EPS Preview Certification Checklist

Preview release gate

• Database migration parses and applies in an isolated environment; rollback/recovery is documented.
• RLS is enabled, anon/authenticated table access is revoked, service-role grants are explicit, and the apply function is not a public SECURITY DEFINER escape.
• Organizer access, partner boundary, project membership, canonical-command capability, and audit actor are tested.
• A proposed project links to exactly one same-partner EMS event.
• EMS edits appear in Planning without import; applied Planning edits appear in EMS without sync.
• Pending/rejected proposals never appear in Rego; applied commands schedule one publication refresh; idempotent replay schedules none.
• Gantt, calendar, and table show the same dates; keyboard-only creation and view switching work at desktop and mobile widths.
• Meetings, agenda items, revisioned minutes, join links, and .ics output are tested without implying hosted calls.
• Mandatory email plus linked personal Telegram DM, Discord DM, and verified consented SMS tests use one canonical reminder identity, independent bounded channel attempts, no duplicate logical key, and no planning-state mutation.
• Administrator-managed Email, Discord bot/webhook, and Telegram bot tests keep write-only secrets encrypted and separate from personal direct-message destinations.
• Every upload reaches Sanity only; Supabase Storage remains unused.
• Browser HTML, JSON, redirects, exports, notifications, and errors contain no Sanity URL.
• Confidential files are ciphertext in Sanity, blocked before clean review, authorized on download, decrypted by the Worker, and never redirected upstream.
• Logs and exports exclude tokens, webhook URLs, encryption material, personal facilitator notes, and unnecessary personal data.
• Type checks, builds, route inventory, SQL smoke tests, browser screenshots, responsive checks, console checks, and docs link/frontmatter checks pass.

Personal reminder channel gate

Local schema and fixture evidence

• Cadence. Assert 30, 28, 24, 21, 18, 14, 10, 7, and 3 days; 36, 24, 12, 6, and 3 hours; 1 hour; 30, 15, and 5 minutes; due time; and six-hour overdue repetition without rounding or a second channel timer.
• Mandatory fallback. Test email plus zero, one, two, and three enabled personal channels. Opt-out, unlink, provider failure, no SMS device, quiet hours, and snooze must not suppress email.
• Identity lifecycle. Test Telegram private-chat binding, Discord DM readiness, verified E.164 ownership, current consent, duplicate provider identity quarantine, wrong-user denial, expiry/replay, unlink, relink, and identity-version replacement.
• Cancellation. Test submission, completion, every terminal state, reassignment, due-date change, preference disable, consent withdrawal, destination revocation, and account unlink. Pending reminders, outbox entries, leases, and SMS jobs must cancel without invalidating immutable attempt history.
• Concurrency. Test duplicate materialization, overlapping scheduler runs, concurrent claims, expired lease recovery, device restart, provider timeout, retry-after, retry exhaustion, and safe manual reconciliation.
• Isolation and privacy. Test partner, project, membership, recipient, device, SIM, and destination mismatch denial. Scan browser data, logs, fixtures, exports, screenshots, bot/SMS payloads, and errors for secrets, full phone numbers, raw provider IDs, evidence URLs, and classified planning content.
• SMS policy. Test E.164 normalization, challenge attempt/resend limits, consent versions, masking, country allowlist, encoding, segments, per-message/run/day cost ceilings, pacing, online-only devices, permission loss, non-roaming verified SIMs, gateway outage, and sent_unconfirmed wording.

Provider, device, and hosted evidence

Local fixtures do not certify external delivery. Record each of these as a separate non-production gate:

1. Telegram canary. Use a real linked test identity and private bot chat. Record bind/revoke/relink, wrong-user rejection, provider acceptance, rate-limit/retry, blocked-bot recovery, sanitized receipt, and tenant isolation.
2. Discord canary. Use a real linked test identity. Record DM creation/reuse, privacy-blocked failure, revoke/relink, wrong-user rejection, provider acceptance, rate-limit/retry, sanitized receipt, and tenant isolation.
3. SMS canary. Use an approved verified test number, current consent, an authorized online Android device, and a verified non-roaming SIM. Record country/segment/cost preflight, lease, native request identity, sent/delivered/failed receiver results where available, opt-out, masked logs, and carrier limitations.
4. Hosted canary. Apply the migration, deploy the Worker, configure API-owned secrets, verify scheduled-worker and device-token health, run one linked user per channel, exercise revocation/rotation/recovery, and prove provider results never mutate planning state.
5. Review decision. Record independent security, accessibility, privacy, load/retry, key-rotation, provider-outage, and support-owner review. A green local build or provider-accepted message is not a General Availability decision.

Existing Event Management SMS Blasts, organization Discord/Telegram integrations, social publishing, or EMS LAN gateway certificates do not certify EPS personal reminders. EPS needs its own recipient, authorization, job namespace, logical reminder, cancellation, and evidence trail.

General Availability exit criteria

GA additionally requires independent security review, deployed malware scanning, recovery and key-rotation exercise, load/retry/queue certification, full quiet-hour/digest/escalation semantics, retention/legal-hold automation, calendar interoperability fixtures, migration compatibility policy, accessibility audit to the declared WCAG profile, support runbooks, SLOs, and an approved release decision.

Evidence record

Record the commit, migration version, environment, test commands, timestamps, screenshots, fixture IDs (non-secret), reviewer, exceptions, recovery result, and final decision. A green build alone is not a release decision.

Completion check

Each checked item links to reproducible evidence and each exception has an owner, risk acceptance, due date, and expiry.