Rollout: four phases, each closed by a live check before the next begins
Each phase ends with a check against real state, not a checklist. Durations are estimates for one person working alone, which is how Hangar has been built. A Modelplane hub trial and a second cloud come after this, once agents run and their spend is bounded.
Verify A · end of week 6
A T0 call works end to end and leaves an audit row.
A run ends on time with Clearance stopped, and again with the function pod killed.
The network-policy canary fails on kiac-dev (reported honestly) and passes on kind-prod.
customize-cluster.sh refuses autopilot on a type: upper cluster.
Verify B · end of week 10
A repo-scoped token cannot open a PR on any other repo.
Upper sync and any kubectl write are refused with the agent token.
A PR that edits .tekton/ turns agent-scope red and cannot merge.
A model call for a model off the allowlist is denied and audited.
Verify C · end of week 14
One task_id runs from audit row to Argo annotation to a Loki line.
Preflight scores the seed cases, and a seeded bad run fails.
A new agent scaffolded from a template runs end to end with no platform change.