# What you can do

Run Oncall locally or host it in your own Cloudflare account and finish setup; add team members and services with runbooks; see who is on call now and next, create named-zone rotations and overrides, and download a private ICS feed. Declare an incident, record notes and decisions, follow its runbook, assign follow-ups and complete a review. Record monitoring alerts, route and replay them, preview an Opsgenie or PagerDuty move-in, and explicitly adopt reviewed schedules. Sign in by owner email link or an admin-created member's installation-local workspace name and password on the local or hosted app, then export and restore local installation data without transferring credentials.

Release 1 supports hosted incident coordination alongside your existing pager. Paging stays OFF; an independent standby is not required for coordination. Release 2 paging and its independent standby are not built.

## Maintained verification flows

The flows below are acceptance requirements and verification entrypoints. Passing evidence must name the exact commit and actual command result; this document alone records no new passing run. `rer verify` invokes the maintained local journeys. Local verification does not prove live mail delivery or hosted account operations; no paging or standby acceptance is claimed.

1. OC-001–010: emitted HTTP coordination journey preserves event identity/generation, routing replay, roles/revocation, incident transitions, copied runbooks/follow-ups, strict atomic archive restore and visible failures. Existing held flow is retained in tests/runtime.mjs.
2. OC-011,014,020: tests/activation.mjs exercises named-zone DST turns, exact hand-off and override endpoints, overlap refusal, unavailable member gaps, now/next, authenticated ICS and escalation configuration through HTTP.
3. OC-012–015: delivery/timer/resume/callback paths refuse; intake records an event with no receipt/send; held module archives remain historical and restore pending timers paused.
4. OC-016–017: tests/activation.mjs exercises the recovery checkpoint and reviewed-handoff requirements through the emitted Worker, D1 and the private handoff CLI. The test file names each OC-016/OC-017 requirement it proves.
5. OC-018: command check/describe, install/setup/build/preview/reset/export/import/deploy dry-run, owner sign-in, dev identity and theme; Hosted acceptance exercises an ordinary emailed sign-in link independently of local dev identity.
6. OC-019: tests/runtime.mjs seeds the actual held one-row SQL fixture before migrations, upgrades, signs in using its held password and compares the full state over HTTP; repeated migration is idempotent.
7. OC-021–022: tests/activation.mjs tests both documented-shape fixtures, zero-write preview, rejected-rule accounting, paused apply, authorization, review mismatch, malformed/credential input, atomic rollback, restart/resume, idempotence and undo preserving native edits.
8. tests/activation-browser.mjs runs setup/dev identity and real keyboard-only incident declaration, notes, acknowledgement, schedule/override/preview at 1440 and 390 from committed HEAD in a fresh clone. It captures visible focus, checks literal hostile HTML, and causes a real HTTP stale-revision rejection from a second session: the alert announces failure, no saved claim appears, and server state is unchanged. Existing pointer move-in/replay and overflow checks remain. Screenshot output is copied outside the checkout to `../evidence/browser` (or `ONCALL_BROWSER_EVIDENCE`). Acceptance requires the passing run and inspection of its screenshots.

Public landing requires Base's publication scan on the exact tree before each push with zero findings, and the public repository's **Oncall verification** CI green on the exact merged head. Fetch and rebase immediately before a fast-forward-only push. These publication and CI requirements are independent of local journeys; they do not establish hosted readiness.

OC-018 uses the exact published `rer` version pinned in package.json (currently 0.2.27) and the effects declared in `OPERATIONS.json`. Local dev and preview bind loopback; hosted coordination serves protected application APIs at the deployed HTTPS origin. A successful local dry-run does not establish hosted readiness.

Release 1 hosted acceptance requires actual `rer deploy` success, `/health` matching the deployed source/version, automatic owner claim and setup-token retirement, configured remote-mail owner sign-in, administrator-created member password sign-in at `/signin/local`, protected incident coordination and persistent schedule/incident data after reload. Confirm that paging still refuses. Removal acceptance uses the same Cloudflare credentials and `rer deploy --remove --yes`, then empty readback for every recorded Worker, database and queue. Record actual results separately; this document does not assert these checks have passed.

Obsolete synthetic-dispatch tests and the drill UI are removed because sending is no longer an accepted flow. Pure domain pin/structure tests are replaced by emitted public-flow proof; removal does not relax the preserved incident, archive or import guarantees.