Track the bootstrap MVP
Last evidenced update: 2026-08-27.
Verified current state
| Sequence | Scope | Delivery status | Evidence | Material blocker |
|---|---|---|---|---|
| 1 | ESHOPV1-EP-1 | TO_BE_RELEASED (DERIVED) | All four required Features are TO_BE_RELEASED; Argo CD manifests reached application head 3be141af869220620672b04681d335fb2803f425 | Harbor authentication failed in Actions task 1448; publication, deployment, and Sandbox verification remain blocked |
| 1.1 | ESHOPV1-FT-1 | TO_BE_RELEASED (DERIVED) | Nine-product evidence-backed gallery and governed artifact workflow merged | Actions run 3203 was rejected by Harbor during task 1448; no image was published |
| 1.2 | ESHOPV1-FT-2 | TO_BE_RELEASED (DERIVED) | Cart implementation and governed artifact workflow merged | Actions run 3203 was rejected by Harbor during task 1448; no image was published |
| 1.3 | ESHOPV1-FT-3 | TO_BE_RELEASED (DERIVED) | Fail-closed PayPal Sandbox BFF merged and tested | Runtime Sandbox credentials must use the approved secret path |
| 1.4 | ESHOPV1-FT-4 | TO_BE_RELEASED (DERIVED) | Confirmation surface and governed artifact workflow merged; exact-head tasks 1435 and 1436 passed | Successful deployed Sandbox capture is not verified |
The application default head is 3be141af869220620672b04681d335fb2803f425. No item is DONE: merged GitOps manifests and validation do not replace successful artifact publication, deployment, and release verification.
Predicted upcoming plan
- Resolve the Harbor
unauthorizedauthentication result from task1448through the approved secret-management path without exposing credential values. The required organization secret name is present. See Prepare the Sandbox release. - Publish the exact application image and chart from an exact-head successful workflow and record immutable references.
- Onboard the E-Shop workload through the governed GitOps template/render workflow.
- Verify the deployed gallery and cart without payment credentials.
- Inject PayPal Sandbox-only credentials through the approved runtime secret path and verify create/capture plus confirmation.
- Advance exact Tasks and deterministic parent roll-ups to
DONEonly with durable deployment and acceptance evidence.
No stage grants production go-live. The launch catalog remains nine defensible products; three additional records remain excluded because no evidence-backed product and price could be established.