Rehearse release readiness and close the factory loop

[ZempTime]

Rehearse release readiness and close the factory loop

Parent: #1
Blocked by: #11, #13, #14, #16
Local ticket ID: T16

Outcome

One final composition run proves the complete Owner/Viewer/Producer/Operator experience, release artifacts, clean-clone setup, credential-driven deployment plan, public evidence, security posture, and reusable factory learning. “Credential-ready” is distinguished from a live deployment smoke not yet supplied credentials.

Acceptance

• Reconcile every PRD story/ticket/ADR with merged behavior and close all blockers/review findings.
• From a fresh clone, run setup and production-shaped app; install released CLI; complete bootstrap → remote-style login → publish/republish/rollback → invite/Shelf/view → offline/update → feedback/receipts → revoke/delete.
• Run complete browser/request/black-box CLI/unit/provider-contract, lint/type/security/license/secret/container/build/link/screenshot suites and retain concise evidence.
• Repeat the exact trust/data-flow/threat audit over the complete product—including offline, feedback, receipts, deletion, provider/provisioner code, release artifacts, fixtures, screenshots, and runtime/browser network behavior—and resolve every blocker.
• Verify app images, binaries/checksums/SBOM, compatibility matrix, docs, synthetic example, screenshot regeneration, backup/restore/deletion, and credential inventory; only after all final reviews pass may release-candidate artifacts be promoted to a stable public release/tag.
• After every credential-free check/review is green, present one consolidated setup ceremony. If the Operator supplies credentials/deployment values through the direct safe ingress, run redacted live provision/deploy/smoke; otherwise return the credential-ready repository with one exact Operator-only command and complete value checklist.
• Consolidate every ticket's harvest and evaluate controller throughput, parallelism, repair cycles, failures, human interruptions, harnesses, and recommended factory changes without raw reasoning logs.

Evidence and review

• Final release report links commands/results, issues/PRs/commits, reviewers/dispositions, artifacts, screenshots, setup/security evidence, provider boundary, and factory evaluation.
• Independent final Standards, Spec, security/operations, OSS/proprietary-content, and clean-room composition reviews.
• Controller updates root RUN.md, closes PRD: Shortbread v1 #1 only after terminal evidence, and marks the persistent goal complete.

[ZempTime]

Stage 05 delivery replan: this issue remains the release-readiness umbrella. Final audit U37 #55 and stable-release/credential-ceremony U38 #56 are its executable leaves. Canonical graph: https://github.com/ZempTime/shortbread/blob/246320c73d81e5afdf0490b43a2b02272f40268b/docs/initiatives/2026-07-shortbread-v1/05_delivery_replan/output/2026-07-20-delivery-plan.md