The Trilogy Times

## The incident (Surtr PR 1161, 2026-08-10)

A ruff-fix push and a draft→ready promotion landed ~2s apart. Per-PR concurrency cancelled the ready_for_review run; the surviving synchronize run read the event snapshot's draft: true and skipped — orphaning the review. The manual workflow_dispatch fallback then withheld auto-approve because its CI gate counted the *cancelled* review-check instance from the killed run as failing CI. Two defects, each hiding the other.

## Fixes

1. Draft gate queries live PR state (gh api pulls/N --jq .draft, falling back to the snapshot on API error) — a stale snapshot can no longer orphan a review.

2. CI gate dedupes to the latest check-run per name (--slurp + group_by(.name) | map(max_by(.started_at))) — superseded cancelled instances stop reading as red forever.

Both changes are inside the existing gate step; no new permissions, no behavior change on the happy path. YAML validated; Surtr rides @main so the next real PR event exercises this as the canary.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary

Implements [AI-199](https://linear.app/builder-team/issue/AI-199/harness-model-registry-is-a-code-change-opus-5-is-available-and-unusable-and) by making Cursor's live model registry authoritative before every cloud-agent create. Floating Opus aliases now resolve safely, exact live variants are assembled and validated, and an unknown or unvalidated selection cannot fall through to Cursor's server default.

## Why It's Needed

The harness encoded a small, stale model registry in model-selection.ts. That made Opus 5 unusable without a code edit, pinned opus-latest to an older revision, missed constrained variant matrices, and allowed unknown revisions to degrade to a bare { id } selection whose server default could silently restore the 1M-context pricing tier.

## Changes

- Added live-model-registry.ts, backed only by authoritative variants[].params (not the incomplete adjacent parameters metadata).

- Resolves opus / opus-latest among actual alias holders by greatest uniquely parseable numeric Opus revision; exact canonical IDs remain exact and ambiguous aliases fail closed.

- Applies the conservative Opus constraints (thinking=true, context=300k, effort=high, fast=false) and forwards the matching live variant's complete tuple, including provider-controlled fields such as cyber.

- Exact-validates assembled tuples order-independently and rejects duplicate params, unknown IDs, missing variants, impossible combinations, and ambiguous required dimensions.

- Enforces resolution at the shared createCloudAgent choke point immediately before Agent.create; omitted selections are refused, while optional production paths inject the harness default explicitly.

- Shares the same resolver with drones doctor and exposes the full model-selection flags there.

- Adds a finite API-key-scoped memory cache plus atomic hashed-key disk cache (10-minute fresh TTL, bounded one-hour stale fallback only after a live failure); failed reads are evicted and concurrent reads deduplicate.

- Updates architecture/operator docs, CLI help snapshots, and the append-only decision ledger.

## Breaking Changes

Unknown model IDs, ambiguous aliases, impossible tuples, unavailable/expired registry evidence, and direct createCloudAgent calls without a model now fail before Agent.create instead of inheriting a cloud default. opus and opus-latest now float to the newest live numeric Opus revision rather than pinning to 4.8.

## Test Plan

- pnpm exec vitest run src/live-model-registry.test.ts src/model-selection.test.ts src/mcp-config.test.ts src/mcp-call-sites.test.ts src/reviewer.test.ts src/conflict-resolver.test.ts src/mercy-watcher.test.ts src/spec-author-agent-runner.test.ts src/eligibility-cloud-agent-runner.test.ts src/runner.test.ts src/retro-concern-validity.test.ts src/arch-drift.test.ts — 591 passed.

- pnpm exec vitest run src/doctor.test.ts src/cli/ai247-move-verify.test.ts — 47 passed.

- node scripts/run-python-tests.mjs — 542 passed.

- pnpm typecheck — passed.

- git -c core.whitespace=cr-at-eol diff --check — passed.

- Full parallel pnpm test reached 3,795 passed / 1 skipped; three pre-existing subprocess tests hit their 5–7 second parallel timeout ceilings. Their exact files passed 47/47 in isolation above.

## Verification Artifact

A read-only live registry probe with the operator key resolved opus-latest to:

{"id":"claude-opus-5","params":[{"id":"cyber","value":"false"},{"id":"thinking","value":"true"},{"id":"context","value":"300k"},{"id":"effort","value":"high"},{"id":"fast","value":"false"}]}

The focused choke-point test also proves an unknown model never reaches Agent.create, and the live-resolver fixture for thinking=false, effort=xhigh proves an absent matrix combination is refused locally.

Closes #860.

Stands up product analytics for Aerie and instruments the Admissions Funnel tab as the first surface, establishing the browser -> Next route -> Mixpanel proxy pattern every later report reuses. The browser never sees the project token; the server attaches identity and request metadata (the whole point of the proxy — a Convex action has no Request).

## What's here

| File | Purpose |

|---|---|

| chat/lib/product-analytics/events.ts | Strict Zod schema + inferred types, shared by route and client. .strict() so a client cannot inject email/user_id via the body. Enums start narrow and widen per report. |

| chat/lib/product-analytics/mixpanel-server.ts | import "server-only", buildBaseProperties(headers) + track(). Plain fetch behind a 3s timeout, awaited, failures logged not thrown, no-ops when the token is absent. |

| chat/lib/product-analytics/track.ts | Client helper. Returns void, swallows rejections, no-ops under vitest. |

| chat/app/api/analytics/track/route.ts | POST. 401 unauth, 400 on unknown keys, 204 otherwise — including when tracking fails. |

| chat/components/dashboards/admissions/community-funnel/admissions-funnel-view.tsx | Fires the view event. |

Server-derived properties: env from NODE_ENV/DOMAIN, $insert_id for dedupe, and ip/$browser/$os/$device/$referrer/$referring_domain/language from headers via ua-parser-js (new dependency).

## Fire conditions

aerie_report_view counts *views of a funnel*: first render of the tab, and every switch between community_funnel and full_funnel. It does not re-fire on sort, program search, counting-mode change, pagination, or drill-down.

Deviation from the issue's file table, called out for review: the issue suggested a mount effect in community-funnel-view.tsx plus a separate fire in funnel-type.tsx. That split double-fires on a full -> community switch (the change handler fires, and the remounting community view's mount effect fires again) and can't observe a switch *into* the un-instrumented full view. Instead the fire lives in a single effect at AdmissionsFunnelView, the shared owner of funnelType, keyed on [funnelType, isAuthenticated] with a ref guarding the last-reported funnel. That fires exactly once on first render and once per switch in both directions, and nothing else touches those deps.

## Secret

MIXPANEL_PROJECT_TOKEN is a runtime var read from the chat container's env_file: .env — no compose/Dockerfile change needed. The route no-ops cleanly when the token is absent, so this ships ahead of the secret. Someone with SSH access still needs to refresh /home/bran/app/.env and restart the chat container once the secret lands in the aerie/prod + aerie/dev blobs (CD does not run pull-env.sh).

## Verification

- pnpm typecheck — clean.

- pnpm biome check — clean.

- pnpm test — 8 new route tests (401, no Mixpanel before auth, .strict() 400, missing-token 204/no-throw, header-derived properties) + 85 existing funnel/panel tests, all green.

- next build — compiled successfully; the only build failure is downstream static prerender on unrelated pages (/archived-chats, /admin/audit) from a missing local Clerk publishableKey, which CI supplies.

One infra note: vitest.config.ts aliases server-only to its own empty stub so server modules guarded by it stay unit-testable — the guard still holds in the real Next build.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Enables the daily schedule for the renewal-action-hub-pp-redshift-sync pipeline that landed (disabled) in #1175.

Change

- schedule.enabled: false → true. Runs daily at 06:30 UTC (cron(30 6 * * ? *)).

- README schedule section updated to match.

Why now

- The mart table mart_customer_success.renewal_action_hub_pain_points DDL has been applied to prod Redshift (44 columns, currently 0 rows).

- Every run is a full refresh (~587 low-velocity rows), so the first scheduled run populates the table from empty — there is no separate backfill step.

- The pipeline was shipped disabled deliberately (ship-dark default); this flips it on for the production cadence.

Deploy still occurs via CD on the production branch; merging this to main does not deploy on its own.

Moves the renewals-v3 successor backfill off the external SuiteQL executor Lambda (returning NetSuite 401 INVALID_LOGIN since ~2026-07-11 and silently swallowed) onto a Redshift read of the canonical raw table staging_finance_netsuite.raw_subscription, owned and refreshed daily by the netsuite-raw runner.

## What changed

- successor_key_resolver.py rewritten to read raw_subscription in Redshift; drops the requests/SUITEQL_EXECUTOR_API_KEY/suiteql-executor runtime dependency.

- subscriptionRenewalHistory has no raw table; the direct predecessor→successor edge is reconstructed as COALESCE(custrecord_parent_subscription, root_subscription) (parent precedence, non-self root fallback), validated against a captured executor snapshot (~95% of edges; residual is 5-month snapshot drift).

- Fail closed on missing / stale (netsuite-raw publication >48h) / empty / failed source instead of publishing a healthy-looking empty result.

- Drop ambiguous predecessors (a chain root fronting several first renewals) rather than picking arbitrarily.

- .env.example: remove the retired executor credential.

- Tests cover successor match, no-match, ambiguity, the edge-SQL reconstruction contract, the freshness-gate SQL contract, and missing/stale/empty/failed source.

- FEATURE.md: document the revised lineage; note fct_renewals was retired in the 2026-07-17 mart-saas-metrics cutover, so renewals_budgeted_contracts is the terminal mart.

## Reconciliation

renewals-v3 is a full reconciliation sweep, so no separate backfill job is needed — the first run after cutover restores the missed successor matches across the current-budget population. Against the live mart, 2,989 of 6,142 current budget-only contracts have an unambiguous successor under the new rule.

## Validation

- 274 tests pass; ruff format + check clean.

- Freshness and edge SQL validated against live Redshift.

- Pipeline itself not run (Surtr infra is production-only).

Two one-line cron edits per issue 1181 (heimdall verified the exact diff, no fix_class for cron → human applies): cost-pipeline 06:00→06:30, usage-pipeline 06:00→07:00, entity-sync stays 05:30 as anchor. Ends the shared-quota 429 storms (08-10: 4 usage BUs + CNU cost rows + 1 entity-sync org in one morning). Windows are date-granular — no data impact from later starts. TF June-offset precedent.

Resolves https://github.com/AI-Builder-Team/Surtr/issues/1181

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary

Rebuilds the Lockup Release Waterfall on /spacex-valuation to the new Gigafund 22-Jul-26 distribution model ("SpaceX Distribution Waterfall" sheet), then makes its projected tranches follow the live / What-If price while the realized Actual tranches stay pinned at the $108.27 Q2'26 pricing-date close.

Two stacked pieces of work (built spec → plan → subagent-driven implementation, each with independent review):

### 1. Model rebuild

- Replaces the old "12 Jun IPO Recon" waterfall with the new model: new tranche ladder, corrected percentages, resolved price trigger (not met — $108.27 < $175.50 = 130% of IPO), and Gigafund 0.25 + Strauss as Rule 144 releases.

- Two tables: Lock-Up Release Schedule (tranche / date / status / % / price) and Combined Availability Timeline (per-tranche carry waterfall → LP net shares & value).

- Header + captions presented in an amber callout; fund-scope note in an info callout.

### 2. Live-priced projected tranches (stakeholder request)

- Projected tranches now price at the current SPCX price (the What-If slider, which defaults to the live quote); the two Actual rows stay fixed at $108.27.

- Introduces calculations/lockup.ts — a faithful port of the sheet's per-fund, cumulative, share-settled carry engine (carry = 20% × max(0, cumulativeDistributed − capitalCredit), settled in shares at each tranche's price), summed across the 7 funds into the combined timeline.

## Correctness

The engine ties out to the sheet penny-for-penny at $108.27 — independently verified numerically in review:

| | |

|---|---|

| Gross shares | 37,339,135 |

| Tranche value | $4,042,708,146 |

| Carry taken | $571,484,060 |

| Carry shares withheld | 5,278,323 |

| Net shares to LP | 32,060,812 |

| Net value to LP | $3,471,224,087 |

This is asserted against an independently-transcribed totals constant and is mutation-checked, so it's a genuine tie-out (not a tautology). At $108.27 the live-priced engine reproduces the prior static snapshot exactly — i.e. a strict superset.

## Testing

- 138 SpaceX feature tests pass (incl. 11 new engine tie-out + price-behavior tests).

- tsc -p tsconfig.app.json --noEmit, pnpm build, and pnpm lint:pr all clean.

- Verified live in-browser: projected rows show the slider price (e.g. $114.92 default → $200 when dragged) while Actual rows hold at $108.27, and Table B recomputes accordingly.

## Notes

- Two source-sheet quirks are transcribed verbatim by design (documented in code comments): a duplicated "Day 70 after prospectus" label in the combined timeline, and a "n/a rigger not met" price-basis typo.

- Scope is confined to the SpaceX lockup files — valuation.ts, the What-If slider, and the summary cards are untouched.

- Specs & implementation plans included under docs/superpowers/.

## Screenshots

<img width="1472" height="768" alt="image" src="https://github.com/user-attachments/assets/614522d6-64f1-42a6-8bc9-239cecbd9fc1" />

<img width="1456" height="722" alt="image" src="https://github.com/user-attachments/assets/472380be-e8d7-483c-ad1b-aed7bbef606d" />

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Problem

On the Performance Review Income Statement, expanding an expense line to its vendor drilldown rows showed the variance colors inverted: a spending reduction (under budget) appeared red, and an overrun (over budget) appeared green — the opposite of the correct expense coloring already applied to the parent category rows.

Reported by a stakeholder: _"Reduction in expense showing in red now. Supposed to be green."_

## Root cause

Parent category rows pass invertColors={node.invertColors ?? false} into their cells, so expenses (COGS / OPEX / Spend / etc.) correctly invert: under budget = green, over budget = red.

Vendor drilldown rows, however, are rendered by a separate VendorRow component (fed by the useVendorBreakdown hook), which never passed invertColors to its TableCells. They fell back to TableCell's default (invertColors = false, i.e. revenue semantics), producing the inverted colors.

This regressed in #2410 (2026-03-31) when VendorRow was reintroduced without the flag.

## Fix

Thread invertColors from the parent tree node through VendorRow onto each of its five period TableCells (month 1/2/3, QTD, quarter):

- Add invertColors prop (+ type) to VendorRow

- Pass invertColors={invertColors} to the five data cells

- Pass invertColors={node.invertColors ?? false} at the <VendorRow> render site

8-line change, one file. The zero-variance/future-quarter placeholder cells are left untouched (no variance to color).

## Verification

- tsc -p tsconfig.app.json --noEmit — clean

- eslint --max-warnings 0 on the changed file — clean

- Manual browser check (localhost, Q3 2026):

- Under-budget expense vendors (e.g. AI Engineering −2,333; AI Builders −2,339 under NHC OPEX → CF) now render green ✅

- Over-budget expense vendor (Khoros MR under NHC COGS) now renders red ✅

- No related console errors

## Screenshot

<img width="1263" height="920" alt="image" src="https://github.com/user-attachments/assets/79621c7e-5e5c-4b08-9dad-cbe242a4612c" />

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_AGENT_PR_BODY_BEGIN -->

### 1. Summary

scripts/dispatch-poll-wrapper.sh's post-dispatch rc == 0 branch had a false comment and a real sub-second race. The comment claimed TERMINAL_ATTEMPTED suppresses re-entrant epitaph work on that path, but that flag is only ever set inside emit_abnormal_exit, which the healthy path never calls — it stays 0 there and guards nothing. Separately, a SIGTERM landing between pnpm drones heartbeat --from-latest-dispatch-receipt returning 0 and TERMINAL_WRITTEN=1 executing let the TERM/INT trap see TERMINAL_WRITTEN=0 and stamp a spurious abnormal-exit epitaph right next to the fired record that had just been written — a false "the host killed the tick" for a tick whose fire actually succeeded.

### 2. Why it's needed

abnormal-exit is the exact signal AI-227 built to detect real interrupted fires. A false positive in that signal is worse than a missing one, because "you should not page on abnormal-exit alone" (per guidelines/dispatch-scheduled-runner.md) already relies on operators trusting the signal enough to investigate when it fires — repeated false alarms are how a new alarm gets ignored. The misleading comment also actively misdirects the next person who touches this file into believing a guard exists where it doesn't.

### 3. Changes

- Comment fix (defect 1): both the flag-initialization comment and the comment above the rc == 0/rc != 0 split now say explicitly that TERMINAL_ATTEMPTED guards the rc != 0 arm (via emit_abnormal_exit setting it as its own first statement, before any write) and guards nothing on the rc == 0 arm.

- Race fix (defect 2) — went beyond the ticket's suggested "gate on dispatch_rc" scope: I considered gating the trap's first emit on dispatch_rc being unknown-or-non-zero, as the ticket's "Better" option suggests. I rejected it after verifying (via direct bash experiments, see Test plan) that it reopens exactly the silent-hole failure mode the ticket warns against: once dispatch_rc is known to be 0, systemd's default KillMode=control-group delivers the *same* SIGTERM to the heartbeat child process directly (not just to the wrapper), so the child can die mid-write with the fallback path never reached — bash defers trap execution until the currently-running foreground command completes, so the trap fires and exits the whole script immediately once that (killed) child returns, before any of the existing elif/else fallback logic can run, and DISPATCH_PID is already cleared so the trap's reap-based path can't cover it either.

Instead I added trap '' TERM INT around just the rc == 0 write attempt (both the primary emit and its existing no-receipt fallback), then let the pre-existing unconditional trap - TERM INT restore default disposition afterward either way. This closes both problems in one move: SIG_IGN discards a signal outright with no queued replay once unmasked (so it can never race an already-succeeded write into a duplicate abnormal-exit), and because SIG_IGN carries across exec per POSIX, the masking is inherited by the pnpm drones heartbeat child too — the same cgroup-wide SIGTERM that would otherwise kill it mid-write is ignored by the child as well, so the write simply runs to normal completion instead of possibly dying first. SIGKILL remains untrappable/un-ignorable either way, unchanged — that's already-accepted AI-236 pairing territory (start-without-terminal + reporterPid gone).

### 4. Breaking changes

None. This only changes signal handling within a ~1-line-wide window of one already-Low-severity, sub-second race inside a wrapper script that isn't imported by any other module; no public interface, CLI flag, receipt schema, or dispatch-tick-outcome record shape changed.

### 5. Test plan

- pnpm typecheck → clean (no output, exit 0).

- pnpm test → 83 test files / 2324 vitest tests passed, plus the Python unittest suite (412 tests) → OK. Includes src/interrupted-fire-orphan.test.ts (19/19 passed), which pins the wrapper's structure (backgrounded dispatch, bare wait, TERM trap installed before fire, emit_abnormal_exit on non-zero rc) — verified with an explicit script that all pinned indexOf orderings (trapIdx < dispatchBgIdx < pidAssignIdx < waitIdx < abnormalBranchIdx < emitAbnormalIdx) still hold after the edit, since nothing before/at that ordering moved.

- bash -n scripts/dispatch-poll-wrapper.sh → syntax OK.

- Empirically validated the bash signal semantics this fix depends on, and the fix itself, with standalone scripts (not committed — throwaway, deleted after use):

- Confirmed bash defers a trapped signal until the current foreground command completes, both when that command is unaffected by the signal (sleep outlives a non-group kill) and when a group-wide signal kills the foreground child too (trap then fires immediately once the child dies) — this is what makes the "gate on dispatch_rc" approach unsafe.

- Confirmed a signal received while trap '' TERM is in effect is discarded outright, not queued for replay after re-arming the trap.

- Confirmed SIG_IGN is inherited across exec: with the parent masked, a spawned child (bash -c ...) also ignores a group-wide SIGTERM and runs to completion — this is the key fact that makes masking (not just deferring the wrapper's own trap) close the silent-hole risk too.

- Ran a 60-iteration stress test of a faithful mini-simulation of the fixed rc == 0 branch (backgrounded "dispatch" exiting 0, masked write attempt, group-wide SIGTERM jittered right across the dispatch-completion boundary): 0 double-records, 0 silent holes across all 60 runs. Also separately verified the "genuinely interrupted healthy emit" scenario (heartbeat child killed mid-sleep before it could write) always still produces exactly one record.

### 6. Verification artifact

$ pnpm typecheck
> trilogy-drones@0.1.0 typecheck /workspace
> tsc --noEmit
(exit 0, no output)
$ pnpm test
...
Test Files  83 passed (83)
Tests  2324 passed (2324)
...
Ran 412 tests in 0.177s
OK
$ npx vitest run src/interrupted-fire-orphan.test.ts
✓ src/interrupted-fire-orphan.test.ts (19 tests) 67ms
Test Files  1 passed (1)
Tests  19 passed (19)
$ bash -n scripts/dispatch-poll-wrapper.sh
SYNTAX OK
Stress test (60 runs, signal jittered at the exact rc==0 race boundary):
total=60 double_records=0 no_record=0

Closes AI-253.

<!-- CURSOR_AGENT_PR_BODY_END -->

<div><a href="https://cursor.com/agents/bc-418a875d-d331-4e26-a233-b2029891ed41?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/background-agent?bcId=bc-418a875d-d331-4e26-a233-b2029891ed41&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>

<!-- CURSOR_AGENT_PR_BODY_BEGIN -->

## Summary

Mounts Financials ??? CAPEX at /dashboards?tab=financials&sub=capex, composing the typed all-site summary table, clean-grain DDR-vs-booked chart, and AERIE-1113 entity tie-out inside the existing Financials shell (school filter + coherent Refresh).

## Changes

- Add capex to Financials sub-tab type/URL validation, context-panel nav, layout routing/labels, and capability mapping (reuses financials.schoolPl.read; no new capability).

- Add CapexView + pure presentation helpers (capex-summary.ts): sortable/filterable table, quality badges/notes (MIXED, non-isolable, unresolved mapping, NS-TB-without-QB, no-current-close-TB), chart eligibility at ddr >= $500_000 with the exact clean-row predicate, selected-close account-11500 TB wording.

- Live loading via useCapexSummaryLive / useCapexEntityTieoutLive (useLiveSection); Refresh refetches both without a request loop.

- Reuse Aerie Financials tokens and var(--color-chart-*) for the recharts horizontal chart ??? no CAPEX-only palette.

## Tests

- Pure helpers: threshold/eligibility, quality notes, sort/filter, pct bar clamp (capex-summary.test.ts).

- Chart: clean-row-only rendering + empty status (capex-ddr-vs-booked-chart.test.tsx).

- CapexView: loading/error/retry, refresh coherence, school filter, sort, capability deny (capex-view.test.tsx).

- Live hooks + navigation/capability: summary hook, tie-out enabled gate, URL/sub-tab, context panel CAPEX visibility.

- pnpm typecheck (chat) + biome check on changed files ??? pass (pre-commit).

## Verification

Live browser verification passed against Redshift at /dashboards?tab=financials&sub=capex (1680?1050): 38 summary rows, 30 tie-out rows, 26 degraded rows, SELECT privilege true on all three CAPEX marts, and zero load failures.

- Filters, configurable DDR threshold, split Attribution/Mapping/Coverage columns, suppressed degraded comparisons, short chart labels, issue references, simplified tie-out rows, KPI reconciliation insights, sorting, and Refresh were exercised.

- CAPEX tests: 88/88 pass; typecheck and Biome pass.

- [Full CAPEX tab](https://cursor.com/agents/bc-eff21704-f125-4d8a-bda3-71f3274dd26e/artifacts?path=%2Fopt%2Fcursor%2Fartifacts%2Fcapex-tab-full.png)

- [Degraded/quality rows](https://cursor.com/agents/bc-eff21704-f125-4d8a-bda3-71f3274dd26e/artifacts?path=%2Fopt%2Fcursor%2Fartifacts%2Fcapex-quality-row.png)

- [Tie-out and coverage](https://cursor.com/agents/bc-eff21704-f125-4d8a-bda3-71f3274dd26e/artifacts?path=%2Fopt%2Fcursor%2Fartifacts%2Fcapex-tieout-coverage.png)

## Risks / follow-ups

- Parks for human merge.

- No AERIE-1115 transaction drilldown; no new capability.

- Live MIXED-row / coverage-card screenshot evidence blocked until Redshift SELECT grants land for the cloud-agent warehouse user.

## Out of scope

- Transaction drilldown, new Redshift marts/actions, new capability keys, auto-merge.

_{To show artifacts inline, <a href="https://cursor.com/dashboard/cloud-agents#team-pull-requests">enable</a> in settings.}

## Verification artifact

Browser verification: pass

Live CAPEX at /dashboards?tab=financials&sub=capex with 12 clean vs 38 all sites; new mode toggle (Clean comparisons / All sites) drives muted-bar all-cohort view — verified with live Redshift rows, 0 console errors, current_user redacted, has_table_privilege true on all three CAPEX marts.

Screenshots:






<!-- CURSOR_AGENT_PR_BODY_END -->

<div><a href="https://cursor.com/agents/bc-05db9391-f1f5-41eb-9746-a0725d6c8a31?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/background-agent?bcId=bc-05db9391-f1f5-41eb-9746-a0725d6c8a31&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>

## Browser verification

### Boot

- From the repo root run pnpm dev-local; wait for http://localhost:3000.

- Chromium and Playwright are already installed by the Aerie cloud setup.

- Preserve the newly injected shell REDSHIFT_* runtime secrets when booting local Convex; do not overwrite them with stale .env.local or aerie/dev values, and never print secret values.

### Auth

- Use the established Aerie storage-state replay or mint a fresh Clerk session if the captured JWT expired.

- Verify the authenticated role has financials.schoolPl.read.

### Flow

1. Before browser assertions, query current_user and has_table_privilege for all three CAPEX marts; report the non-secret username and booleans. Live SELECT access is required.

2. Navigate to http://localhost:3000/dashboards?tab=financials&sub=capex.

3. Confirm CAPEX nav is active and loading settles without visible or console errors.

4. Verify populated summary table columns, a visibly degraded/MIXED row, and selected-close NetSuite TB wording.

5. Verify the horizontal chart includes only clean rows with DDR >= $500,000 and sampled values agree with the table.

6. Verify the entity tie-out table and both coverage cards contain live rows.

7. Exercise table sorting or school filtering and Refresh; both sections must settle without duplicate request loops.

8. Compare the page with adjacent Financials tabs for semantic theme tokens, spacing, typography, chart palette, focus, and responsive consistency.

### Screenshots to capture

- capex-tab-full.png - full mounted table and chart.

- capex-quality-row.png - populated MIXED or degraded row and explanation.

- capex-tieout-coverage.png - populated tie-out and coverage cards.

### Pass criteria

- Fixture-only or permission-denied UI evidence is not a pass. The mounted flow must load live CAPEX rows using the injected Redshift credentials.

- Publish durable screenshot links, route, viewport, interactions, console result, current_user, and privilege booleans in the Verification artifact. Never publish credential values.

### Current-head capture guidance

- If pnpm dev-local requests Convex login, use the proven anonymous local path: create/select the local deployment with CONVEX_AGENT_MODE=anonymous, then push functions and start Next.

- Set REDSHIFT_HOST, REDSHIFT_PORT, REDSHIFT_DATABASE, REDSHIFT_USER, REDSHIFT_PASSWORD, LEGACY_EDUCATION_WAREHOUSE_READS_ENABLED=true, and the Clerk issuer on the local Convex deployment without printing values.

- If stored Clerk state is expired, mint a fresh sign-in ticket for the same test user and grant a seeded role carrying financials.schoolPl.read in the disposable local deployment.

- CAPEX scrolls inside its own content container. Capture the inner CAPEX scroll region in stitched sections or locator screenshots; do not rely on Playwright fullPage, which produces mostly empty space.

- Ensure the final screenshots clearly show: executive/attention summary and table, expanded lineage/quality details, chart labels and filters, tie-out KPIs/largest differences/table.

## Demo

<img width="2624" height="1636" alt="image" src="https://github.com/user-attachments/assets/aece962b-d0d8-4587-8ae4-3b66a7310005" />

## Summary

- add a sortable Forecast column to the Admissions Forecast table

- calculate Forecast as Net Existing/Re-Enrolled plus students in the Pipeline Enrolled stage

- include Forecast in CSV exports and mobile school views

- add contract, derivation, sorting, CSV, and table coverage

## Why

Admissions needs a committed enrollment figure that combines retained students with newly enrolled pipeline students without including weighted open-pipeline stages or deposit projections.

## Impact

Users can compare Confirmed, Forecast, Finance, and QS values per school on desktop and mobile. The new value is also available in exported CSV data.

## Validation

- pnpm exec biome check <10 changed files>

- pnpm --filter @bran/chat exec vitest run components/dashboards/admissions/forecast/__tests__/derivation.test.ts components/dashboards/admissions/forecast/__tests__/forecast-table.test.tsx (97 tests)

- pnpm --filter @bran/contracts exec vitest run src/admissions-forecast-finance.test.ts (4 tests)

- pnpm --filter @bran/contracts typecheck

- pre-commit Chat TypeScript check

## Summary

- collapse duplicate CDC representations when every version of a source ID is deleted

- preserve the existing fail-closed behavior for mixed or conflicting duplicates

- add a regression fixture matching the production Budget payload that blocked FY27 budget ingestion

## Production validation

- replayed the affected alpha_schools_llc CDC window through the patched parser using read-only QuickBooks access

- confirmed the parser returns deleted IDs 1000000001 and 1000000002 plus active Budget 1000000011

- no pipeline was triggered and no source or warehouse data was modified

## Test plan

- uv run --project pipelines/runners/quickbooks-raw-sync pytest pipelines/runners/quickbooks-raw-sync/tests -q

- uv run --project pipelines/runners/quickbooks-raw-sync ruff check pipelines/runners/quickbooks-raw-sync/src/qb_client.py pipelines/runners/quickbooks-raw-sync/tests/test_qb_client.py

- uv run --project pipelines/runners/quickbooks-raw-sync ruff format --check pipelines/runners/quickbooks-raw-sync/src/qb_client.py pipelines/runners/quickbooks-raw-sync/tests/test_qb_client.py

## Summary

- add TransactionLine.memo to the scheduled raw_transaction_line source contract

- limit published memo values to the legacy-compatible 250 characters while retaining the complete source payload in immutable landing

- add the idempotent Redshift column migration, canonical comment, deployment-order documentation, and regression coverage

## Deployment order

1. Apply pipelines/runners/netsuite-raw/ddl/2026-08-05_transaction_line_memo.sql.

2. Deploy the netsuite-raw runner.

The runner fails closed during schema preflight if deployed before the migration.

## Test plan

- uv run --project pipelines/runners/netsuite-raw ruff check on all changed Python files

- uv run --project pipelines/runners/netsuite-raw pytest pipelines/runners/netsuite-raw/tests (222 passed)

## What

Tier 2 of the Skyvera accommodation: the spend benchmark becomes per-product, per-category (was per-category), and is now the single source of truth — both margin benchmarks are derived from it, not stored.

Per Ravi (2026-08-08) and his worked sheet, Cloudsense and Kandy carry a +15pp total-spend allowance landing on exactly two cells:

| Cell | Group standard | Cloudsense / Kandy |

|---|---|---|

| Central::SaaS | 2.5% | 7.5% (+5) |

| Edge::Hard COGS | 0% | 10% (+10) |

| Total spend | 25% | 40% → margin 60% |

The split is encoded as data (benchmark_overrides in per-BU refdata), so the BU's real function-level split drops in as a one-file edit. Every other product/category stays at group standard. JigTree (all-standard) is unchanged.

> ⚠️ Provisional: Ravi flagged the SaaS+5 / HardCOGS+10 split as *assumed* pending the BU's function-level breakdown. The mechanism is the work; the numbers are a data edit when the BU responds.

## How

Backend (services/benchmark)

- refdata: new benchmark_overrides {product: {"Section::Category": pct}}; removed the now-derived benchmark_targets / benchmark_bu_blended constants.

- engine: _cell_benchmark applies override→standard fallback; per-product margin derived as 1 − total spend benchmark. The consolidated column is a true additive rollup of the product columns — its expected \$ = Σ per-product (benchmark × own revenue), matching the sheet, not blended-rate × aggregate revenue (they diverge when the actual-revenue mix ≠ budget-revenue mix). Display benchmarks are budget-revenue-weighted blends; margin derives from them.

- _ordered_functions now includes override-only categories (Hard COGS at 10% with 0% standard) so the by-function decomposition invariant holds. consolidated_reconciles reworked to compare against the raw GL aggregate (was tautological once consolidated became a literal rollup).

Frontend (BenchmarkByProduct)

- BenchmarkTable: category cost cells color against each cell's own benchmark, not the consolidated row-label blend — the per-cell twin of the #3503 margin-coloring fix.

- consolidate: the subset "Selected Products Consolidated" column blends cell/section/function/margin benchmarks by budget revenue; dollars stay additive.

## Verification

- JigTree golden reconciles unchanged (all-standard BU untouched).

- Live Skyvera reproduces Ravi's sheet to ~12 significant figures through the real Redshift + budget path (consolidated margin 0.6300183863; Cloudsense 0.60; Cloudsense SaaS benchmark 0.075; all invariants hold).

- 45 backend + 42 FE tests pass; ruff / pyright / eslint clean.

- Mutation-checked: override lookup, additive consolidation, and per-cell coloring each proven to fail when broken.

- Live in-browser (this branch on :3001): per-cell coloring inversions confirmed at the DOM level (Cloudsense SaaS 3.1% no-fill vs VoltDelta 3.2% pale; Cloudsense HardCOGS 13.2% orange vs VoltDelta 13.1% red), derived margins correct (Cloudsense 64% actual renders green vs its 60% target), and the budget-weighted subset blend reproduces the shown value (63.9%).

Design spec updated (docs/superpowers/specs/2026-08-07-...): Tier 2 BLOCKED → BUILT.

🤖 Generated with [Claude Code](https://claude.com/claude-code)