@@ -50,6 +50,7 @@ Never mark a gate `Passed` without its approved SHA, deployment disposition, evi
 | Phase 5c: all-allowlisted 24-hour gate | Not started | Pending | Pending | Pending | Pending | Canary operator |
 | Phase 6: rollout closeout | Not started | Pending | Pending | Pending | Pending | Release operator |
 | Side surface: authed MCP server + account/pairing dashboard | In progress | `mcp-4-dashboard-pairing` HEAD `00a6cf1` (local branch, not yet pushed/merged) | **Deployed `2026-07-31`, version `f334a2c8-c158-458f-a230-26bab95e79ea`** on account `056cbaa6…`. Applied migrations `v3` (`AccountDirectory`) + `v4` (`UnderstudyMcp`, `AccountAgent`); bound `MCP_AGENT`/`ACCOUNT`/`ACCOUNT_DIRECTORY`/`OAUTH_KV` (`920a2498…`)/`EMAIL`; secret `VAULT_UPLOAD_PRIVATE_KEY` set (sha256 prefix `150c0c6a…`). Both allowlists `["metamind", "prefix:acct-"]`. **This deploy reset the Phase 3b soak clock** (see the soak section) | Built green pre-deploy: backend 307 tests + extension 145 + build + `wrangler deploy --dry-run`; all three quality-gate lanes + `/security-review` passed (twice). Post-deploy live smoke against `understudy.proofof.tech`: `/health` → `{"ok":true}`; RFC 8414 + RFC 9728 metadata correct (S256, scopes `["mcp"]`, resource `.../mcp`); `POST /mcp` initialize with no bearer → `401` with the `resource_metadata` WWW-Authenticate pointer (the OAuth handshake's first exchange); DCR `/oauth/register` → `201` client_id; `/dashboard` → `200` sign-in page, `no-store` + nonce CSP. The full **authed** handshake (DCR→consent→PKCE→`tools/list` of 14 tools, and the `usk_` path) is proven in the workers-pool suite against identical code; live it needs a human to complete the emailed OTP, so only the unauthenticated discovery handshake was exercised live. Additive only — per-command path, `/v1` API, and soak-owned device/lease behavior unchanged. **Superseded: this version's dashboard was write-dead — every POST, sign-in included, returned `403 cross-origin request refused`. See "The dashboard refused its own POSTs (2026-07-31)". The smoke recorded here missed it because its only dashboard-plane request was `GET /dashboard`. **Fixed and deployed `2026-07-31`, version `dc9c378e-6e6b-416b-b7ef-038411bc4ae5`** (commit `56ed00a` on `dev`); post-deploy smoke: `/health` ok, admit probe `200` with the code page, refuse probe `403` (the discriminator — pre-fix answers `200`), `Referrer-Policy: same-origin` served, plaintext well-known now `308`s, and a real Chrome 150 form POST captured over CDP returns `200` with `origin: https://understudy.proofof.tech` + `sec-fetch-site: same-origin`** | `2026-07-31` | Engineering |
+| Side surface: Chrome Web Store beta privacy prerequisite | Passed | `76f1ec9cbae3d0c0ce6f2430175a6efb9e9ca239` | Deployment `b69d9a87-72f1-4175-8237-9dc062f61cad`, version `13159f32-e3a2-4370-902d-68a6d5347786` at 100%, message `release 76f1ec9cbae3d0c0ce6f2430175a6efb9e9ca239 - add Understudy Beta privacy page` | Reviewed store ZIP SHA-256 `1a1bf97744fa24ca00e8b31b722d18e291f383dc8d174c98d888a67fd1a4cabe`; full typecheck and 560-test suite passed; all three independent review lanes clean. Wrangler dry run passed. Live custom-domain smoke: `/health`, `/dashboard`, and `/privacy` returned `200`; privacy served `Cache-Control: no-store` and nonce CSP; admitted same-origin auth POST returned `200`; equivalent cross-site POST returned `403` | `2026-07-31T09:33:01Z` | Engineering |
 
 ## Unplanned Phase 1b deployment (2026-07-28)