docs: advance platform build gate

tasks/plan.md

@@ -1,6 +1,6 @@
 # Implementation Plan: Platform Operations
 
-- Status: Planned from draft revision; implementation blocked pending explicit spec approval
+- Status: Implementation plan ready for stakeholder review — implementation not authorized
 - Capability: Platform operations
 - Task list target: `tasks/todo.md`
 - Last updated: 2026-08-20
@@ -16,7 +16,7 @@ No task below is authorized merely because it appears here.
 ## Dependency graph
 
 ```text
-approve revised spec + resolve server/runtime contracts
+resolve concrete server/runtime inputs + authorize build
         |
         +--> safe config + manual release-record contract
         |        |
@@ -50,14 +50,15 @@ approve revised spec + resolve server/runtime contracts
 - Use automatic Let's Encrypt/Certbot TLS.
 - Treat structured logs/health/manual checks as MVP; add Prometheus/Grafana after MVP and before AI.
 
-## Phase 0: approve exact contracts
+## Phase 0: resolve implementation inputs and authorize the build
 
-- Approve the revised Platform Operations spec.
-- Resolve server/provider/capacity/user/path, image tags, resource limits, repository URLs/commands/health routes, backup endpoint/credentials/schedule, Redis AOF choice, release-record format, operator/secret escrow, and MVP-ready/observability gates.
+- Treat the approved Platform Operations spec and ADRs 0001–0003 as the implementation baseline.
+- Obtain the production IP/DNS state, repository URLs, actual protected environment values, ParsPack endpoint/bucket/prefix/credentials, and named operator/secret-escrow contacts.
 - Obtain the backend command contract for API, worker, migration, import, admin, liveness, readiness, and Redis-loss recovery.
 - Obtain the frontend build/static health contract.
+- Obtain explicit authorization before creating deployment implementation artifacts.
 
-Checkpoint: no implementation file exists before explicit approval and resolved inputs.
+Checkpoint: no implementation file exists before explicit build authorization and the inputs needed by its slice are resolved.
 
 ## Phase 1: configuration and Compose foundation
 
@@ -82,7 +83,7 @@ Checkpoint: manual deployment records the three SHAs, passes TLS/health/SSE chec
 - Minimally adapt Qlockify backup/upload/restore/S3-restore scripts for ZarinPal paths/services/credentials.
 - Remove Qlockify environment-file backup/restore; include PostgreSQL archive plus non-secret manifest/checksums only.
 - Add exact destination and production confirmation guards.
-- Bootstrap the server, deploy the MVP, perform one-time import/credential setup, create an encrypted remote backup, and rehearse clean restore within two hours.
+- Bootstrap the server with `first-start.sh`: migrate, import/reconcile the pinned archive, then activate public services; perform separate credential setup, encrypted remote backup, and a clean restore rehearsal within two hours.
 
 Checkpoint: every MVP acceptance criterion passes through manual health/log/disk/certificate/queue/backup checks.
 
@@ -103,9 +104,9 @@ Checkpoint: an induced failure is detected, correlated to the three-hash release
 | Dirty checkout is destroyed | Lost operator/user work | Fail on dirty/divergent state; no unconditional `git reset --hard` |
 | Server-side build differs over time | Harder reproduction | Pin base/dependency inputs in service repos, record Git hashes/local image ids/build time |
 | Migration blocks rollback | Extended outage | Expand/contract, measured locks, fresh backup, no automatic down migration |
-| Redis loss drops queue/cache | Partial analytics interruption | Optional AOF, PostgreSQL authority, idempotent reconciliation/cold-cache tests |
+| Redis loss drops queue/cache | Partial analytics interruption | AOF `everysec`, PostgreSQL authority, idempotent reconciliation/cold-cache tests |
 | SSE buffering/timeouts | Dashboard appears stuck | Exact Nginx route, buffering/compression/cache off, heartbeat/reconnect test |
-| Docker-group compromise | Host-root compromise | Dedicated key-only trusted account, restricted SSH, no daemon TCP exposure |
+| Docker-group compromise | Host-root compromise | Restricted key-only access to trusted `ubuntu` account, no daemon TCP exposure |
 | Backup leaks credentials | Wider compromise | Remove `.env` backup/restore, encrypt, separate passphrase, archive exclusion tests |
 | Backup is unusable | Data loss beyond RTO | Checksums/listing/remote verification plus clean restore rehearsal |
 | Delayed monitoring hides degradation | Slower MVP incident diagnosis | MVP health/log/operator checklist; mandatory Prometheus/Grafana before AI |