# CityZeen Marketplace Pass/Rail Checklist

Use this checklist before each client demo or onboarding session.

Pass condition: all critical items are `PASS`.
Rail condition: any critical item `FAIL` blocks launch.

---

## 1) Deploy & Branch Integrity (Critical)

- [ ] `PASS` Preview/Prod deployment uses branch `feat/w18-2-chk5-autonomous`
- [ ] `PASS` Deployment hostname matches the intended hosting project (confirm in dashboard before demo)
- [ ] `PASS` Deployment includes latest expected commit hash
- [ ] `PASS` No unexpected uncommitted local changes

If any fail: stop and fix deployment/source mismatch first.

---

## 2) Auth & Access Guardrails (Critical)

- [ ] `PASS` `/investor` redirects to `/login` when not authenticated
- [ ] `PASS` `/provider` redirects to `/login` when not authenticated
- [ ] `PASS` `/admin` redirects to `/login` when not authenticated
- [ ] `PASS` `/icp.html` redirects to `/login` when not authenticated
- [ ] `PASS` Wrong role cannot open another role portal (e.g. investor -> admin)
- [ ] `PASS` Session expires and requires login again (TTL behavior)

If any fail: do not onboard clients.

---

## 3) Investor Journey (Critical UX)

- [ ] `PASS` First screen shows **Request Allocation** as primary full-width block (not side/aside)
- [ ] `PASS` Tranche selection updates selected tranche summary
- [ ] `PASS` Request Allocation CTA routes into compliance-gated flow
- [ ] `PASS` Investor **Account** screen exists and is accessible from top nav + mobile nav
- [ ] `PASS` Integrations screen loads and key status cards render

---

## 4) Provider Journey (Critical UX)

- [ ] `PASS` Provider **Account** is visible in top nav, mobile, and banner links
- [ ] `PASS` Account includes onboarding checklist (identity -> KYB -> settlement -> issuance)
- [ ] `PASS` Launch Issuance validates required fields and blocks invalid submission
- [ ] `PASS` Launch Issuance button shows loading state and prevents double submit
- [ ] `PASS` Provider ERP Odoo webhook failures queue safely (issuance remains tracked)

---

## 5) Admin Controls & Safety (Critical Ops)

- [ ] `PASS` High-risk actions require reason + typed confirmation:
  - escalate, initiate tokenization, bulk approve, mint, burn
- [ ] `PASS` High-risk actions enforce two-person reviewer + evidence reference
- [ ] `PASS` KYC/KYB/AML action buttons disable and show busy labels while running
- [ ] `PASS` Admin DB upload validates records and blocks invalid file types
- [ ] `PASS` Replay/conflict telemetry visible in Admin token control plane
- [ ] `PASS` Admin ERP Odoo webhook failures queue safely without silent data loss
- [ ] `PASS` Retry queue flush controls operate from Admin (admin + provider queues)

If any fail: no client-facing operations.

---

## 6) Brand & UI Consistency (High)

- [ ] `PASS` Shared brand stylesheet is loaded (`/cityzeen-brand.css`)
- [ ] `PASS` Fonts and color identity align with `cityzeen.co` style
- [ ] `PASS` No major visual regressions on mobile nav or CTA hierarchy

---

## 7) Analytics & Observability (High)

- [ ] `PASS` Vercel Analytics script present on core pages:
  - `index`, `login`, `investor`, `provider`, `admin`, `icp`
- [ ] `PASS` Vercel preview metrics receive traffic after manual test clicks
- [ ] `PASS` Token audit chain verifies as valid in Admin (`audit chain OK`)
- [ ] `PASS` Replay-blocked attempts appear in telemetry after duplicate action test
- [ ] `PASS` Direct Odoo health endpoint responds (`/api/health-odoo`)

---

## 8) Tokenization Safety Rails (Critical)

- [ ] `PASS` Token transitions require idempotency key (no duplicate state writes)
- [ ] `PASS` Replay transition attempts are blocked + audited
- [ ] `PASS` Compare-and-set transition conflicts are blocked (fromState mismatch)
- [ ] `PASS` Investor duplicate buy attempts are blocked without double-write

---

## 9) Quick Go/No-Go Decision

### GO

All items in sections 1, 2, 3, 4, 5 are `PASS`.

### NO-GO

Any critical item is `FAIL`.

---

## 10) Test Session Log (fill each run)

- Date:
- Environment URL:
- Branch/Commit:
- Tester:
- Critical failures found:
- Go/No-Go:
- Notes: