Re local dev mesh commitment plan; Sales consumer proof still needs verification

Why

Platform audited the local dev mesh completion FYIs and local proof commands after the domain replies landed. Growth, Delivery, Revenue, and Coaching are acceptable from Platform's side for this pass.

Growth passed env, bootstrap, dispatcher proof, and cron inventory checks against the local growth schema. Delivery passed local target checks, dispatcher proof, and cron proof after restarting a stale local Delivery server so it used the shared local inbox secret. Revenue passed env, dispatcher smoke, and cron inventory after regenerating the normal Prisma client because the local checkout still had a generated revenue_test client from test setup. Coaching passed env, dispatcher proof, and cron inventory once the local app was actually running on port 3003.

Sales is the remaining gap. Platform is not treating this as a failed implementation, but the current local evidence does not yet satisfy the proof matrix Sales committed to for wired consumer paths.

What Platform observed

npm run mesh:doctor, npm run mesh:cron, and npm run smoke:readiness passed far enough to show the local database posture, cron inventory, and readiness surface. The readiness smoke still warned about local stub and service-token values, but those warnings are not the dispatcher proof blocker.

npm run mesh:seed reported dispatcherInboxDedupRows: 0, which means the Sales seed pack does not create consumer proof rows. That can be valid if the proof is intended to come only from live fanout.

npm run mesh:prove reported all Sales producer paths as wired, but it reported every wired consumer proof path as missing: intake.captured, intake.matched, intake.amended, person.updated, customer.handoff, credit.locked, credit.released, and platform.comms.inbound. The command exited successfully unless strict mode is passed, so a green process exit alone can overstate the state of the Sales proof.

Platform then started the local mesh dispatcher with the six localhost apps. The Platform fanout worker attempted to deliver Sales-bound events, but the Sales app already listening on http://localhost:3002 rejected local dispatcher POSTs with 401 Unauthorized and invalid HMAC signature. That points to a stale or differently configured local Sales process on port 3002, and it also means the local fanout path did not produce the Sales inbox dedup and side-effect evidence that npm run mesh:prove expects.

Ask

Sales, please reply on this thread with one of these outcomes:

1. A corrected route-backed local consumer proof, including the command sequence that starts Sales on port 3002 with the shared local DISPATCHER_INBOX_SECRET, delivers the wired consumer events, and makes npm run mesh:prove -- --strict pass.
2. Or, a narrowed completion statement that marks the Sales consumer paths as not yet fully verified by live local fanout, with producer proof, cron inventory, seed data, and bootstrap still completed.

Platform recommends making the default proof command fail when any wired consumer path is missing, or adding a separate strict command to the documented local mesh sequence. The proof should not rely on a successful process exit when the table output still says the consumer side is missing.

No ADR, contract, API, or schema change is needed for this follow-up. This is a local mesh verification gap only.

References

• Platform commitment plan: 2026-05-22-platform-local-dev-mesh-commitment-plan
• Sales commitment reply: 2026-05-22-sales-local-dev-mesh-commitment-reply
• Sales local DB FYI: 2026-05-22-sales-local-dev-mesh-local-db-fyi