Consent onboarding and Preview conformance
Use this checklist with the consent integration guide. Status — 28 September 2026: S2/S3 APIs are landed and adoption is dormant; S4 hosted enforcement, S5 event handling and S6 UI are incomplete. The rows below are required outcomes, not executed or passing tests. No tenant/environment is activated by this guide. Documentation tests do not establish S8 browser or network proof.
Prepare one environment
- Identify the exact tenant, deployment environment, canonical checkout host, deployed API/hosted/admin revisions, schema digest and configuration revision using redacted evidence. Preview and Production are independent.
- Confirm ordinary CART / ONE_TIME
/sessionscope, existing hosted GA entitlement, exact-host admission, sanitized event contract and advertising restrictions. Excluded account/order-status/booking/subscription surfaces remain analytics-dark. - Integrate a storefront-owned CMP/choice source with exact
granted/denied/unknown, protected capability generation and persistence-before-send, scoped updates, bounded retries, and truthful pending/failure reporting. Define lost-secret behavior; the platform cannot recover the secret. - Publish accurate tenant privacy disclosures and link them with the
hosted
/cookiesnotice at handoff. Disclose actual rollout state, data, lifetime, withdrawal and browser/domain limits. An API receipt does not prove hosted enforcement or document accuracy. - Confirm delivered S4/S5/S6/S7 behavior and exact API/OpenAPI parity, including the #4472 hosted tenant/environment correction. Finish the final comparison below before treating S7 as complete.
- Resolve applicable polling, lost-secret, restore, provider-retention and separate source-owned evidence gates in the live E32 queue #4249. In particular, #4303 gates enabling polling, #4307 gates tenant/environment activation, and #4283/#4437 leave restore/provider-copy proof outstanding.
- Obtain an exact operator assignment for integrated Preview conformance S8 #4266, with approved fixtures, scope, access and evidence custody. This checklist grants no provider setting, database, deployment, payment or live-test authority.
Q1–Q16 evidence matrix
For each row, record a synthetic case ID, expected outcome, actual outcome, PASS/FAIL/UNVERIFIED, pinned revision/environment, evidence reference and owner. Run positive and negative cases separately; never infer no-request proof from an empty provider report or infer provider receipt from browser dispatch.
| Trace | Required cases and expected outcome | Required redacted evidence |
|---|---|---|
| Q1 | Explicit granted, denied and unknown use only the published vocabulary. | Schema-valid requests and safe outcome categories; no raw tokens or capabilities. |
| Q2 | Omitted/malformed/unusable signal never grants; commerce still works. | Validation categories, suppressed request counts, commerce-continuation assertion. |
| Q3 | Initial snapshot, reload/re-entry, fresh and failed reads; tenant/environment/host isolation. No cookie/account/newsletter inference. | State/revision/freshness assertions and negative isolation results, no identifiers. |
| Q4 | Bind/reprice/activity cannot extend original cutoff; reload stops at it; successor with/without fresh storefront signal and known inherited denial. Paid alone is not withdrawal. | Relative cutoff timings and predecessor/successor case labels, no private URLs. |
| Q5 | Accepted withdrawal for explicitly addressed originals, delayed old grant and reordering. No hidden cross-device discovery. | Durable decision/revision ordering and separate later-entry outcomes. |
| Q6 | Unknown/denied, grant lapse and withdrawal during tag loading and after load: stop all admitted analytics requests and discard unsent work; no denied-mode pings. | Destination classes and request counts before/after, loading/buffer/lifecycle races. |
| Q7 | Acceptance-to-active-stop ≤30 seconds; denial immediate; stale/delayed reads, blocked browser tasks, failed reads, offline/background and resume. Failed storefront delivery remains pending. | Monotonic elapsed bounds, read freshness and request-stop assertions; distinguish acceptance from click time. |
| Q8 | Newer explicit grant before cutoff restores only a new generation; stale retries and post-cutoff grants cannot revive work. | Ordered outcomes and zero replay/backfill assertions. |
| Q9 | Accepted withdrawal triggers owned-cookie attempt; success/partial/failure, closed page then return, expired original and multiple browsers. Unknown/lapse alone does not trigger cleanup. | Cookie names/presence only where authorized, bounded results and independent suppression proof; W1–W7 below. |
| Q10 | Existing sanitized page/checkout-start/server-confirmed one-time purchase only; grant at occurrence and send, omit unprovable purchase occurrence; ≤30-second in-page wait; no resend after dispatch uncertainty. | Safe payload-field assertions, occurrence/send timing and counts across reload/return/visibility/generation changes. No real orders or values. |
| Q11 | Framework-neutral storefront handoff/update, CSPRNG secret, persistence failure, lost response, same-key retry and changed-body conflict; hosted never receives update secret. | Local adapter fault tests and redacted HTTP outcomes; separate browser CORS conformance. |
| Q12 | Independent environments; Owner/Admin acknowledgement, ID roles, disable, ID clear/change/A→B→A and invalidation; adopted dark never becomes legacy. All-region granted analytics and denied advertising. | Role/status/configuration assertions and ≤30-second stop/entry proof, no setting secrets. |
| Q13 | Scoped authenticated diagnostics, explicit unknown on failure, coarse counts only; no shopper timeline/provider receipt. | Role/tenant tests, safe reason allowlist, per-observation ≤30-day expiry/purge proof. |
| Q14 | API/source/OpenAPI/examples/navigation/search and hosted/tenant disclosure parity; no banner or preference-center promise. | Built-page canonicals, link/example/notice test results and versioned disclosure review. |
| Q15 | iprodigital (Jon) remains accountable Product owner; Engineering/runtime and existing QA ownership stay separate. | Signed ownership/acceptance receipts and any properly routed Product fork. |
| Q16 | All finite inclusions/exclusions, authority gates and unresolved rows have explicit disposition. No expanded surfaces/events, all-tenant adoption requirement or revenue guarantee. | Signed finite closeout referencing this complete matrix; Production approval recorded separately. |
W1–W7 expired-original and cleanup proof
| Trace | Required outcome |
|---|---|
| W1 | Consent/configuration reader is side-effect-free even when commerce is expired: no payment reconciliation, reprice, create/resume, commerce mutation or grant renewal. Compare commerce effects before/after through authorized test instrumentation. |
| W2 | Independently resolved tenant/environment binds the same original primary or already-recognized authorized resume reference. Test wrong tenant/environment, invalid/deleted/revoked/retired/excluded references; no aliases or cross-session search. |
| W3 | Both ordinary hosted entry and neutral unavailable shell reach current cleanup authority; resume refreshes. Unavailable cleanup-only entry mounts no GA, emits no event and reveals no commerce recovery DTO. |
| W4 | Minimal private/noncacheable projection, neutral negative cases, no customer/order/payment/token/hash/secret or lookup-reason disclosure. Error leaves suppression and cleanup unfulfilled, never reports success. |
| W5 | Ten-day return after ordinary expiry/404 can retain I1 obligation while I2 retry receipts have expired. Independent capability validity; legitimate deletion ends addressability, with seven-day post-lifecycle purge and no authority recreation. |
| W6 | Exact owned/reachable-cookie allowlist; partial/failure and repeated/multiple-browser attempts do not clear shared withdrawal or claim all browsers clear. No new browser identity, completion ledger, historical-ID store or retention permission. |
| W7 | Retain the complete positive/negative matrix above plus stale-read ordering, no commerce effects, no unavailable-path requests, I1/I2/receipt separation and selected-B purge/restore proof. A failed required case returns to its proper authority. |
Evidence custody and retention
Retain only I8-permitted synthetic case IDs, code/environment/configuration revisions, safe transitions, elapsed bounds, request counts/classes, redacted assertions and cleanup/deletion outcomes. Engineering/QA access must be authorized. Temporary captures expire within 30 days. Do not capture raw cookies/browser storage, checkout links, update capabilities, credentials, private URLs or real shopper payloads. Existing protected QA receipts and durable signed conclusions remain governed by their own source contracts.
Also prove the I1–I9 inventory: counts ≤30 days, auxiliary retries and post-lifecycle cleanup ≤7 days, new control evidence ≤365 days and necessary recovery copies ≤90 days from capture. Do not invent a fixed-day cap for lifecycle-bound I1/I5 facts or physical deletion of unreachable I4 browser residue. A read filter alone does not prove physical purge, backup age, restore fencing or preserved denial.
Required final S4/S5/S6 comparison
These are S7 closeout dependencies, not prerequisites to drafting the guide. Keep #4265 In PR; do not mark it Done until the final behavior has been compared and discrepancies routed to the owning lane.
- S4 / #4262: compare landed #4472 binding/read schema, entry/unavailable shell coverage, lease/stop timing, exact cleanup instructions and notice wording with the guide. Engineering and the hosted runtime owner supply proof.
- S5 / #4263: compare actual occurrence/send eligibility, bounded wait,
no-backfill behavior, marker names/lifetimes and deduplication with the guide
and
/cookiesinventory. Preserve legacy marker behavior. - S6 / #4264: compare actual environment UI, role/error states, acknowledgement/ID-change/disable semantics, diagnostics, disclosure wording and links with the guide. API semantics alone do not prove UI behavior.
- S7 / #4265: synchronize final documentation and notice-specific checks against those exact landed revisions. Remove pending claims only with evidence; public prose cannot waive a failed contract.
Activation and finite closeout
- Engineering/runtime owners attest the delivered enforcement, event, isolation, lifecycle and browser/network outcomes. API, hosted, admin and docs owners retain their lanes. Product scope/forks/acceptance belong to iprodigital (Jon); Global retains data-policy/restore/provider authority.
- The separately assigned S8 owner records finite Preview conformance and disposition of every required case, with the final public docs/notices and proper authority receipts. Preserve #4027/Asterwyn and EKGIS #229/Tithonia evidence; this matrix does not replace their analytics-continuity work or #2273 and #2509 ownership.
- Only after delivered controls/docs/enforcement and approved conformance may an exact operator authorize platform availability for a named environment. Qualified tenant Owner/Admin adoption/disclosure then targets that same environment, canonical host and attested measurement ID. A new ID requires renewed acknowledgement and applicable validation. No silent legacy migration.
- Production needs separate release/configuration authority and resolution of DR-1828-03 before tag activation. Preview success, a merge, green CI or a measurement ID alone is insufficient.
Finite completion requires the supported integration and this evidence matrix, not every tenant's adoption or equality between GA counts and the order ledger. Additional fields, broader access, longer retention or a weakened outcome return to the appropriate Product/Engineering/Global authority.