Clinic-readiness release train and authoritative NO-GO decision

[evangauer]

Executive decision — 2026-08-30

NO-GO for clinic use, staging migration, merge to a canonical branch, or production deployment.

OpenVPM has meaningful product depth, observable non-demo use, and a fully green exact-SHA hardening stack. It is not yet a clinic-ready PIMS because independent governance, isolated staging, tested restoration, managed-data disposition, and a supervised human clinic pilot are still open. Green CI is necessary evidence; it is not authorization to release.

This issue is the authoritative release-train decision record. Component issues remain the source of implementation detail. Nothing below authorizes fabrication, destructive cleanup, production writes, spend, merge, migration, or deployment.

What is proven

• Read-only aggregate evidence shows 56 practices, 12 practices with non-demo appointments, 10 recent non-demo creators, 430 clients, 1,001 patients, 38 appointments, and 109 invoices. This is behavioral evidence of real use, not identity proof that every account belongs to a human or that any clinic has accepted production readiness.
• The eight-PR migration and clinical-integrity stack is draft, exact-head green, and mechanically clean:
  • reconcile managed release lines before clinic-readiness promotion #285 migration reconciliation (40323771)
  • feat(billing): rebuild immutable clinic-day close after canonical 0107 #286 immutable clinic-day close (20259346)
  • feat(billing): rebuild annual-at-renewal cadence after canonical 0108 #287 annual-at-renewal cadence (315f6db0)
  • fix(billing): harden flexible Stripe subscription creation #289 flexible Stripe checkout (1c82344c)
  • fix(clinical): harden controlled-substance ledger #290 controlled-substance ledger (c43d3b72)
  • fix(clinical): harden prescription integrity #296 prescription integrity (1d53f8ba)
  • fix(clinical): harden lab result integrity #299 lab-result integrity (39c4442f)
  • fix(clinical): harden vaccination evidence #301 vaccination evidence (956e733b)
• The exact final head passes hosted CI, disposable PostgreSQL migrations and RLS contracts, patient merge, production build, dependency audit, artifact secret scan, and OSS release verification.
• The configured data-bearing environment was audited read-only. No production/configured rows were mutated, no migration was applied, and no hosted resource was provisioned.

Ordered release train

Gate 0 — preserve containment

• Keep reconcile managed release lines before clinic-readiness promotion #285 through fix(clinical): harden vaccination evidence #301 draft and unmerged.
• Keep all canonical-branch, staging-migration, and production-deployment gates closed.
• Require exact immutable commit SHAs in every evidence packet; rerun evidence after any change.
• Do not use the current data-bearing openvpm-staging project as disposable staging.

Exit: every later gate is explicitly owned and containment has not been bypassed.

Gate 1 — independent governance and migration-line approval

• Complete Enforce independent release review and clinic-readiness branch protections #281: add at least two durable human release/security reviewers, require two approvals, enforce CODEOWNERS/current-head checks, prevent self-review and admin bypass, and test rejection/success paths.
• Complete the independent SQL/security review required by Reconcile divergent Main and Development migration histories before release #284 and approve reconcile managed release lines before clinic-readiness promotion #285 as the canonical migration reconciliation.
• Review reconcile managed release lines before clinic-readiness promotion #285 → fix(clinical): harden vaccination evidence #301 strictly in dependency order. A child PR cannot be approved before its base is accepted.
• Resolve Stripe flexible-billing inventory and approval in Release gate: inventory and approve Stripe flexible billing mode for annual cadence #288 before fix(billing): harden flexible Stripe subscription creation #289 can advance.

Exit evidence: live GitHub policy packet is green; two independent approvals exist; all required exact-head checks are green; migration reviewer records forward/repair boundaries.

Gate 2 — isolated synthetic staging

• Complete Create isolated staging and provision fail-closed hosted operations #278 with an approved cost owner before spending: separate Supabase project, synthetic-only tenants, Stripe test mode, non-delivering email, independent storage/keys, least-privilege roles, fail-closed health, exact-SHA deployment, reset and retention procedure.
• Apply the canonical stack from zero only in the new isolated environment.
• Prove environment-secret separation and block real contact destinations.

Exit evidence: isolated environment inventory, synthetic-data attestation, exact SHA, migration/RLS/schema-conformance results, /api/health 200, and reset proof.

Gate 3 — restore and recovery drill

• Complete Automate clinic-ready restore drills and deterministic release gates #279: restore a database export and an independently replicated managed object by immutable version/checksum into isolated staging.
• Exercise recovery hold, operator reconciliation, and reviewed release of autonomous jobs.
• Run auth, tenant isolation, scheduling, clinical chart, invoice, payment, and file-access smoke tests.
• Recover or disposition the four missing patient-linked managed objects in Recover four missing patient-linked managed objects before production rollout #277 without inventing content.

Exit evidence: PHI-free drill record with RPO/RTO, operator, sources, checksums, test results, failures, and next due date.

Gate 4 — attributed data disposition

• Resolve negative controlled-drug demo balances append-only in Release gate: reconcile negative controlled-drug demo balances append-only #291.
• Resolve legacy demo prescription lifecycle history append-only in Release gate: reconcile legacy demo prescription lifecycle history append-only #293.
• Resolve aged demo lab results with an attributed decision in Release gate: reconcile aged demo lab results with attributed decisions #297.
• Resolve legacy demo rabies/certificate records in Release gate: reconcile legacy demo rabies records before certificate use #300 without fabricating certificate data.
• Decide and document the recovery-safe projection strategy for controlled drugs (Design recovery-safe database enforcement for controlled-drug balances #292), prescriptions (Design recovery-safe database enforcement for prescription lifecycle projections #295), and labs (Design recovery-safe database enforcement for lab result projections #298).
• Source and approve validated veterinary drug-interaction data and persisted safety decisions in Release gate: source validated veterinary interaction data and persist safety decisions #294.

Exit evidence: all configured-data audits return release-safe, or each accepted exception has a named clinical owner, rationale, expiry, and compensating control.

Gate 5 — supervised clinic pilot

• Complete the first-clinic path in Add exact prospective first-clinic-win preflight and cohort hardening #260 and associated lifecycle delivery in Make optional lifecycle marketing delivery durable and provider-I/O-safe #259.
• Name a veterinary clinical owner, practice manager, release owner, security owner, and incident commander.
• In isolated staging, run one complete supervised day: onboarding/MFA, client and patient registration, appointment, chart/medical note, prescription, controlled drug, lab result, vaccination/certificate, estimate/invoice, payment/refund, close, export, backup, and restore.
• Record defects, workarounds, timings, training gaps, support escalation, and explicit clinical acceptance.
• Exercise incident response, secret rotation, rollback, and downtime procedure before production access.

Exit evidence: signed pilot acceptance, zero unresolved safety-critical defects, completed runbooks/on-call coverage, and a reviewed rollback decision.

Promotion checklist — all must be true

• Gates 0–5 have named owners and complete evidence.
• Two independent reviewers approve the exact release SHA.
• Exact-SHA build, tests, migrations, RLS, schema conformance, CodeQL, dependency audit, secret scan, golden clinic workflow, and restore drill are green.
• Hosted health is green with no release-blocking check downgraded to advisory.
• Backup freshness and managed-object replica coverage meet policy.
• No unresolved P0/P1 clinical safety, tenant isolation, authentication, medication, billing, backup, or recovery defect exists.
• Production change window, communications, rollback trigger, and incident staffing are approved.
• Final GO decision is recorded here by the release owner and independent clinical/security approvers.

Until every checkbox above is satisfied with current evidence, the decision remains NO-GO.

Ownership required now

Project owner: assign named humans and target dates for Gate 1 governance, Gate 2 cost approval, Gate 4 clinical data disposition, and Gate 5 clinic pilot. Engineering can continue producing evidence, but it cannot self-approve these controls or invent clinical decisions.

[evangauer]

Live governance checkpoint — 2026-08-30

I re-audited the GitHub control plane and corrected the original snapshot. No code, branch, environment, deployment, or data mutation occurred during the read-only portion.

Material progress already present:

• main now requires 2 approvals, CODEOWNERS review, stale-review dismissal, approval after the last push, resolved conversations, strict current-head checks, and administrator enforcement. Its required checks include build, migration history, RLS, both CodeQL analyses, Golden clinic workflow, and Disposable restore drill. Force pushes and deletion are disabled.
• staging has equivalent exact-head checks and review hygiene with 1 required approval. Force pushes and deletion are disabled.
• Production deploys only from main; Staging deploys only from staging. Both environments prevent self-review and require the configured reviewer.
• Canonical-branch ruleset 20625373 is active across exactly development, staging, and main, with no bypass actors.

Control tightened in this checkpoint:

• development previously allowed a PR merge with zero approvals. Its classic branch protection now requires 1 approval, CODEOWNERS review, stale-review dismissal, and approval after the last push. Existing strict checks, administrator enforcement, conversation resolution, and no-delete/no-force-push controls were preserved.
• Verification: reconcile managed release lines before clinic-readiness promotion #285 is draft, exact-head green, and now reports REVIEW_REQUIRED / BLOCKED at 40323771b7d74091040b4d1f18d2da2d65f70f35.

Remaining release blockers:

• The repository still has exactly one collaborator, @evangauer.
• .github/CODEOWNERS still assigns all sensitive paths to that same account.
• Therefore the configured approval gates cannot constitute independent review; main cannot obtain two human approvals, and self-authored development/staging changes cannot obtain a valid independent approval.
• The REST environment response omits an explicit can_admins_bypass: false; the fail-closed release collector intentionally treats omission as unsafe. A fresh evidence packet must prove no environment administrator bypass after reviewer onboarding.

The next owner action is organizational: onboard at least two durable human reviewers (ideally a clinical safety reviewer and a security/release reviewer), then replace personal CODEOWNERS boundaries with team/role ownership and exercise one rejected self-approval plus one successful independent approval. Until then the release decision remains NO-GO.

[evangauer]

Zero-spend staging interlock implemented — 2026-08-30

Draft PR #303 (509669f999b2da679601b0c0ce2a7087831c8066) closes a real drift between this issue's runbook and .github/workflows/migrate.yml:

• staging dispatch now requires the typed MIGRATE_STAGING confirmation;
• the job uses only the dedicated STAGING_DATABASE_URL secret and requires STAGING_PROJECT_REF;
• the existing Supabase project-ref verifier runs before any database command and rejects both known data-bearing project identities;
• the independent expected/forbidden target-fingerprint guard remains mandatory;
• regression tests enforce secret isolation, project-ref presence, and verifier-before-migrate ordering.

Local evidence: 4,596 tests passed with 31 intentional integration skips; lint, type-check, focused controls (18/18), formatting, and diff checks passed. Hosted exact-head CI is still running and will be linked when complete.

Containment remains: #303 is draft and stacked on #301. It did not provision or contact staging, change environment secrets, incur spend, apply a migration, merge, or deploy. This issue remains open until an approved, synthetic-only Supabase project and sandbox provider stack are provisioned and exercised with independent review.

[evangauer]

Real-use confidence update — 2026-08-30

Two independent, aggregate-only evidence sources now support a bounded conclusion.

Product behavior

The read-only configured-data audit found 56 practices, including 12 with non-demo appointments and 10 recent non-demo creators, plus 430 clients, 1,001 patients, 38 appointments, and 109 invoices. This demonstrates nontrivial application behavior outside the known demo-practice classification.

Public repository adoption

• 26 stars and 14 forks;
• 4 public contributor accounts: the repository owner, 2 non-owner accounts typed by GitHub as User, and 1 bot;
• GitHub's available 2026-08-16 through 2026-08-29 traffic window reports 580 views / 111 unique viewers and 20,305 clones / 789 unique cloners.

Defensible interpretation

High confidence: OpenVPM is being exercised beyond a single empty demo and has nonzero outside interest/contribution.

Not proven: every application account is a distinct human; the clone count represents people rather than CI/bots/automation; any specific veterinary clinic is currently depending on OpenVPM for live care; users accept the workflow, safety, support, or recovery model.

The product and repository signals are encouraging, but they do not replace direct human evidence. Gate 5 remains open until #260 names a real clinic and decision makers, completes a supervised end-to-end pilot, records defects and workarounds, and captures explicit clinical acceptance. No identifiers or row-level patient data were read or published for this update.

[evangauer]

Exact-head staging-safety evidence — 2026-08-30

Draft PR #303 is green at immutable head d0836c433a999199ce6f87e9c0377a10808423dc.

Hosted run: https://github.com/evangauer/openvpm/actions/runs/33338849680

• build: passed (including source/artifact secret scans, production dependency audit, lint, type-check, full tests, production build, and OSS release verification)
• Migration history integrity: passed
• RLS tenant isolation: passed, including the real PostgreSQL clinical contracts and patient-merge transaction contract
• Golden clinic workflow: passed, including browser flow and real WebAuthn ceremonies
• all three Vercel candidate checks passed by intentionally canceling through the ignored-build guard; no preview deployment was produced

Independent local evidence at the same head:

• 4,599 tests passed; 31 intentional environment-gated integration skips
• focused staging/environment/email/governance controls: 70/70 passed
• archive preflight: 49/49 passed serially and again in the final full suite after one transparently recorded parallel resource-contention timeout
• production build: passed, 56 static pages generated
• source secret scan: passed with 9 reviewed synthetic-fixture exceptions
• deployable artifact secret scan: passed with 9 structural framework/dependency classifications
• production dependency audit: no known vulnerabilities
• OSS release verification: 1,557 tracked files passed
• worktree clean after push

The live GitHub Staging environment currently has zero secrets and zero variables, so the new workflow cannot reach any database. Provisioning, cost, migration, provider contact, merge, and deployment remain unperformed and unauthorized. Gate 2 remains open pending approved isolated resources, synthetic-only data, sandbox destinations, a reset exercise, hosted health, and independent review.

[evangauer]

Material release-control update: draft #304 now closes a fail-open gap in the machine clinic-readiness decision.

Previously, the evaluator could theoretically emit GO without ingesting the configured controlled-substance, prescription, lab-result, or vaccination audits required by this release issue. On exact head fef536965f16226dc7686e0b7181c1c12c59704b, format-version 6 now requires all four reports to be fresh, read-only aggregate output, exact-schema/PHI-bounded, target-bound to the independently configured database fingerprint, empty of findings, and explicitly releaseSafe: true. Missing, stale, cross-target, malformed, extra-field, or unsafe evidence fails closed.

Draft PR: #304
Hosted exact-head run: https://github.com/evangauer/openvpm/actions/runs/33340052602

Hosted build, migration integrity, full RLS/database contracts, and golden clinic/WebAuthn all passed. Local full serial suite passed 4,610 tests with 31 intentional integration skips; lint, type checks, production build, dependency audit, OSS verification, and source/artifact secret scans passed.

This does not change the authoritative NO_GO: independent reviewers, isolated staging acceptance, provider-backed restore evidence, configured-data remediation/disposition, and clinic pilot evidence are still absent. No merge, deployment, database mutation, or staging provisioning occurred.

[evangauer]

CTO execution-window addendum — 2026-08-30

This comment supersedes the release-stack length in the original issue body. The decision remains NO_GO.

Current protected release train

The retained train is now 11 ordered draft PRs: #285 → #286 → #287 → #289 → #290 → #296 → #299 → #301 → #303 → #304 → #305. Every child is mechanically clean against its parent and exact-head hosted CI is green. The obsolete pre-reconciliation drafts #282 and #283 were closed with links to their canonical replacements #286 and #287. Nothing was merged or deployed.

The final three controls added after the original issue body are:

• fix(ops): enforce isolated staging boundaries #303: isolated staging database identity interlock and nonproduction email-recipient confinement;
• fix(ops): gate releases on clinical data audits #304: format-version 6 machine release gate requiring fresh, exact-schema, same-target, release-safe configured-data audits for controlled substances, prescriptions, labs, and vaccinations; and
• docs: state current live-clinic no-go #305: prominent public live-cutover NO_GO language plus regression tests preventing readiness, Cloud, or AI claims from outrunning evidence.

Hosted exact-head runs:

• fix(ops): enforce isolated staging boundaries #303: https://github.com/evangauer/openvpm/actions/runs/33338849680
• fix(ops): gate releases on clinical data audits #304: https://github.com/evangauer/openvpm/actions/runs/33340052602
• docs: state current live-clinic no-go #305: https://github.com/evangauer/openvpm/actions/runs/33340498506

Adoption finding

There is nontrivial usage and real outside engineering interest, but verified clinic reliance remains unproven.

• Read-only aggregate application evidence: 56 practices; 12 with non-demo appointments; 10 recent non-demo creators; 430 clients; 1,001 patients; 38 appointments; 109 invoices.
• Current public repository evidence: 26 stars, 14 forks, 580 views / 111 unique viewers, and 20,305 clones / 789 unique cloners for GitHub's 2026-08-16 through 2026-08-29 traffic window.
• Contributors include three named GitHub User accounts, one anonymous attribution, and one bot. At least one non-owner account has merged contributions; identities and clinic roles are not verified.
• Public downstream derivatives and production-labeled deployment evidence exist, but no authorized adoption report has been submitted. Clone volume is automation-heavy and must not be converted into a user count.

Defensible statement: real people are almost certainly evaluating and adapting OpenVPM, and configured non-demo behavior exists; no veterinary clinic has yet been verified as safely relying on it for daily care.

Next execution sequence

1. People/governance (critical path): add two durable independent human reviewers; name the veterinary clinical owner, release owner, security owner, incident commander, and clinic pilot champion. Code cannot self-approve this gate.
2. Isolated staging authorization: approve the approximately $9.81/month isolated staging spend, then provision it with no production credentials, synthetic-only tenants, test-mode payments, confined email delivery, independent storage/keys, and exact-SHA deployment.
3. Review the train in order: independently review reconcile managed release lines before clinic-readiness promotion #285 first, then each child. Never approve a child before its base, and rerun exact-head evidence after any change.
4. Provider-backed recovery: run Automate clinic-ready restore drills and deterministic release gates #279 in isolated staging, recover or formally disposition the four missing managed objects in Recover four missing patient-linked managed objects before production rollout #277, and prove immutable object/version recovery plus clinic workflow smokes.
5. Clinical data disposition: a named clinical owner resolves Release gate: reconcile negative controlled-drug demo balances append-only #291/Release gate: reconcile legacy demo prescription lifecycle history append-only #293/Release gate: reconcile aged demo lab results with attributed decisions #297/Release gate: reconcile legacy demo rabies records before certificate use #300 append-only and decides Design recovery-safe database enforcement for controlled-drug balances #292/Release gate: source validated veterinary interaction data and persist safety decisions #294/Design recovery-safe database enforcement for prescription lifecycle projections #295/Design recovery-safe database enforcement for lab result projections #298. No fabricated drug interaction, prescription, lab, rabies, or certificate evidence.
6. Controlled clinic pilot: execute Add exact prospective first-clinic-win preflight and cohort hardening #260 for at least five clinic days in parallel with the incumbent PIMS; record workflow defects, training/support burden, downtime/rollback, billing, communications, and clinical acceptance.
7. Only then evaluate GO: assemble format-version 6 evidence for one exact release SHA. Any missing/stale/cross-target audit, advisory dependency, absent approval, restore gap, or unresolved P0/P1 remains NO_GO.

Owner decisions required

• authorize or decline isolated staging spend;
• identify the independent reviewers and clinical/pilot owners; and
• choose the first controlled clinic and target window.

Until those decisions exist, engineering should concentrate on review support and evidence, not add feature surface or weaken gates.

[evangauer]

CTO addendum: safe reset evidence added — 2026-08-30

The protected release train now contains 12 ordered draft PRs: #285 → #286 → #287 → #289 → #290 → #296 → #299 → #301 → #303 → #304 → #305 → #306. Draft #306 is mechanically clean against #305 and green at exact head 015b062b31aa0c8367b043fe17a646c25a2695cd.

PR: #306
Hosted run: https://github.com/evangauer/openvpm/actions/runs/33342694287

#306 replaces the unsafe unguarded reset helper with target-validated local and staging entrypoints, a protected exact-SHA reset/reseed/audit workflow, schema-derived reset coverage, synthetic-contact enforcement, target fingerprints in hosted health, and clinic-readiness evidence format v7. The final ephemeral PostgreSQL contract reset 129 application tables, left zero sentinel rows, and retained migration history; all hosted build, migration, RLS/database, browser clinic, and WebAuthn gates passed.

Decision remains NO_GO. The Staging environment still has zero secrets and zero variables, and no isolated provider resources, sandbox integrations, hosted reset/health evidence, independent approval, restore drill, clinical dispositions, or clinic pilot exist. Nothing was merged, deployed, provisioned, or written to production/configured staging, and no spend was incurred.

[evangauer]

CTO addendum: exact-byte recovery gate — 2026-08-30

The protected release train now contains 13 ordered draft PRs, ending #305 → #306 → #307. Draft #307 is mechanically clean against #306 and green at exact head 8aef7d43062c3047c15d835e62c8b7ec5e3d4923.

PR: #307
Hosted run: https://github.com/evangauer/openvpm/actions/runs/33343436557

The recovery audit found that a legacy manifest with no recorded checksum could treat same-length bytes as exact recovery evidence. #307 contains that patient-data integrity risk: checksum-less execute now requires a separately reviewed SHA-256 before provider reads, and the typed confirmation binds file UUID plus digest. Full hosted build, migration, RLS/database, browser clinic, WebAuthn, and safe-reset gates passed.

Decision remains NO_GO. This does not locate or recover the four legacy objects, replace independent review, create isolated staging, complete provider-backed restore, resolve clinical data decisions, or produce clinic-pilot evidence. No patient object, provider, configured database, merge, deployment, provisioning, or spend was touched.

[evangauer]

Superseding #307 evidence: the final recovery-control head is 40ad451e61344e33732c7059e14cf7fdf0cd9b3c, green in hosted CI at https://github.com/evangauer/openvpm/actions/runs/33343996252 and mechanically clean against #306.

The guarded recovery path now binds executed work to exact reviewed bytes, an independently expected database fingerprint, and distinct canonical legacy/primary/replica targets before provider access. Human provider-account/IAM independence is still required and is not inferred by code. No provider, patient object, configured database, merge, deployment, provisioning, or spend was touched. The 13-PR train remains draft and release remains NO_GO.

[evangauer]

CTO addendum: immutable release-review provenance — 2026-08-30\n\nThe protected train now contains 14 ordered draft PRs, ending #306 → #307 → #308. Draft #308 is mechanically clean against #307 and green at exact head 8e8a4ede4f6069b8a02d72b90baa671491c10329.\n\nPR: #308 \nHosted run: https://github.com/evangauer/openvpm/actions/runs/33344951959\n\nClinic-readiness evidence format v8 now proves immutable merge/review provenance: the release SHA must be the merge commit of exactly one pull request to main, and two distinct non-author reviewers must have approved the exact final PR head before merge. Direct-push history, stale approvals, unresolved change requests, incomplete pagination, and malformed provenance fail closed.\n\nHosted build/security, migration history, RLS/database contracts, browser golden-clinic workflow, and real WebAuthn ceremonies all passed. Local verification passed 4,624 tests with 31 intentional integration skips, lint, type checking, formatting, and a 56-page production build. Vercel candidates were canceled by the ignored-build guard; no preview was deployed.\n\nDecision remains NO_GO. This control detects missing independent review; it cannot create reviewers or self-approve. Isolated staging resources, provider-backed recovery, configured-data clinical decisions, and a supervised clinic pilot also remain absent. Nothing was merged, deployed, provisioned, written to production/configured staging, or charged.

[evangauer]

CTO addendum: clinic pilot is now a machine release gate — 2026-08-30\n\nThe protected train now contains 15 ordered draft PRs, ending #307 → #308 → #309. Draft #309 is mechanically clean against #308 and green at exact head dc775f8c2a1af0f284414560e3f499d87645e2ae.\n\nPR: #309 \nHosted run: https://github.com/evangauer/openvpm/actions/runs/33345988475\n\nThe audit found that the authoritative evaluator could theoretically emit GO after automated golden-clinic CI without a completed human clinic pilot. Evidence format v9 now fails closed unless a strict PHI-free packet proves five distinct clinic days for the exact release SHA, immutable validated-use projection linkage, explicit clinic acceptance, retained incumbent-PIMS and rollback paths, required operational outcomes, four distinct clinic/clinical/release/security approvals, and zero critical, high, or open release-blocking findings. Free-form or sensitive fields are rejected.\n\nHosted build/security, migration history, RLS/database contracts, browser golden-clinic workflow, and real WebAuthn all passed. Local verification passed 4,633 tests with 31 intentional integration skips, lint/type/format checks, 56-page build, dependency audit, OSS verification, and source/artifact secret scans. No preview was deployed.\n\nDecision remains NO_GO. The new control requires a real pilot; it does not create one. Independent reviewers, isolated staging/provider recovery, clinical data disposition, named clinic and owners, and five-day supervised acceptance remain absent. Nothing was merged, deployed, provisioned, charged, or written to configured environments.

[evangauer]

CTO addendum: provider-backed recovery is now fail-closed

The protected release train now contains 16 ordered draft PRs, ending #308 → #309 → #310. Draft #310 is mechanically clean against #309 and green at exact head 1619ff4289e7de9e69e309ba28bce1c49f9eaf9b.

PR: #310
Hosted run: https://github.com/evangauer/openvpm/actions/runs/33347173086

The audit found that provider-restore evidence could previously carry unbounded extra content into the final release packet and did not authoritatively bind database backup identity, dual control, RPO/RTO, or the restore target. Evidence format v10 now rejects that path. A GO requires a fresh, non-synthetic, exact-release packet with distinct pre-authorized operators, exact database and object versions/checksums, isolated-staging target identity, hold/release and clinical smoke outcomes, bounded RPO/RTO, zero blocking findings, and a strict PHI/secret/provider-payload-free shape.

Hosted verification passed 4,641 tests, the 56-page build, migration history, full RLS/database contracts, golden clinic browser flow, and real WebAuthn ceremonies. No preview was deployed.

Decision remains NO_GO. This control can reject missing or unsafe evidence; it cannot create isolated staging, perform a provider-backed restore, supply two independent reviewers, make clinical data-disposition decisions, or complete a five-day human clinic pilot. Nothing was merged, deployed, provisioned, charged, or written to configured environments.

[evangauer]

Release-train update: the retained draft stack now contains 17 PRs and ends with #309 -> #310 -> #311. #310 established strict provider-restore evidence; #311 now independently binds clinic-pilot assertions to current database-derived evidence and the exact immutable projection.

#311 exact head 11a29d0846f85acf24e67648212aaf7437879f24 passed all hosted gates: https://github.com/evangauer/openvpm/actions/runs/33348863191

No PR was merged, no deployment was created, and no configured database, provider object, patient object, secret, variable, or production state was touched. The train remains draft and NO_GO pending independent human review, isolated staging authorization/provisioning, an actual provider restore drill with the missing object classes, remaining clinical data dispositions, and a real five-day clinic pilot.

[evangauer]

CTO closeout: verified downstream adoption signals

A fresh public-evidence audit strengthens the answer to whether real people are using the project, while preserving the clinical-safety boundary.

• The repository currently has 26 stars and 14 user-owned forks.
• resonancevet/vetflow-emr is a public downstream veterinary EMR fork that is 70 commits ahead of OpenVPM main. Its independent work spans mobile field workflows, SOAP/clinical records, inventory, scheduling, client portal, compliance, backup/recovery, audit logging, and deployment, with pushes through 2026-08-17.
• rayalah/doctorpet-openvpm contains 15 independent commits on a localization/visit-workspace branch and nine commits on a Doctor Pet/Costa Rica productization branch, including regional settings, regulatory profiles, isolated local development, branding, i18n, and clinical workspace localization.
• GitHub reports 580 views / 111 unique viewers and 20,305 clones / 789 unique cloners for 2026-08-16 through 2026-08-29, but the clone pattern is automation-heavy and is not a human-user count.
• The earlier read-only configured-data audit remains: 56 practices, 12 with non-demo appointments, 10 recent non-demo creators, 430 clients, 1,001 patients, 38 appointments, and 109 invoices.

Updated defensible conclusion: real external people are demonstrably evaluating and materially adapting OpenVPM, and configured non-demo activity exists. There is still no verified evidence that a veterinary clinic safely relies on it for daily patient care.

The operational boundary is also confirmed: the Staging GitHub environment has zero environment secrets and zero variables. Its only required reviewer is the repository owner with self-review prohibited, so a second independent human is structurally required before a staging deployment can proceed. The only repository Actions secret is DEMO_DATABASE_URL; it is not an isolated staging configuration. No environment or secret was changed during this audit.

[evangauer]

Release-train closeout update: the retained draft stack now contains 18 PRs and ends #310 -> #311 -> #312. #312 rejects zero-byte independent-object restores and zero-millisecond RTO claims that could previously satisfy the strict provider evidence packet.

Exact head a0e955558198b4faec78980c2cf30672db1c1c39 is fully green: https://github.com/evangauer/openvpm/actions/runs/33349594191

No merge, deployment, provider access, configured database access, environment mutation, provisioning, or spend occurred. The release remains NO_GO. The remaining work is not another packet-shape assertion: it is independent human review, isolated staging authorization and resources, the real provider-backed restore, clinical-owner dispositions, and the supervised five-day clinic pilot.