B2BEA.org V1 Production Readiness Gap Register

Source of record: RedKey Supabase Studio artifact.

• Project: B2BEA.org Rebuild
• Project ID: a820dd0c-6cef-4133-bfbd-d802fd806e44
• Artifact: production-readiness-gap-register
• Artifact ID: 80328220-3deb-4cf9-a68f-d440b41a38da
• Version: 3
• Status: draft
• Updated: 2026-05-06T20:00:09.174+00:00

V1 means production-ready. Core production capability groups are in scope unless explicitly removed during review.

The internal admin model can stay light because core site changes are handled by Brett, Sarah, and Justin. The site still needs strong production controls around public publishing, external self-service, entitlements, billing, surveys, jobs, learning access, vendor data, company workspaces, auditability, and rollback.

| ID | Topic | Decision | |---|---|---| | DEC-001 | Public practitioner company profiles | Exclude from V1. Company workspace is private only; vendor profiles remain public. | | DEC-002 | Company-created jobs | Require B2BEA admin review before public publishing in V1. | | DEC-003 | Sanity versus Supabase source of truth | Sanity owns editorial/public content. B2BEA Supabase owns application and operational data, including people, company, vendor, membership, course, survey, job, event, analytics, and notification records. | | DEC-004 | Notifications | V1 is email-first with an internal notification event log. In-app notifications are designed for later unless a surface explicitly needs them. | | DEC-005 | CRM source of truth | HubSpot is the primary CRM for leads, pipeline, sales activity, and renewals. B2BEA Supabase owns website profiles and operational entities. | | DEC-006 | Vendor and company analytics exports | V1 allows bounded own-account exports only. No raw platform-wide data, cross-account comparisons, or sensitive user-level data unless explicitly consented and permitted. |

• P0: Blocks production launch or creates unacceptable public, security, or data risk.
• P1: Required for V1 quality; launchable only with a deliberate temporary workaround.
• P2: Important polish or operational maturity after core production flows are stable.

| ID | Domain | Severity | Current State | Production Requirement | Next Artifact | |---|---|---:|---|---|---| | GAP-001 | Design System And UI Contracts | P0 | Lovable-system styles exist as an overlay, but page families still need a hardened reusable contract. | Shared tokens, typography scale, page headers, fields, tables, pills, buttons, cards, states, and responsive rules. | design-system-spec | | GAP-002 | Publishing Model | P0 | Publishing spans Eleventy, Sanity, static pages, and custom landing/resource needs without one documented lifecycle. | Two explicit paths: custom HTML import and Sanity standard page creation, each with owner, preview, publish, archive/rollback, analytics, SEO, and URL behavior. | publishing-model-spec | | GAP-003 | Auth, External Authorization, And Entitlements | P0 | Auth exists and role checks are present, but critical authorization and entitlement behavior needs a target server-side model. | Members, vendors, company admins, employees, and anonymous users have explicit access rules enforced server-side. | permission-lifecycle-matrix | | GAP-004 | Data Ownership And Lifecycle States | P0 | Data is spread across Supabase, Sanity, and

Affected capabilities include SystemRenderEmptyState, SystemRenderErrorState, SystemRenderLoadingState, PublicSearchSite, and AdminViewDashboard.

Missing work:

• Design-system spec.
• Component inventory.
• Page template rules.
• Regression screenshot checklist.

Decision needed: confirm Lovable-system as the target design language and define which home, blog, and resource pages remain exceptions.

Affected capabilities include AdminOpenStudio, AdminCreateArticle, AdminScheduleArticle, AdminPublishArticle, AdminManageContentSEO, and AdminManageRedirects.

Missing work:

• Sanity page schema.
• Custom HTML import spec.
• Preview/publish workflow.
• Redirect and SEO rules.
• Rollback/archive behavior.

Decision: Sanity owns editorial/public content. B2BEA Supabase owns operational/application data.

Affected capabilities include SystemAuthorizeByRole, SystemAuthorizeByEntitlement, PublicGateResourceByMembership, MemberAccessProResources, and CompanyGrantAcademyAccess.

Missing work:

• Role/entitlement matrix.
• Server-side guard pattern.
• Membership, course, and resource entitlement rules.
• Failure states.
• Audit events.

Decision needed: keep internal admin light, but decide external roles for member, pro member, vendor admin, vendor member, company admin, company employee, and author.

Affected capabilities include AdminCreateCompany, AdminCreateVendor, VendorSubmitProfileUpdate, CompanyUpdateCompanyProfile, and AdminPublishOrArchiveJob.

Missing work:

• Canonical entity inventory.
• Supabase/Sanity ownership map.
• Lifecycle state matrix.
• Archive/delete rules.
• Migration plan.

Decision needed: decide source of truth per entity: people, organizations, vendors, pages, articles, courses, surveys, jobs, events, and resources.

Affected capabilities include AdminCreateSurvey, AdminPublishSurvey, PublicTakeSurvey, MemberTakeSurvey, CompanyAssignSurvey, AdminDisplaySurveyData, and AdminExportSurveyResponses.

Missing work:

• Survey schema.
• Question types.
• Audience assignment.
• Response capture.
• Scoring and reporting.
• Export.
• Results display permissions.

Decision needed: decide whether maturity assessment becomes the first survey type or remains a separate special flow.

Affected capabilities include AdminCreateForm, PublicSubmitForm, MemberSubmitForm, VendorSubmitForm, and AdminReviewFormSubmission.

Missing work:

• Form schema.
• Submission model.
• Review queue.
• Assignment/status.
• Spam/rate controls.
• Export.

Decision needed: decide which existing forms should be migrated into the reusable system for V1.

Affected capabilities include CompanyViewWorkspace, CompanyManageEmployeeSeats, CompanyInviteEmployee, CompanyGrantAcademyAccess, CompanyAssignCourseToEmployee, and CompanyViewEntitlements.

Missing work:

• Company roles.
• Seat model.
• Employee invite/remove.
• Academy assignment.
• Career permissions.
• Entitlement display.
• Team analytics.

Decision: public practitioner company profiles are not V1. Company workspace is private only; vendor public profiles remain V1.