Definition of done

v1 is complete when all of the following are true:

• Organization is the enforced tenant throughout Filament, REST, MCP, queues, source, storage, runtime, and audit.
• The pilot organization authenticates through Entra OIDC.
• JIT provisioning and role/group mapping work.
• SCIM deprovisions users and revokes access.
• Managed apps are stored in hidden Forgejo and are portable.
• A nondeveloper can create and modify a Nuxt app through an approved AI client.
• Every AI change is attributed to the human and client.
• Builds execute in disposable strong sandboxes.
• Runtime applications execute in workerd inside OS/VM sandboxes.
• Apps have no ambient filesystem, infrastructure-network, or cross-app access.
• DB, KV, identity, config, and integrations are explicit capabilities.
• Preview environments use isolated databases and synthetic data.
• Production deployments are immutable, approved, signed, and traceable.
• Destructive migrations require human approval.
• Backups, pre-migration snapshots, database restore, and export work.
• Code rollback and data restore are separate.
• App access is enforced by the gateway using Entra identity, groups, and optional named IP lists.
• Organization mandatory policy cannot be weakened by an app creator.
• IP/WAF-lite policies are reusable, named, versioned, and audited.
• AI cannot approve deployment, read secrets, or expand its own authority.
• Untrusted app origins use a separate registrable domain from the control plane.
• The organization pilot is explicitly limited to non-regulated data.
• The system passes cross-tenant, malicious-code, SSRF, identity-spoofing, migration-failure, and restore tests.
• A developer can export or take over an AI-created app.
• A GitHub repository can become canonical without creating a second writable master.
• Every production app has a business owner, technical owner, risk class, and review date.
• Ordinary application consumers do not require paid creator seats.
• Operations has complete deployment, upgrade, backup, restore, key-rotation, and incident runbooks.

Each requirement needs linked implementation and verification evidence before it is checked off. An accepted design or generated document alone does not satisfy acceptance.