Generated proof projection
Read depth alongside status.
A capability with many verified surfaces and one named gap is labeled Partial. A thin capability can be Proven after only one or two surfaces. Depth and status belong together.
Verified surfaces
Executable surfaces associated with the capability in committed acceptance graphs.Enforced controls
Named gates and guarded states found on those same surfaces.Named gaps
Missing-future witnesses kept visible instead of being promoted into capability.Evidence depth
Surface breadth, acceptance domains, and mutation-pinned assertions read together.Deepest current evidence
Ordered by executable surfaces, controls, and mutation-pinned assertions—not by the status label.partial
Verified 2026-09-27
Email, SmartMail, SMS, and communications provider events
75 surfaces40 controls35 gaps25 mutation pins29 domains
Public boundary: Privacy disclosures may describe configuration-dependent calling, messaging, recording, transcription, AI analysis, consent, DNC/suppression processing, deliberate post-call scorecards, locally proved manual user assertions, locally normalized Gmail/Microsoft/custom-mailbox evidence, and locally projected metadata-only interaction measurements backed by the named code paths. Manual logging does not read personal device call or message history and must not be described as provider-observed evidence. The unified timeline does not include message bodies, does not assign deal-death probabilities, does not use cross-workspace cohorts, and does not itself send, schedule, or mutate CRM records. Email body, subject, snippet, HTML, and quoted content are stored data and never grant confirmation, credential, assistant, tool, send, or CRM-mutation authority. Since LI-1380 (2026-09-20) AI processing of email content is separately consented: checkEmailAIConsent requires master AI consent AND aiSettings.emailProcessingConsent === true, an absent flag denies, and every path that sends email body, subject, thread or snippet to a model refuses without it — smart replies and variations, email sentiment and priority inbox, email intelligence analysis and its background continuation after a mailbox sync, task extraction, AI email composition, and the eleven assistant email tools. Do not describe AI email features as available on master AI consent alone. State no retention period and no provider training posture for email content: neither is established by code in this repository. Disconnect retains historical Email rows unless a separate workspace deletion or retention action removes them. Treat inbound SMS authority/replay/suppression, signed voice ingestion, automatic recaps, automatic post-call assessment, worker recovery, recording deletion, legal holds, the inline model-effect fence, custom IMAP/SMTP setup and normalized sync, Microsoft durable sync, the verified-phone assistant control channel, the native-phone user-first bridge, manual interaction backfill, and cold-lead intelligence as local implementation/fixture proof only. Do not imply hosted or live-provider readiness, deployed automatic processing, live handset/control-number operation, recap or scoring accuracy, autonomous replies, bulk sends, universal consent enforcement, live voice calling, CRM/outreach effects, live coaching, workforce management, certification, performance improvement, business outcomes, universal inbound-to-action conversion, live Titan/Fastmail compatibility, automatic custom-mailbox thread/contact/deal linking, automatic deal linking, assistant-SMS manual logging, outcome learning from raw content, unmetered sending, quota/cost, or provider delivery without provider-specific and outcome proof. LI-1685 adds a locally tested structural refusal for recognized secrets and identity numbers in workspace-authored email and SMS, with no raw-keyword block; it is not a complete PII detector, and no hosted or live-provider outcome is inferred from the fixture proof. Reply candidates are deterministic reminders from the loaded mailbox history, not proof that a response is required. No-reply addresses and recognized bulk mail are excluded from reply nudges, not deleted or excluded from independent task/AI review. Sent folder/labels identify outgoing mail even when the connected mailbox differs from the application login. Repeated incoming notifications alone are not a cold conversation. Reply-To and automation headers are not persisted for this classifier; do not promise full header-aware response detection.114 governed capability-truth blocker records remain internal; this public projection exposes their count and the approved public boundary, not operational or security details.partial
Verified 2026-10-27
Billing, entitlements, quotas, usage, and credits
45 surfaces32 controls21 gaps30 mutation pins27 domains
Public boundary: Explorer is a plan, not a persona. Navigation visibility is not authorization; previews are not execution; payment is not provider readiness; and client-side quota constants are not customer allowances. Legacy web/API tier metadata catalogs are not price authorities and contain no subscription prices; checkout prices come from governed commercial offers. Their contact lines now derive from the tier contact enforcer and email lines from the daily QuotaService ceiling; a daily email quota is not a monthly allowance or a grant to use an email-sending product. Prepaid usage credits: do not imply that calls or texts are charged to the balance until LI-1526 and LI-1530 land, that credits never expire, that a text or AI-voiced minute has a price, that anyone but the workspace owner can buy credits, or that any amount under $15 can be bought. LI2308 repairs missing reference_id in the locked settle/release hold projections, preserving the actual call reference in usage transaction metadata without changing prices, allowance, credits, entitlements or settlement rules. This bounded attribution repair does not prove live private calling or full contacts acceptance.37 governed capability-truth blocker records remain internal; this public projection exposes their count and the approved public boundary, not operational or security details.partial
Verified 2026-10-07
Client Portal / Share Center and Documents
16 surfaces43 controls16 gaps47 mutation pins3 domains
Public boundary: Position Documents as a real-estate transaction handoff workspace, not general cloud storage. Portal access is not proof of delivery, acceptance, signature, or legal review. Do not imply fully launched portals, universal resource support, provider-backed Doc AI extraction/telemetry, or completed signature loops. The Deal Board sample room is fictional and read-only; it does not create invitations, share files, publish a room or prove hosted storage. Generated Deal summaries are built only from the workspace's own records with per-figure sources; missing figures stay missing; they are not appraisals, forecasts or AI-written analysis, and preparing a client-ready version does not share or send it.33 governed capability-truth blocker records remain internal; this public projection exposes their count and the approved public boundary, not operational or security details.partial
Verified 2026-10-27
Lead Intelligence / Lead Engine
26 surfaces28 controls7 gaps39 mutation pins10 domains
Public boundary: Do not imply full public-record coverage, guaranteed seller motivation, automatic CRM cleanup, automatic source-to-lead conversion, contact eligibility, or live-provider readiness. Cross-holding evidence means that separately sourced holdings are linked to one review candidate; it never transfers a source observation, occupancy fact, ownership assertion, motivation, consent, or contactability from one property to another. A reviewed opportunity is an operator-selected research record, not a motivation score or a statement that an owner is distressed, likely, ready, or willing to sell, contactable, consenting, or verified. Last recorded sale is an admitted assessor sale signal, not current value, market price, a complete transaction history, or a recorder/deed-history product. The assessment-gap observation compares a tax assessment with a disclosed sample of observed sales; it is not a recorded or estimated market value, AVM, appraisal, underwriting result, proof of equity, or claim that the source sample covers the jurisdiction. The hands-off funnel is workspace-admin opt-in, runs only when derivation runs, never invents missing contact identity, and does not schedule source ingestion. Derived public-record leads identify a PROPERTY first; an owner name or mailing address may appear only when the exact selected source release admitted that field, and never implies a phone number, email, outreach permission, or generally contactable lead. Only counties a workspace has ingested and approved produce leads — do not imply nationwide coverage, and do not present the number of jurisdictions we have reviewed as the number a customer can use. Shared prospect-pool enrichment requires a Lead Intelligence product. ATTOM-first enrichment additionally requires a valid key owned by the selected workspace and is unavailable when the ATTOM kill switch is off; it never borrows the platform key. Web-search-first needs no ATTOM key, but an uncached model lookup spends one request from the workspace's existing assistant allowance and fails closed when admission cannot be recorded. Local mocked-provider proof does not establish live ATTOM, live web-search, hosted cost, or customer outcome readiness. Every purchasable public surface must label Lead Engine Paid beta or Beta and must not describe it as Customer-ready, generally available, or nationally complete. Field capture (LI-1883 record): the promise above does not describe it and nothing here widens it. Do not imply durable production photo storage until LI-1709 lands, parcel candidates everywhere (they appear only where public property records exist near the camera position), HEIC or HEIF support (refused with guidance), or that confirming a parcel admits a lead, identifies an owner or creates a contact; it submits an unadmitted review-queue candidate only. Seller acquisition (LI-2356): permissioned one-property request code is local-only and defaults off. No seller-facing report, valuation, buyer invitation, verified identity/ownership, CRM admission, marketing permission, deletion promise, supported operating geography, or hosted/customer outcome claim follows from this slice. Opening a page without its separate private code reveals no inquiry information. Founder direction0060 moves counsel review to general release (LI-2361). Limited access reports still require applicable business permission and admitted sources; supported operating geography, separately approved buyer sharing and independent acceptance remain separate. Missing current business/source permission denies release; locally proved native confirmation with synthetic participants does not establish customer report availability, buyer-sharing permission or sourced financial outcomes.90 governed capability-truth blocker records remain internal; this public projection exposes their count and the approved public boundary, not operational or security details.partial
Verified 2026-09-28
Mission Control
29 surfaces25 controls7 gaps26 mutation pins9 domains
Public boundary: Do not imply every module emits standardized packets, universal backend execution, full audit/rollback, or received revenue without an authoritative accounting or payment source. A public-record Property-ready handoff does not identify a contact or seller and does not automatically run matchmaking or Property Intelligence, create contacts, send outreach, qualify a lead, or promote lifecycle state. A saved contact is not consent, contactability, intent, or a completed follow-up; its review does not send, enrich, create a task, or record a business outcome. Action-availability text is an explanation, not execution authority. Partial-source counts exclude unavailable sources. The authenticated sample is labeled local fixture work, not a provider-ready or customer-data proof. A newly created, never-paid free workspace has active Explorer access despite its inactive billing row; inactive status with a recorded paid plan or Stripe subscription remains a lapse. Lapsed paid-workspace Explorer Mission Control review and its paused AI planner have local browser and API proof only; platform-wide paid-feature locking and hosted Stripe lifecycle remain unproved. LI-1802 locally refuses the workspace-product route helper and explicit email-analysis model action after lapse, while preserving the review queue; other paid readers remain outside that proof. The local email-scan control now names manual analysis as paused when that model boundary is closed; the background scheduler was already snapshot-gated. The account and top-bar status menus now use effective access labels, and a selected free power-up is stripped after lapse; both have local test proof. Reported confidence is informational: it does not grant approval or replace source evidence, consent, entitlement, cost, or human review, and the feed does not change reasoning depth by score. The alternate /ai lead-suggestion page shares the qualitative confidence legend but is not the canonical action-packet queue; its score does not authorize a step or promise more reasoning. The alternate /ai card and filter now use the action-packet 0.8/0.55 confidence bands and High/Medium/Low labels. The AI chat Mission Control context chip uses those same raw-score bands and card-matched whole percentages; even High is an informational cue, not success or approval. The alternate /ai saved lead-suggestion read is provider-free and available without AI-processing consent; new AI analysis remains consent-gated. Its saved contact projection now excludes missing or foreign-linked contacts in the selected workspace, with local service proof only. An isolated beta-tester fixture now renders one saved suggestion and its factors, but that does not prove a customer first action, consented analysis, hosted entitlement, measured outcome, or provider readiness. Telemetry and AI health remain consent-gated; without consent their cards explain the boundary and link to AI settings, but do not show metrics or claim healthy providers. Their Settings return paths are route-specific on /ai, /mission-control, and /health in rendered local tests; only /ai has the LI-1688 authenticated browser walk. Customer first-use and provider readiness remain unproven. The alternate /ai Priority Inbox now labels missing or invalid refresh time as unavailable rather than displaying Invalid Date. The alternate /ai lead queue has no measured historical action success or revenue/value source; it shows no such figures. Opening a contact is a session activity only, not a completed follow-up, approved action, conversion, or business outcome. Session activity does not survive reload as a durable outcome record. The assistant chat Mission Control chip follows packet confidence bands; its score is distinct from the planner request-match value under “Why this answer?”. The alternate /ai queue now registers for authenticated Mission Control socket events, records failed executions as failed, and counts only observed completed executions while that page is open; a disconnected or reloaded page cannot report a durable total. Its Refresh control refetches the active saved-lead query, and lead-score sort orders across priority groups. These are local code and rendered-test findings, not hosted or customer outcome proof. The assistant can list what is in the Mission Control queue and explain one handed-off item from the same workspace read the page uses; it covers only what that queue returns, runs and records nothing, treats confidence as informational, and reports an item it cannot re-read as not found. The current API omits a source refresh timestamp. LI-1663 maps the populated priority rows for the alternate /ai card and Voice Dashboard and scopes displayed counts and sentiment to the returned unread selection; this is local fixture proof, not connected-mailbox sync freshness, all-mailbox health, or real mail-action execution. An empty alternate /ai Priority Inbox selection is not a reviewed inbox: the endpoint ranks only the caller's unread inbox email that passes free triage and reports which filter emptied the selection (no stored email, no unread inbox email, or unread inbox email set aside by triage); never describe an empty selection as all caught up or all email reviewed. A refresh time is shown only when reported in the API's ISO 8601 UTC format, and the API currently reports none. The saved-lead service now refuses missing or malformed workspace identity before a query; the AI insights routes require authenticated workspace membership and action-status updates scope both lookup and returned row. The local stdio lead-intelligence server advertises health only because it has no trusted workspace principal; these are local tests, not hosted tenancy or customer first-use proof. LI-2006 local tests route explicit document-aggregate questions to one entitled read-only tool and retain the canonical queue for general attention questions; isolated normal-login browser proof now completes one high-risk-contract document read through a loopback mock without recording local tester consent. This is bounded local fixture proof, not hosted provider execution, production paid-user consent bypass, or customer outcome proof.86 governed capability-truth blocker records remain internal; this public projection exposes their count and the approved public boundary, not operational or security details.partial
Verified 2026-09-25
Teams, workspace admin, security, and compliance
39 surfaces22 controls14 gaps14 mutation pins29 domains
Public boundary: Do not imply SOC/compliance certification, complete enterprise governance, production-ready SCIM, universal RBAC coverage, full account-session/device telemetry, end-to-end two-factor enrollment/login readiness, or internal admin readiness without owner-approved evidence and authenticated browser/API proof. The login gate now refuses access when canonical two-factor status cannot be read, but the customer settings/enrollment flow and subsequent TOTP/SMS login completion remain separately unproved and tracked. Do not describe generic retention management as available: the proved customer surface is derived leads only. Do not imply that policy creation deletes data, cleanup is enabled by default, a dry-run itself deletes data, archives provide an end-user restore workflow, or the local daily job proves hosted scheduler operation. A protected cron route is not proof of a deployed scheduler, live provider deletion, guaranteed provider-media preservation after a late hold, or comprehensive compliance coverage. Do not imply automatic assignment, workload/capacity-aware routing, calibrated probabilities, demonstrated conversion lift, or accepted proposal/confirmation behavior from LI-1068/PR #1734. Local Phase2a availability/readiness and bounded manual-assignment entitlement proof do not establish all assignment lifecycle protection, ranking quality, hosted readiness or a launched routing workflow. Do not claim the one- or three-human seat limit is enforced, that one product's included seats apply to every other product in a mixed workspace, or that this local invite acceptance proves hosted email delivery. LI-1714 proves separate workspace creation and membership only: newly created workspaces are stored with subscriptionStatus inactive, so usable Explorer features depend on LI-1545 / PR #2442 and a repeated access-snapshot proof. Do not equate a stored free tier with active Explorer capabilities.21 governed capability-truth blocker records remain internal; this public projection exposes their count and the approved public boundary, not operational or security details.partial
Verified 2026-10-27
Workflow Automation and Guardrails
15 surfaces11 controls7 gaps36 mutation pins6 domains
Public boundary: Do not imply that save, preview, test, or publish alone activates or executes a workflow. Do not imply hosted production automation, arbitrary cron/timezones, provider delivery, configured email/SMS/webhook/AI availability for every workspace, arbitrary financial operations, arbitrary MCP execution, hosted multi-worker or real-customer proof, or broad Guardrails+ coverage. Local mocked provider-contract and durable recovery evidence is not hosted delivery/deployment qualification. Do not imply the 36 legacy designs are runnable, that manual market/buyer review starters retrieve live signals, that the global floating assistant can draft native graphs, or that the initial five-scenario live AI evaluation proves universal draft quality or fulfills unsupported requests.36 governed capability-truth blocker records remain internal; this public projection exposes their count and the approved public boundary, not operational or security details.partial
Verified 2026-08-26
Automatic Deal Handoffs
32 surfaces4 controls5 gaps22 mutation pins27 domains
Public boundary: Do not imply arbitrary property or custom-field triggers, delayed execution, role-based assignment, provider notifications, documents, AI effects, guaranteed handoff or business outcome, hosted multi-worker reliability, a deployed production scheduler, Guided Workflow or assistant execution, MCP access, or launch readiness.4 governed capability-truth blocker records remain internal; this public projection exposes their count and the approved public boundary, not operational or security details.Raw capability graph projection
50 declared capabilities · 30 acceptance domains. This drill-down preserves the generated status labels without treating Partial as a low-depth score.| Capability | Status | Surfaces | Controls | Gaps | Mutation pins | Verified |
|---|---|---|---|---|---|---|
| Email, SmartMail, SMS, and communications provider events | partial | 75 | 40 | 35 | 25 | 2026-09-27 |
| Billing, entitlements, quotas, usage, and credits | partial | 45 | 32 | 21 | 30 | 2026-10-27 |
| Client Portal / Share Center and Documents | partial | 16 | 43 | 16 | 47 | 2026-10-07 |
| Lead Intelligence / Lead Engine | partial | 26 | 28 | 7 | 39 | 2026-10-27 |
| Mission Control | partial | 29 | 25 | 7 | 26 | 2026-09-28 |
| Teams, workspace admin, security, and compliance | partial | 39 | 22 | 14 | 14 | 2026-09-25 |
| Workflow Automation and Guardrails | partial | 15 | 11 | 7 | 36 | 2026-10-27 |
| Automatic Deal Handoffs | partial | 32 | 4 | 5 | 22 | 2026-08-26 |
| CRM / Contact Foundation and Customer List Import | partial | 14 | 16 | 11 | 22 | 2026-08-29 |
| Government Data / public sources | partial | 19 | 9 | 5 | 19 | 2026-10-05 |
| Document AI Reviewed Analysis | partial | 10 | 23 | 10 | 3 | 2026-10-13 |
| Private Lender Capacity Review | partial | 9 | 12 | 3 | 12 | 2026-10-01 |
| CMA calculators and saved artifacts | partial | 21 | 3 | 2 | 7 | 2026-10-23 |
| Skip Trace | partial | 4 | 9 | 2 | 18 | 2026-09-01 |
| Customer-Owned Lender Evidence Ingestion | partial | 7 | 11 | 3 | 11 | 2026-10-01 |
| Persistent Assistant Workflow Operability | partial | 12 | 12 | 2 | 3 | 2026-10-23 |
| Onboarding, help, and guided education | partial | 15 | 8 | 1 | 3 | 2026-08-29 |
| Campaign Hub | partial | 9 | 10 | 7 | 6 | 2026-09-28 |
| Property Intel analysis and private CMA artifacts | partial | 10 | 4 | 1 | 7 | 2026-10-01 |
| Provider-Independent Appointment Scheduling and Outcomes | gated | 8 | 5 | 0 | 8 | 2026-10-02 |
| Marketing Scouts monitors and insights feed | partial | 4 | 3 | 4 | 11 | 2026-08-04 |
| Deal Pipeline | partial | 6 | 10 | 3 | 0 | 2026-10-05 |
| Private Lender Candidate Review | partial | 9 | 5 | 1 | 1 | 2026-10-01 |
| Social media scheduling and posting | partial | 6 | 1 | 2 | 8 | 2026-08-04 |
| Workspace Provider Connections and BYOK | partial | 6 | 7 | 1 | 2 | 2026-10-27 |
| Developer APIs and webhooks | partial | 4 | 4 | 1 | 6 | 2026-10-01 |
| Paid Ads campaign drafting | partial | 7 | 6 | 5 | 0 | 2026-08-04 |
| Buyer Network | gated | 6 | 2 | 0 | 4 | 2026-09-27 |
| Pipeline Builder Setup | partial | 4 | 4 | 1 | 3 | 2026-10-27 |
| Search Agents / watchlists | gated | 6 | 5 | 0 | 0 | 2026-10-23 |
| Network / Relationship Intelligence | partial | 5 | 2 | 1 | 3 | 2026-10-27 |
| Inventory / Portfolio Advisory | gated | 1 | 7 | 0 | 0 | 2026-08-14 |
| Vendor announcements and workspace-private Q&A (forum) | gated | 1 | 7 | 0 | 0 | 2026-08-18 |
| Internal ops, support, and founder telemetry | partial | 7 | 0 | 2 | 0 | 2026-10-28 |
| Reporting, analytics, and activation telemetry | partial | 3 | 2 | 1 | 1 | 2026-08-24 |
| Goals / OKR | proven | 2 | 0 | 0 | 3 | 2026-08-19 |
| Seller pipeline workspace | gated | 4 | 1 | 0 | 0 | 2026-08-26 |
| Mobile and native readiness | gated | 2 | 1 | 0 | 0 | 2026-09-27 |
| AI Sales Coaching Role-Play | gated | 1 | 1 | 0 | 0 | 2026-10-03 |
| Experimental predictive scoring runtime | proven | 2 | 0 | 0 | 0 | 2026-08-10 |
| Market Intelligence / Market Signals | proven | 2 | 0 | 0 | 0 | 2026-10-06 |
| Context Workspace | partial | 1 | 0 | 1 | 0 | 2026-07-16 |
| Saved Market Areas and Active Market Geography | proven | 1 | 0 | 0 | 0 | 2026-08-25 |
| AI Receptionist Reviewed Meeting Loop | declared only | 0 | 0 | 0 | 0 | 2026-10-11 |
| Deal Approval Policies | declared only | 0 | 0 | 0 | 0 | 2026-08-04 |
| Distressed property and motivated-seller discovery | declared only | 0 | 0 | 0 | 0 | 2026-08-14 |
| Lead owner recommendation and assignment support | declared only | 0 | 0 | 0 | 0 | 2026-09-28 |
| Location capability — county public-record lookup and workspace-private save | declared only | 0 | 0 | 0 | 0 | 2026-09-08 |
| Workspace Property Map | declared only | 0 | 0 | 0 | 0 | 2026-08-25 |
| Workspace Theme and Appearance Customization | declared only | 0 | 0 | 0 | 0 | 2026-09-10 |