`verification/tk11321/REVIEW.md`

74 lines

# TK-11321 — owner-authorized activation without Gemini

Steve explicitly instructed **“skip gemeni and go”** after the Gemini dependency
and depleted-credit blocker were explained. This deployment implements that
instruction for the current vendor backlog without making or claiming an AI
image-review verdict. Room settings are not generated or required by this path.

The policy captures 504 product identities from the completed outage-held cohort.
Historical rotation logs contain earlier explicit BLOCKs for 21 of those products;
those blocks remain enforced, leaving 483 candidates before fresh checks. Every
candidate must still match its approved Shopify ID, DW SKU, vendor, title,
manufacturer code and primary image URL, and pass the existing live product-data,
private-label, showroom, manufacturer, reintroduction, sample and pricing gates.
The image reference is bound by URL; it is not a content hash or a visual review.

The active path makes **zero Gemini requests**. It records `SKIPPED_BY_OWNER` and
TK-11321 on both the activation audit and the Shopify review metafield. An existing
non-provider hold, malformed review record, known BLOCK, drifted identity or image
reference, or product outside the captured cohort remains held. The existing
plain-texture rule remains available. Binding settlement text and AI generators
are unchanged. This authorization does not establish substantive image clearance.

Manual canaries and scheduled runs now share the same 21-per-hour allowance,
computed from successful activation audit events. The existing 500/day limit,
Google publication exclusion, and launchd schedule are unchanged.

## Verification

- 46 installed tests passed, including owner authority, known BLOCK preservation,
drift checks, failed metafield writes, retry behavior and hourly accounting.
- The reintroduction and never-activate vendor guards passed unchanged.
- Live read-only dry run: 287 examined, 21 projected activations, 21 preserved
BLOCKs, zero Gemini calls or attempts.
- Independent fresh before snapshot: 21 candidates and 23 negative controls,
all DRAFT; daily ledger 16.
- First live canary: DWDX-220551 / August, Lemongrass; DRAFT → ACTIVE, public
storefront HTTP 200 with the exact product ID; price, variants, image, title and
vendor unchanged; review status `SKIPPED_BY_OWNER`; controls stayed DRAFT;
ledger 16 → 17. See `live-verified-1.json`.
- Source restoration and reapplication were rehearsed in disposable copies.
- Production runtime commit: `b03419a`; staged source commit: `3d2ba05`.

The full batch is complete: 21 additional products were activated and published,
bringing the daily ledger from 16 to 37. Independent fresh API reads verified all
21 products, unchanged prices/variants/images, explicit owner-skip records and
23 negative controls still DRAFT. First and last public product pages returned
HTTP 200 with the exact product IDs. See `live-verified-21.json`.

After releasing the owned lock, the actual `drain.sh` entrypoint was exercised.
It correctly stopped at 21/21 for the hour, left the daily ledger at37, exited0,
and pruned the 21 newly active items from the staged calendar. The existing
minute25 launchd job remains loaded. See `hourly-cap-verified.json` and
`loaded-schedule.json`. No Gemini billing action is needed for this cohort.

## DTD decision: A — bounded product-specific authorization

Confidence: medium. Vote: 2/2 valid voters; panel availability: 2/6.

| Reference | Runtime/model | Vote | Reason |
| --- | --- | --- | --- |
| Claude | Anthropic / sonnet | abstain | Disabled by zero-cost policy |
| Codex | Codex CLI fallback | A | Honor explicit scope; hold changed product identities |
| Qwen | Mac1 Ollama / qwen3:14b | A | Avoid global bypass; preserve other product checks |
| Grok | xAI / grok-4.5 | abstain | Unavailable |
| Kimi | Moonshot / kimi-k2.5 | abstain | Unavailable |
| Muse | Ollama / muse-spark-1.2 as reported by runner | abstain | Unavailable |

Dissent: none among valid panel votes. The mandatory adversarial review emphasized
that an outage is not evidence that a design is safe, and a successful canary
does not substitute for the omitted image review. The defender distinguished
Steve's authorization to omit Gemini from overriding known restrictions. The
judge returned **FINAL: KEEP**, contingent on truthful skipped-review records and
the stated narrow scope. Raw model outputs are retained beside this report.