook absent in separate cases; observe the exact missing-provider state and guide plus one retained blocked job and no send. Complete the corresponding live guide/link step and resume once, process the real signed/authenticated reply into the task and stop follow-up under the original permissions. Exercise PEG-084’s unauthenticated-domain block, signed bounce/complaint suppression and throttle/restart cases for this email path without duplicate, silent-drop or false-delivered outcomes. Existing evidence: none. Gap: No implementation exists for coordinate through actual updates and proposed re-plans; the complete behavior and public-door acceptance journey remain required.

• PEG-066 — Triage until work has an owner and a next step. Status: missing. Submit an ambiguous request and a near-duplicate with a malicious instruction. Through Intake, inspect cited candidates and proposed routing, approve a clarification and process its reply. A person decides merge/priority and acceptance; the agent then verifies an actual owner and next action without changing another team's commitment or granting access. Existing evidence: none. Gap: No implementation exists for triage until work has an owner and a next step; the complete behavior and public-door acceptance journey remain required.

• PEG-067 — Carry creative review to an accountable decision. Status: missing. Run a campaign proof through missing external review, request-changes and v3 replacement. Inspect a sourced revision brief, an ordinary proof reminder authorized by the reviewed share, and a separately human-approved agent-written reminder, reject an old-v2 approval and observe the actual human v3 sign-off close follow-up. No merely delivered reminder or generated replacement is marked approved. Existing evidence: none. Gap: No implementation exists for carry creative review to an accountable decision; the complete behavior and public-door acceptance journey remain required.

• PEG-068 — Measure coordination and delivery outcomes honestly. Status: missing. Use a completed project with attributable human time entries, agent activity, an approved baseline and actual finish. Through Outcomes, reconcile hours and slip counts to source rows, change the comparison window and include a project with missing time. Observe correct exclusions/unknowns and a plain refusal to claim proven savings from insufficient data. Through Outcomes, reconcile edit distance for an unchanged accept, a one-token edit and a rejection; for a plan compare field/edge diffs separately. Execute the reference campaign and matched manual run with the same brief, workload, scripted edge responses and real human reviewer, record timings and source decisions and test the stated 16/20, two-report and reduced-minute criteria. Report actual failures or insufficient data without claiming benchmark success; no benchmark model output is mocked. Existing evidence: none. Gap: No implementation exists for measure coordination and delivery outcomes honestly; the complete behavior and public-door acceptance journey remain required.

• PEG-069 — Preserve focus while repairing a slipping schedule. Status: missing. Overrun a task while a meeting consumes its next block, lock a focus period and delay a shared milestone. Review alternative plans in Calendar/Timeline, approve one and inspect real provider events plus task dates. Hidden availability, stale proposals and capacity shortfalls remain explicit, with no overwritten lock or unapproved colleague deadline. Existing evidence: none. Gap: No implementation exists for preserve focus while repairing a slipping schedule; the complete behavior and public-door acceptance journey remain required.

• PEG-078 — Resolve resource conflicts across a portfolio. Status: missing. Create a 30-project portfolio where two projects compete for one designer, a qualified alternate has space and a third project has a locked commitment. Run the agent through Portfolio capacity, compare two sourced alternatives, approve reassignment to the alternate and inspect conflict-free total workload, unchanged lock and one attributed application. Change an estimate during review, remove a project grant and test a portfolio with no feasible staffing; require refreshed review/limited context or an explicit shortage without automatic reassignment or deadline movement. Existing evidence: none. Gap: No implementation exists for resolve resource conflicts across a portfolio; the complete behavior and public-door acceptance journey remain required.

• PEG-070 — An agent helps prove the migration. Status: missing. Give a migration preview with an unknown status, expired file link, duplicate identity and conflicting owner change to the agent. Inspect sourced repair suggestions, let the owner resolve them and rerun reconciliation; only the owner's explicit cutover approval can continue, and all unresolved losses remain visible in the final report. Existing evidence: none. Gap: No implementation exists for an agent helps prove the migration; the complete behavior and public-door acceptance journey remain required.