Hardening and Continuity Cut

Updated 9 September 2026

Initial hardening was deployed on 7 September 2026; the Stage 1 extensions followed on 8 September. This improves the technical pilot; it is not a production-readiness certification.

What Staff Can Use

1. Open Teams → OCDIT → Inbox. Reload the app to load the update.
2. Open a case you own → Case Context. Write a continuity summary and its intent, outcome and process. Choose Save Context.
3. For a potentially reusable answer, select Nominate as a Knowledge Candidate. This is a nomination only. Use the subsequent Knowledge Library workflow to draft, review and reuse an answer.
4. Select All Conversations and search an older message, internal note or case tag. Search covers captured text, including resolved cases in that view.
5. Open Service Report for backlog, handovers, nominations, first-response samples and outstanding delivery jobs. Close and reopen it to refresh the snapshot.

Context remains internal and follows the case through handover. Only the current owner may edit it; other enabled staff may read it. Concurrent updates require an explicit review of the latest saved context, keeping the employee's edits intact. No AI service receives conversation data. Customer identities remain channel-specific.

Hardening Delivered

• New action IDs are bound to a hash of their payload. Reusing one with changed content returns a conflict; an identical retry does not repeat the action.
• Malformed action bodies return a validation error. Existing ownership, revision, tenant, scope and authenticated employee checks remain enforced.
• A restart quarantines interrupted sends as uncertain, records an audit event and schedules updated Teams visibility. It never automatically resends them.
• Shutdown stops taking jobs and allows the active worker call to finish, bounded by 25 seconds. Forced termination still follows uncertain-send recovery.
• scripts/backup.py makes a consistent SQLite backup, restores it separately and checks integrity, foreign keys and all application-table row counts. It never replaces a file.
• The production dependency audit reported zero known vulnerabilities at the check date. This is a registry check, not a penetration test.

Evidence and Measurement Limits

Fifteen automated tests pass, including context authorization, changed-payload retries, internal isolation, historical search, reporting and worker drain. The existing 200-case queue, cross-channel, SSO, delivery ambiguity and restart tests pass. Browser checks used fictional data: context save, conflict, review and successful retry passed at the actual desktop browser size. This cut has no new mobile claim.

A consistent copy of the live database passed an isolated restore check before deployment. The previous application and database backups remain available. No tenant, credential, nginx or other application configuration changed.

Reports cover all captured history, not a selected period. First response is the time from the earliest inbound message to queuing the first subsequently accepted reply, for answered channel identities only. It is not delivery latency, per-case reopening performance, or an SLA. Resolved counts are current states. Handovers count successful handover actions. These measures do not establish the PDF's adoption or service-improvement thresholds without a business baseline.

Gates Before Real Customer Traffic

1. Business owner: define subsidiary boundaries, staff/manager roles, retention, deletion, backup location and recovery objectives. No automatic deletion is enabled.
2. Agent and administrator: rehearse the implemented offboarding and supervisor recovery with separate authorized employees.
3. Channel administrator and agent: replace sandbox credentials/account paths, rehearse rotation, and verify production messaging entitlements. WeChat plaintext sandbox callbacks remain a production blocker; encrypted callbacks are not built.
4. Agent: implement monitored off-host backups and a service-level failover drill. The current restore check does not prove recovery of ingress, endpoints or Teams.
5. Agent: rehearse the Azure cutover and capacity limits, then finish the incident runbook and alerts. One SQLite process remains the supported pilot topology.

Current Product Scope

The Stage 1 Build now includes knowledge review, verified/unverified profile facts, explicit relationship links, feedback and period reporting. Platform and workspace administration, purpose-specific decisions, capture exclusions and reviewed logical deletion are deployed. AI suggestions require human review and live inference remains disabled. Real policy decisions, external-copy disposition, multi-user acceptance and production operations remain rollout gates.