# StoMale R1 - Consolidated approval checklist

Current checkpoint: **R1 1.8.2 — four-person project environment, tutorial Academy and synthetic incomplete-assessment reporting complete; manual QA evidence pending**. This is the single operational list for decisions and approvals. An approval is not inferred from silence, testing activity, saved local feedback or access to the preview.

## A. Hard blockers

These items block only the boundary shown. Independent preview and foundation work may continue.

| Blocker ID | Source IDs | Decision or evidence required | Owner | Blocking boundary | Status |
|---|---|---|---|---|---|
| BLK-G0-01 | D-A01 | Name controller/legal entity, office and DPO/contact | Sponsor | Any real-data notice, collection or processing; G0 | Open - existing |
| BLK-G0-02 | D-A02 | Name authorized Model Authors and Clinical Lead; confirm delegation/SLA | Sponsor + Authors | Clinical governance and G0 | Open - existing |
| BLK-G0-03 | D-A03, MDL-001..025 | Sign one canonical model package and formula rules; approve golden cases | Model Authors | Canonical promotion or any real use of clinical behavior | Open - existing |
| BLK-G1-01 | D-A06 | Approve purpose, necessity and timing of mandatory phone | PO + DPO | Phone field, OTP or phone-data processing | Open - existing |
| BLK-G1-02 | D-A07, D-A09 | Select and approve providers, DPA/TIA, regional controls and budget | Tech + DPO + Sponsor | Additional providers and real-data service activation | Open for remaining provider/legal approvals; Google SSO and four-person project hosting are implemented, not pending setup |
| BLK-G1-03 | D-T01 | Confirm branch-protection administrators and remote CI evidence for the existing Sites repository | Maurizio / Tech Lead (decision); Codex (execution and evidence) | Remote CI evidence and team delivery | Open - existing |
| BLK-G2-01 | D-A11 | Approve retention by domain, RPO/RTO and restore acceptance | Tech + DPO | Persistent personal/assessment/monitoring data store | Open - existing |
| G2-SSO | ADR-018, D-T27, D-T36 | Exact four-address allowlist, authenticated session boundary and deny-by-default access | Maurizio + Security + Privacy | Shared private BO, Labs and previews | Closed for the four-person project environment at www.sto-male.com: application Google SSO and server-side allowlists active. Broader real-data use remains under G1 |
| G2-CODEX | ADR-018 | Approve private repository, trusted runner, API/workspace credential, budget and audit | Maurizio + Tech + budget owner | Automatic Codex execution bridge | Open - local queue and fail-closed bridge contract prepared |
| D-A08 | MDL-021 | Provide exact thermometer bands, boundaries, labels and result text | Model Authors + UX | Clinically meaningful result presentation | Open - existing |
| BLK-ACT-01 | G0/G1/G2/G3 | Signed gate record and explicit activation authorization | Named gate approvers + Sponsor | Real participant users, real data or beta invitations beyond the existing four-person synthetic project environment | Open - existing |

## B. Batch approvals - non-blocking for the four-person project environment

| Review ID | Artifact / task | Owner or reviewers | Acceptance focus | Due boundary | Status |
|---|---|---|---|---|---|
| REV-UI-01 | Landing and invite entry | PO, UX, Content, Legal/DPO | Promise, limitations, CTA, responsive and keyboard behavior | Before wider access | Ready for review |
| REV-UI-02 | Synthetic onboarding | PO, UX/A11y, Legal/DPO | Age scenarios, anti-enumeration copy, local-state disclosure, focus order | Before S3 implementation | Ready for review |
| REV-UI-03 | Personal home and navigation | PO, UX/A11y | Information hierarchy, mobile navigation, clear clinical lock | Before S2 design baseline | Ready for review |
| REV-UI-04 | Synthetic check-in and activity views | PO, UX, Content, Clinical reviewer | Confirm wording is non-clinical and no implied score/interpretation exists | Before S7 implementation | Ready for review |
| REV-UI-05 | Preferences and accessibility controls | PO, UX/A11y | User choice precedence, quiet hours, reduced motion, text scaling | Before S8 implementation | Ready for review |
| REV-UI-06 | Privacy center demo | DPO/Legal, UX | Local-only disclosure, export/reset, separate choices, no dark pattern | Before S3/S11 implementation | Ready for review |
| REV-UI-07 | Help and support boundary | Operations, Content, Clinical/Safety, Legal | Technical support vs clinical care; no human-monitoring promise | Before real support channel | Ready for review |
| REV-BRAND-01 | Brand B rollout and Respiro identity | Erika + Daniele collaborate and validate; Maurizio decides; Codex executes | Verify accessibility, applications and claims of the selected Respiro identity | Before wider access | GFX-B-1.3 workflow available in Brand Lab and BO |
| REV-CONTENT-01 | Trust-led Italian content `CONTENT-IT-1.3.0` | Erika + Daniele collaborate and validate; Maurizio decides; Codex executes | Verify recognition, utility, authority, expectation setting, claims, boundaries, accessibility and psychological meaning across site and assessment surround | Before wider access | Applied to private preview; dedicated Communication Lab workflow available |
| REV-ILLUSTRATION-01 | Direction B “Spazi che accolgono” and GFX-B-1.2.x/1.3.5 | Erika + Daniele collaborate and validate; Maurizio decides; Codex executes | Verify inclusion, alternative text, intensity, portraits and non-interpretive use | Before product-wide rollout | Erika and Daniele portraits applied; release-level feedback/rework workflow available in Lab and BO |
| REV-UX-1.4-01 | `UX-IT-1.4.0` / `GFX-B-1.4.0` layout, peritext and mobile-first assessment | Erika + Daniele collaborate and validate; Maurizio decides; Codex executes | Verify page alignment, semantic illustration placement, assessment comfort, helper neutrality, touch use and narrow-screen behavior | Before wider access | Applied to private preview; feedback, approval and rework available in Lab and BO |
| REV-GFX-1.4.1-01 | `UX-IT-1.4.1` / `GFX-B-1.4.1` scenic illustration integration | Erika + Daniele collaborate; Maurizio decides; Codex executes | Review continuous hero landscape, narrative scene bands, embedded portraits, assessment welcome scene and mobile recomposition | Before wider access | Applied to private preview; visual specimens, rollback, feedback, approval and rework available in Lab and BO |
| REV-MOBILE-1.6-01 | `UX-MOBILE-1.6.0` complete mobile system | Erika + Daniele collaborate; Maurizio decides; Codex executes | Review iPhone and Android reflow, touch comfort, safe areas, keyboard, landscape, assessment actions and reviewer tools | Before wider access | Applied to private preview; device matrix, rollback, feedback, approval and rework available in Lab and BO |
| REV-UX-CONTENT-1.6.1-01 | `UX-CONTENT-1.6.1` fluid composition and guided journey | Erika + Daniele collaborate; Maurizio decides; Codex executes | Review symmetric desktop margins, vertical rhythm, separate text/image areas, assessment controls, selective per-question help and assessment-gated monitoring | Before wider access | Applied to private preview; release, rollback, feedback, approval and rework available in Lab and BO |
| REV-ASSESSMENT-REMINDER-01 | Save/resume and WhatsApp reminder contract | Maurizio + Erika + Daniele; Privacy/Tech before activation | Review consent, gentle copy, 1/day cap, direct-resume behavior, completion stop, opt-out and data-minimized provider payload | Before real messaging | Save/resume and local outbox applied; provider, phone collection and real delivery remain OFF |
| REV-BO-GUIDE-1.6.1-01 | `BO-GUIDE-1.6.1` guided Cabina di progetto | Erika + Daniele collaborate; Maurizio decides; Codex executes | Review first-visit clarity, role-based tasks, progressive disclosure, explained repository, tutorial usefulness and accessibility | Before shared team access | Applied to private preview; release feedback/rework available in Lab and Cabina |
| REV-ASSESS-FLOW-1.6.2-01 | `ASSESS-FLOW-1.6.2` assessment validation and flow audit | Erika + Daniele collaborate; Maurizio decides; Codex executes | Review corrected per-emotion frequency semantics, no-dead-end behavior, contextual error messages and unchanged clinical model | Before wider access | Applied to private preview; 145 source questions and all Adult/Couple branches covered by automated contracts |
| REV-ACCESS-GUIDE-1.6.3-01 | `ACCESS-GUIDE-1.6.3` SSO, gateway and contextual Cabina guide | Erika + Daniele collaborate; Maurizio decides; Codex executes | Review account access, gateway orientation, contextual explanations, role boundaries, AI disclosure, mobile layout and failure fallback | Before broader team access | Applied to three-person private preview; guided text, OpenAI free-form answers and natural Italian voice active with server-side credential |
| REV-ACCESS-GATEWAY-1.6.4-01 | `ACCESS-GATEWAY-1.6.4` authenticated root and direct assessment registry access | Erika + Daniele collaborate; Maurizio decides; Codex executes | Verify login-to-gateway handoff, separation of project BO and results registry, direct anchor and three-account authorization | Before broader team access | Applied to the private preview; participant site remains available from the gateway at `/sito/` |
| REV-ASSESSMENT-BO-1.7.0-01 | `ASSESSMENT-BO-1.7.0` product Back Office and project-tool boundary | Erika + Daniele collaborate; Maurizio decides; Codex executes | Verify naming, standalone navigation, person/attempt filters, full answer flow, attributed notes, synthetic-only boundary and absence of assessment data from the Cabina | Before real assessment operations | Applied to the private preview at `/assessment-bo/`; real-data activation remains blocked by G0/G2 controls |
| REV-CABINA-UX-1.7.1-01 | `CABINA-UX-1.7.1` modular Cabina and SSO personal views | Erika + Daniele collaborate; Maurizio decides; Codex executes | Verify role-relevant home/actions, administrator completeness, module separation, understandable sprint explanations, shared context and no identity impersonation | Before broader team workflow | Applied to private preview; identity is derived from the application Google-authenticated session and technical tools are reserved to Maurizio’s view |
| REV-CABINA-UX-1.7.2-01 | `CABINA-UX-1.7.2` actionable sprints, downloadable documents and scalable assessment registry | Erika + Daniele collaborate; Maurizio decides; Codex executes | Verify per-role sprint activities, structured debrief/brief handoff, accurate document descriptions/downloads, useful non-diagnostic clusters, filtering at scale and separate person analysis | Before broader team workflow | Applied to private preview; stakeholder review remains in the single non-blocking checklist |
| REV-PROD-READY-1.7.3-01 | `PROD-READY-1.7.3` micro-fix, notification CTA and production SSO handoff | Erika + Daniele collaborate; Maurizio decides; Codex executes | Verify Back Office contrast, integer-only numeric inputs, correct `Procedi`/`Review` branching, sprint deep links and deny-by-default production handoff | Before production activation | Completed for the project environment: domain www.sto-male.com and Google SSO active; the Cloudflare handoff is a historical alternative, not a pending setup task. Real-service gates remain open |
| REV-PERSONAL-LANGUAGE-1.7.4-01 | `PERSONAL-LANGUAGE-1.7.4` personal management language | Erika + Daniele collaborate; Maurizio decides; Codex executes | Verify feminine forms for Erika, masculine forms for Daniele/Maurizio, correct SSO-derived view and no changes to participant or clinical content | During stakeholder use | Implemented in management surfaces. Owner: Maurizio; optional feedback does not assign operational work to Erika or Daniele |
| REV-G2-TTS | Natural Italian voice and eight tutorial videos, R1 1.8.0 | Maurizio owns; Codex executes | Optional listening feedback on calmness, clarity and warmth | During team use | Implementation complete; published in Sites version 33, commit 3500c4e7a42e138954ea802bb3fdbac35dd92678; no hard blocker |
| REV-TUTORIALS-1.8.0-01 | `TUTORIALS-1.8.0` guided Academy and contextual help | Maurizio owns; Codex executes; Erika and Daniele may review without operational assignment | Verify the eight-video learning path, warm Italian narration, captions, direct destinations and contextual links in Gateway, Cabina, Lab, review space and assessment Back Office | During stakeholder use | Applied without changing the clinical model; optional stakeholder feedback remains non-blocking and creates no automatic assignment |
| REV-VIRGINIA-1.8.1-01 | `VIRGINIA-ACCESS-1.8.1` supervisor access and workflow boundary | Maurizio owns; Virginia supervises the Lab; Codex executes | Verify Google access, feminine language, complete read visibility, Lab-only contributions, synthetic assessment feedback and absence of new approval dependencies | During stakeholder use | Applied; Virginia receives notifications only for Lab tasks explicitly assigned to her from 8 September 2026 |
| REV-ASSESSMENT-PROGRESS-1.8.2-01 | `ASSESSMENT-PROGRESS-1.8.2` aggregate progress registry | Maurizio owns; Codex executes | Verify separate incomplete/completed views, completion ratio and absence of partial answers or results in progress telemetry | During synthetic testing | Applied; non-blocking review available in the Back Office |
| REV-DATA-SYN-01 | Synthetic Assessment Registry | Maurizio + Tech; Privacy/Security review before real use | Verify immutable attempt history, pseudonymous subjects, BO authorization, reset/retest and failure recovery | Private synthetic preview now; before any real data | Implemented in `DATA-SYN-0.1.0`; real-data path absent and blocked by G0-DATA/G2-TECH |
| REV-CLIN-COPY-01 | Gender-aware UI language and warm help for difficult questions | Model Authors, Content, UX/A11y | Exact approved grammatical variants, comprehension support, no semantic/scoring/routing drift | Before changing canonical question presentation | Ready for review |
| REV-OPS-01 | Read-only readiness console | Product, Tech, QA, Security | Correct blocker/evidence state and no raw/sensitive data | Before S9 implementation | Ready for review |
| REV-ADR-01 | ADR-011 private synthetic preview | Tech, Security, DPO | Owner-only access, controlled schema, no backend/external calls | Before widening access | Ready for review |
| REV-QA-01 | WP-14 final QA evidence, R1 1.8.2 | Maurizio coordinates; Codex executes | Manual browser/device/accessibility acceptance and documented limits | Before QA closure | Open execution task: 72 unit, 6 integration and 2 end-to-end tests passed; manual evidence is still outstanding |
| REV-CTL-01 | DEV-004 review center and DEV sequence | Product, Tech, QA, Security, UX/A11y | Accurate story mapping, status semantics, preview links, local feedback boundary and reset/export | Before shared workflow or status promotion | Ready for review |
| REV-CLIN-01 | DEV-008…010 assessment candidate | Model Authors, Clinical Lead, UX/A11y | Exact wording, branches, formulas, missing/invalid policy, result comprehension | Before canonical promotion | Ready for review |
| REV-SAFE-01 | DEV-014 safety and Model Lab | Clinical Lead, Legal, Operations | Trigger/action/resource contract, responsibility and expiry | Before any real clinical use | Ready for review |
| REV-R1-01 | DEV-016 candidate demo and evidence pack | Steering, Model Authors, QA, Security, UX/A11y | Cross-module acceptance, documented conditions and rework ownership | Before activation decision | Ready for review |
| REV-GOV-01 | Stakeholder workflow and Agile brief generator | Maurizio, Erika, Daniele, Codex | Validate roles, joint competence review, final decision, execution routing and evidence publication | Before shared team use | Implemented in local private preview |
| REV-NOTIFY-01 | Workflow e-mail rules and outbox | Maurizio + Privacy + Tech | Approve recipients, provider, lawful treatment, templates and delivery controls | Before real e-mail delivery | Product outbox remains a local simulation. Separate authorized e-mail notifications have been reported sent in the project conversation; they are not proof of an integrated product mail provider |
| REV-TASK-MAIL-01 | Immediate task mail, first-login briefing and Monday digest | Maurizio + Erika + Daniele; Privacy/Tech before activation | Verify individual/shared classification, exact recipients, task periods, idempotency, unsubscribe/error handling and AI copy boundary | Before real workflow e-mail delivery | External scheduled notification requests exist in the project conversation; current scheduler execution was not reverified in this alignment. Product outbox/provider remain separate. Never infer assignments to Erika or Daniele from optional review |

## C. Not activated

- The production shell is live at `https://www.sto-male.com`; the hosting route is public only to permit the branded login, while application access is denied by default and restricted to the four approved Gmail identities.
- Gmail identities are verified server-side by the application session boundary. No real contact, consent, assessment, monitoring or support data enters the product.
- Application Google sign-in is active for the four authorized identities. Product analytics, participant messaging, real payment, referral and partner activation remain outside the enabled scope.
- A separately named candidate assessment is executable only in the four-person project environment with synthetic data. It has no approved bands, diagnosis, advice, referral or external safety action and is not the canonical Kernel.
- The canonical clinical Kernel remains empty/locked; no candidate artifact can be promoted by configuration or reviewer silence.
- No approval in section B satisfies or weakens a blocker in section A.

## Review recording rule

For every decision, record reviewer identity, authority, artifact/version, date, outcome, conditions and review expiry. Rejected or conditional items return to the same row with evidence links; they are not silently reclassified.

The responsible person supplies the domain instruction with expected outcome, acceptance criteria and evidence. Erika and Daniele validate competence briefs jointly; Maurizio approves the resulting Agile package; Codex owns technical execution, rework, verification, evidence update and preview publication. The private preview can queue an approved Codex job locally, but the server-side execution bridge remains OFF until a provider and authenticated workflow store are approved; a browser-only job must never be represented as repository execution.