Public websiteLive
Brand, product education, pricing, signup, and investor-ready product narrative.
Release & Trust Center
Build progress you can inspect—not a readiness claim you have to guess at.
SalesPitch AI publishes the current product phase, customer-facing availability, operating safeguards, and version history while private credentials, provider references, and customer data remain protected.
Product availability
Every surface states what is live and what remains controlled.
“Live” means available on the public domain. “Controlled beta” and “human-gated” mean provider effects remain behind verification, policy, or approval controls.
Checking application healthCurrent check in progress
Reading the current privacy-safe production signal.
View machine-readable health →Customer workspaceControlled beta
Authenticated product, lead, campaign, follow-up, billing, and help-desk workflows.
C.O.L.T.E.N. AI™ voiceControlled beta
Verified-number demos and governed calling remain behind production launch gates.
Outbound provider actionsHuman-gated
Calls, emails, calendar writes, and provider refreshes require explicit readiness evidence.
Evidence-based launch readinessChecking current production controls
Private controls are being projected safelyNo readiness claim is made until the current privacy-safe production signal loads.
Public safeguards
Customer-facing automation stays inside a governed operating envelope.
The public status page intentionally avoids provider secrets and private operational detail. Authenticated operators receive deeper evidence inside the Integration Center.
Why this operating model matters- 01Verified customer consent before demo calling
- 02Human approval before production outbound actions
- 03Tenant-scoped lead and campaign records
- 04Suppression, calling-window, and evidence controls
Signed-ingest production certificate
Six live boundary checks. Zero valid provider events.
Release v4.63 certifies the content-free signed-ingest-response-v1 contract on the public Stripe and meeting-event boundaries. The probes verify rejection safety only; they do not create an entitlement, change a meeting, contact a prospect, or call a provider.
Two governed boundaries
The production monitor reaches the signed Stripe entitlement webhook and signed meeting-event ingest on the canonical application domain.
Six credential-free probes
Each boundary receives an unsigned payload, a syntactically valid stale signature, and a content-free body exactly one byte above its published ceiling.
Exact response policy
Every receipt must be JSON, private, non-cacheable, MIME-sniffing protected, and marked with the reviewed contract version.
No private identity
No customer, billing, lead, meeting, prospect, or provider identity is supplied or retained by this certificate.
What this provesInvalid and oversized deliveries stop at the reviewed public boundary.What remains gatedReal provider lifecycle tests, credentials, licenses, and final human launch approval remain separate.
Public-surface production certificate
Eighty-eight exact destination checks. No silent SalesPitch sessions.
Twenty-two customer-facing pages are certified across the hosted site, root domain, www domain, and application domain. Each response must remain on the exact requested origin and route before its content or claims are accepted.
Exact destination
Core product, support, legal, privacy, AI disclosure, data lifecycle, and trust pages cannot silently redirect to another origin or route.
Verified web document
Every page must return HTML with the complete reviewed browser-security header baseline, including HSTS, CSP, framing defense, and MIME protection.
Infrastructure-only cookie
No SalesPitch application or session cookie is allowed. Only the hosting edge's hardened bot-management cookie may appear.
Private values excluded
Cookie values are never retained. The certificate records only the allowed policy and aggregate check count.
What this provesPublic browsing stays on the reviewed SalesPitch surface without creating application session state.What remains gatedAuthenticated workflow behavior, provider credentials, live calls, lead licenses, and final human launch approval remain separate.
What “market ready” means
The date is a target. Evidence determines launch authority.
SalesPitch AI will not describe a protected provider workflow as production-ready merely because a page renders or a credential exists.
Product
Signup, billing, entitlements, account setup, products, scripts, governed leads, campaigns, meetings, follow-up, and help work together in the authenticated workspace.
Providers
OpenAI, calling, email, calendar, payment, lead-data, and monitoring contracts are configured with restricted credentials and signed callbacks.
Evidence
Controlled end-to-end tests prove authorized-number calling, suppression, calendar roundtrips, billing lifecycle, backups, and incident response.
Authority
American Business Capital Group, Inc. completes legal, data-license, carrier, security, and final human launch reviews before external automation switches can open.
Recent releases
New versions add verifiable product behavior.
Release notes describe customer-visible or safety-relevant changes. They do not treat unfinished provider setup as shipped functionality.
Legal-entity-only global catalog boundary
Corrects the dormant worldwide GLEIF loader before activation. The loader now pins the official 2026-08-12 08:00 UTC archive and its exact SHA-256 fingerprint, inspects all 3,400,279 source rows, excludes exactly 124,333 SOLE_PROPRIETOR records, and permits only 3,275,946 legal-entity records across 6,552 immutable chunks. Health evidence explicitly states that the catalog contains no natural persons or contact data and grants no outreach authority. The global lane remains disabled until its private Supabase importer, service-role privileges, database counts, rollback path, and release fingerprint are independently verified; this release performs no provider lookup, call, email, message, or public data activation.
Provider-rights registry and business-contact classification
Adds a fail-closed, server-only rights registry for the paid SalesPitch lead pool. A service token can no longer assert a provider name or contract reference by itself: every ingest batch must match an approved provider-plus-contract entry, explicit rights class, SHA-256 rights-evidence digest, customer-display and workspace-copy authorization, permitted fields, operations, territories, and expiry window before any database read or write occurs. Existing rows without this exact proof are quarantined. Decision-maker names and business contact details are now correctly classified as personal data with sensitive demographics, personal email, and non-business phone classes excluded. Public and member responses continue to hide provider identities, contract references, raw source rows, and credentials; this release performs no provider lookup, purchase, call, email, or message.
Reviewed official public-business decision makers
Adds a distinct public_business_source authority for manually reviewed executive names, current company roles, and company switchboards published by the relevant business. Silver-and-higher plan language now distinguishes reviewed official public-business facts from contract-licensed provider rows and CC0/open data; copied field evidence uses the same distinction instead of relabeling public facts as licensed. Official leadership and contact pages must be current, source URLs remain attached to field proof, company numbers stay classified as company rather than direct, and ambiguous professional-profile matches are suppressed. Public professional facts do not establish consent, DNC clearance, reachability, or permission to call, and third-party provider rows still require downstream display rights before entering the paid pool.
Rights-cleared lead pool and aggregate service evidence
Expands the paid member lead source from contract-licensed records to a truthful governed pool that may also contain commercially reusable open data. Silver, Gold, Diamond, Platinum, and Lead Validation benefits now use the same rights-cleared language and monthly allowance rules. A service-token-protected aggregate receipt reports total, eligible, suppressed, verified, and channel-availability counts without returning contact records, provider names, or raw source rows. The first CC0 executive batch is retained only where structured-data rights permit commercial reuse; current leadership facts are independently checked, historic non-operating founders are suppressed, company switchboards are classified as company rather than direct numbers, and no stored record establishes consent, DNC clearance, reachability, or permission to call.
Paid licensed lead pool and calling-list pulls
Adds a server-only licensed business-contact pool, exact field-evidence records, provider ingest receipts, tenant claim ledger, and idempotent monthly allowance reservations. Silver, Gold, Diamond, Platinum, and Lead Validation members can search company, role, seniority, location, validation, and channel availability, then deliberately pull up to ten eligible records into a new or existing mutable calling list. Search previews withhold contact identity and business contact values until the governed pull; provider contract names and record identifiers remain server-only; personal email and non-business phone classes are discarded at ingest; expired, suppressed, blocked, or out-of-license records fail closed. Schema revision 54 adds five recovery-verified tables. This release performs no call, email, message, or provider lookup by itself, and it does not claim that any provider dataset has loaded until an authenticated ingest receipt exists.
Private v5.00 release evidence ledger
Adds one authenticated, deterministic v5.00 evidence ledger that separates engineering and credentials from controlled tests, customer-facing data rights, independent human voice review, tenant administrator actions, final business authority, and deliberate activation switches. It closes launch-runway omissions by making C.O.L.T.E.N.™'s five-minute endurance results, 100-slot capacity evidence, governed speech-source catalog, cold-call playbook, source-intelligence inventory, and source-asset integrity explicit gates. The decision-maker provider waterfall reports only bounded gate status, never credential values, provider payloads, or personal contacts. A configured connector or completion percentage cannot authorize a market-ready claim; even a fully machine-verified ledger still requires named human review and independent production verification.
Authenticated monitoring-provider receipts
Adds a service-token-protected evidence boundary for Sentry, incident-alert delivery, and Discord support checks. The endpoint accepts only fixed provider classes, approved observation sources, recent timestamps, HTTP outcomes, bounded latency, and hashed receipt identities; it rejects unknown fields and never retains credentials, provider payloads, customer data, message content, or raw provider identifiers. Evidence expires after 90 minutes, replayed receipt identities must match exactly, runtime configuration remains separate from provider health, and public monitoring readiness now requires current healthy evidence for every configured core monitoring provider. Schema revision 53 adds the bounded evidence ledger and restore coverage after the Dashboard API registry in revision 52. This release does not claim that Sentry, incident alerts, or Discord are configured or healthy until real authenticated receipts arrive.
C.O.L.T.E.N.™ v35 final-draft voice controls
Publishes the jarvis-natural-voice-v35 behavior contract across the website and customer app while retaining the newer production CRM, monitoring, and security history. C.O.L.T.E.N.™ uses the exact approved self-executing representative opening, answers direct AI, bot, automation, or human-identity questions truthfully, creates each continuation under the full session policy, targets 32-word drafts, rewrites any ordinary turn above 40 words to 28 words or fewer, and scans twice before audio for internal implementation narration. The exact content-free policy fingerprint is verified while prompts, transcripts, provider payloads, customer data, and synthetic cue text remain excluded. The additional 1,000-call synthetic run remains in progress, and five independent human reviewers remain required before any 4.9/5 or 5/5 quality claim or uncontrolled calling release.
Universal CRM Dashboard API
Adds a tenant-scoped, read-only Dashboard API for every system in the 426-connector CRM and sales-app catalog. Workspace owners can choose a provider, allow one exact HTTPS browser origin, select Leads, Calling, Prospecting, and Follow-up widgets, copy a one-time bearer token, and rotate or revoke it immediately. SalesPitch retains only a contextual SHA-256 token hash and returns aggregate progress, success, and next-action counts—never customer contact rows or credential values. Schema revision 52 adds the installation registry and recovery coverage. Compatibility means the CRM accepts a custom app, tab, widget, web app, or REST API data source; it does not claim a certified marketplace listing, vendor endorsement, automatic vendor-side installation, or finished native two-way synchronization for every provider.
Cloud-native encrypted CRM credential vault
Adds a FastAPI Cloud-compatible remote vault that encrypts CRM OAuth state and provider token bundles with AES-256-GCM inside the connector service, retains only tenant-bound ciphertext and nonce metadata in SalesPitch AI D1, and keeps the decryption key and all credential plaintext exclusively in the connector deployment secret manager. One-use OAuth state is bound to the exact pending connection, provider, authorization attempt, generation, expiry, and atomic callback consumer. The local encrypted SQLite backend remains an explicit compatibility option, while the default connector no longer requires a persistent filesystem. Schema revision 51 adds the two encrypted-vault tables and recovery coverage. This release does not activate a provider: OAuth clients, bridge secrets, worker URL, vendor approval, and a controlled read-only synchronization test remain required.
Complete named automotive connector and object coverage
Expands the governed integration catalog from 392 to 426 distinct systems so the named BHPH, desking, F&I, inventory, fixed-operations, communications, customer-intelligence, and OEM retail products remain directly discoverable instead of being compressed into broader vendor entries. Every automotive connector now declares the same complete 38-object dealership import model spanning dealer group, dealership, OEM franchise, store, employees, salespeople, BDC agents, customers, households, leads, opportunities, vehicles, VIN, inventory, trades, deals, credit, lenders, F&I, appointments, test drives, calls, SMS, email, service, equity, lease maturity, and ownership cycle. SMS import intentionally retains delivery metadata without message bodies. Adapter and partner activation states remain fail-closed until provider-specific credentials, approvals, worker logic, and controlled reconciliation are verified.
Hardened CRM sync and partnered automotive data path
Expands the governed integration catalog to 392 systems and designates AutoManage VM as the partnered automotive CRM and management database with partner API setup still required before any live synchronization claim. CRM authorization callbacks are now one-use events bound to an exact expiring attempt and monotonic generation; queue polling issues a signed five-minute lease bound to current data policy, billing entitlement, and vault key version; concurrent batches use atomic claims and monthly saved-lead reservations; interrupted side effects enter explicit recovery quarantine; and retained normalized snapshots remove raw external identifier fields. The homepage also identifies ChatGPT, Codex, the OpenAI Platform, NVIDIA-accelerated hardware, and Apple hardware used during development and testing without claiming sponsorship, certification, endorsement, or identical production infrastructure.
Governed CRM lead synchronization foundation
Adds a tenant-scoped CRM connection center to Leads, a 391-system integration catalog spanning general, sales, automotive, dealership, and DMS platforms, and configuration-ready connection paths for Salesforce, HubSpot, Microsoft Dynamics 365, Zoho CRM, and Pipedrive. A new connector-worker boundary normalizes Lead, Contact, Account, Opportunity, Activity, Call, Meeting, Task, Note, and Disposition records into the protected SalesPitch AI data plane, with optional automotive objects, bounded idempotent batches, hashed external identifiers, authority-expiry checks, audit evidence, and opaque vault references instead of browser or database credential storage. This source release does not claim that provider OAuth clients, partner approvals, connector workers, or production synchronization are live; each provider remains fail-closed until those deployment gates are configured and verified.
Governed C.O.L.T.E.N.™ source intelligence
Adds a license-aware source-intelligence boundary built from ten fully inspected customer-supplied sources. C.O.L.T.E.N.™ can use 354,164 licensed English entries for bounded campaign vocabulary hints and 226 explicitly approved workbook records for optional conversational guidance, while 2,308 sales-call sentences and 1,038 authorized-speaker recording passages remain offline evaluation material rather than prospect facts. All 564 referenced links are inventoried; no movie, television, speech, or third-party video dialogue is ingested because usage rights were not verified. The controlled evaluation catalog advances to jarvis-conversation-eval-v22 with 77 transcript-free scenarios, including permission-based opening, verified-source claims, concise objection handling, meeting-first progression, and aggregate-only learning. Runtime 0.44.0 fails closed if the inventory or any governed source asset drifts. This release records no passing human listening panel and does not unlock uncontrolled calling.
C.O.L.T.E.N.™ capacity and continuous safe QA
Advances C.O.L.T.E.N.™ Voice to runtime v0.43.0 with a race-safe pool of 100 concurrent conversation slots that all use the same C.O.L.T.E.N. AI™ identity, voice options, knowledge, tools, safeguards, and functionality while retaining isolated per-conversation memory. The 101st launch fails before durable reservation or provider submission; known dispatch failures, machine answers, and terminal call statuses release capacity, and public health exposes aggregate totals only. Ten non-routable synthetic trial accounts now exercise all three monthly subscription workflows hourly in GitHub Actions with zero provider requests, external actions, or production records. C.O.L.T.E.N.™ Operations and Lead Validation also publish fail-closed worker heartbeat evidence. This software capacity contract does not by itself prove that the current Render instance, Twilio account, OpenAI project, or human listening panel can sustain 100 simultaneous five-minute calls; those controlled production gates remain required.
C.O.L.T.E.N.™ endurance and guided product navigation
Advances the shared C.O.L.T.E.N.™ natural-voice contract to jarvis-natural-voice-v16, the controlled listening catalog to jarvis-conversation-eval-v21 with 67 transcript-free scenarios, and the voice runtime to 0.42.0. New five-minute endurance controls require continuous context, reuse accepted facts instead of re-asking, recover unresolved questions, handle repeated interruptions consistently, and resist late-call delivery drift. The website and app navigation now use accessible desktop and mobile dropdown groups with C.O.L.T.E.N. AI™ directly visible, full Solutions and Company groupings, and a Plans menu that separately identifies all three monthly subscriptions and the annual memberships. Existing Lead Database filters continue to cover industry, title, company, geography, size, revenue, seniority, validation, channel, buyer profile, fit, freshness, suppression, and source authority with per-field evidence and call locks. This source release records no passing human listening panel and does not unlock uncontrolled calling.
Guided demos and five-minute conversation gate
Rebuilds the public safe preview, verified self-demo, and member AI Meeting Generator around clear step-by-step instructions and one honest next action. Adds a transcript-free five-minute C.O.L.T.E.N.™ quality gate requiring at least five minutes, ten prospect turns, complete audible and interruption-recovery evidence, median reply start at or below 1.5 seconds, 95th-percentile reply start at or below 2.5 seconds, and five independent listener reviews averaging at least 4.3 out of 5 for naturalness, turn taking, and continuity. The gate fails closed on context resets, repeated openings, incomplete or inaudible responses, provider errors, token caps, weak listener scores, or missing AI disclosure. This release defines and tests the standard; it does not claim that a live five-minute listening panel has passed and does not unlock uncontrolled calling.
Canonical C.O.L.T.E.N.™ robot and verified commercial release
Replaces every public, demo, sandbox, and member-workspace C.O.L.T.E.N.™ placeholder with one transparent, cursor-responsive, fully mechanical SalesPitch AI character—no human face, superhero styling, or borrowed identity. The release also synchronizes the Balanced Hybrid 2026 catalog with eight verified live Stripe recurring prices and payment links, adds a password-protected investor sandbox that blocks production side effects at the edge, restores exact Render and environment contracts, and patches the deployed dependency graph to zero known production vulnerabilities. The complete production build and 730 automated contracts pass; live calls, messages, calendar writes, provider refreshes, and general market release remain governed by their separate production approvals and readiness evidence.
Immutable audience segment portfolio
Adds a dedicated audience segment portfolio to the protected Lead Database, classifying exact filtered snapshots, mutable user selections, and governed source imports without exposing another tenant or inventing a contact. Members can open each exact list, review retained membership totals and activity age, and distinguish list memberships from unique people. Frozen filtered segments are now immutable at both the member interface and protected mutation route, preserving the membership fingerprint recorded when the complete filtered match was created. No provider lookup, credit spend, call, message, calendar write, or other external action is performed by this release.
Human-paced C.O.L.T.E.N.™ vocal delivery
Advances the shared C.O.L.T.E.N.™ natural-voice contract to jarvis-natural-voice-v15, the controlled listening catalog to jarvis-conversation-eval-v20 with 63 transcript-free scenarios, and the voice runtime to 0.41.0. C.O.L.T.E.N.™ now groups meaning-linked clauses instead of pausing mechanically at every comma, lets statements settle while reserving a questioning contour for genuine questions, and keeps vocal emphasis selective rather than punching every brand, noun, number, or clause. Three new two-reviewer listening cases reject choppy clause delivery, habitual statement upspeak, and overemphasized announcer cadence. The new contract and catalog identities invalidate older evidence; this release records no passing listening result and does not unlock live calling.
Governed Lead Database and living C.O.L.T.E.N.™ identity
Separates the customer-authorized Lead Database from live company validation, places it directly between Lead Validation and AI Meeting Generation, and adds exact filters for industry, department or title, company, geography, company size, revenue band, seniority, verification, contact channel, source authority, freshness, suppression, and evidence-backed fit. Saved segments remain tenant-scoped and provenance-aware; unavailable data never becomes a fabricated result. The app replaces static C.O.L.T.E.N.™ initials with a cursor-responsive character while public version labels now use a consistent dotted format. No provider lookup, contact purchase, message, meeting, or call is performed by this release.
Contextual C.O.L.T.E.N.™ turn delivery
Advances the exact shared natural-voice contract to jarvis-natural-voice-v14 and the C.O.L.T.E.N.™ Voice runtime to 0.40.0. C.O.L.T.E.N.™ must vary how nearby turns begin, avoid announcing short answers with written structure labels, and mirror ordinary customer terminology only when it improves clarity—without imitating accents, impairments, slang patterns, verbal tics, or mannerisms. Customer-facing company references now use American Business Capital Group, Inc. in full, and C.O.L.T.E.N.™ speaks the legal name naturally rather than reducing it to initials. The content-free health contract adds three exact controls plus the new policy fingerprint; no policy text, transcript, audio, contact data, credential, or provider response is exposed or retained. This release records no passing listening result and does not unlock live calling.
Exact-evidence campaign candidate gate
Moves exact current phone-field verification to the campaign-construction boundary, before C.O.L.T.E.N.™ ranks or displays a prospect. Candidates whose retained phone lacks current matching evidence are excluded rather than entering a dead-end review queue. The signed no-call creation receipt and audit record now reconcile source-candidate, evidence-eligible, and evidence-excluded counts without exposing phone values or evidence hashes; approval and final launch still repeat the exact-evidence check.
Natural C.O.L.T.E.N.™ spoken-delivery evaluation
Advances the transcript-free launch catalog to jarvis-conversation-eval-v19 with 60 controlled scenarios. Three new two-reviewer cases reject repeated use of a person's name as filler, telegraphic or legalistic written-form cadence, and narration of internal tools, state transitions, or system mechanics. The immutable catalog fingerprint changes, so older evidence fails closed. This release records no passing listening result, stores no transcript or audio, and does not unlock live calling.
Natural C.O.L.T.E.N.™ spoken delivery
Advances the exact shared natural-voice contract to jarvis-natural-voice-v13 and the C.O.L.T.E.N.™ Voice runtime to 0.39.0. C.O.L.T.E.N.™ must now avoid repeating a person's name as filler, favor ordinary spoken contractions and connected phrasing, and hide internal reasoning, tool names, state transitions, and system mechanics while stating only truthful customer-facing outcomes. The content-free health contract adds three exact controls plus the new policy fingerprint; no policy text, transcript, audio, contact data, credential, or provider response is exposed or retained. This release records no passing listening result and does not unlock live calling.
Natural C.O.L.T.E.N.™ short-turn evaluation
Advances the transcript-free launch catalog to jarvis-conversation-eval-v18 with 57 controlled scenarios. Three new two-reviewer cases reject echoed short answers or praise for routine details, exaggerated emotional energy, and repeated formulaic transition phrases across nearby turns. The immutable catalog fingerprint changes, so older evidence fails closed. This release records no passing listening result, stores no transcript or audio, and does not unlock live calling.
Natural C.O.L.T.E.N.™ short-turn delivery
Advances the exact shared natural-voice contract to jarvis-natural-voice-v12 and the C.O.L.T.E.N.™ Voice runtime to 0.38.0. C.O.L.T.E.N.™ must now carry short factual answers forward without needless echoing, keep emotional energy proportional to the person's tone and the moment, and avoid recycled formulaic bridges across nearby turns. The content-free health contract adds three exact controls plus the new policy fingerprint; no policy text, transcript, audio, contact data, credential, or provider response is exposed or retained. This release records no passing listening result and does not unlock live calling.
Unforced C.O.L.T.E.N.™ evaluation
Advances the transcript-free launch catalog to jarvis-conversation-eval-v17 with 54 controlled scenarios. Three new two-reviewer cases reject routine follow-ups after complete answers, feature-inventory monologues, and pressure or false consent during hesitation. The immutable catalog fingerprint changes, so older evidence fails closed. This release records no passing listening result, stores no transcript or audio, and does not unlock live calling.
Unforced C.O.L.T.E.N.™ dialogue
Advances the exact shared natural-voice contract to jarvis-natural-voice-v11 and the C.O.L.T.E.N.™ Voice runtime to 0.37.0. C.O.L.T.E.N.™ must now stop naturally after a complete answer instead of appending a routine question, compress feature inventories into one or two relevant conversational details, and protect thinking space without repeating, pressuring, or treating silence as consent. The content-free health contract adds three booleans plus the exact policy fingerprint; no policy text, transcript, audio, contact data, credential, or provider response is exposed or retained. This release records no passing listening result and does not unlock live calling.
Explicit lead-source selection
Marks the selected Lead Library evidence-source renewal card as the current item and gives every source action an exact accessible name containing the retained provider and license class. Selecting and clearing a review target is now unambiguous without changing current-page scope, the ranked verified evidence plan, suppression exclusions, or the no-provider-request/no-credit-spend/no-external-action boundary.
Accessible lead-source renewals
Makes the selected Lead Library evidence-source renewal state an explicit polite live status and gives previous and next controls exact target labels that include the retained provider and license class. Disabled boundaries announce that no prior or next source exists instead of exposing an ambiguous control. The ranked verified plan, current-page scope, urgent toggle, cleared selection, suppression exclusion, and no-provider-request/no-credit-spend/no-external-action boundaries remain unchanged.
Truthful C.O.L.T.E.N.™ quality evidence
Adds a dedicated quality-evidence section to the public C.O.L.T.E.N. AI™ experience. It distinguishes the current 51-scenario evaluation target from a completed listening result, explains the two-independent-review-packet requirement, names the content excluded from published evidence, and links directly to current production status. The section does not claim that human listening has passed, does not expose transcript or audio, and does not change provider, call, or launch authority.
Proportional C.O.L.T.E.N.™ evaluation
Advances the transcript-free launch catalog to jarvis-conversation-eval-v16 with 51 controlled scenarios. Three new two-reviewer cases require useful acknowledgments to connect directly to substantive progress, response size to remain proportional to the person's contribution, and a brief confirmation to advance only one approved step without a full recap or reopened decision. The immutable catalog fingerprint changes and older listening evidence fails closed. This release records no passing listening result, stores no transcript or audio, and does not unlock live calling.
Proportional C.O.L.T.E.N.™ conversation
Advances the exact shared natural-voice contract to jarvis-natural-voice-v10 and the C.O.L.T.E.N.™ Voice runtime to 0.36.0. Useful acknowledgments must now connect directly to a substantive answer or next approved step, response size must stay proportional to the person's contribution, and a brief confirmation can advance only one approved step without a full recap, repeated wording, or reopened decision. The content-free health contract adds three booleans plus the exact policy fingerprint; no prompt, transcript, audio, contact data, credential, or provider output is exposed or retained. This release records no passing human listening result and does not unlock live calling.
Recoverable Help Desk playback
Extends truthful browser playback recovery to the full C.O.L.T.E.N.™ Help Desk for voice samples, manual answer playback, and automatic read-aloud. If a browser requires another user gesture after secure audio preparation, the exact approved profile-bound audio and verified written answer remain available, both playback controls become explicit start actions, and Stop can still discard the prepared object. A second permission rejection stays recoverable; any other playback failure releases audio and fails closed. Exact voice identity, bounded preparation, transcript matching, same-origin enforcement, rate limits, no retention, and no external action remain unchanged.
Source-specific urgent renewals
Lets members narrow an already selected provider-and-license evidence group to the exact current-page contacts whose proof from that authority expires within seven days, then return to the complete 30-day source workload without changing the server query or pagination. A dedicated fail-closed review validates every urgency flag and bounded source label before exposing the subset. Switching source groups clears urgency and record selection; suppression exclusion, original contact order, aggregate workload context, no provider request, no credit spend, no evidence mutation, no outreach, and no external action remain unchanged.
Recoverable C.O.L.T.E.N.™ playback
Treats a browser autoplay restriction as a distinct, truthful, recoverable state instead of misreporting the approved C.O.L.T.E.N.™ voice as unavailable. The prepared profile-bound audio remains local to the page, the control asks for one more user click, and playback resumes without another provider request; other playback failures still release the object and fail closed. Exact selected-voice labels, accessible live status, profile-bound verification, clean transition cleanup, stable playback, bounded preparation, stale-request protection, approved wording, transcript matching, same-origin enforcement, rate limits, no retention, and no external action remain unchanged.
Accessible C.O.L.T.E.N.™ voice controls
Gives every reusable C.O.L.T.E.N.™ sampler an exact selected-voice action label for preparation, cancellation, and playback, plus an explicit live status region. Keyboard and screen-reader users can now distinguish the chosen accent and presentation before acting and receive truthful preparation, speaking, timeout, unavailable, and ready updates. Profile-bound verification, clean transition cleanup, parent callback isolation, stable playback, cancelable bounded preparation, stale-request protection, exact approved wording, delivery v2 phrasing, transcript matching, same-origin enforcement, rate limits, no retention, and no external action remain unchanged.
Clean C.O.L.T.E.N.™ profile transitions
Separates governed-profile resets from component removal in every reusable C.O.L.T.E.N.™ sampler. A profile change still cancels old audio, clears stale state, and reports ready on the next browser task; unmount cleanup now only clears the pending reset and releases audio, avoiding state updates during component teardown. Parent callback isolation, stable playback, cancelable bounded preparation, stale-request protection, truthful selected-voice states, exact approved wording, delivery v2 phrasing, transcript matching, profile-bound verification, same-origin enforcement, rate limits, no retention, and no external action remain unchanged.
Stable C.O.L.T.E.N.™ sample playback
Separates reusable sampler lifecycle cleanup from parent callback identity changes. The avatar hero and any other surface may now rerender or provide a new state callback when playback begins without triggering profile cleanup and pausing the valid sample. A current callback reference receives state updates, while audio cleanup remains tied only to an actual governed-profile change or component removal. Cancelable bounded preparation, stale-request isolation, truthful selected-voice states, exact approved wording, delivery v2 phrasing, transcript matching, profile-bound verification, same-origin enforcement, rate limits, no retention, and no external action remain unchanged.
Truthful C.O.L.T.E.N.™ sampler states
Makes every reusable C.O.L.T.E.N.™ sampler name the exact selected accent and presentation while distinguishing governed-profile ready, secure preparation, active playback, timeout, and unavailable states. The prior generic message no longer claims a sample was generated before audio exists. Labels are derived from the same normalized profile used for request binding, so invalid values fall back to the approved identity instead of producing inconsistent copy. Cancelable bounded preparation, stale-request isolation, exact approved wording, delivery v2 phrasing, transcript matching, profile-bound verification, same-origin enforcement, rate limits, no retention, and no external action remain unchanged.
Cancelable C.O.L.T.E.N.™ sample preparation
Brings the Help Desk's bounded, cancelable voice-preparation behavior to every reusable C.O.L.T.E.N.™ sampler in the campaign center, voice studio, avatar hero, and demo. A member can cancel while audio is preparing, stalled preparation ends after the governed timeout with a truthful profile-preserved message, and request-identity checks prevent an older aborted completion or playback event from stopping or overwriting a newer profile sample. Profile-change cleanup, exact approved wording, delivery v2 phrasing, transcript matching, profile-bound response verification, same-origin enforcement, rate limits, no retention, and no external action remain unchanged.
Source renewal workload context
Advances lead evidence-source navigation to a v2 contract that carries the selected source's verified urgent and 30-day contact-field renewal counts through previous and next review controls. Members can now distinguish the number of matching contacts on the current page from the aggregate field-level proof workload for that retained provider and license authority. Invalid, duplicate, inconsistent, or stale plan data still fails closed. Original contact order, current-page isolation, suppression exclusion, cleared selections, no provider request, no credit spend, no record mutation, no outreach, and no external action remain unchanged.
Meaning-led C.O.L.T.E.N.™ phrasing
Advances exact-script playback to the C.O.L.T.E.N.™ Help delivery v2 contract. The governed audio request now treats punctuation as phrasing guidance rather than mechanical pause commands, keeps connected thought groups together, lets meaning determine sentence-boundary timing, begins at a natural speaking level, and finishes the final word without a synthetic fade or clipped ending. Exact approved wording, provider transcript matching, profile-bound response verification, same-origin enforcement, bounded waits, rate limits, no retention, truthful AI identity, and no external action remain unchanged.
Bounded C.O.L.T.E.N.™ voice wait
Places a 30-second customer-side ceiling on Help Desk voice preparation while retaining the server's shorter provider timeout. A stalled request is aborted, its timer is always cleared, the PREPARING state ends, and the verified written answer remains visible with an honest retry instruction. A customer's manual cancellation stays distinct from a timeout, and stale aborted requests still cannot overwrite a newer voice selection or playback state. Profile-bound response verification, approved-script controls, transcript matching, same-origin enforcement, rate limits, no retention, and no external action remain unchanged.
Cancellable C.O.L.T.E.N.™ voice preparation
Adds an explicit PREPARING state while the C.O.L.T.E.N.™ Help Desk securely generates approved audio. Voice controls cannot start overlapping requests, the Stop voice control can cancel an in-flight generation before playback begins, and stale request completions cannot overwrite the current voice state. The interface exposes its busy state to assistive technology and returns to the exact selected accent and presentation label after cancellation. Profile-bound response verification, approved-script controls, transcript matching, same-origin enforcement, rate limits, no retention, and no external action remain unchanged.
Truthful C.O.L.T.E.N.™ voice identity
Makes the C.O.L.T.E.N.™ Help Desk identify the voice a customer actually selected. American, British, and Australian accent choices now produce matching ready, speaking, and completed status text; masculine and feminine presentation choices no longer carry a hard-coded American label. The same normalized governed profile that binds playback is used to build the customer-visible identity, so invalid values fall back to the approved American masculine default. Profile-bound response verification, automatic playback cancellation, approved-script controls, transcript matching, same-origin enforcement, rate limits, no retention, and no external action remain unchanged.
Profile-bound C.O.L.T.E.N.™ audio
Adds one bounded normalized token for the exact C.O.L.T.E.N.™ accent, voice presentation, language, language mode, conversation style, and speaking pace used for public audio generation. The server returns that content-free token with each verified WAV, and both the Help Desk and reusable voice-profile sampler reject a response that does not match the requested profile—even when the general voice and delivery contract versions are current. Changing a profile stops and clears in-flight or playing audio before another sample can begin, preventing an older accent or delivery from being presented as the user's new selection. Approved-script, transcript-match, same-origin, rate-limit, no-retention, and no-external-action boundaries remain unchanged.
Ranked source-renewal navigation
Lets members move to the previous or next provider-and-license group inside the current-page evidence-renewal plan while preserving the server-verified ranking and exact page scope. A dedicated v1 navigation contract validates every bounded source label, nonzero renewal count, urgent-to-total relationship, unique authority pair, and selected source before exposing navigation; any malformed, duplicate, missing, or stale plan fails closed. Changing groups clears record selection and list-building state, never changes the submitted filters or pagination, and performs no provider request, evidence refresh, credit spend, record mutation, outreach, or external action.
Contract-bound C.O.L.T.E.N.™ playback
Binds both public C.O.L.T.E.N.™ audio consumers—the Help Desk and the governed voice-profile sample—to the exact voice-profile and Help Desk delivery contracts returned by the server. Even a successful WAV response is rejected when either response header is missing or stale, preventing an edge, old route, or mismatched runtime from being presented as the currently governed C.O.L.T.E.N.™ voice. The controls still accept only server-approved text, require exact transcript verification before audio leaves the server, retain no audio on the page, and perform no call, message, booking, account, or provider action.
Verified C.O.L.T.E.N.™ Help delivery
Repairs a fail-closed mismatch between the public Help Desk's voice-sample button and the server's single approved sample, so the visible control now submits the exact governed script the server permits. A dedicated v1 Help Desk delivery contract also directs the audio model to connect related words, vary clause timing and pitch subtly, avoid uniform sentence landings and commercial voice-over cadence, and never manufacture breaths, sighs, laughter, or filler. Provider audio is still accepted only when its returned transcript canonically matches the approved written answer, and the route remains same-origin, bounded, rate-limited, server-keyed, non-retaining, and incapable of placing a call, sending a message, booking a meeting, or taking another provider action.
Page-scoped source renewal review
Turns Release 411's aggregate source-renewal plan into an exact current-page member review. A member can select one retained provider and license authority, isolate only otherwise-complete contacts whose current verified proof from that source expires within 30 days, select the resulting visible set, and return to the unchanged page. The browser derives the worklist from the same independently verified v5 coverage contract, preserves original contact order, and fails closed if any page coverage or source evidence is missing. The review changes no server filter or pagination and performs no provider request, credit spend, evidence renewal, record mutation, outreach, or external action.
Source-aware lead evidence renewal plan
Advances the protected Lead Library evidence contracts to v5 and groups current verified contact-field proof due within 30 days by its retained provider and license authority. Members can see exact aggregate renewal workload per governed source, including the subset due within seven days, while the browser independently recomputes the plan from the same tenant-scoped field evidence and verification clock. Suppressed contacts are excluded, contact values and provider identifiers are not added to the aggregate, and the deterministic plan performs no provider request, credit spend, evidence refresh, record mutation, outreach, or external action. Source proof still does not establish reachability, consent, DNC clearance, or permission to call.
C.O.L.T.E.N.™ clarification runtime alignment
Binds Release 409's targeted clarification, brief mishearing repair, and compound-question listening requirements directly into the controlling C.O.L.T.E.N.™ Realtime policy and every governed customer voice profile. C.O.L.T.E.N.™ must preserve understood context and ask for only the unclear detail, accept a correction without an apology loop or full-conversation recap, and prioritize the first substantive question while acknowledging the remainder instead of producing a compressed monologue. The shared natural-voice contract advances to v9 with three additional public fail-closed controls and a new content-free policy fingerprint. This proves deterministic runtime alignment without exposing policy text, transcripts, audio, contact data, credentials, or provider responses; it does not claim that the required independent human listening review has passed, and live calling remains locked behind every production gate.
C.O.L.T.E.N.™ natural clarification evaluation gates
Advances the transcript-free C.O.L.T.E.N.™ launch catalog to v15 with 48 controlled scenarios and a new immutable fingerprint. Three additional two-reviewer cases require one targeted clarification without discarding established context, brief correction after a mishearing without an apology loop or full-script recap, and concise prioritization of compound questions while acknowledging the remainder. Retained evaluation evidence remains limited to outcome codes, tool names, bounded timing, counts, packet fingerprints, and conservative scores—never transcripts, audio, prompts, contact data, reviewer identity, or model output. These are new listening requirements, not a claim that the current independent human listening review has passed; live calling remains locked behind every production gate.
Seven-day evidence renewal urgency bands
Advances the protected Lead Library evidence contracts to v4 and divides the existing 30-day renewal signal into deterministic seven-day urgent and 30-day upcoming bands. Members can see urgent contact and field counts, isolate only otherwise-complete current-page contacts with verified proof due within seven days, select that exact visible set, and return to the unchanged page. The browser independently recomputes both urgency bands from the server-bound evidence timestamp and fails closed on missing urgency evidence. Urgent does not mean callable, reachable, consented, or DNC-cleared; the workflow performs no provider request, credit spend, evidence renewal, record mutation, outreach, or external action.
Page-scoped lead evidence renewal review
Turns Release 406's 30-day evidence signal into a dedicated member review mode. Members can isolate only current-page contacts whose verified canonical field proof is approaching expiry, preserve the page's original contact order, select exactly the visible renewal set, and return to the complete page without changing server filters or pagination. The general evidence-exception review now recognizes the renewal priority instead of failing closed on the new contract. Missing or unsupported coverage still empties an enabled review rather than hiding uncertainty. The mode performs no provider request, enrichment, credit spend, evidence renewal, record mutation, outreach, or external action; current proof remains current until its retained expiry.
Upcoming lead evidence renewal queue
Adds a deterministic, privacy-safe 30-day renewal queue to the protected Lead Library. Current verified proof remains counted as current, while canonical fields whose retained source evidence expires within 30 days are separately identified for renewal and aggregated into the current-page remediation plan. The response binds every freshness calculation to one exact evidence-check timestamp, and the browser independently reproduces the coverage and summary from that same timestamp before showing it. Suppressed contacts remain excluded from remediation priorities. The queue contains only field names and aggregate contact counts and performs no provider request, enrichment, credit spend, record mutation, outreach, or other external action; evidence still does not establish reachability, consent, DNC clearance, or permission to call.
Natural conversation runtime alignment
Applies Release 404's objection, context-continuity, and terminal-closing listening targets directly to the controlling C.O.L.T.E.N.™ Realtime policy and each governed customer voice profile. C.O.L.T.E.N.™ must reflect the substance of an objection before one concise evidence-grounded response, carry established relevant context into later turns without repeating an answer or restarting the introduction, and end a terminal outcome with one brief close instead of launching a new pitch or stacking questions. The shared natural-voice contract advances to v8 with three additional public fail-closed controls and a new content-free policy fingerprint. This proves deterministic runtime alignment without exposing the policy or claiming that the required independent human listening review has passed; live calling remains locked behind all production gates.
Natural conversation continuity gates
Advances the transcript-free C.O.L.T.E.N.™ launch catalog to 45 governed scenarios with three new safeguards for natural objection handling, multi-turn context continuity, and brief outcome-aware closings. The catalog now checks that C.O.L.T.E.N.™ reflects the substance of an objection before responding concisely, carries relevant context forward without repeating an earlier answer or restarting a scripted introduction, and ends a completed outcome without launching a new pitch or stacking another closing question. These are deterministic evaluation requirements—not a claim that a current human listening review has passed—and live prospect calling remains locked behind the full signed evidence, independent listening, compliance, and controlled authorized-number test gates.
Prioritized lead evidence remediation
Aggregates the protected Lead Library's field-level proof gaps into a deterministic current-page work plan. Repeated expired, unverified, and missing-proof fields are ranked by affected contact count, with canonical field names and exact aggregate counts only. Suppressed contacts are deliberately excluded from remediation priorities so the plan does not encourage unnecessary data work on blocked records. The browser independently reproduces the complete summary before presenting it, and the plan performs no enrichment, provider request, credit spend, record mutation, outreach, or external action.
Actionable lead evidence remediation
Turns each protected Lead Library coverage result into exact, privacy-safe field-level remediation cues. Members can now see which retained canonical field names need a source refresh, verification review, or missing proof without exposing the underlying contact value in the coverage contract. Counts are derived from and reconcile exactly with the ordered field-name arrays, while the browser independently reproduces the complete v2 receipt before showing it. This performs no enrichment, provider request, contact mutation, call, message, meeting, or other external action; source proof still does not establish consent, reachability, DNC clearance, or permission to call.
Natural conversation policy alignment
Applies the Release 400 listening targets directly to the controlling C.O.L.T.E.N.™ Realtime policy and customer voice-profile instructions. C.O.L.T.E.N.™ must answer a direct question in one or two short sentences before offering detail, avoid unrelated pivots and pitch-like monologues, state unsupported-answer limits in context-specific language instead of a stock fallback, and reflect the person's stated priority before resuming after an interruption. The shared natural-voice contract advances to v7 with an exact content-free policy fingerprint and three public fail-closed controls, so the app and independent production monitor reject missing or drifted behavior. This is deterministic runtime alignment—not a claim that the required human listening review has passed or permission to enable live calling.
Natural conversation evaluation gates
Advances the transcript-free C.O.L.T.E.N.™ launch catalog to v13 with 42 controlled scenarios. Three new independent cases now fail evaluation when C.O.L.T.E.N.™ turns a direct answer into a monologue or unrelated pivot, uses canned robotic uncertainty language, or resumes after an interruption without first reflecting the prospect's stated priority. Retained evidence remains limited to governed outcome codes, tool names, bounded timing, counts, and conservatively merged listening scores—never transcripts, audio, contact data, prompts, provider responses, or model output. This expands the measurable listening target; it does not claim the required two-reviewer human evaluation has passed or authorize live calling.
Reconciled lead evidence summary
Adds an exact current-page summary for the protected Lead Library that reconciles ready-for-review, refresh-required, evidence-incomplete, and suppressed contacts with the retained-field, current-proof, expired-proof, unverified-proof, and missing-proof totals underneath them. The server derives the content-free aggregate from the per-contact evidence receipts, and the browser independently reproduces both layers before showing any percentage or category count. Missing, extra, stale, or altered summary evidence invalidates the complete response rather than presenting a misleading dashboard. Suppression updates recompute the same contract locally. No contact value enters the summary, and no provider request, enrichment, record mutation, outreach, or external action occurs.
Page-scoped evidence review queue
Adds a member worklist that isolates every current-page contact whose field-level source proof is expired, incomplete, unverified, or suppressed while preserving the page's original contact order. The review is explicitly page-scoped, leaves tenant filters and pagination unchanged, clears selected contacts when the mode changes, and cannot run at the same time as duplicate-only review. Missing or unsupported coverage fails closed instead of hiding an exception. It performs no provider request, enrichment, validation purchase, record mutation, outreach, or external action, and source evidence still does not establish reachability, consent, DNC clearance, or permission to call.
Auditable lead evidence coverage
Adds a deterministic, action-free evidence-coverage receipt for every contact on the protected Lead Library page. The server counts only canonical fields that are actually retained, separates current verified proof from expired, unverified, and missing evidence, and labels each contact for review, refresh, incomplete evidence, or suppression. The member browser independently reproduces the projection and rejects missing, extra, or mismatched coverage before presenting the page as verified. The interface shows page and contact-level coverage while stating that source evidence is not proof of reachability, consent, DNC clearance, or permission to call. No enrichment, provider request, merge, outreach, or external action occurs.
Verifiable C.O.L.T.E.N.™ speech policy
Advances the shared C.O.L.T.E.N.™ natural-voice contract to v6 and publishes a content-free SHA-256 identity for the exact controlling Realtime speech policy. The protected app and independent production monitor now reject a runtime when that identity is missing or differs—even if its visible voice, pause, interruption, response-length, pronunciation, contact read-back, correction, and spoken-markup flags still appear correct. This proves policy identity without exposing the policy, prompts, scripts, transcripts, audio, contact data, credentials, or provider responses. It does not substitute for genuine two-reviewer listening evidence or authorize live calling.
Human-delivery evaluation gates
Advances the transcript-free C.O.L.T.E.N.™ launch catalog to v12 with 39 controlled scenarios. New independent listening cases now fail a release when C.O.L.T.E.N.™ inserts voiced filler instead of a brief pause, repeats the same acknowledgment in adjacent turns, reads email or phone details unnaturally, recites markup or navigation cues, or repeats more than the corrected fragment. The catalog records only bounded outcome codes, tool names, counts, timing, and independently merged listening scores—never transcripts, audio, contact details, prompts, or model output. These are stronger measurable gates, not a claim that the current human listening review has passed; live calling remains locked until genuine evidence and the authorized-number test are complete.
Resilient OpenAI startup preflight
Adds a bounded startup recovery path for transient OpenAI model-access reachability failures. C.O.L.T.E.N.™ Voice now retries the same read-only, project-scoped model check after one and two seconds, installs only the verified signed content-free receipt when the provider becomes reachable, and still stops immediately on credential, project, model, signature, response, or authorization failures. All attempts remain secret-free in logs and cannot place a call or change the live-call switch.
Natural C.O.L.T.E.N.™ delivery controls
Advances the shared C.O.L.T.E.N.™ voice contract to v5 across Realtime calling, Help Desk playback, the customer voice studio, app readiness, and the independent production monitor. C.O.L.T.E.N.™ now prefers a brief silence over synthetic hesitation, avoids repeating the same canned acknowledgment in consecutive turns, repeats only a corrected fragment when confirmation is needed, speaks email and phone read-backs in natural chunks, and never reads markup or interface labels aloud. These deterministic controls improve the listening target but do not claim that current two-reviewer human listening evidence has passed; live calling remains fail-closed until all production gates are verified.
Contact-bound Lead Library provenance
Requires positive, unchanged, or observed field provenance to correspond to the same protected contact's retained email, phone, profile URL, identity, employment, or company-profile value before the browser can trust it. Orphan positive evidence can no longer make an absent field appear validated, while legitimate negative provider evidence such as not-found, invalid, conflict, or provider-error outcomes remains visible for review. Safe links, governed vocabulary, freshness, chronology, privacy envelope, identity, request, pagination, and no-external-action controls remain unchanged.
Safe Lead Library provenance links
Applies one shared public-link policy to field-provenance URLs at both server projection and browser verification. Evidence links must be canonical HTTPS destinations without embedded credentials, query or fragment secrets, localhost names, private IPv4 ranges, or local/private IPv6 ranges; unsafe sources are removed by the server and cannot be trusted if reintroduced by a malformed response. Evidence vocabulary, clock-bound freshness, chronology, privacy envelope, identity, request, pagination, and no-external-action controls remain unchanged.
Governed Lead Library evidence vocabulary
Requires every field-provenance record in the protected Lead Library to use a documented evidence field, public license class, and verification outcome emitted by the approved customer-import, licensed-refresh, Browse AI, or verified self-demo writers. Invented field names, unsupported resale claims, and ambiguous verification labels now invalidate the complete response rather than appearing as trusted evidence. Clock-bound freshness, chronology, privacy envelope, row states, identity, request, pagination, and no-external-action controls remain unchanged.
Clock-bound Lead Library freshness
Binds every expiring field-provenance label to the verification clock: an expiry in the future must be current, while an expiry at or before verification must be expired. A stale label can no longer survive merely because its timestamp is well formed, and the browser rejects the complete protected response when freshness disagrees with retained evidence. Chronology, canonical timestamps, privacy envelope, governed states, provenance, identity, request, pagination, and no-external-action controls remain unchanged.
Chronological Lead Library evidence
Requires protected saved-list and contact histories plus field-provenance lifecycles to follow a possible chronological order. A list or contact cannot be updated before creation, validation and suppression dates cannot occur after the retained contact update, and field evidence cannot expire before it was observed. Impossible histories now invalidate the complete browser response rather than influencing lead freshness, compliance, or selection decisions. Canonical timestamps, privacy envelope, governed states, provenance, identity, request, pagination, and no-external-action controls remain unchanged.
Consistent Lead Library time evidence
Requires protected saved-list and contact lifecycle dates plus field-provenance observation and expiry dates to be canonical timestamps before the browser can trust them. A non-expiring evidence label must now correspond exactly to a null expiry, while current or expired evidence must retain an explicit valid expiry. Malformed dates and structurally impossible freshness claims invalidate the complete response rather than influencing validation or suppression decisions. Privacy-envelope, row-state, provenance, identity, request, pagination, and no-external-action controls remain unchanged.
Exact Lead Library privacy envelope
Requires the complete protected Lead Library response and each workspace, saved-list, contact, page, and segment object to contain exactly the reviewed public fields. Undeclared root properties, ownership identifiers, provider record IDs, internal cursors, private limits, and other unexpected data now invalidate the browser response instead of entering a trusted UI state. Governed row states, field provenance, identity, request, filters, pagination, page-drift, and no-external-action controls remain unchanged.
Governed Lead Library contact states
Requires every protected Lead Library contact row to use a recognized DNC state, source-license class, and validation state before the browser can present it as verified evidence. Invented clearance labels, unsupported license claims, and ambiguous validation claims now invalidate the complete response, while legitimate pending, partial, not-found, stale, invalid, verified, blocked, cleared, and suppressed lifecycle states remain available. Provenance, identity, request, filter, pagination, page-drift, and no-external-action controls remain unchanged.
Unique Lead Library field provenance
Requires every field-level provenance record shown for a protected contact to use the exact public evidence contract, a recognized freshness state, and a field name that appears only once for that contact. Duplicate field evidence, undeclared provider payload properties, and invented freshness labels now invalidate the complete Lead Library response rather than overstating validation coverage or leaking unapproved data. Tenant, request, filter, identity, pagination, page-drift, and no-external-action controls remain unchanged.
Complete Lead Library continuation proof
Requires the protected Lead Library page boundary to reconcile exactly with its tenant-scoped total. When more matching contacts remain, the response must provide the precise next offset; when the current page reaches the total, the response must provide no continuation. A missing, premature, stale, or surplus next-page marker now invalidates the complete browser response instead of hiding contacts or enabling a nonexistent page. Request, filter, identity, provenance, page-drift, and no-external-action controls remain unchanged.
Unique Lead Library page identities
Requires every saved-list identity and every contact identity in a protected Lead Library response to be unique before the browser can show the page as verified. Duplicate IDs now invalidate the complete response rather than allowing repeated rows, ambiguous selections, conflicting provenance, or misleading page counts. Existing field-evidence and identity-conflict records remain restricted to contacts on the verified page, while workspace, pagination, filter, source, and page-reset authority checks remain unchanged. No provider request, record mutation, deduplication merge, outreach action, or external action occurs.
Recoverable Lead Library page drift
Detects when concurrent suppression, deletion, list membership changes, or filter updates remove the page a member requested. The authenticated route counts the exact tenant-scoped match before loading records, returns a strict private page-reset receipt only when a positive offset is no longer valid, and avoids unnecessary record, provenance, or identity queries. The browser verifies the receipt field-for-field, clears stale selections, returns to offset zero, and then requires a fresh request-bound Lead Library response; malformed reset evidence remains unavailable. No provider request, record mutation, outreach action, or external action occurs.
Canonical Lead Library query envelope
Accepts only the twelve documented Lead Library query parameters and permits each parameter at most once. Unknown, misspelled, or repeated page, saved-list, search, source, buyer-profile, contact, suppression, validation, or freshness controls now receive a private non-cacheable error after authentication and before workspace database access. This prevents first-value selection and silent typo handling from turning an ambiguous request into a trusted lead result, while preserving the strict value, pagination, response, and request-binding checks from prior releases. No provider request, record mutation, merge, outreach action, or external action occurs.
Strict Lead Library pagination authority
Rejects malformed, signed, fractional, unsafe, zero, negative, or out-of-range Lead Library page parameters instead of silently replacing or clamping them into a different query. Missing parameters retain the documented 50-record first-page default; accepted limits remain 1–100 records and accepted offsets remain 0–1,000,000. The authenticated route stops invalid requests before workspace database access, while the browser continues to require exact page and filter evidence before showing records or counts. No provider request, record mutation, merge, outreach action, or external action occurs.
Request-bound Lead Library evidence
Binds every protected Lead Library response to the exact page size, page offset, saved-list selection, sanitized search text, industry query, seniority, validation state, contact channel, suppression state, source authority, buyer profile, and freshness filter requested by the member. The browser first validates the complete tenant-scoped response and then independently reproduces the server's bounded search normalization before accepting the echoed authority. A stale, reordered, mismatched, or relabeled response now becomes unavailable instead of showing old counts or contacts under a newer search. No provider request, record mutation, merge, outreach action, or external action occurs.
Fail-closed Lead Library filters
Replaces permissive filter-token handling with exact allowlists for seniority, validation status, contact channel, suppression state, source authority, buyer profile, and validation freshness. The protected GET route rejects any unrecognized value before accessing workspace data, and filtered-segment creation reuses the same authority sets. The member browser independently validates every echoed filter, so a typo, stale client, or malformed request can no longer be silently ignored and produce a trusted empty or overly broad Lead Library result. This performs no provider request, enrichment, record mutation, merge, outreach action, or external action.
Complete C.O.L.T.E.N.™ response outcome proof
Extends the transcript-free campaign proof to report every documented terminal response class: completed, incomplete, failed, cancelled, and unknown. Failed and unknown outcomes become explicit operational-review flags, while cancellations remain separately visible so reviewers can interpret them alongside interruption evidence. The protected browser contract now requires all five terminal classes to be nonnegative integers and rejects any total that exceeds the number of started responses. No transcript, audio, prompt, model output, raw provider payload, call, or provider request is added.
Fail-closed C.O.L.T.E.N.™ quality receipts
Makes the member browser independently validate every transcript-free C.O.L.T.E.N.™ completion metric before rendering it as campaign proof. New incomplete, output-token-ceiling, and content-filter counts must be nonnegative integers; the two documented reason counts must exactly reconcile to the incomplete total; completed plus incomplete responses cannot exceed started responses; and the displayed completion rate must reproduce the aggregate counts. Missing, malformed, or inconsistent evidence now makes the protected queue unavailable rather than presenting an unverified quality claim. This performs no call, provider request, transcript retention, or live-switch change.
Transcript-free C.O.L.T.E.N.™ completion evidence
Classifies every completed Realtime response as completed, cancelled, failed, or incomplete and retains only the documented content-free reason when an incomplete turn reaches the output-token ceiling or the provider content filter. Tenant-scoped campaign proof now reports aggregate incomplete, token-capped, and content-filtered counts without storing transcripts, audio, prompts, model output, or raw provider data. Malformed outcomes and unsupported reasons fail closed. This makes the release 373 turn ceiling observable; it does not claim human listening review has passed, and production calling remains locked until that review and the controlled authorized-number test are complete.
Bounded C.O.L.T.E.N.™ conversation turns
Adds an OpenAI-supported 320-token ceiling to every ordinary Realtime response while preserving the separately bounded approved opening. The shared v4 voice contract also limits the preferred shape to one-to-three short sentences and at most one focused question per turn, with semantic turn detection and immediate interruption handling retained. App readiness and the independent production monitor reject a runtime that omits or weakens any bound. This is a deterministic anti-monologue control—not a claim that human listening review has passed—and production calling remains locked until that review and the controlled authorized-number test are complete.
Page-scoped duplicate review queue
Adds a member worklist that isolates possible duplicates among the currently verified Lead Library page while retaining their original order. The interface reports an explicit page-only flagged count, leaves server filters and pagination unchanged, clears selections when review mode changes, and resets safely when the dataset or page changes. It never claims a workspace-wide count and performs no record mutation, provider request, merge, outreach action, or external action.
D1-safe identity lookup hotfix
Replaces PostgreSQL-only duplicate lookup expressions with SQLite/D1-compatible lower, trim, replace, and instr operations. Both retained-library review and CSV import preflight now execute in deterministic groups of at most 20 source records, keeping the worst-case query below D1's 100-bound-parameter ceiling. Candidate groups merge by opaque record ID before the existing content-free conflict contract runs; tenant isolation, self-demo exclusion, no-auto-merge behavior, and zero provider dispatch remain unchanged.
Actionable import conflict review
Turns a blocked duplicate-aware CSV import into a validated member-facing review card. It reports the aggregate affected-row count and separately labels existing-record mismatches, multi-record matches, and cross-row identifier collisions. The client accepts only the exact private, zero-action server contract; malformed or extra-field evidence is rejected. There is intentionally no override or unsafe resume path—the user must correct the source or retained identities and start a new immutable import session.
Duplicate-aware import preflight
Blocks an entire customer CSV batch before any lead row is created or updated when strong business email, phone, or LinkedIn identities point to a different retained canonical record, match more than one retained record, or collide across different incoming canonical rows. Exact one-record canonical deduplication remains available. A blocked import writes only a content-free audit receipt with aggregate conflict counts and the immutable manifest fingerprint; it exposes no identifier or record ID and performs no provider request or external action.
Tenant duplicate review signals
Scans the authenticated workspace for strong exact identity collisions on business email, phone, and LinkedIn profile for the records currently being reviewed. The API returns only signal names and an aggregate candidate count—never the matching identifier or candidate IDs. Possible duplicates are visibly review-only: SalesPitch AI performs no automatic merge, provider lookup, outreach action, or record mutation, and verified self-demo records remain excluded.
Transparent lead record diagnostics
Adds a deterministic, read-only quality card to every visible tenant lead. It reports eight-field record coverage, validation freshness, source-authority classification, conservative call readiness, and exact remediation codes without copying contact values into the diagnostic result. A call-ready label now requires a present verified phone, verified current validation, classified source authority, cleared DNC state, and no suppression. The calculation makes zero provider requests and executes zero external actions.
Reviewer packet operations
Makes the independent C.O.L.T.E.N.™ listening gate executable by operators without introducing conversation content into release evidence. One command creates an exact 35-scenario, content-free, unscored packet for each opaque reviewer reference; a second validates a completed packet and emits only a fingerprinted receipt with catalog identity, scenario count, and completion state. Invalid, incomplete, oversized, extra-field, retained-content, or wrong-catalog packets fail closed with a bounded error, while live calling remains locked until two genuine reviews and the controlled authorized-number test pass.
Independent listening evidence
Binds all 35 controlled C.O.L.T.E.N.™ scenarios to exactly two distinct, opaque human-review packets and conservatively uses the lower score for naturalness, pronunciation, accent stability, disclosure clarity, conversation coherence, pacing, and interruption recovery. The v11 catalog and v2 signed-run contract invalidate older unbound evidence. Review references, transcripts, audio, prompts, model output, and contact data are excluded from merged observations and production receipts.
Fail-closed OpenAI rechecks
Revokes any earlier in-memory OpenAI readiness proof immediately when an opted-in startup model-access recheck fails. A denied, unreachable, mismatched, or invalid provider response can no longer leave a previous process receipt active. The failure remains content-free, health monitoring stays available, and the live-call switch remains locked.
Deployment-safe OpenAI readiness
Lets each new C.O.L.T.E.N.™ Voice worker perform one explicit opt-in, project-scoped, read-only check for the exact approved OpenAI Realtime model and install only a short-lived signed proof in process memory. No credential, project identifier, provider response, transcript, audio, or contact data is returned or retained. A failed or skipped startup check keeps voice readiness and live calls locked while allowing health monitoring and safe operator recovery to remain available.
Indexed lead freshness retrieval
Adds a query-critical tenant and validation-time index for the governed Lead Library so current, aging, and stale lead views remain responsive as licensed and customer-authorized records grow. Isolated recovery now rejects any backup that omits the index, and public health plus production certification require schema revision 36 before this release can be promoted. No contact is enriched, shared, called, or sent to a provider by the migration.
Verified demo readiness and lead precision
Makes the verified-number C.O.L.T.E.N.™ demo recheck protected provider readiness automatically until every call gate is current, then stop polling once activation is available. The demo capability catalog now renders from one deduplicated contract. The governed Lead Library adds decision-maker, complete-profile, multichannel, needs-enrichment, and validation-age filters; exact filtered segments retain those controls in their membership evidence without sending contacts to any provider.
Pacing and interruption listening gate
Advances the transcript-free controlled conversation catalog to v10 and makes two additional human listening dimensions independently enforceable: pacing quality and interruption recovery. Each must score at least 4/5 alongside naturalness, pronunciation, accent stability, disclosure clarity, and conversation coherence, with at least two independent reviewers for voice and multilingual scenarios. Only bounded scores and aggregate pass/fail evidence enter the evaluator; reviewer identity, transcripts, audio, prospect data, prompts, and model output remain excluded.
Human-calibrated American voice delivery
Binds the approved masculine and feminine presentations to the governed Cedar and Marin provider voices inside the voice worker, even if a conflicting launch payload arrives. Narrows audio-speed adjustment to reduce rushed or artificially slow speech, adds explicit relaxed, measured, and energetic English delivery bands across multi-turn samples, and forbids speed-reading or padding speech with filler to meet a numeric target. The natural-voice contract advances to v3 while preserving semantic turn detection, immediate interruption handling, controlled pronunciation, AI disclosure, and transcript-free evaluation evidence.
Runtime-applied OpenAI preflight
Lets the owner-only C.O.L.T.E.N.™ control perform one project-scoped, read-only lookup of the exact approved Realtime model and immediately install the resulting content-free signed receipt in the current voice worker. The API key, project ID, signing secret, and provider response never enter the customer workspace or browser. The Integration Center refreshes current readiness after the check, displays only the approved model and check time, and keeps the live-call switch, recipient authority, controlled-call evidence, and prospect calling independently locked.
Explainable verified self-demo activation
Adds a live six-gate activation path to the C.O.L.T.E.N. AI™ demonstration so customers and investors can see exactly what is complete, what is current, and what remains locked: protected account identity, an approved product, production provider contracts, explicit one-time consent, phone ownership verification, and controlled call delivery. Technical provider blockers are translated into bounded customer-readable categories without exposing credentials. Changing the product, phone, or consent resets dependent evidence, and the experience continues to place no call until every retained safety and provider gate passes.
Unified C.O.L.T.E.N.™ natural voice contract
Moves the C.O.L.T.E.N. AI™ hero, guided demo, Voice Studio, member campaign editor, and Help Desk onto one American-first governed voice family instead of device-dependent or legacy British playback. American masculine and feminine profiles now share semantic interruption, correction and repair behavior, a nine-entry SalesPitch pronunciation map, exact approved-script validation, private no-store audio generation, and the v9 35-scenario multilingual evaluation catalog. The phone runtime advances to 0.28.0, while customer calling remains fail-closed until every carrier, provider, compliance, listening-review, and controlled-test gate passes.
Unified exact operations evidence validation
Makes the authenticated operations dashboard use the same strict evidence validators as final launch readiness. Backup recovery, SEV-1 tabletop, and licensed lead-provider indicators now verify the exact evidence type, approved method, passed status, 90-day boundary, mutation identity, input fingerprint, and every contract-specific assertion. Expired, partial, failed, malformed, future-dated, wrong-method, or legacy generic records remain visibly incomplete. Private evidence detail is used only server-side for validation and is omitted from the dashboard response.
Bound licensed lead evidence to exact controls
Strengthens the licensed lead-provider launch receipt so a generic passed test cannot satisfy the customer-facing intelligence gate. The workspace owner must separately confirm current source and resale rights, the exact authorized one-record scope and permitted fields, pre-lookup suppression, retained provider-credit evidence, and the signed outcome for the exact original lookup. The contract is versioned and fingerprinted; missing or changed assertions fail closed. Recording the receipt imports no contact, executes no lookup, consumes no provider credit, and performs no external action.
Required licensed lead-provider test evidence
Makes current exact-record evidence a separate launch requirement for customer-facing decision-maker data. A configured worker, credential, or OEM data license no longer clears the lead-intelligence lane by itself. The private Integration Center now records and displays a dedicated licensed-provider test receipt that must be current, owner-attested, redacted, bound to the exact evidence method and mutation identity, and explicitly prove that recording the evidence performed no external provider operation. Evidence from billing, outbound, calendar, suppression, recovery, or incident tests cannot satisfy this gate.
Required current controlled provider test evidence
Separates configured connectors from verified provider workflows. Stripe billing, outbound delivery and reply handling, Google and Microsoft calendar round trips, and suppression callbacks now require their own current unexpired owner-attested passed evidence before their launch and provider-activation lanes can clear. Each record must use the exact evidence type and method, retain the approved redaction and control-preservation assertions, prove the save performed no provider operation, and carry valid mutation and input fingerprints. Evidence for one provider path can never satisfy another path.
Made backup recovery evidence a launch gate
Promotes a current controlled D1 backup and isolated-recovery drill from an operations reminder into an explicit fail-closed governance and provider-activation gate. Readiness accepts only the tenant’s unexpired 90-day owner-attested passed backup record when it uses the exact evidence method, retains the approved redaction and control-preservation assertions, proves the save ran no backup or restore, and contains valid mutation and input fingerprints. Missing, partial, failed, expired, malformed, wrong-type, or incorrectly retained evidence remains blocked and receives one exact no-operation next step.
Added exact provider activation checklist
Adds an authenticated, credential-safe production activation checklist for the customer workspace, Stripe, OpenAI and C.O.L.T.E.N.™ Voice, Twilio, follow-up and calendars, licensed lead intelligence plus governed Browse AI imports, and governance. Every lane distinguishes credentials, infrastructure, evidence, controlled tests, final authority, and activation switches; identifies one exact next gate; treats missing or non-boolean evidence as blocked; returns no credential or customer value; and proves the inspection executes zero provider actions and makes no production change. Exact current checkout-terms approval is now also an explicit Stripe readiness and launch gate.
Added emergency containment visibility
Adds a privacy-safe emergency-containment matrix to the authenticated production control plane. Operators can see the exact state and shutdown instruction for C.O.L.T.E.N.™ live calling, outbound email and calendar dispatch, licensed lead-provider dispatch, follow-up sequence automation, and Stripe checkout authority. Unknown switch evidence never masquerades as containment, enabled boundaries remain explicit, signed inbound lifecycle evidence must remain available for reconciliation, and the inspection proves it executes zero provider actions and makes no production change.
Bound tabletop evidence into launch readiness
Promotes current complete SEV-1 tabletop evidence from an operations reminder into an explicit fail-closed governance launch gate. Readiness now accepts only the tenant’s unexpired 90-day owner-attested passed record when its stored contract proves all eight incident boundaries and proves that saving the record ran no shutdown, provider action, or production mutation. Missing, partial, failed, expired, malformed, incorrectly retained, or incomplete evidence stays blocked and receives one exact no-action next step.
Added recoverable incident-tabletop evidence
Adds a tenant-scoped SEV-1 tabletop evidence workflow to the authenticated Integration Center. A workspace owner must attest to severity classification, escalation ownership, provider shutdown controls, suppression preservation, ambiguous-outcome containment, notification decisions, isolated recovery integrity, and credential rotation. The exact interrupted save is recoverable and its receipt proves that recording the tabletop executed no shutdown, provider action, production mutation, call, message, meeting, payment, or data operation. Current passed evidence remains visible for 90 days; it records a completed tabletop and does not claim that a real incident or live shutdown occurred.
Published incident response and service availability
Adds a canonical Incident Response & Service Availability notice to public, mobile, footer, legal-center, sitemap, and authenticated-workspace navigation. It explains monitoring, SEV-1/2/3 classification, provider shutdown controls, ambiguous-outcome containment, customer and regulatory notification boundaries, external-provider availability, isolated recovery integrity, suppression-preserving restore rules, verified reporting routes, and privacy-safe evidence. Production certification now verifies 22 customer-facing pages on each of four live domains without creating sessions or enabling any provider action.
Verified cross-system suppression priority
Adds one deterministic suppression-priority contract across lead records, campaign queues, call launches, follow-up sequences, and outbound actions. Recallable local work is canceled or blocked before another provider reservation, while provider-accepted and completed work keeps its authoritative carrier or delivery status for reconciliation and audit. A privacy-safe 49-case certificate verifies all five stages with no customer data, network request, provider action, recall attempt, message, meeting, or call.
Published communications and billing transparency
Adds dedicated Calling, SMS & Email Compliance and Billing, Cancellation & Refund pages across the public Legal Center, footer, mobile navigation, sitemap, and authenticated workspace. The communications notice explains channel authority, AI identity, consent evidence, Do Not Call precedence, prospect-local calling windows, recording, email and SMS duties, demo boundaries, and suppression routing. The billing notice explains prices, recurring renewal, Stripe evidence, usage, cancellation, refunds, payment correction, failed-payment behavior, data after cancellation, and support routing. Production certification now verifies both pages across every live domain without enabling checkout, live calling, messaging, or any provider action.
Verified saved-version rollback candidate
Adds a read-only rollback-candidate verifier that binds the current saved Sites release to its immediate predecessor, exact project, distinct source commits, deployable archive digests, and successful privacy-safe production certificates for both versions. Generated evidence fingerprints opaque Sites identifiers and explicitly records that no rollback, production mutation, provider action, or network request occurred. The runbook now separates proof that a known-good candidate exists from the separately approved act of deploying it during an incident.
Published AI and data lifecycle transparency
Adds canonical AI & Voice Disclosures and Data Lifecycle & Retention pages to the public site and authenticated workspace navigation. The notices explain C.O.L.T.E.N.™’s AI identity, synthetic speech, non-impersonation, recording and transcription authority, safe unknown-answer escalation, meeting-confirmation evidence, stop and Do Not Call rights, customer and American Business Capital Group, Inc. roles, category-specific retention, reviewed deletion, backups, suppression preservation, AI-data boundaries, source lineage, and account closure. Production certification now enforces both notices across every live domain without enabling any provider action.
Manifest-bound recovery integrity
Makes the six-domain recovery digest enforceable rather than informational. An owner-approved backup manifest can now supply the expected domain-integrity SHA-256 alongside the export and suppression digests; the restore fails closed if tenant, suppression, billing, meeting, outbound, or audit counts or hashed workspace distributions differ. The CI recovery gate independently derives and requires the synthetic fixture digest, and the verifier still performs no network or provider request.
Verified domain recovery integrity
Extends isolated D1 recovery evidence beyond whole-database and suppression digests. The verifier now reports separate privacy-safe tenant, suppression, billing, meeting, outbound, and audit record counts, distinct-workspace counts, hashed per-workspace distributions, and one combined domain-integrity digest. Evidence exposes no workspace identifier, customer row, message content, provider identifier, or suppression value; the temporary database is removed and the verifier executes zero network requests or provider actions.
Corrected recovery launch accuracy
Makes the first-build checklist and recovery runbook agree with the deployed revision-35, 40-table database contract. It removes an obsolete revision-31/39-table description, distinguishes the synthetic CI proof from the still-required owner-approved production-snapshot drill, and restores sequential operating steps. Regression assertions now fail if those historical values or step-order errors return.
Verified isolated recovery evidence
Promotes the complete revision-35 D1 recovery contract into a dedicated CI gate. Every reviewed change now rebuilds all 40 required tables from the checked-in migration sequence, restores a synthetic non-customer fixture in an isolated temporary database, verifies SQLite and foreign-key integrity plus exact dump and suppression-ledger digests, removes the restored copy, and retains only redacted evidence for 30 days. This gate performs no provider action and does not represent or replace the separately approved production-backup recovery drill.
Published privacy choices and vendor transparency
Adds a canonical Privacy Choices Center covering access, export, correction, deletion, restriction, objection, consent withdrawal, sale/share/targeted-advertising opt-out, outreach suppression, agents, appeals, non-discrimination, browser signals, and reviewed outcomes. It also publishes bounded Data Processing & Vendor Transparency with observed hosting, runtime, payment, carrier, AI, data, calendar, and email provider status; vendor review controls; subprocessor changes; international transfers; and a separately executed DPA request path. Production certification monitors both pages and their exact authority boundaries on every live domain.
Published accessibility and trust assurance
Adds a canonical Accessibility Statement and Security & Trust Center with verified support routes, WCAG 2.2 AA as a design target rather than an unsupported certification claim, documented interaction and media practices, known limitations, accommodation routing, tenant and identity controls, release evidence, incident reporting, responsible-AI boundaries, provider readiness, and explicit assurance limitations. Production certification monitors both surfaces, security headers, indexing, cookies, exact destinations, and sitemap discovery on every live domain.
Verified contact and support routing
Publishes a canonical Contact & Support center that routes product, billing, privacy, legal, abuse, security, and accessibility requests through the established C.O.L.T.E.N.™ mailbox, tenant-bound workspace controls, published security.txt, phone, and physical address. It removes unverified role aliases, warns against emailing credentials or raw lead data, and distinguishes message receipt from resolution, refund, legal acceptance, privacy outcome, bounty, or response-time promises. Production certification verifies the page, routes, security headers, indexing, cookie boundary, and discovery on every live domain.
Published privacy and policy center
Publishes dedicated Privacy Notice, Terms of Service, Cookie Notice, and Acceptable Use & Outreach pages without changing the exact checkout or onboarding policy versions. Public and authenticated navigation now reaches request controls, data categories, retention and rights, essential-only cookie posture, subscription boundaries, lawful-source rules, AI disclosures, calling hours, Do Not Call, recording, unsubscribe, and suppression duties. Production certification verifies all four pages, canonical discovery, browser security, exact versions, and the explicit final-counsel-review gate on every live domain.
Recoverable launch evidence saves
Binds every owner-recorded recovery or launch test to one reload-safe browser identity, canonical input fingerprint, deterministic intent, tenant and evidence-type record identity, compare-and-set prior state, and deterministic completion receipt. Interrupted exact retries converge without rerunning any provider, billing, data, calendar, suppression, backup, or recovery operation; conflicting or newer evidence fails closed and must be refreshed.
Recoverable ambiguous-call reconciliation
Binds each no-call operator review to one reload-safe browser identity, canonical attestation fingerprint, tenant and actor, deterministic intent, compare-and-set claim marker, and deterministic completion receipt. Interrupted exact retries recover the same request, conflicting identities fail closed, and the lead plus final evidence records are conditionally batched only while the exact launch remains provider-ID-free. The workflow never places or retries a call; only a provider-identified signed lifecycle event may supersede the operator marker.
Contained ambiguous-call reconciliation evidence
Removes the pre-claim operator-attestation write from ambiguous C.O.L.T.E.N.™ call review so a failed compare-and-set race cannot leave false review evidence. After the launch is successfully claimed, the campaign-lead failure state and both operator-attested and reconciled audit records are applied in one downstream batch. Fresh signed carrier evidence still wins the race and forces the owner to refresh, while this review request places no call and performs no carrier action.
Recoverable calendar review receipts
Binds every quarantined-hold review acknowledgment to one reload-safe browser identity, canonical operator-attestation fingerprint, tenant and actor, and deterministic audit receipt. Interrupted exact repeats converge on the same acknowledgment, reused identities and superseded hold evidence fail closed, and the browser locks competing reviews until recovery completes. The exact receipt continues to prove that the slot remains quarantined, signed provider evidence is pending, retry and reuse are forbidden, and no provider or slot action occurred.
Recoverable meeting availability mutations
Binds each availability save or cancellation to a reload-safe browser identity, canonical payload fingerprint, deterministic tenant audit, and—when creating—a deterministic slot identity. Interrupted exact retries converge on the same retained result, reused identities and superseded evidence fail closed, and the browser restores authority only after the exact receipt plus fresh tenant-scoped availability evidence agree. Every receipt explicitly proves that no external calendar or provider action occurred.
Atomic recoverable onboarding saves
Moves the requested workspace-name, business-profile, policy-acceptance, completion, and audit changes behind the protected rate limit and applies them in one D1 batch. Each save carries one reload-safe browser identity, one canonical payload fingerprint, and one deterministic audit receipt; interrupted exact repeats converge without an external action, while the browser restores onboarding authority only after a fresh tenant-scoped read reproduces the exact saved input and completion evidence.
Recoverable Stripe access reconciliation
Binds each read-only provider check to one reload-safe browser request, one tenant-owned local entitlement, and one deterministic audit identity while resolving the Stripe subscription only on the server. Network loss, transient provider failures, unreadable responses, and exact repeats reuse the same bounded request; the browser accepts refreshed membership authority only when the exact provider-verified receipt is reproduced by current billing status and explicitly proves that no Stripe billing setting changed.
Recoverable retention-policy saves
Binds each retention-target save to one browser mutation identity and one payload-bound audit identity. Network loss, transient failures, malformed successes, and concurrent repeats retry only the same convergent save; the browser accepts only exact saved day targets plus an explicit receipt proving automated deletion remained disabled, zero records were deleted, and no external action occurred.
Recoverable privacy-request submission
Binds every access, correction, restriction, or deletion request to an opaque tenant-, actor-, type-, scope-, reason-, and browser-request identity. Interrupted and concurrent submissions converge on one protected-review record and one audit event; a different open request remains an explicit conflict, and the browser accepts only a receipt proving the request was recorded without changing or deleting customer records or performing an external action.
Recoverable Stripe billing portal
Carries one browser-generated portal request through a deterministic Stripe idempotency key, a live-session receipt, reload-safe recovery, and a convergent audit identity. Network loss, provider timeouts, idempotency conflicts, unreadable successes, and malformed live-session evidence retry only the same bounded request; terminal provider failures stop immediately, and the verified receipt states that opening the portal did not itself change billing.
Recoverable Stripe checkout handoff
Binds checkout preparation to a customer-generated request identity and a deterministic, tenant-scoped reference. Network loss and transient failures retry only that same identity, concurrent requests converge on one retained reference, and the browser accepts only an exact plan-, terms-, request-, and provider-truth receipt before navigating to Stripe. The receipt explicitly distinguishes a prepared payment-link handoff from a provider session or completed payment.
Contained product and script mutations
Adds a shared fail-closed mutation classifier to Products & Pitches and Sales Script AI. Product drafts, fact updates, approvals, script generations, version saves, and approval changes now require action-, identity-, status-, input-, and version-bound receipts before changing browser authority. Lost responses, server failures, malformed successes, and unexpected successful statuses hide authoring controls behind re-verification instead of inviting duplicate records, generations, or approvals.
Contained C.O.L.T.E.N.™ mutation outcomes
Requires identity-bound, action-specific receipts for campaign drafts, campaign-control saves, recipient decisions, and one-call launches before the browser changes authoritative state. Network interruptions, server failures, malformed successes, and durable-launch conflicts now hide actionable controls behind explicit verification instead of inviting a duplicate draft, decision, save, or call; verified launch receipts distinguish provider submission from durable reconciliation.
Verified registry search authority
Binds every live GLEIF company-search result to the exact normalized query and country, validates source identity, unique LEIs, record URLs, timestamps, match totals, and coverage disclosure before SalesPitch Intelligence renders a row or count. Searching, unavailable, verified-results, and verified-empty states are now explicit, so a provider failure cannot masquerade as zero matches or leave a stale total beside cleared records.
Verified lead freshness authority
Requires retained-record health, saved lists, governed refresh jobs, recurring policy, and licensed-provider readiness to satisfy one internally consistent tenant contract before Lead Validation renders counts, provider claims, controls, or a verified-empty conclusion. Planning, approval, and policy changes now require exact no-provider-action receipts; ambiguous outcomes lock mutation controls until the protected evidence is re-verified.
Verified meeting availability authority
Requires the tenant-scoped availability list, hold duration, calendar-sync state, truth boundary, slot chronology, and every retained slot to satisfy one complete contract before AI Meeting Generation renders an offerable time or verified-empty conclusion. Create and cancel actions now require exact no-calendar-action receipts, and unconfirmed outcomes lock mutation controls until the protected library is re-verified.
Verified product and script authority
Requires Products & Pitches and Sales Script AI to validate their complete tenant-scoped libraries before rendering records, retained counts, grounding claims, or verified-empty conclusions. Failed and malformed reads now hide stale or inferred data behind explicit retry boundaries, while product and script mutations require schema-valid records and an exact no-call or no-external-action receipt.
Atomic Follow-up authority
Requires paid Follow-up metrics, meetings, tasks, sequences, delivery actions, call outcomes, ranked prospects, and provider evidence to validate as one internally consistent contract before rendering. Lapsed plans retain a separately verified least-data safety-stop projection, while failures in either path hide false zero and empty claims behind an explicit retry boundary.
Verified C.O.L.T.E.N.™ campaign authority
Requires the protected product, lead-list, campaign, voice-provider, recipient-queue, exact-phone, suppression, and conversation-evidence contracts to validate before C.O.L.T.E.N.™ renders operational conclusions. Failed or malformed refreshes now hide stale counts behind explicit retry states, and only a verified response may say that no campaign or callable recipient exists.
Schema-verified Lead Library
Requires the tenant workspace, saved lists, lead records, field provenance, pagination, segment limits, and active filters to satisfy one internally consistent protected contract before any count or empty-state claim appears. Loading and failed refreshes now hide stale data behind explicit verification and retry states, while only a validated response may say that no retained contacts match.
Verified Browse AI readiness
Separates a protected Browse AI connection that is verifying, contract-valid but gated, import-ready, provider-unreachable, or temporarily unavailable. Missing evidence can no longer masquerade as a missing credential or disabled switch; only validated HTTP 200 or expected provider-unreachable 503 responses may render configuration conclusions, with retry available for all other failures.
Atomic account authority evidence
Requires onboarding, Stripe access, audit history, privacy requests, and retention policy to return together with valid protected schemas before Account & Setup renders a conclusion. A missing or malformed feed now hides empty-state claims behind a retryable unavailable boundary, while the non-destructive retention dry run remains independently and explicitly optional.
Verified import authority evidence
Distinguishes a protected lead-import ledger that is verifying, verified empty, verified with manifests, or temporarily unavailable. Malformed governance responses fail closed, retry is explicit, and a refresh failure after a completed batch or revocation can no longer misreport the underlying customer operation as failed.
Atomic integration evidence
Loads voice readiness, operational controls, provider health, ambiguous-call reconciliation, calendar reconciliation, and the owner OpenAI preflight boundary as one protected evidence set. Empty defaults never masquerade as no incidents, no runs, or failed controls; customers receive a verifying or retryable-unavailable state, while the exact owner-only 403 remains a valid restricted-control result.
Truthful billing authority
Removes an unverified no-entitlement claim from Membership & Billing. Authenticated customers now see explicit Stripe-backed verification, verified active or inactive evidence, and a retryable authority-unavailable state; checkout, usage, reconciliation, and billing-management claims remain hidden or locked until the protected billing contract succeeds.
Schema-verified command center
Requires every protected Command Center response to satisfy the complete workspace, metric, and activation-evidence contract before it can enter a verified state. Missing fields, negative counts, malformed steps, mismatched totals, and inconsistent completion progress now fail closed to the explicit retry surface instead of rendering as customer data.
Truthful command-center evidence
Prevents authenticated customers from seeing authoritative-looking zero totals while protected workspace evidence is still loading or cannot be verified. Metrics, activation progress, and campaign readiness stay hidden behind an explicit loading or retry state; verified summaries and clearly labeled previews remain available.
Complete workspace access states
Closes the final workspace-shell ambiguity by making initial Stripe and policy verification explicit. Paid controls remain visibly unavailable until authority is confirmed, the loading state asserts that no provider action is authorized, and authenticated member workspaces no longer inherit an investor-preview badge.
Actionable membership state
Gives every authenticated workspace one honest plan-access state before customers enter feature-level controls. Accounts without a Stripe-verified active plan receive a direct Membership & Billing path and an explicit no-paid-access boundary, while the profile header distinguishes verification, membership, setup, and authority-unavailable states.
Fail-closed workspace authority
Keeps membership and policy verification visible when the authority service cannot be reached or returns malformed evidence. Protected workflows remain explicitly paused, the customer receives a safe retry and setup path, and returning to the browser tab triggers a fresh no-cache authority check instead of trusting stale client state.
Workspace-wide policy pause
Surfaces current-policy authority across the authenticated customer workspace. Paid workspaces see one clear, global explanation when protected lead refresh, C.O.L.T.E.N.™, follow-up, or outbound workflows are paused, receive a direct Account & Setup action, and watch the banner clear only after the server confirms every current policy receipt.
Inspectable policy receipts
Makes each private onboarding receipt explain itself. Customers can now distinguish current, missing, and superseded policy evidence, see the retained acceptance version and date, and receive an exact re-acceptance instruction when a prior receipt no longer grants authority—without relying on browser state.
Current-policy launch authority
Routes every consequential onboarding gate through one shared current-policy contract. Billing access, workspace activation, Browse AI, customer imports, lead refresh, C.O.L.T.E.N.™ campaigns and launches, follow-up sequences, outbound actions, and provider workers now re-check the exact current Terms, data-authority, and outreach evidence instead of trusting a completion timestamp alone.
Version-bound policy acceptance
Binds every onboarding acceptance to the exact current Terms, data-authority, and outreach-policy versions. A superseded or unversioned timestamp now fails closed, existing completion authority is cleared by migration until the current policies are explicitly re-accepted, and live legal certification verifies all three public version labels.
Server-verified onboarding path
Turns account onboarding into a versioned, customer-visible four-step contract. Business-profile and policy completion now come from retained server evidence, the next required action is deterministic, every current policy authority is linked, and the protected onboarding route is added to production certification.
Uncached sales authority
Requires the signup surface on every production domain to serve current pricing, terms version, checkout status, and plan inventory with an explicit no-store, must-revalidate policy. Certification rejects public or shared caching plus any response carrying aged or cache-hit evidence.
Cross-domain public indexability
Certifies that all 32 public page-and-domain responses remain eligible for search indexing. Release verification now rejects both HTTP X-Robots-Tag noindex directives and rendered robots noindex metadata on the homepage, Trust Center, legal, signup, C.O.L.T.E.N. AI™, Sales Script AI, Help Desk, and demo surfaces.
Public-surface production certificate
Publishes the 32 live public-page checks as customer- and investor-readable Trust Center evidence. The certificate explains exact route destinations, HTML and browser-security transport, the infrastructure-only cookie boundary, private-value exclusion, and the provider gates this evidence deliberately does not satisfy.
Exact public route destinations
Binds every certified public page to the exact origin and path requested by the visitor. Thirty-two live page-and-domain checks now fail if a homepage, trust, legal, signup, C.O.L.T.E.N.™, Sales Script, Help Desk, or demo response silently redirects to another domain or route before its content is evaluated.
Infrastructure-only public cookies
Certifies all 32 public page-and-domain responses against an explicit cookie boundary. SalesPitch application and session cookies are forbidden on public sales, support, demo, legal, and trust pages; only the hosting edge's hardened Cloudflare bot-management cookie is accepted, and no cookie value is retained in evidence.
Exact public HTML media types
Requires every certified public page on every live domain to return an exact HTML media type in addition to the complete browser-security baseline. Thirty-two page-and-domain checks now reject content-type confusion before accepting page copy, canonical metadata, or safety claims.
Full public-surface transport verification
Extends the exact browser-security baseline to every certified public sales and trust page: home, status, legal, signup, C.O.L.T.E.N. AI™, Sales Script AI, Help Desk, and the investor demo. Production now verifies 32 page-and-domain header sets instead of accepting safe copy over a weakened transport.
Trust Center transport verification
Makes the Trust Center's browser-security baseline part of cross-domain release certification. Correct version text no longer passes by itself: CSP, framing defense, HSTS, referrer policy, MIME protection, opener isolation, and the reviewed permissions policy must also remain present on every live status page.
Public signed-ingest trust proof
Adds an investor- and customer-readable certificate section to the public Trust Center. It identifies the two governed boundaries, six credential-free probes, exact response policy, explicit private-data exclusion, and the separate provider and human gates that the certificate does not satisfy.
Signed-ingest certificate evidence
Consolidates the six live Stripe and meeting-event boundary checks into one privacy-safe production certificate. The retained report names the exact response-contract version and proves private, no-store, nosniff, JSON behavior while explicitly recording that no private data was included.
Versioned signed-ingest receipts
Adds one content-free signed-ingest response contract shared by Stripe and meeting-event routes. Live certification now requires JSON media type plus the exact reviewed contract version on unsigned, stale-signature, and oversized-payload receipts, while retaining private, no-store, and nosniff protections.
Verified signed-ingest MIME policy
Extends production certification for all six credential-free Stripe and meeting-event boundary probes. Each unsigned, stale-signature, and oversized-payload response must now be private, non-cacheable, and explicitly protected against browser MIME sniffing on the live domain.
Private signed-ingest responses
Routes every Stripe and meeting-event response through one explicit private, no-store, MIME-sniffing-protected JSON contract. Duplicate acknowledgments, processing locks, sandbox ignores, immutable-binding conflicts, stale-event receipts, successful applications, and safe application failures can no longer inherit an implicit cache policy.
Private webhook rejection responses
Makes every Stripe and meeting-event pre-processing rejection explicitly private and non-cacheable, with browser MIME-sniffing disabled. Production certification now requires that policy on unsigned, stale-signature, and oversized-payload failures for both public signed-ingest endpoints before accepting the release.
Verified webhook payload ceilings
Adds credential-free production probes for both public signed-ingest byte limits. Certification sends content-free repeated bytes one byte above each exact ceiling, requires HTTP 413 with the bounded size failure, and supplies no signature, event, billing, workspace, prospect, meeting, or provider identity—proving oversized bodies stop before parsing or data access.
Verified stale-signature rejection
Adds credential-free, non-retrying freshness probes for both public signed-ingest endpoints. Certification submits only an empty payload with a syntactically valid but permanently stale timestamp and zero signature, requires the exact signing-gate failure, and supplies no customer, billing, meeting, prospect, provider, or event identity.
Verified edge-origin boundary
Certifies the two real production layers separately across all 34 browser mutation methods. Missing-origin requests must reach the application guard and return a private, no-store HTTP 403. Hostile-origin requests may return that application denial or the exact upstream Sites JSON denial, which must be content-sniffing protected and carry neither cache-hit nor aged-response evidence.
Origin response cache-policy audit
Added private, no-store application responses to the two remaining origin guards. Production certification was deliberately withheld when the first monitor treated an upstream Sites hostile-origin denial as though it had reached the application route; v2.82 preserves the finding and verifies each layer by its actual contract.
Verified missing-origin rejection
Strengthens production certification for all 34 browser mutation methods: each credential-free request without an Origin header must return exactly HTTP 403. Authentication-only HTTP 401 no longer counts as origin protection. Hostile-origin probes remain separate, while signed webhooks and internal service endpoints keep their independent authentication contracts.
Verified meeting-ingest signature boundary
Adds a credential-free, non-retrying production probe for the signed meeting-event webhook. Certification sends an empty unsigned payload, requires HTTP 400 with the signature-verification failure, drains the response, and never supplies a timestamp, signature, workspace, prospect, meeting, or provider event—confirming the configured signing gate without applying an event.
Comprehensive browser mutation defense
Extends the shared scheme-and-host origin contract to every top-level browser mutation: billing, checkout, company search, C.O.L.T.E.N.™ calls and campaigns, launch evidence, lead import and refresh, suppression, availability, onboarding, privacy, retention, and sales scripts. The signed meeting-event webhook remains deliberately origin-independent and HMAC-gated. Production now certifies all 34 browser mutation methods plus the protected internal evaluation boundary.
Scheme-bound mutation defense
Centralizes browser-mutation origin enforcement into one exact scheme, host, and port contract. Product creation and edits, task changes, sequence creation and edits, import revocation, outbound approval and cancellation, reconciliation receipts, and the operator OpenAI preflight now reject hostile or malformed origins before authentication or parsing; production certification probes every monitored method.
Same-origin action controls
Adds an application-level same-origin guard to both outbound-action approval and cancellation before authentication, body parsing, database access, or provider-readiness checks. Missing, malformed, and hostile origins fail closed with HTTP 403, and production certification now probes both POST and PATCH boundaries.
Reload-safe action cancellation
Retries only the exact convergent outbound-action cancel request once after a network or transient edge failure. Provider-reservation races and other terminal conflicts are never retried; an unconfirmed outcome fails closed with a reconciliation instruction, and Follow-up requires the verified cancellation receipt before changing local UI state.
Atomic outbound-action cancellation
Makes queued provider-action cancellation least-data, atomic, and convergent. A provider reservation race returns a truthful conflict instead of a false cancellation; already-canceled actions can re-run linked sequence cleanup, and receipts distinguish the local transition from preserved provider work and open reconciliation.
Verified safety projection contract
Adds a versioned least-data contract to the lapsed-plan safety response and makes the client verify its scope, 30-day reconvergence window, private-detail exclusion, and no-external-action assertion before displaying any safety record.
Minimal sequence-stop lookup
Moves sequence stopping onto a dedicated early-return path that reads only tenant-bound sequence ID and status before the convergent stop. Approval snapshots, lead and task relationships, provider metadata, cadence scheduling, and other edit fields are never loaded for a stop request.
Minimal cancel ownership lookup
Limits the initial task-cancellation ownership lookup to ID, status, channel, and completion state. Drafts, approval records, campaign and lead relationships, meeting holds, and the remainder of the full task row are never read on the cancellation path.
Minimal task-cancel path
Sends only the task ID and cancel action from every task-cancellation control, excludes draft content from the cancellation update, and reads only the five fields required for the opaque response. Full task, prospect, meeting, and draft joins are reserved for paid non-cancel workflows.
Opaque task safety
Removes follow-up task titles, draft content, prospect identity, lead references, meeting details, and approval data from lapsed-plan safety lists and cancellation receipts. The API returns an opaque task label plus only the state required to cancel or re-run the convergent safety cascade.
Least-data sequence safety
Returns a dedicated tenant-scoped safety projection for lapsed-plan sequence lists and stop receipts. The projection retains only the state needed to stop or re-run safety; prospect identity, message subjects, message bodies, approval content, and paid editing details are not returned.
Actionable sequence safety list
Separates active follow-up sequences from recently stopped sequences in the tenant-scoped safety center. Active stops cannot be displaced by completed history, while stopped sequences remain available for 30 days so an interrupted safety cascade can be re-run after a reload.
Reload-safe task cancellation
Keeps recently canceled standalone follow-up tasks in the tenant-scoped safety center for 30 days. A workspace owner can reload, return later, and re-run the convergent cancellation cascade without restoring paid editing controls or exposing draft content and prospect details.
Convergent task-linked safety
Re-runs linked sequence cleanup when an individual task cancellation is replayed, including already-stopped parents while excluding completed sequences. Legacy stopped counts stay stable, and the receipt adds convergence attempts, cleanup changes, preserved provider work, and open reconciliation without retrying or recalling external actions.
Truthful task-cancel receipts
Counts the task transition, canceled local queue records, linked sequence effects, preserved provider history, and provider actions still awaiting reconciliation. The safety center distinguishes open reconciliation from preserved terminal history and explicitly records that cancellation neither retried nor recalled provider work.
Standalone task safety center
Surfaces minimal active-task identity in the lapsed-workspace safety center without exposing drafts or paid prospect controls. Task cancellation uses one bounded retry of the exact convergent request, renders exact local cancellation effects, and never claims provider work was recalled.
Always-available task cancellation
Lets an authenticated workspace owner cancel an individual follow-up task after plan access lapses or normal review limits are exhausted. Cancellation is convergent, returns exact queued-action and linked-sequence effects, and is monitored in production as an authenticated read, exact PATCH, and hostile-origin PATCH.
Persistent safety-stop center
Adds an authenticated, tenant-scoped sequence safety list that remains available when full Follow-up access is plan-gated. Lapsed workspaces can review and stop future sequence work, while editing, activation, pause, resume, prospect data, and other paid controls remain hidden and gated.
Always-available outreach stop
Allows an authenticated workspace owner to stop future follow-up even after subscription access lapses or the ordinary sequence-edit rate limit is exhausted. Ownership, completed-sequence, authentication, and origin controls remain enforced; only the safety stop bypasses commercial and edit throttles.
Exact sequence-stop mutation boundary
Verifies the sequence endpoint only through its real PATCH contract: an unauthenticated exact-method mutation and a hostile cross-origin mutation. The monitor keeps the route's intentional GET 405 separate from authorization evidence and still fails certification if either mutation boundary drifts open.
Sequence-stop monitor contract audit
The first expanded monitor correctly withheld certification when it treated an intentionally unsupported GET as an authorization probe. That finding was retained, the endpoint stayed closed with HTTP 405, and the monitor contract was narrowed to the real PATCH surface in v2.59.
Sequence-stop delivery resilience
Retries only the exact convergent stop request once after a network or transient HTTP failure. Activation, pause, resume, and content changes are never retried; an unconfirmed stop fails closed and directs the operator to re-run stop safety before resuming or authorizing follow-up.
Convergent sequence-stop controls
Lets an already-stopped sequence re-run its idempotent child-state safety cascade after an interrupted request. The customer API returns the exact stop receipt, and Follow-up distinguishes preserved provider work, open reconciliation, and a clean local stop without claiming a retry, recall, or new external action.
Provider-safe sequence stops
Preserves reserved, dispatched, delivered, failed, bounced, complained, unsubscribed, and outcome-unknown provider history when a follow-up sequence stops. Each receipt separately counts preserved work and open reconciliation, never retries it, never claims a recall, and keeps local stop effects distinct from prior external actions.
Truthful sequence-stop receipts
Counts only follow-up tasks, queued actions, steps, and parent sequences actually changed by a stop request. Audit evidence now distinguishes a newly applied stop, a child-state convergence after a race, and a true no-op while retaining the resulting parent status and an explicit no-external-action boundary.
Verified revocation boundary
Extends the retained production monitor to probe the import-authority endpoint as an unauthenticated read, an unauthenticated exact-method PATCH, and a hostile cross-origin PATCH. The release fails certification unless authentication and same-origin controls remain closed on the live domain.
Revocation delivery resilience
Retries an interrupted authority-revocation request once with the exact same convergent payload, limits retries to network and transient server failures, never retries terminal ownership or validation errors, and fails closed with a direct safety-cascade recovery instruction when the final outcome remains unknown.
Truthful revocation residuals
Separates newly blocked work from provider actions that may already have left SalesPitch AI. Revocation now reports privacy-safe call and follow-up counts, identifies unresolved provider reconciliation, preserves external history, and never implies that accepted carrier, email, or calendar work was recalled.
Convergent authority revocation
Makes imported-data revocation safely repeatable after an interrupted request. An already-revoked manifest re-runs the complete campaign, recipient, call, follow-up, and sequence lock cascade, clears any legacy retained approval snapshot, and reports exact retry evidence instead of short-circuiting partial cleanup.
Authority-revocation cascade
Revoking an imported-data authority now clears every pinned C.O.L.T.E.N.™ recipient approval, cancels pre-provider call reservations, cancels queued or reserved follow-up work, stops open sequences, and records privacy-safe impact counts. C.O.L.T.E.N.™ Voice re-reads the exact launch authority after reservation and before carrier submission.
Approval-pinned C.O.L.T.E.N.™ recipients
Stores a bounded, PII-free import-authority snapshot with every individually approved C.O.L.T.E.N.™ recipient. Call reservation must match the exact current manifest and Browse AI source snapshot, while selecting or removing a recipient clears stale approval evidence automatically.
Approval-pinned import authority
Pins the exact list source, import-manifest fingerprint, and immutable Browse AI snapshot into every manually or automatically queued outbound approval. Provider reservation re-checks that evidence byte-for-byte, so an authority change after approval blocks dispatch instead of inheriting stale consent.
Snapshot-bound outreach
Carries each Browse AI immutable source snapshot through campaign creation, recipient approval, C.O.L.T.E.N.™ call reservation, follow-up automation, provider dispatch, and lead refresh. Any legacy or altered Browse AI list without matching snapshot evidence now fails closed before an external action can be reserved.
Immutable Browse AI snapshots
Freezes each approved Browse AI task into a privacy-safe SHA-256 snapshot that binds the robot, task, captured-list choice, completion time, mapped row content, and row order. Every recoverable batch must match that retained evidence or import stops before another row is written.
Zero-downtime cursor isolation
Adds ordered key rotation for encrypted calendar incident cursors: new tokens use a dedicated signing secret while active one-hour tokens can still be opened with the prior domain-separated provider-ingest key. Private operations evidence reports dedicated-key isolation and rotation overlap without exposing credential values.
Fail-closed incident coverage
Adds an explicit operations control proving whether the complete calendar incident queue is reachable. More than 100 unresolved holds now fail closed when encrypted cursor signing is unavailable, while the dashboard reports bounded-page versus encrypted full-queue coverage without exposing secrets or raw slot identifiers.
Encrypted reconciliation pagination
Adds expiring AES-GCM cursor and review tokens bound to one authenticated workspace, enabling operators to load and acknowledge incidents beyond the first 100 without exposing internal slot identifiers or weakening provider-resolution containment.
Truthful bounded incident queue
Separates the exact tenant-wide calendar reconciliation total from the bounded 100-item evidence response and warns operators whenever later incidents are not yet visible, preventing a safe response limit from becoming a false completeness claim.
Calendar review coverage
Measures stale reconciliations with no durable operator review and critical outcomes with no receipt in the last 24 hours; re-escalates lapsed ownership while keeping provider resolution, retries, and slot reuse independently locked.
Durable calendar review receipts
Adds tenant-scoped, same-origin operator acknowledgments for quarantined calendar outcomes; records an immutable incident-owner receipt without retrying provider work, reusing a slot, changing the unresolved state, or exposing internal slot and provider identifiers.
Age-based reconciliation escalation
Classifies every quarantined calendar outcome as contained under 24 hours, stale after 24 hours, or critical after 72 hours; adds tenant-scoped stale and critical operations counts; and escalates malformed or future-dated age evidence instead of treating it as current.
Exact calendar reconciliation queue
Adds an authenticated, tenant-scoped queue for quarantined meeting holds with their exact retained time, timezone, provider class, and bounded action-state evidence. It omits raw slot IDs, prospect contact data, and provider identifiers, and offers no retry or slot-reuse action while signed evidence remains pending.
Calendar reconciliation visibility
Counts every workspace calendar hold whose provider outcome remains uncertain, surfaces a prominent private operations incident without exposing customer or slot identifiers, and blocks the meetings launch runway until signed evidence resolves the exact original hold—never by retrying or reusing the time.
Provider-safe hold expiry
Makes expired meeting holds compare-and-set and provider-aware: harmless unreserved work is canceled and released, while reserved, dispatched, delivered, unknown, or unexpected provider outcomes quarantine the exact slot until signed evidence reconciles it—preventing automatic retry, silent reoffering, and false booking claims.
Exact meeting-time rendering
Renders every retained availability window, temporary hold, hold expiry, follow-up review, and verified meeting in its own retained IANA timezone, preventing a browser's local timezone from silently changing the customer-visible date or clock time while preserving the distinction between temporary holds and provider-confirmed bookings.
Exact meeting commitment boundary
Requires C.O.L.T.E.N.™ to prepare one complete retained offered slot, finish an audible recap of its exact date, time, and timezone, observe a later prospect reply, and consume a one-use transcript-free receipt before creating only a temporary hold pending verified calendar-provider confirmation.
Listening-aware C.O.L.T.E.N.™ conversation
Upgrades C.O.L.T.E.N.™ Voice to runtime v0.25.0 and evaluation catalog v7 with 30 transcript-free scenarios, explicit active-listening and ambiguity-repair behavior, a bounded conversation-coherence listening score, and fail-closed withholding of consequential actions when a name, number, date, timezone, consent choice, objection, or meeting preference is unclear.
Readiness edge convergence
Extends the production monitor with bounded semantic retries for each domain's readiness receipt, compression-aware ETag, and conditional response—tolerating only the reviewed deployment-propagation window and naming the exact domain and failing contract when drift persists.
Readiness verification receipts
Binds the privacy-safe readiness inventory to the exact public release and current control state with a deterministic SHA-256 receipt, compression-aware ETag, and verified conditional revalidation contract—without hashing or publishing customer data, provider identifiers, or credential material.
Public launch evidence
Adds a privacy-safe, machine-readable readiness projection and visual status inventory for the workspace, billing, C.O.L.T.E.N.™ Voice foundation, live calling, licensed lead refresh, follow-up delivery, and monitoring—publishing only bounded booleans and reviewed descriptions.
Cross-edge release convergence
Makes the production monitor verify status HTML and the machine-readable manifest together on every live domain, request cache revalidation, tolerate only bounded deployment propagation, and name the exact domain and artifact when convergence fails.
Exact OpenAI launch authority
Separates C.O.L.T.E.N.™ OpenAI readiness into six independently visible, fail-closed launch controls: project-scoped key, production project binding, signed webhook secret, reviewed Realtime model, current content-free signed preflight, and aggregate runtime agreement.
Launch-authority review receipts
Promotes the versioned C.O.L.T.E.N.™ human-review receipt into a mandatory fail-closed production gate across operational blockers, provider readiness, the five-stage launch plan, and next-action guidance; a missing proof can no longer inherit launch authority.
Versioned human-review receipts
Binds C.O.L.T.E.N.™ uncertainty recovery to an explicit receipt version and retained task identifier, while separately proving that no human outcome, response-time promise, callback, message, or provider action has occurred; a new listening scenario verifies that spoken boundary.
Machine-confirmed human review
Adds a bounded follow-up receipt that lets C.O.L.T.E.N.™ acknowledge a human-review request only when an exact pending task was retained; missing, malformed, or non-review results fail closed and never imply a message, callback, response time, or external provider action.
Verified uncertainty recovery
Makes C.O.L.T.E.N.™ acknowledge unsupported product questions without guessing, ask permission before requesting human review, and confirm a follow-up only after its retained disposition exists—without inventing an answer, response time, message, callback, or provider action.
Owner-controlled OpenAI preflight
Adds an authenticated, hashed-operator-only workspace control for the protected model-access check, with a strict three-per-hour limit, safe audit evidence, explicit no-call boundaries, and an in-session four-value receipt handoff.
Protected OpenAI preflight runner
Adds an administrator-only, read-only runner for the reviewed OpenAI model-access check. It returns only an expiring signed receipt and explicit non-retention flags, never provider credentials, project identifiers, or a live-call state change.
Signed OpenAI credential preflight
Requires C.O.L.T.E.N.™ Voice to prove that its project-scoped key can retrieve the exact configured Realtime model, then retains only a current HMAC-signed pass receipt—never the key, project ID, or provider response.
Release manifest transport hardening
Makes the public manifest directly discoverable from the Release & Trust Center and verifies its JSON media type, bounded public cache policy, and browser MIME-sniffing defense on every production domain.
Machine-readable release manifest
Publishes a bounded, credential-free release document at a well-known URL with the exact public release, phase, target date, canonical surfaces, and reviewed C.O.L.T.E.N.™ runtime—then verifies it on every production domain.
Cross-domain release verification
Adds the Release & Trust Center itself to the automated production contract, requiring the exact version, release title, and canonical status URL to render across the root, www, app, and hosted production domains.
Exact C.O.L.T.E.N.™ runtime pinning
Makes the private customer control plane verify the reviewed C.O.L.T.E.N.™ Voice runtime version independently, so a reachable but stale backend remains visibly blocked instead of inheriting production authority.
Inspectable OpenAI webhook security
Publishes a content-free runtime contract for SDK signature verification, raw-body handling, the documented delivery identifier, durable replay defense, and zero transcript retention—then independently verifies that contract in production.
Signed OpenAI delivery replay defense
Binds each verified OpenAI callback to the documented webhook delivery identifier, rejects missing or malformed idempotency evidence, and prevents a duplicate or conflicting delivery from accepting the same Realtime call twice.
Exact customer launch runway
Groups the private production control plane into five fail-closed stages, reports verified and remaining controls, and identifies the next exact gate without exposing credentials, provider identifiers, or customer data.
Exact OpenAI provider readiness
Exposes four non-secret runtime proofs—project-scoped API key, production project ID, signed webhook verification, and approved Realtime model—so operators see the precise remaining gate without ever receiving a credential value.
End-to-end meeting activation truth
Separated live voice clearance from Google/Microsoft calendar delivery and signed meeting-ingest readiness in the first-campaign path, so an approved call workflow cannot be represented as fully meeting-ready before the booking roundtrip is verifiable.
Voice Help Desk production contract
Updated the cross-domain production monitor to require C.O.L.T.E.N.™ voice-question capture, voice-sample preview, spoken-answer controls, and the precise browser-speech no-action disclosure introduced in v2.09.
Conversational C.O.L.T.E.N.™ Help Desk
Added bounded topic memory for natural follow-up questions, optional Chrome voice dictation, discovery and selection of real installed browser voices, a voice-sample preview, and verified internal next-step links while preserving the no-hidden-action boundary.
Payment-ready Stripe brand controls
Applied SalesPitch navy and accessible blue to the live Stripe seller account and extended the redacted read-only preflight to verify charges, payouts, activation details, seller identity, canonical website, USD market, statement descriptor, brand colors, and whether both hosted brand images are configured.
Branded, policy-linked billing portal
Added the canonical SalesPitch AI Terms and Privacy destinations to Stripe's live customer portal, upgraded the customer-facing portal headline, exposed period-end cancellation behavior inside the member billing center, and made conflicting legal URLs fail the read-only portal contract.
Verified customer billing management
Branded the live Stripe customer portal, fixed the app-domain return path, canonicalized every production billing return, and added a read-only release gate for portal identity, invoices, payment methods, customer updates, period-end cancellation, and intentionally disabled untested plan switching.
Canonical signed billing fulfillment
Moved Stripe entitlement callbacks to the canonical sales-pitch.ai endpoint and added a non-mutating production proof that the signing secret, exact event set, live endpoint, and enabled state remain intact.
Verified Stripe catalog and canonical returns
Machine-checked all eight live prices and payment-link line items, corrected every successful checkout return to app.sales-pitch.ai, and added a read-only catalog preflight that fails on amount, interval, link, quantity, or redirect drift.
Live, privacy-safe application health
Connected the public trust experience to the current production application and customer-data health contract without publishing credentials, records, or provider diagnostics.
Public release transparency
Added this Release & Trust Center, explicit product-surface states, public safeguards, and a direct release-status path from the beta banner.
Questions or security reports
Use a verified channel.
Ask P.A.Y.T.O.N. AI for product guidance, or report security concerns privately without including credentials or customer data.