Settings

Feature flags gated on the phase gates, typed configuration, the stock-type and location registries, secret rotation status, integration config and the role mapping. Every change is an append, never an overwrite.

Phase 1 of 9 GATE-1 day 6 / 7 Flags 14 · 6 authoritative · 4 shadow · 4 disabled Gate-locked flags 4 Secrets overdue 1 Sections 1..9 · Search /

Feature flags

Three states, not a boolean. A flag in shadow computes its answer and records disagreement without acting on it. Promotion to authoritative needs the mismatch rate under the bar and its gate to have passed.

35-day shadow window

SHOPIFY_DIRECT_INGEST authoritative

Shopify order webhooks post directly to the quantity ledger. Keyed on variant.id, never on the SKU string, so a rename does not orphan the stream.

Usage 7d 2,481,209 evaluations · 0 errors

ahmad@ promoted to authoritative 18-07 09:12 · shadow divergence 0.04% for 9 days · ahmad@ created 01-07

Core

OPS2_DISPATCH_AUTHORITATIVE authoritative

ops2 dispatch events own courier handoff. Other sources are shadow inputs for drift detection only.

Usage 7d 318,402 evaluations · 0 errors

ahmad@ promoted 14-07 14:02 · fatima@ tightened the AWB match window to 48h 21-07 11:28

Core

CARRIER_STATUS_TO_QUARANTINE authoritative

A carrier-confirmed return moves units to QUARANTINE: present, owned, not sellable. A status string is structurally incapable of crediting sellable stock, and only a physical scan moves units out.

Usage 7d 1,842 evaluations · 197 would-have-credited events refused

ahmad@ promoted 16-07 08:55 · created after 197 rows claimed "returned" about parcels the carrier had delivered

Reconciliation

CLOSE_FREEZE_REQUIRES_ZERO_RESIDUAL authoritative

A close whose category decomposition does not add up to its independently computed closing balance cannot be frozen. Turning this off would let a residual be absorbed into next month's opening.

Usage 7d 3 evaluations · 3 freezes refused

ahmad@ created authoritative 02-07 12:08 · never been disabled

Safetykill switch disarmed: this flag is a correctness guard

CLEAN_COUNT_WRITES_VERIFICATION authoritative

A zero-variance count writes a balance_verifications row, not a ledger row. A zero-quantity ledger row is forbidden, and without this a diligently counted location would drift to "never verified" precisely because it keeps passing.

Usage 7d 1,204 verifications · 188 variances routed to the ledger

ahmad@ promoted 24-07 10:14 · 78% of counts are clean, so this is the majority path not the exception

Counts

SAMPLE_72H_AUTO_FALLBACK authoritative

Auto-route SAMPLE_QC to SAMPLE_POOL after 72h of inactivity, so an unclassified sample cannot sit in a QC bucket forever.

Usage 7d 88 evaluations · 2 in breach at 148h

fatima@ tuned the SLA 48h to 72h 20-07 10:14 · ahmad@ promoted 12-07 18:22

Programs

CSD_RESERVATION_PER_LINE shadow GATE-2

Hold every SKU on a case at its own location and quantity, keyed per line and per sequence. The incumbent sends only the first SKU of the case with quantity 1 and a hardcoded location, and its key has no line, so a case re-entering approval is deduplicated away and never re-held.

Target authoritative on GATE-2 pass · gate streak 0 / 7 · shadow day 12 / 35

Usage 7d 4,182 evaluations · 312 shadow mismatches (7.5%, bar is 0.5%)

ahmad@ flipped disabled to shadow 18-07 09:00 · 312 mismatches are all cases with more than one SKU, which is the defect this flag exists to fix

Reversepromotion refused: GATE-2 streak 0/7 and mismatch 7.5% over the 0.5% bar

RFID_UNIT_LEDGER shadow GATE-6

The unit ledger becomes a peer of the quantity ledger, keyed on sku_id with the SKU code kept only as a frozen display copy so a rename cannot orphan an encoded tag.

Target authoritative on GATE-6 pass · gate streak 0 / 7, best 4 · shadow day 18 / 35

Usage 7d 1,842,118 unit hops · no data for 3 days, gate G2 offline

ahmad@ flipped to shadow 10-07 07:30 · streak reset 4 to 0 on 27-07 when the metric returned NULL

RFIDpromotion refused: GATE-6 streak 0/7, metric NULL for 3 days

COST_LAYER_VALUATION shadow GATE-3

Value stock at the layer the units arrived on rather than at one company-wide current cost. Without it a single new receipt reprices every unit on the shelf, and a past valuation changes when somebody edits a cost.

Target authoritative on GATE-3 pass · needs cost confidence layered 95%, currently 91.4%

Usage 7d 184 valuation runs · AED 8.6% of value still estimated

ahmad@ flipped to shadow 08-07 22:14 · converging steadily, 74% to 91.4% in three weeks

Financepromotion refused: GATE-3 not started, confidence 91.4% under the 95% bar

PER_STORE_CUTOVER shadow MCC only

Per-store gradual cutover, scoped by location rather than globally, so a rollback is one flag flip at one store and never a database restore.

Sequence MCC then YAS 05-08 · CCZ 12-08 · AJM 19-08 · BAS 26-08 · 1 / 5

Usage 7d 18,402 evaluations at MCC · 0.06% divergence

ahmad@ enabled MCC shadow 14-07 07:30 · ahmad@ set the rollout sequence 12-07 22:14

Rollout

IWMS_CARTON_WEBHOOK disabled GATE-5

Accept carton create, move, split and QC events from the warehouse layer. Registered but not enabled: the sibling emits six inbound-warehouse topics and i3 needs the carton set to be complete first.

Blocked on a sibling PR · target shadow on the outbox landing

Usage 7d 0 evaluations

system registered the flag 16-07 21:40 · the subscription is registered before the topic is switched on, deliberately, so the first hour of events is not lost

Pending sibling

SHOPIFY_LEVELS_WRITEBACK disabled GATE-8

Push i3 balances back into Shopify inventory levels. Locked until the close is reproducible and one full month is signed, because a wrong write-back is visible to customers.

Locked to GATE-8 · streak 0 / 7 · gate not started

Usage 7d 0 evaluations

system registered 01-07 00:00 · never enabled in any environment

Cutovershadow itself is locked: even a dry run needs GATE-8

LULWA_BRAND_SCOPE disabled

Bring the second brand into scope. Held until MCC has cut over, per the phased rollout decision.

Target after MCC cutover, before the full estate

Usage 7d 0 evaluations

system registered 01-07 00:00

Scope

DEV_CONSOLE_WRITE_REQUIRES_APPROVER authoritative

Any write from the developer console needs a second named engineer. Includes replay to production, flag promotion, secret rotation and reopening a filed close.

Usage 7d 41 evaluations · 2 pending approval, oldest 41m

ahmad@ created authoritative 02-07 12:08

Safetykill switch disarmed: this flag guards its own kill path

Phase gates

Read-only mirror of the tracker. Waiving a gate is a named human decision with a reason and an expiry, and a waived gate renders differently from a passed one everywhere it appears.

1 passed1 holding2 failingOpen tracker

Gate	Phase	Streak	Best	State	Flags bound to it	Waiver
GATE-0	0 · Opening balance	18	18	passed	none	-	Open
GATE-1	1 · Sales and cancels	6	6	holding	SHOPIFY_DIRECT_INGEST	-	Open
GATE-2	2 · Reverse logistics	0	1	failing	CSD_RESERVATION_PER_LINE	-	Open
GATE-3	3 · Inbound and cost	0	0	not started	COST_LAYER_VALUATION	-	Open
GATE-4	4 · Transfers and retail	0	0	not started	none	-	Open
GATE-5	5 · IWMS physical	0	0	not started	IWMS_CARTON_WEBHOOK	-	Open
GATE-6	6 · RFID unit ledger	0	4	regressed	RFID_UNIT_LEDGER	-	Open
GATE-7	7 · Programs	0	0	not started	none	influencer source unowned	Open
GATE-8	8 · Close reproducible	0	0	not started	SHOPIFY_LEVELS_WRITEBACK	-	Open

A metric that returns NULL counts as a failing day and a metric computed over zero rows never counts as a pass. GATE-6 lost a streak of 4 to a collector outage rather than to a real regression, and the tracker says which.

Stock-type registry · 18

Five flags per type. These flags drive every measure in the system, so the table is migration-only: there is no UI that can edit a flag, because a mistyped flag would silently move a number on every page at once.

read-onlyseed migration is the only writer

#	Code	Dimension	physical	sellable	floor sell	owned	pipeline	Note
1	STOCK	condition	yes	yes	yes	yes	no	the ordinary case
2	DISPLAY_GOOD	condition	yes	no	yes	yes	no	on the floor, resellable
3	DISPLAY_DAMAGED	condition	yes	no	no	yes	no	owned, not resellable
4	QUARANTINE	condition	yes	no	no	yes	no	where a carrier-confirmed return lands
5	WRITTEN_OFF	condition	no	no	no	no	no	value already gone · finance approves
6	IN_TRANSIT_CUSTOMER	custody	no	no	no	yes	no	owned, unpaid-returns risk
7	IN_TRANSIT_RETURN	custody	no	no	no	yes	no	coming back from a customer
8	IN_TRANSIT_INTERNAL 17th	custody	no	no	no	yes	no	a truck between HQ_319 and MCC is not a customer risk
9	LOST_IN_TRANSIT	custody	no	no	no	no	no	terminal until an investigation resolves it
10	RTS_PENDING	custody	yes	no	no	yes	no	staged for return to supplier
11	RESERVED	custody	yes	no	no	yes	no	already left STOCK, so never subtract it again
12	RECEIVED_NOT_INVOICED	custody	yes	no	no	yes · corrected	no	ownership inbound is monotonic: title cannot un-pass at the dock
13	INFLUENCER_POOL	program	yes	no	no	yes	no	loan pool
14	SAMPLE_POOL	program	yes	no	no	yes	no	classified samples
15	SAMPLE_QC	program	yes	no	no	yes	no	72h SLA before auto-fallback
16	ON_TRIAL 18th	program	no	no	no	yes	no	out with a customer or staff member · a restoration, not an invention
17	IN_PRODUCTION	pipeline	no	no	no	no	yes	a real balance, not inventory · the deposit is a prepayment
18	GIT_INBOUND	pipeline	no	no	no	yes	yes	title passes at FOB, so goods on a ship are ours

18 types, not 14 and not 16. Any module or query hardcoding an older count is wrong, and the seed migration is the single place the list lives. Two of these flags carry the whole valuation: owned is the balance-sheet quantity, and physical is what a warehouse count should find.

Location registry · 10

The real codes, fetched from Shopify rather than guessed. Roll-ups are derived and never stored, so no row here can double-count the estate.

1 unmapped

Code	Name	Kind	Sellable	Shopify location id	On hand	Owned value	Note
HQ_319	Warehouse 319	warehouse	yes	18370396100	38,204	AED 5.84M	primary · RFID gates G1 and G2
HQ_325	Warehouse 325	warehouse	yes	18370396120	9,118	AED 1.20M	overflow and repack
MCC	Mirdif City Centre	store	yes	18370396140	1,842	AED 248K	first in the cutover sequence
YAS	Yas Mall	store	yes	18370396150	1,204	AED 168K	next in the sequence, 05-08
CCZ	City Centre Zahia	store	yes	18370396160	988	AED 143K	-
AJM	Ajman City Centre	store	yes	18370396170	742	AED 98K	-
BAS	Bawabat Al Sharq	store	yes	18370396180	610	AED 84K	-
TRANSIT	In transit	virtual	no	none	4,198	AED 1.28M	holds the transit types with a counterpart location
SUPPLIER_HOLD	Supplier hold	virtual	no	none	64	AED 13K	staged for RTS
3PL_ARAMEX	Aramex third-party	third_party	unmapped	18370396195	312	AED 49K	a live Shopify location that appears in no plan and no NetSuite account. Needs a mapping decision
DISCONTINUED	Discontinued pool	virtual	no	none	0	AED 0	terminal holding, currently empty

Sellable requires both the stock-type flag and the location flag. Stock sitting at TRANSIT in a sellable type is still not sellable, which is why the two flags are separate columns rather than one.

Valuation basis registry

Which cost basis i3 uses, and which basis the accounting system uses for the same items. A mismatch here is the single largest source of a reconciliation delta, so it is a declared fact rather than a discovery.

3 unconfirmedOpen recon

Scope	Applies to	i3 basis	NetSuite basis	Match	Confirmed by	Effect if mismatched
global	all SKUs, default	fifo_layer	unknown	unconfirmed	nobody yet	a permanent costing bucket that grows with price volatility
category	Leather goods	fifo_layer	fifo	yes	finance@ · 12-07	-
category	Fragrance	fifo_layer	average	no	finance@ · 12-07	AED 36.6K of the July costing bucket sits here
category	Jewellery	fifo_layer	unknown	unconfirmed	nobody yet	unknown until somebody reads an item record
sku	consignment-sourced items	fifo_layer	unknown	unconfirmed	nobody yet	2 of 5 partners are not in the accounting system at all

i3 publishes a management valuation and reconciles to the accounting system, which owns the balance sheet. On a disagreement about units i3 wins, because it has the gates, the cartons and the counts. On a disagreement about AED after a vendor bill is posted the accounting system wins. On the reason a difference exists i3 wins, because it owns the movement history.

Roles and personas

The auth portal has exactly four roles. A persona is derived at login from role, feature flags and rota-effective locations, then cached in i3's own table. It is never granted, because the session token has a hard size ceiling across the whole estate and nothing per-persona can live in it.

4 roles · 9 personasSSO portal

Persona	Min role	Required features	Locations from	Derivation rule
Owner	admin	none	all	role = admin
Finance	manager	finance	all	role ≥ manager AND feature:finance
Store manager	manager	retail	rota	role ≥ manager AND feature:retail AND rota_locations ≠ {}
WH operator	ops_manager	warehouse	rota	role ≥ ops_manager AND feature:warehouse
Inbound	manager	inbound, suppliers	all	role ≥ manager AND feature:inbound
CS agent	viewer	reverse	none	role ≥ viewer AND feature:reverse
Planner	manager	planning	all	role ≥ manager AND feature:planning
Marketing	viewer	programs	none	role ≥ viewer AND feature:programs
Admin	admin	dev_console	all	role = admin AND feature:dev_console

The phrase "requires the store_manager role" specifies something the auth system cannot express: there is no such role. The correct form is role ≥ manager plus a feature flag, and every permission rule in i3 is written that way. Where several personas match, the lowest priority wins and the page names which one it used.

Secrets and rotation

Rotation status only. The registry table has no value column, so there is nothing here to leak by accident: not a value, not a masked value, not a prefix and not a last-four.

1 overdue1 due soon60-min overlap

Name	Stored at	Owner	Cadence	Last rotated	Status	Consumers
I3_WEBHOOK_SECRET	[see ~/.env.master]	platform@minimalist.ae	90d	12-07 03:00	current	all 9 inbound sources
I3_SHOPIFY_WEBHOOK_SECRET	[see ~/.env.master]	platform@minimalist.ae	90d	20-03 11:42	overdue 131d	12 Shopify topics
I3_INTERNAL_API_KEY	[see ~/.env.master]	platform@minimalist.ae	90d	05-07 22:17	current	CSD · rep app · SKU intel
SSO_JWT_SECRET	[see ~/.env.master]	platform@minimalist.ae	180d	12-07 03:00	current	shared across the whole estate
I3_OUTBOX_SIGNING_KEY	[see ~/.env.master]	platform@minimalist.ae	90d	30-06 04:00	due in 6d	5 fanout destinations
I3_RFID_DEVICE_TOKEN	[see ~/.env.master]	platform@minimalist.ae	365d	01-07 00:00	current	2 gates · 2 handhelds · 5 sleds
I3_TIGRIS_ARTIFACT_KEY	[see ~/.env.master]	platform@minimalist.ae	180d	never	never rotated	report artifact storage

Rotation is a two-phase change with a 60-minute overlap: the new secret is accepted alongside the old one, every consumer is confirmed to have moved, and only then is the old one revoked. Rotating without the overlap drops every in-flight webhook for the length of the deploy.

Integration config

A sibling endpoint URL has no default. If the variable is unset the process refuses to start, because a wrong destination that returns 200 is worse than a crash on boot.

6 enabled2 pending1 not emittableLag monitor

Integration	Direction	Base URL	Auth	Signing secret	Retry	When down	Enabled
shopify	inbound	webhooks direct	hmac	I3_SHOPIFY_WEBHOOK_SECRET	exp 5,30,120	queue	yes
ops2 inbound	both	ops.minimalist-app.com	hmac	I3_WEBHOOK_SECRET	exp 5,30,120	queue	yes
ops2 reverse	inbound	ops.minimalist-app.com	hmac	I3_WEBHOOK_SECRET	exp 5,30,120	queue	not emittable
csd	both	csd.minimalist-app.com	hmac	I3_WEBHOOK_SECRET	exp 5,30,120	fail closed	yes
grn	inbound	grn.minimalist-app.com	hmac	I3_WEBHOOK_SECRET	exp 5,30,120	queue	yes
iwms	inbound	ops.minimalist-app.com	hmac	I3_WEBHOOK_SECRET	exp 5,30,120	queue	shadow
rfid	inbound	rfid.minimalist-app.com	hmac	I3_RFID_DEVICE_TOKEN	exp 5,30,120	queue	shadow
influencer hub	inbound	unset · refuses boot	hmac	I3_WEBHOOK_SECRET	exp 5,30,120	queue	pending
sku intel	inbound	sku.minimalist-app.com	bearer	I3_INTERNAL_API_KEY	daily pull	queue	yes
fanout outbox	outbound	5 destinations	hmac	I3_OUTBOX_SIGNING_KEY	exp 5,30,120 + DLQ	queue	yes

csd fails closed rather than queueing, deliberately: a stock reservation that silently queues while a customer is told the item is held is worse than an error the agent can see. The incumbent defaulted its endpoint to a dormant app, so an unset variable shipped live reservations into a dead system and returned 200 while doing it.

Typed configuration

Every setting declares a type, its allowed values and a default. The incumbent stored these as an untyped key and an opaque JSON value, which is why casting a plain string was a documented landmine.

22 settings

Key	Type	Allowed	Default	Current	Min role	Description
recon.tolerance_floor_fils	int	0 to 10000000	50000	50000	admin	AED 500 floor on any reconciliation tolerance
recon.tolerance_pct	decimal	0.0 to 5.0	0.10	0.10	admin	percentage arm of the tolerance, whichever is greater
gate.window_days	int	1 to 30	7	7	admin	consecutive passing days a gate needs
gate.null_counts_as	enum	fail, skip	fail	fail	admin	a NULL metric is a failing day, never a skipped one
flag.shadow_window_days	int	7 to 90	35	35	admin	covers two month-ends
flag.promotion_mismatch_bar	decimal	0.0 to 5.0	0.50	0.50	admin	shadow disagreement ceiling for promotion
valuation.confidence_bar_pct	decimal	0.0 to 100.0	5.0	5.0	admin	above this share of non-layered cost, a figure is labelled estimated
valuation.basis	enum	fifo_layer, weighted_average, standard	fifo_layer	fifo_layer	admin	the i3 cost basis
close.residual_tolerance_units	int	0 to 0	0	0	admin	fixed at zero by constraint; a residual is a decomposition bug
close.file_requires_extract	bool	true, false	true	true	admin	freezing needs no extract, filing does
cover.null_sort	enum	first, last	first	first	manager	how a SKU with no computable cover sorts
sample.qc_sla_hours	duration	24 to 168	72	72	manager	before auto-fallback to the pool
count.dual_approval_variance	int	1 to 100	5	5	manager	units of variance that trigger a second approver
drift.auto_accept_units	int	0 to 10	2	2	admin	below this, a drift is auto-accepted with evidence
report.max_range_days	int	30 to 730	400	400	manager	guards the runner from an unbounded scan
report.bounce_pause_after	int	1 to 10	3	3	manager	consecutive bounces before a subscription pauses
dev.session_ttl_minutes	duration	15 to 480	60	60	admin	dev console session lifetime
dev.read_only_default	bool	true, false	true	true	admin	the console opens safe
dev.replay_per_minute	int	1 to 60	5	5	admin	per user
session.lifetime_days	int	1 to 30	30	30	admin	aligned with the SSO cookie and JWT
timezone.display	enum	Asia/Dubai, UTC	Asia/Dubai	Asia/Dubai	admin	every timestamp on every page and in every export
currency.display	enum	AED	AED	AED	admin	integer fils internally, AED on the surface

A setting change is an append to the change log with an actor and a reason, never an in-place overwrite, so a value can always be traced to the person who moved it and the day it moved.

SSO status

i3 has no login of its own.

connected

Portal: auth.minimalist-app.com 200
App code: i3
Roles path: payload.apps.i3.role
Roles: viewer · manager · ops_manager · admin
Auth methods: Google · password · passkey, all with TOTP
Session cookie: _mst_session · 30 days
Token budget: under the shared size ceiling across 38 apps
Secret: [see ~/.env.master]
Locations from: rota effective-store roster
Persona cache: i3's own table, rebuilt at login

Compliance

Four hash-chained journals.

Open audit log

Journal	Rows	Last pass	Valid	Retention
ledger_entries	4,186,204	30-07 04:00	yes	infinite
cost_ledger	118,441	30-07 04:00	yes	infinite
unit_ledger	1,842,118	30-07 04:00	yes	infinite
audit_log	248,904	30-07 04:00	yes	infinite
events_raw	6,204,882	n/a	not chained	5 years
webhook deliveries	1,482,204	n/a	not chained	2 years

29 of the last 30 nightly passes were valid. The one exception was an incomplete pass aborted at 78% by a worker redeploy, and an incomplete pass is recorded as not-a-pass rather than as a pass.

Danger zone

Each action needs 2FA step-up, a typed reason and a named approver. None of them is reversible by clicking the same button again.

admin only

Action	What it does, and what it does not	Requires
Reopen a filed close	Moves a filed period back to draft. The cut ids are retained, so the original pack stays reproducible and the reopening is itself an event. Finance is notified.	2FA + approver + reason
Rebuild the balance cache	Recomputes every cache row from the chain. This is not a repair. An unreconciled key stays unreconciled and stays excluded, because only a compensating pair closes it.	2FA + reason
Revert a fixture batch	Writes compensating rows for every event in the batch. Never deletes. Refuses if any row in the batch has already been compensated.	2FA + reason
Force-promote a gated flag	Bypasses the gate constraint for one flag with an expiring waiver. The waiver appears on the flag, on the gate tracker and on every report the flag touches.	2FA + approver + expiry
Rotate every secret at once	Two-phase with the 60-minute overlap, all seven at once. Every consumer must confirm before the old values are revoked.	2FA + approver
Export everything	Full dump of every table to object storage with a 30-day signed URL. Secret values are not included, because they are not stored here.	2FA + reason

There is no "reset the ledger" action, and there never will be. The ledger is append-only, and every correction anywhere in i3 is a compensating row rather than an edit.

Registries not seeded

The stock-type, location and valuation-basis registries are seeded by migration, so an empty page means the migration has not run rather than that nobody has configured anything. i3 will not start against an empty stock-type table: every measure in the system is a flag-driven sum over it, and a missing flag would silently move a number on every page at once.

Could not read the flag service

GET /api/flags returned 503. The application is still running on its last known flag state, cached in process, and is not falling back to defaults: silently reverting a shadow flag to disabled mid-day would change what the ledger records.

Read-only settings

Writing settings needs admin. You have manager, so every panel is readable and no control is live. That is deliberate: the registries and the gate state are things an operator needs to see to understand why a page is behaving as it is, and hiding them makes a gated feature look like a bug. Your derived persona is store manager · MCC.

Flag writes paused

Postgres minor upgrade, 02:00 to 02:40 GST. Flag reads continue from the in-process cache so behaviour does not change mid-window. Flips are queued rather than dropped, and each one keeps the timestamp it was requested at, not the timestamp it applied.

Four flags cannot be promoted yet

CSD_RESERVATION_PER_LINE needs GATE-2, RFID_UNIT_LEDGER needs GATE-6, COST_LAYER_VALUATION needs GATE-3 and SHOPIFY_LEVELS_WRITEBACK needs GATE-8. Each control shows the gate, its streak and its blocking metric rather than just greying out, because "why can I not turn this on" is the only question that matters here. Gate tracker →

Connected to Ops health + gates Dev console Reports + close Cash + valuation Audit log Locations Rules Sibling events Opening stock Sign in (SSO) Help + glossary

1..9 jump section · / search · G gates · F flags · ⌘K palette No panel on this page renders a secret value, a masked value or a prefix. The registry has no value column, so this is enforced by the schema rather than by discipline.