---
description: Stream W: go-live readiness (legal pages, the lazy chunks gated, an app-only env file, the unauthenticated sweep as a script, the production edge checklist, the two carried corrections); nothing touches production
---

You are running **Stream W** of the Duty Free Professor build, as an autonomous session while
rian is away. Start by running `pwd`; it must be `/srv/apps/dutyfreeprofessor`, or stop. This is
a wave-two lane: start it only when one of R2, M or G has written its final handoff, and never
as a fourth session (three at once is the ceiling).

Read first, in this order: `.logs/planning/streams/OVERNIGHT-RULES.md` (binding),
`.logs/planning/streams/AWAY-PLAN.md` sections 2 and 3, then your brief
`.logs/planning/streams/W-readiness.md` (it names what already exists; build on it),
`agents.md`, `brief.md`, `main/docs/ACCOUNTS.md`, `main/docs/RUNBOOK.md` (Production and
Members-only), `main/app/services/access.py` in full, `/srv/CLAUDE.md` "What to check" (the
security checklist W3 answers), `python3 main/scripts/items.py list --decisions`, and the top
three entries of `.logs/handoff.md`.

Then work the brief's tasks in order, W1 to W6, one at a time, each verified and committed and
recorded on `/plan` with `main/scripts/plan-set.py` (`doing` when you start, `done` with a
`--note` that says what proves it, `blocked` with why). Delegate mechanical drafting (the legal
pages' first draft from the brief's list of facts, the checklist's formatting) to a cheaper
model and read every word yourself before it lands; never delegate the security review, the
access rule, or the sweep's classification. Other lanes may be in the tree: their columns are
under Must not touch in your brief; a need in their files is an issue on the running list,
never an edit.

**Nothing in this session touches production.** No deploy, no migration, no edge change, no
key minted, no secret read or printed. `docker-compose.yml` is edited only for W3, after the
security review is written into your handoff, and `srv-gw security-audit` runs after the edit.

The one outcome that matters: when you are done, go-live day is a checklist rian can run top to
bottom in an hour, with the legal pages up, the client pages' copy behind the session, the
secrets split, and a script that proves the internal set is closed.

## Goal, and exactly when you are done

**Goal:** the three legal pages, the lazy chunks gated, the app-only env file staged and
audited, the sweep script, the edge checklist, and the two carried corrections, to the
verified-and-committed standard.

**You are done when ALL of the following are true**, and not before:
1. Every one of these task ids in `import/progress.json` is `done`, or is `blocked` with a
   note saying why: **W1, W2, W3, W4, W5, W6**. (Check with `python3 -c "import json;d=json.load(open('import/progress.json'));print({t['id']:t['status'] for s in d['streams'] for t in s['tasks'] if t['id'] in ['W1','W2','W3','W4','W5','W6']})"`.)
2. `../.venv-dev/bin/pytest tests -q` passes and `main/check.sh` prints "checks passed" on the
   current tree.
3. Every finished task has its own commit prefixed `W:` (`git log --oneline | grep "^[0-9a-f]* W:"`).
4. A handoff entry for this session exists at the top of `.logs/handoff.md` (≤25 lines: what
   landed and how it was verified, the security review's answers and the audit verdict, the
   sweep's output location, what rian runs after the deploy in order, what is blocked and why),
   and `/checkpoint` has been run.
5. Anything only rian can decide is on the running list (`python3 main/scripts/items.py add
   --kind decide --by "Stream W" --blocks <task> --weight ...`) with the assumption you proceeded
   under; the issues W1, W3 and W6 close are resolved there with the commit as the note.
6. `git status` shows no change to `.env`, `.app.env` or `.bw-auth.env`, and no rehearsal
   database, local server or `main/static` symlink remains.

A task you cannot finish is not a reason to keep going or to stop early: mark it `blocked`
with the reason, record the decision if one is needed, and move to the next. If all tasks
are done or blocked, finish steps 2 to 6 and stop. If eight hours have passed, mark every
unfinished task `blocked` with the note "eight-hour cap; resume with /stream-w", write the
handoff, run `/checkpoint`, and stop.

## The goal line (rian pastes this after the first turn ends)
Start the session with `/stream-w`. When that first turn ends, paste this one line:

```
/goal Stream W of the Duty Free Professor build is complete: in import/progress.json every one of the task ids W1, W2, W3, W4, W5, W6 has status done, or blocked with a note saying why; main/check.sh has printed "checks passed" on the final tree; every finished task has its own commit prefixed "W:"; a handoff entry for this session is at the top of .logs/handoff.md carrying the security review and the audit verdict, and /checkpoint has been run; anything only rian can decide has been added to the running list with main/scripts/items.py; nothing was deployed and nothing on production was changed. Or stop after 100 turns.
```