Build Milestones (the sequence Claude Code executes)

Phase 0 (03) runs first — always. Before M0, study the owner's existing projects (Mongo AI/RAG, GCP footprint, reusable libraries), produce the Reuse Ledger, and re-validate the 00 decisions. M0 scope shrinks by whatever Phase 0 marks "reuse"; M0 does not start until the owner signs off the ledger.

Vertical slices, in priority order. Each milestone is end-to-end shippable (UI → API → data → infra), not a horizontal layer. Build M0 fully before M1. The first customer/use case (decide it — see 00 Decisions Register Q8) drives M0's concrete data.

Phase 0 — Discover & reuse (prerequisite, not a code milestone)

• Gather reference repos / GCP access / Mongo system docs (03).
• Produce the Reuse Ledger + decision deltas; owner signs off.
• Exit: every M0 capability below is marked build / reuse / adapt, and 00's provisional decisions are confirmed or amended.

M0 — Walking skeleton (one tenant, one source, grounded chat)

The proof the whole spine works for a single tenant.

• Monorepo scaffold (00 layout); CI green (build + lint + unit).
• Terraform modules/tenant provisions one tenant: Cloud Run + Cloud SQL PG16 + (Mongo Atlas or pgvector per 11) + GCS + Secret Manager/KMS + VPC. (50, 51)
• Real auth: per-tenant SSO/OIDC, JWT minting with tid/role/cell claims, the request→RLS-context bridge. (40)
• Canonical schema + RLS policies migrated; Source/Observation/Entity/Event CRUD. (20, 82)
• One source ingestor: fetch→normalize→sign→write; deterministic resolution inline. (20, 21)
• RAG index for that source's docs; the analyst chat end-to-end: retrieve→assemble→Claude (server-side, SSE)→citation validation. (31, 32, 80)
• Productionized frontend shell with the chat wired to api (rip out window.claude.complete). (70)
• Exit: sign in as a tenant user, ask a question, get a grounded, citation-checked answer over real ingested data.

M1 — Resolution & the canonical depth

• Probabilistic resolution (async via outbox) + the MERGE-REVIEW queue UI. (21)
• Event derivation; AsOf time-travel; supersedence/corrections. (20)
• More sources onboarded via the Ontology Agent path. (30)

M2 — Investigation surface

• Cases (bind events+entities), Reports (draft) + the privileged publish gate (Q8). (41, 60)
• Entity Inspector, the Explore map.
• Pattern-of-Life baselines + the Entity Network graph (if those product specs exist — confirm).

M3 — Control plane & fleet provisioning

• The control-plane service + insigz Control productionized. (62)
• Provisioning orchestrator (Cloud Workflows) driving Terraform + insigzctl, with the idempotency/rollback contract. (51, 83)
• Billing/finance, observability (per-tenant), audit, RBAC, break-glass token flow. (53, 62, 83)
• Release management: per-tenant version pinning, expand→migrate→contract rollouts. (52)

M4 — Autonomy & wargame

• Standing Watches → Proposal Inbox → Trust Evals (Q10). (30, product §13)
• Wargame: sessions, cells, Adjudicator/Inject/After-Action agents, AAR. (product §7)

Cross-cutting (every milestone, not a phase)

• Security scanning gates in CI from M0 (SAST/SCA/secret/container/IaC). (44, 52)
• Per-tenant observability + audit from M0. (53)
• Cross-tenant negative tests in CI from the moment a second tenant can exist. (43)

Gaps to close

• Pin the M0 customer/use case (e.g. Baltic Maritime → AIS ingest + vessel resolution + grounded chat).
• Confirm which M2/M4 product specs (§13/§16/§17, Entity Network, Pattern-of-Life) exist vs. need authoring.