docs(sdd): authorize platform implementation

AGENTS.md

@@ -2,7 +2,7 @@
 
 ## Current phase gate
 
-This project is in specification mode. Do not scaffold or implement application/deployment code until the relevant capability spec is explicitly approved by the user. Documentation, research notes, Git hygiene, and spec revisions are allowed.
+This repository is authorized for SDD Phase 4 implementation as of 2026-08-20. Follow `tasks/todo.md` in dependency order and keep the approved platform specification, adaptation contract, runbooks, and ADRs authoritative. Production operations and destructive actions retain their task-specific human approval guards.
 
 ## Sources of truth
 

CAPABILITY-MAP.md

@@ -1,7 +1,7 @@
 # Capability Map
 
 Status: **approved Phase 0 baseline**  
-Implementation authorization: **not granted**
+Implementation authorization: **granted by user on 2026-08-20**
 
 ## Product intent
 

README.md

@@ -2,7 +2,7 @@
 
 This repository is the operational control plane for the hackathon project. It will own Docker Compose, Nginx, environment templates, deployment automation, backup/restore scripts, and cross-repository release orchestration. Product code belongs in the backend and frontend repositories.
 
-Current state: specification and repository bootstrap only. No application or deployment implementation has been approved yet.
+Current state: specifications, operations plan, adaptation contract, runbooks, and task list are approved. Phase 4 deployment implementation is authorized.
 
 ## Repository topology
 
@@ -11,7 +11,7 @@ zarinpal-analytics-deployment/  # this repository
 ├── backend/                    # ignored checkout of zarinpal-analytics-backend
 ├── frontend/                   # ignored checkout of zarinpal-analytics-frontend
 ├── docs/
-└── (deployment assets only after explicit build authorization)
+└── (deployment assets created through the authorized task list)
 ```
 
 The intended production hostname is `zarinpal.amiirkhl.ir`. The deployment shape will follow the proven Qlockify structure while being reviewed and hardened for this service; it is not a byte-for-byte copy.
@@ -30,4 +30,4 @@ The intended production hostname is `zarinpal.amiirkhl.ir`. The deployment shape
 - `docs/QLOCKIFY-ADAPTATION-CONTRACT.md` maps Qlockify's tracked deployment files and environment layout to the planned ZarinPal artifacts without requiring real server values during planning.
 - `docs/runbooks/FIRST-SERVER-BOOTSTRAP.md` defines the safe first-host sequence without implementing a bootstrap script.
 - `docs/runbooks/BACKUP-RESTORE.md` defines logical PostgreSQL backup, encryption/retention, guarded restore, and rehearsal.
-- `tasks/plan.md` and `tasks/todo.md` hold the approval-gated implementation plan. Their presence does not grant implementation authorization.
+- `tasks/plan.md` and `tasks/todo.md` hold the approved implementation plan and dependency-ordered Phase 4 tasks.

docs/CROSS-REPOSITORY-PLAN-REVIEW.md

@@ -1,12 +1,12 @@
 # Cross-Repository Specification and Plan Review
 
-- Status: Ready for stakeholder review — implementation not authorized
+- Status: Approved — cross-repository implementation authorized 2026-08-20
 - Date: 2026-08-20
 - Scope: `zarinpal-analytics-backend`, `zarinpal-analytics-frontend`, and `zarinpal-analytics-deployment`
 
 ## Outcome
 
-The approved product, data, analytics, identity, API, UX, and operations specifications are sufficiently resolved to plan implementation. No application code, migrations, containers, executable scripts, dependency manifests, or generated artifacts are authorized by this review.
+The approved product, data, analytics, identity, API, UX, and operations specifications are sufficiently resolved for implementation. The user approved all three repository plans/task lists and authorized Phase 4 implementation on 2026-08-20.
 
 ## Confirmed shared contracts
 
@@ -50,4 +50,4 @@ No secrets, raw dataset, generated database, credentials, certificates, backups,
 
 ## Authorization gate
 
-Approval of these plans permits task tracking only. Implementation starts only after the user sends a separate explicit instruction to implement. Remote pushes remain forbidden until the user separately requests a push.
+The user approved these plans and explicitly authorized implementation on 2026-08-20. Implementation must follow each repository's dependency-ordered task list and review checkpoints. Remote pushes remain forbidden until the user separately requests a push.

docs/PLATFORM-OPERATIONS-SPEC.md

@@ -1,7 +1,7 @@
 # Platform Operations Capability Spec
 
 - Status: Approved specification
-- Implementation authorization: Not granted
+- Implementation authorization: Granted by user on 2026-08-20
 - Capability: Platform operations
 - Depends on: all deployable backend and frontend capability contracts
 - Last updated: 2026-08-20

docs/QLOCKIFY-ADAPTATION-CONTRACT.md

@@ -3,7 +3,7 @@
 - Status: Approved planning baseline
 - Source: `D:/Programing/Scripts/Qlockify/qlockify-deployment` (read-only)
 - Target: `/home/ubuntu/zarinpal-analytics-deployment`
-- Implementation authorization: Not granted
+- Implementation authorization: Granted by user on 2026-08-20
 - Last updated: 2026-08-20
 
 ## Purpose

tasks/plan.md

@@ -1,6 +1,6 @@
 # Implementation Plan: Platform Operations
 
-- Status: Ready for stakeholder review; implementation not authorized
+- Status: Approved — Phase 4 implementation authorized 2026-08-20
 - Capability: Platform operations
 - Task list target: `tasks/todo.md`
 - Planning baseline: `docs/QLOCKIFY-ADAPTATION-CONTRACT.md`
@@ -12,7 +12,7 @@ Adapt the read-only Qlockify deployment repository into a manual, production-sha
 
 There is no CI/CD pipeline, runner, registry, automated Git synchronization, or private font injection. Prometheus/Grafana remain a required post-MVP, pre-AI phase.
 
-No task below authorizes implementation.
+The user authorized implementation of the tasks below on 2026-08-20.
 
 ## Dependency graph
 
@@ -56,7 +56,7 @@ approved spec + Qlockify adaptation contract + explicit build authorization
 - The Platform Operations spec, ADRs 0001–0003, Qlockify adaptation contract, bootstrap runbook, and backup/restore runbook define the approved behavior.
 - Runtime values such as IP, DNS access, email, ParsPack credentials, and encryption passphrase are deliberately deferred to the operation that uses them.
 - Backend/frontend command and variable names are integrated when their implementation contracts exist; earlier independent deployment work is not blocked.
-- Implementation starts only after a separate explicit stakeholder authorization.
+- Stakeholder approval and explicit implementation authorization were recorded on 2026-08-20.
 
 Checkpoint: the plan and tasks are approved; no implementation artifact exists yet.
 

tasks/todo.md

@@ -1,6 +1,6 @@
 # Platform Operations implementation tasks
 
-- Status: Planned and ready for stakeholder review; implementation not authorized
+- Status: Approved — Phase 4 implementation authorized 2026-08-20
 - Canonical plan: `tasks/plan.md`
 - Adaptation baseline: `docs/QLOCKIFY-ADAPTATION-CONTRACT.md`
 
@@ -11,7 +11,7 @@
 **Acceptance criteria:**
 - [x] Platform Operations specification and ADRs 0001–0003 are approved.
 - [x] Qlockify flow/environment mapping is documented without real runtime values.
-- [ ] Stakeholder approves this plan/task breakdown and separately authorizes implementation when ready.
+- [x] Stakeholder approved this plan/task breakdown and authorized implementation on 2026-08-20.
 
 **Verification:** Documentation diff review and confirmation that no implementation artifact was created.