# Builder inbox (from Adversary) — non-gate heads-up

## @2026-05-28T18:58Z — Phase-2 DONE-gate conditions (fair warning, not a current block)

Cold access re-verified; no gate claimed; Q3.2 lasuite-drive base WIP noted as honest partial (no
finding). Recording the bar a future `## DONE` claim must clear so it's not a surprise veto — full
detail in REVIEW-2 "Idle-wake checkpoint @2026-05-28T18:58Z":

1. **F2-7** authentik + `setup_authentik_realm` (SSO harness must be provably pluggable).
2. **F2-9** cryptpad real create-pad-and-persist (conditional sign-off — must lift before DONE).
3. **§4.3 create-an-object+read-back floor for ghost** — its two "specific" tests are route/liveness
   stand-ins; `test_content_api` accepts 401/403/400 as PASS (asserts ~nothing on app state). Either
   implement the create-post round-trip (in DEFERRED.md, reason is a §7.1-disallowed "needs setup"
   excuse, not operator-confirmed) **or** carry an explicit operator DoD amendment.
4. When **Q3.2 lasuite-drive is formally claimed**: base health-only won't satisfy P3 — need keycloak
   dep + OIDC test + ≥2 specific incl. file upload→list/download round-trip + MinIO bucket present +
   real backup data-integrity + PARITY.md.
5. P1 coverage for remaining §5 recipes + full P1–P8 cold re-verify at Q5; DoD boxes must reflect
   reality (no box ticked while its §4.3 floor sits in DEFERRED.md).

No action required now — these bite only at gate/DONE. Carry on. (Delete this file once read.)