# California Foundation Grants — post-launch status addendum

**Updated 2026-10-11. Applies to release ca-foundation-grants-ty2022-2024-2026-09-r3b.**

This dataset was published with the owner’s launch approval on 2026-10-11, after the independent external-AI review recorded a **PASS on its agreed bounded audit scope**. The r3b package is published unchanged; the independent audit is closed. A passing bounded audit is not a full-population accuracy or privacy certification and is not an independent human audit.

The original QA_CERTIFICATION.md inside the frozen release ZIP was written before publication. Its opening **CANDIDATE / NOT CERTIFIED FOR PUBLIC RELEASE** label and its “NOT DONE” storage/checkout gate reflect that *earlier point in time*, not the current publication status. The original wording is preserved below, rather than silently rewriting the independently reviewed archive.

## Launch verification and remaining gaps

- Public catalog and product page: published on Vercel from commit 789dad66e5fcd64a424de414e1e478cdf4be3dcd (PR #74).
- Private paid ZIP: uploaded and verified as part of the launch; it is the frozen 24-file, 81.5 MB release.
- Both live Stripe checkout tiers: preflight PASS (US$79 Individual and US$199 Business); mandatory license checkbox configured to fail closed.
- **A completed real-money payment, webhook, and downstream fulfillment/download have not been end-to-end tested.** Checkout preflight is not fulfillment verification.
- Owner-approved publication is documented, but a **separate owner privacy sign-off was not independently documented** in the archived certification; do not infer one from publication approval.
- The early independent pilot-validation gate remains **MISSED** and must not be retroactively marked PASS.
- Source-use / redistribution advice from counsel remains **NOT OBTAINED**; no legal opinion is claimed.

This page adds only later operational context and corrections to buyer-facing presentation. It neither modifies source data nor changes the prior independent audit findings.

---

# Archived pre-launch QA certification (verbatim)

# Release QA certification - ca-foundation-grants-ty2022-2024-2026-09-r3b

**Status: CANDIDATE. NOT CERTIFIED FOR PUBLIC RELEASE.** Engineering and privacy-review layers pass; release gates remain open (below). This file must be regenerated with the gate results before the product is published.

## The four quality layers (kept separate)
| Layer | Result | Evidence |
| --- | --- | --- |
| 1. Structural / schema QA | PASS | Data dictionary matches every file header; CSV and Excel agree row for row and dollar for dollar; unique grant IDs; no e-mail, SSN or street-address-like name problems (formula-leading text is stored as text in Excel) |
| 2. Reconciliation / internal consistency | PASS with documented exceptions | 23,453 operative filings reconcile to the filer's Part XV total; 398 Part-I-only; 3 filer-internal mismatches; accounting identity holds in all operative filings |
| 3. External factual verification | PASS (independent audit, bounded) | Source-faithfulness: 991 raw XML files re-read independently (hash, count, sum), 323 lines compared field by field, two independent parsers agree, 28 gold filings. Independent external audit by a different provider (2026-10-11): all 10 extraction records and 6 duplicate/amendment groups verified against the IRS XML (16 of 16 PASS), 60 supplemental records matched their XML; release r3b at commit aca6729 PASSED the agreed bounded audit after remediation of r3 |
| 4. Provenance / evidence | PASS | Each filing carries source ZIP URL, member path, XML SHA-256 and zip CRC-32; each grant carries its filing object ID and row number; classification reason is recorded per line |

## Privacy review (recipient classes)
Stratified manual reviews by the building agent, in four rounds. Round 1: 131 lines of the old lower-confidence class (3 individuals found; rules fixed; 972 paid lines moved to withheld). Round 2: a fresh 130 (0 found), 70 high-confidence lines (0), 60 withheld individual lines (58 correct), 74 withheld ambiguous lines (about half were organizations). Round 3 (this release): all lower-confidence lines were withheld unless independent evidence exists (IRS Business Master File match); 60 BMF-matched person-pattern names reviewed (0 individuals); 120 random released lines reviewed (1 individual found, rule added, 3 lines moved). Personal names in free text are masked. Round 4 (r3, bounded): 150 restored lines (1 individual: K-1 payee, rule added), 100 person-looking names relying on status only (1 probable individual: crowd-funding campaign, rule added), 60 held-out lines (most were organizations), 45 masked rows and 30 memorial purposes inspected (FBO masking was hiding fiscally sponsored project names; fixed). This is a self-review by the manufacturer and is not independent.

## Release gates
| Gate | State |
| --- | --- |
| Independent external-AI audit (blind stratified records, different provider) | **PASS** for `r3b` (bounded audit closed 2026-10-11). History: r3 FAILED (aggregate placeholder released as a named recipient, a half-masked name); r3a fixed those; r3b corrected two further items (short names wrongly treated as aggregates, a malformed masked text). The auditor's passing scope was the agreed bounded set (source extraction and duplicates, the confirmed defects and their fixes, the targeted corrections); it was not a full-population audit and does not certify that no individual appears in the released lines |
| Early independent factual-validation gate (pilot given to an independent auditor before scaling) | MISSED, and it stays missed: the audit that passed was run after full manufacturing, not before scaling. The pilot was not audited by an independent provider before full manufacturing. This is recorded as a process miss and is not claimed retroactively; the external audit above is therefore a first independent look at the field-level contract, not a confirmatory one, and a new systematic finding there would be treated as a certification failure |
| Owner privacy review and sign-off | PENDING |
| Source-use / redistribution view from counsel | NOT OBTAINED. IRS content-use policy retrieved (covers government-created content, not submitted returns); no license for submitted return content found; see PRIVACY_AND_SOURCE_USE.md |
| Private-storage delivery, deterministic package and registry wiring; checkout | NOT DONE by instruction. Checkout is not enabled |

## Determinism
Two independent full builds (10 and 7 shards) produce identical merged tables and population list (SHA-256 in `QUALITY_REPORT.md`). The release assembly step was run repeatedly with identical CSV output. The Excel workbook is generated from the CSV files and is not byte-for-byte reproducible (the Excel container embeds timestamps); the CSV files are the canonical bytes and the workbook is checked to agree with them in rows and dollars.