route-commerce/docs/qa/audit-2026-06-26/PROMISE-AUDIT.md

Customer-Facing Promise Audit — Route Commerce

Date: 2026-06-26 Scope: Every promise the product makes to customers across marketing, documentation, public UI, and "AI answers" (admin copy that talks to the user in product voice). Includes pricing, security, changelog, roadmap, landing hero/stats, FAQ copy, product descriptions, and LAUNCH_CHECKLIST.md.

Method: Walked every customer-touching surface in the repo. For each distinct promise, captured (a) the exact copy, (b) the file/line, and (c) the strongest evidence — code, schema, docs, or absence of evidence — underneath. Then assigned one label per the user contract.

Labels used

Label	Meaning
PROVEN	Code/schema/docs substantiate the claim today.
PARTLY PROVEN	Substantially true but with caveats; copy overstates one detail.
MISLEADING	The headline reads true but the fine print is materially wrong, or the framing suggests a stronger guarantee than reality.
UNSUPPORTED	No code, schema, audit, contract, or credential backs the claim.
OUTDATED	Was true at one point, no longer true.
MISSING EVIDENCE	Need a human or system to confirm before we can label.

---

1. Landing & marketing surfaces

1.1 Landing hero stats — src/components/landing/HeroSection.tsx:48

{ stat: "500+",  label: "Farm Brands" }
{ stat: "98%",   label: "On-Time" }
{ stat: "50K+",  label: "Deliveries" }

Plus STAT_COUNTERS (HeroSection.tsx:84):

500   "Produce Brands"
50K   "Orders Delivered"
98%   "On-Time Delivery"
$2M+  "Weekly Sales"

Evidence: None. No customers in tree, no DB row count, no integration that surfaces live numbers. The pricing-assessment doc (docs/pricing-assessment.md:79) already flags this: "Landing-page stats are aspirational, not real. The working tree has no customers; this is a marketing claim that could trip up B2B buyers doing due diligence. Either back it with real numbers or remove it."

Label: UNSUPPORTED (high-risk: B2B due-diligence exposure). Fix rank: #1.

1.2 Landing feature copy — HeroSection.tsx:53–98

Promise	Evidence	Label
"Showcase seasonal produce with rich media galleries and real-time availability updates"	No realtime subscriptions on storefront. supabase is mentioned in indian-river-direct/page.tsx for brand lookup, but product availability is a fresh fetch.	MISLEADING
"Optimize delivery routes with intelligent mapping and real-time scheduling"	src/app/api/ai/route-optimizer/route.ts exists but is gated on admin user + AI provider key. No live routing on the storefront.	PARTLY PROVEN (admin-only)
"Track orders from placement through delivery with automated status updates"	No delivery tracking. Order status is admin-set.	UNSUPPORTED
"Give buyers a dedicated space to browse pricing and place bulk orders"	Wholesale portal exists.	PROVEN
"Send email and SMS campaigns about seasonal availability and new harvests"	Harvest Reach exists for admin.	PROVEN (admin surface)
"Uncover sales trends and operational insights with real-time dashboards"	Reports dashboard exists; not realtime.	PARTLY PROVEN

1.3 Pricing page — src/app/pricing/PricingClientPage.tsx

Promise	Evidence	Label
AggregateRating in JSON-LD 4.9 / 12 reviews (src/app/page.tsx:55)	Inline comment: // Placeholder — replace with real review data once collected.	UNSUPPORTED (fabricated rating published as structured data; Google could surface it).
"Marcus T., Fresh Fields Farm" / "Sandra K., Pacific Produce Co-op" / "James R., Gulf Coast Distribution" testimonials (PricingClientPage.tsx:54–58)	No source. Names are made up.	MISLEADING (named-person testimonials with no consent)
"Harvest Reach alone paid for the subscription. Our pickup rate went from 70% to 94% in two months."	No source.	UNSUPPORTED (specific metric, no customer)
"Every new account starts on the Starter plan. … No credit card required to start." (FAQ line 24)	Waitlist page (line 103) contradicts: "Early access members get 30 days free on any plan." No self-serve signup exists; brands are seeded by scripts/provision-admin.ts.	MISLEADING (conflicting free-trial claims)
"Enterprise customers can pay by invoice" (FAQ line 32)	pricing.ts prices Enterprise at $399/mo; stripe-billing.ts has annual=0 (Custom); the FAQ says invoice. None of these match the public pricing card.	MISLEADING (internal pricing model is inconsistent with public copy)
"Add-ons are available on any plan. … billed proportionally when added mid-cycle."	No proportional-billing code path in src/actions/billing/. Stripe proration is on but the proportional UI copy implies a feature we haven't built.	PARTLY PROVEN
Save 25% with annual (line 160)	pricing.ts shows: Starter annual 441 = 49×12×0.75 ✓; Farm 1341 = 149×12×0.75 ✓; Enterprise 3591 = 399×12×0.75 ✓. But stripe-billing.ts:34 shows Farm annual = $1,522.80 (15% off). Two sources of truth disagree.	MISLEADING (internal inconsistency; one of the two is wrong)
"Dedicated SLA" (Enterprise feature)	No SLA document, no sla_* table or RPC, no uptime monitoring integration.	UNSUPPORTED
"Priority support" (Farm)	No support tier system, no SLA, no escalation path.	UNSUPPORTED
Compare table "AI Intelligence Pack" Enterprise-only	Roadmap / pricing says Farm has Harvest Reach but not AI. Pricing page mirrors that.	PROVEN (consistent)
Compare table "Multi-location Support" — not actually in the table (referenced on roadmap only)	n/a	n/a

1.4 Pricing JSON-LD — src/app/page.tsx

offers: { lowPrice: 49, highPrice: 399, ... }
priceSpecification: [ {Starter 49}, {Farm 149}, {Enterprise 399} ]

CLAUDE.md (the canonical reference) says Enterprise is "Custom" pricing. Label: MISLEADING. The structured-data layer is publishing a price that the platform says is custom. This is the kind of thing that surfaces in Google search snippets and creates procurement friction.

1.5 Waitlist — src/app/waitlist/page.tsx

Promise	Evidence	Label
"Join 500+ farms on the waitlist" / "12+ States Covered" / "Q2 Launch Target"	Hard-coded copy. No waitlist row count.	UNSUPPORTED (three different numbers, all made up)
"I've been waiting for a platform like this. The wholesale portal alone will save us hours every week." — Maria S., Sunny Acres Farm	No source.	UNSUPPORTED
"Yes! Early access members get 30 days free on any plan."	No billing code grants this.	UNSUPPORTED
"Full access to all features including products, orders, stops management, and communications."	Waitlist → /api/waitlist writes a row. Does NOT auto-create a tenant.	MISLEADING

1.6 Indian River Direct landing — src/app/indian-river-direct/page.tsx

TESTIMONIALS = [
  { name: "Linda Hurlbut", text: "I finally got my grapefruit from you today..." },
  { name: "Phil Myers",   text: "I just wanted to comment on the citrus I received..." },
  { name: "Bill Prue",    text: "I would just like to say how pleased we are..." }
]

Evidence: These are real customer quotes from the brand owner's email archive (different file than the pricing page). Label: PROVEN for IRD-specific surface; isolated risk.

---

2. Pricing & billing internal consistency

2.1 Two pricing sources of truth

src/lib/pricing.ts (marketing UI):

Farm annual = $1,341  (25% off)
Enterprise annual = $3,591 (25% off)

src/lib/stripe-billing.ts (Stripe checkout logic):

Farm annual = $1,522.80  (15% off)  ← src/lib/stripe-billing.ts:67
Enterprise annual = $0  (Custom)     ← src/lib/stripe-billing.ts:82

Label: MISLEADING — the marketing UI cannot be trusted to match what the checkout will charge. Fix rank: #2 (after landing stats, since this can cost real money).

2.2 Feature flags display

src/lib/feature-flags.ts:59 shows wholesale_portal: "Contact us" and ai_tools: "OpenAI API required", but pricing.ts prices them at $99 and $59.

Label: MISLEADING (the add-on tile says "Contact us" while the pricing card says "$99/mo"). Same item, two prices.

2.3 Add-on Stripe env-var mismatch

src/actions/billing/stripe-checkout.ts:19 reads STRIPE_PRICE_WATER_LOG. pricing.ts and stripe-billing.ts agree on price. But stripe-billing.ts:154 also defines _annual price IDs that are never used.

Label: PARTLY PROVEN (works for monthly, but annual is not actually wired in any Stripe price env var the docs mention). Fix rank: lower.

---

3. Security page — src/app/security/page.tsx

Promise	Evidence	Label
"SOC 2 Compliant — Our infrastructure meets SOC 2 Type II standards for security, availability, and confidentiality."	No SOC 2 report, no auditor name, no compliance-trust URL.	UNSUPPORTED (high-risk; this is a regulatory/compliance claim).
"We conduct quarterly penetration tests and annual security audits with certified third parties."	No pentest repo, no audit report, no scheduled task.	UNSUPPORTED
"99.9% Uptime SLA — Enterprise plan customers receive a 99.9% uptime guarantee with 24/7 monitoring."	No SLA doc, no sla_* table, no monitoring integration beyond Vercel's defaults.	UNSUPPORTED
"GDPR & CCPA Compliant"	src/app/privacy-policy/page.tsx exists but does not include DPA, SCCs, or data-residency clauses.	PARTLY PROVEN (privacy page exists; compliance posture unverified)
"Supabase Auth provides secure, compliant authentication with 2FA support." (line 69)	Auth was migrated to Neon Auth (src/lib/auth.ts), and 2FA is not enabled in the Better Auth config.	OUTDATED + UNSUPPORTED (both — wrong product AND no 2FA)
"SSL Secured" / "SOC 2 Compliant" / "GDPR Ready" / "PCI Compliant" trust badges (line 47)	Same SOC 2 / PCI issue.	UNSUPPORTED
"Stripe — PCI-compliant payment processing" (line 178)	Stripe IS PCI DSS Level 1; we inherit it. PROVEN for Stripe's posture.	PROVEN (when scoped to Stripe's posture, not our own)
"Vercel — Edge network with automatic DDoS protection and global CDN" (line 168)	Vercel does provide this.	PROVEN (when scoped to Vercel's posture)
"Supabase — PostgreSQL database with built-in encryption and real-time capabilities" (line 173)	DB is now Neon Postgres direct via pg, not Supabase.	OUTDATED
"256-bit SSL encryption" / "PCI DSS Level 1 compliant" / "Advanced fraud detection" / "Secure card tokenization"	All Stripe attributes, true when scoped to Stripe.	PROVEN (Stripe-scoped)
mailto:security@routecommerce.com for vulnerability reports	Inbox unverifiable from repo.	MISSING EVIDENCE (need to confirm mailbox monitored)

---

4. Changelog — src/app/changelog/page.tsx

Version	Promise	Evidence	Label
2.4.0 (2025-01-15) "Harvest Reach Email Campaigns — …templates, scheduling, and analytics"	Templates, scheduling, analytics all in code.	PROVEN
2.3.0 "Square Inventory Sync"	Settings UI + square_to_rc / rc_to_square / bidirectional modes in SquareSyncSettingsClient.tsx:443.	PROVEN (UI exists; cron at /api/square/process-queue is wired in vercel.json).
2.2.2 "Dashboard now loads 40% faster"	No benchmark in tree.	UNSUPPORTED (specific perf claim with no measurement)
2.2.1 "Order Export Fix"	Generic bug-fix entry.	MISSING EVIDENCE (cannot verify without git blame)
2.2.0 "AI Intelligence Pack — Campaign Writer, Pricing Advisor, Demand Forecasting. Available on Enterprise plan."	All 8 AI endpoints exist (/api/ai/*); all gated on getAIClient(brandId) returning a client. Requires brand to have an AI provider key configured.	PARTLY PROVEN (works only when brand has configured an API key — defaults to OpenAI which is BYO key, not "included in Enterprise")
2.1.0 "Water Log Module"	Module exists at /admin/water-log and /water; schema documented in docs/water-log.md.	PROVEN
2.0.0 "New Admin Dashboard"	v2 routes under /admin/v2/*.	PROVEN
1.9.0 (2024-10-30) "Two-Factor Authentication"	No TOTP/2FA in src/lib/auth.ts or src/auth.config.ts. Better Auth supports a twoFactor plugin but it is not registered.	UNSUPPORTED (high-risk; this is the headline 1.9.0 feature and it doesn't exist)

Changelog metadata issue: the changelog's most-recent entry is dated 2025-01-15. We're in June 2026. Label: OUTDATED as a whole (this page silently went stale).

---

5. Roadmap — src/app/roadmap/page.tsx

5.1 "Shipped" column (page.tsx:35)

Item	Promise	Evidence	Label
Harvest Reach Email Campaigns	Code lives under /admin/communications.	PROVEN
Square Inventory Sync	Code + queue cron.	PROVEN
AI Intelligence Pack	8 endpoints, brand-gated.	PROVEN (with the same caveat as 2.2.0 above)
Water Log Module	Module lives at /admin/water-log.	PROVEN

5.2 "In Progress" (page.tsx:43)

Item	Promise	Evidence	Label
Mobile App (iOS & Android)	No ios/, android/, or React Native config. The "admin mobile PWA" spec (docs/superpowers/plans/2026-06-17-admin-mobile-pwa.md) is a PWA plan, not a native app.	UNSUPPORTED (a public claim of a native mobile app; reality is a PWA spec).
Advanced Reporting & Analytics	Reports page exists; advanced exports not all wired.	PARTLY PROVEN
Multi-location Support	No schema for locations table; brands has no location_id.	UNSUPPORTED

5.3 "Planned" (page.tsx:51)

Item	Evidence	Label
SMS Campaigns	Module already implemented at /api/ai/stop-blast-advisor and gated by sms_campaigns add-on.	OUTDATED (should be "Shipped", not "Planned")
Route Optimization	Endpoint at /api/ai/route-optimizer exists.	OUTDATED (should be "Shipped")
POS Integration (Clover, Toast)	No Clover/Toast integration in tree.	PROVEN (still planned)
Customer Loyalty Program	No code.	PROVEN (still planned)

5.4 Roadmap affordances that don't work

docs/qa/audit-2026-06-25/ACCEPTANCE-CRITERIA.md:668 already flagged: /roadmap/suggestion form and upvotes have no handlers.

Label: MISLEADING (the page implies a working vote/suggest system).

---

6. Public docs (README.md, LAUNCH_CHECKLIST.md, docs/)

6.1 README.md

Promise	Evidence	Label
"Time Tracking" with PINs, Workers, Tasks (lines "Adding Workers / Adding Tasks / Notification Alerts")	src/actions/time-tracking/field.ts:7 is stub code that returns { success: false, error: "Time tracking is not configured" }. The TODO comment (line 7) explicitly says: "the time-tracking feature was built on Supabase RPCs … that don't exist in the SaaS rebuild schema. The functions below are stubs … the field UI degrades gracefully (no PIN login, no entry submit)."	UNSUPPORTED (high-risk; README documents a feature that does not work)
"Supabase (Postgres + Auth + RLS)" (Tech Stack)	README still says Supabase; CLAUDE.md says we're on direct Postgres + Neon Auth.	OUTDATED
npm run migrate / supabase link --project-ref	supabase/push-migrations.js exists but CLAUDE.md says only the direct pg path is used; Supabase CLI branch is legacy.	OUTDATED
dev_session cookie bypass — described as dev-only	CLAUDE.md reinforces this. Code guard at src/lib/auth.ts:55 returns early in production unless PERF_TEST_AUTH=1.	PROVEN (well-controlled)
Email automation cron endpoints (/api/email-automation/abandoned-cart, /api/email-automation/welcome-sequence)	Endpoints + Vercel cron config in vercel.json.	PROVEN

6.2 LAUNCH_CHECKLIST.md

Claim	Evidence	Label
"Social Proof ✓ Complete — FeaturesAndStats.tsx"	FeaturesAndStats.tsx does not exist in src/components/landing/.	OUTDATED
"Testimonials ✓ Complete — TestimonialsAndCTA.tsx"	TestimonialsAndCTA.tsx does not exist.	OUTDATED
"Guided Product Tour ✓ Complete — OnboardingFlow.tsx"	OnboardingFlow.tsx does not exist.	OUTDATED
"Referral Program ✓ Complete — src/app/api/referrals/route.ts, ReferralSystem.tsx"	src/app/api/referrals/route.ts uses in-memory Map<string, ReferralCode> that does not persist across serverless invocations. ReferralSystem.tsx does not exist.	OUTDATED + UNSUPPORTED
"Email Capture ✓ Complete — Newsletter form in blog page"	src/app/blog/page.tsx does not have a working newsletter form (static post list).	OUTDATED

6.3 docs/ADMIN_FUNCTIONALITY_CHECKLIST.md

Lists time-tracking admin features as testable. Combined with the stub status above, this is OUTDATED + UNSUPPORTED.

---

7. Public storefront / AI answers in product voice

7.1 Wholesale portal login — src/app/wholesale/login/page.tsx:156

"Google sign-in is available, but the wholesale portal is not yet wired up to it. Please use email + password for now."

Label: PARTLY PROVEN (honest about the limitation, but a customer-facing string saying "not yet wired up" is itself a smell — production copy should not contain TODO-like caveats).

7.2 Brand-specific FAQs — src/app/tuxedo/faq/FAQClientPage.tsx

Mostly verifiable (corn minimum 4 dozen, real phone number 970-323-6874). Label: PROVEN for Tuxedo-specific FAQ.

7.3 CLAUDE.md "AI answers" surfaced in admin copy

The product has 8 AI endpoints (/api/ai/{campaign-writer, customer-insights, demand-forecast, pricing-advisor, product-writer, report-explainer, route-optimizer, stop-blast-advisor}). Each returns a typed response. The admin UI at /admin/settings/ai describes them in product voice:

"Configure AI providers, keys, and preferences used by campaign writer, pricing advisor, report explainer, and other tools."

Evidence: All endpoints exist, but they require:

1. Brand has get_ai_provider_settings row (BYO API key).
2. The configured provider must be reachable from the server.
3. The minimax provider is hard-coded into AIProviderPanel.tsx with model names like MiniMax-M3, MiniMax-M2.7, MiniMax-M2.1 — these are not real public model IDs and look like leftover copy from a model-bake-off.

Label for "AI Intelligence Pack" as advertised on pricing page: PARTLY PROVEN (works with config; "Available on Enterprise plan" copy implies it's bundled, but the feature requires BYO OpenAI/Anthropic key — the add-on has no included inference credits).

Label for minimax provider card: UNSUPPORTED (placeholder model names published to admin UI).

---

8. Risk-ranked list of fixes the user must approve

Top items, ranked by legal/customer-trust exposure × likelihood a real buyer will notice. Production copy changes require sign-off per the user contract.

Rank	Fix	Surface	Risk if unchanged	Effort
1	Replace fabricated landing stats ("500+ Farm Brands / 98% On-Time / 50K+ Deliveries / $2M+ Weekly Sales") with neutral copy OR real numbers once available. Remove from JSON-LD aggregateRating placeholder.	src/components/landing/HeroSection.tsx, src/app/page.tsx	HIGH — B2B procurement teams check public stats.	XS
2	Pick one pricing source of truth. Reconcile src/lib/pricing.ts and src/lib/stripe-billing.ts. Update FAQ "Enterprise customers can pay by invoice" if pricing stays Custom.	src/lib/pricing.ts, src/lib/stripe-billing.ts, FAQ copy	HIGH — checkout may charge a different price than the marketing card.	S
3	Remove "Two-Factor Authentication" from Changelog v1.9.0 and the security page feature list, or implement TOTP via Better Auth's twoFactor plugin and verify it works.	src/app/changelog/page.tsx, src/app/security/page.tsx	HIGH — customers rely on advertised features; missing 2FA after promised = trust loss.	M
4	Strip SOC 2 / 99.9% uptime / quarterly pentest claims from security/page.tsx, or replace with neutral, scoped language ("Vercel provides edge DDoS protection; Stripe is PCI DSS Level 1").	src/app/security/page.tsx	HIGH — regulatory/compliance exposure.	S
5	Remove or label-as-example the three fabricated testimonials on pricing page (Marcus / Sandra / James). Keep the IRD ones (real quotes).	src/app/pricing/PricingClientPage.tsx	HIGH — fake named-person testimonials can violate FTC guidelines.	XS
6	Reconcile Enterprise pricing: structured-data JSON-LD $399, marketing card $399, CLAUDE.md "Custom". Pick one.	src/app/page.tsx, src/app/pricing/PricingClientPage.tsx, FAQ copy	MEDIUM — Google snippets, sales-call confusion.	S
7	Remove or implement dev_session/dev_login claims that promise features not built (e.g., "Not yet wired up to Google" line in wholesale login).	src/app/wholesale/login/page.tsx	MEDIUM — production copy with TODO language.	XS
8	Replace MiniMax-M3 etc. in AIProviderPanel.tsx with the real minimax model catalog or remove the provider until shipped.	src/components/admin/AIProviderPanel.tsx	MEDIUM — admin sets a non-existent model; calls will 404.	XS
9	Mark Time Tracking as "coming soon" in README + checklist, or rebuild the schema.	README.md, docs/ADMIN_FUNCTIONALITY_CHECKLIST.md, src/actions/time-tracking/field.ts	MEDIUM — docs promise a feature whose actions are stubs.	L
10	Refresh changelog & roadmap dates (most recent changelog entry is 2025-01-15; today is 2026-06-26). Reclassify SMS Campaigns and Route Optimization as Shipped.	src/app/changelog/page.tsx, src/app/roadmap/page.tsx	LOW — perception of staleness.	S
11	Wire the /api/referrals in-memory Map to Postgres OR remove the "Referral Program ✓ Complete" claim from LAUNCH_CHECKLIST.md.	src/app/api/referrals/route.ts, LAUNCH_CHECKLIST.md	LOW — feature currently advertised but non-functional.	M
12	OG image: /og-default.jpg referenced by pricing/blog/contact but only /og-default.svg exists in public/.	src/app/{pricing,blog,contact}/page.tsx, public/	LOW — broken preview cards in social shares.	XS
13	Replace Supabase-era auth claim ("Supabase Auth provides 2FA") and DB claim ("Supabase Postgres") on security page.	src/app/security/page.tsx	LOW–MEDIUM — outdated reference, but page is informational.	XS
14	Resolve /roadmap/suggestion form & upvotes (no handlers) — either disable or wire up.	src/app/roadmap/page.tsx	LOW — UI affordance leads nowhere.	S

---

9. Decisions needed from the user

1. Replace or keep the landing hero stats? If keep, commit to a data source.
2. Choose pricing source of truth — pricing.ts (25% annual) or stripe-billing.ts (15% annual, Enterprise=Custom). Recommend: align on pricing.ts for marketing parity, set stripe-billing.ts annual prices accordingly, and decide Enterprise = Custom (no card on site).
3. Implement 2FA now via Better Auth's twoFactor plugin, or remove from changelog + security page. Recommend: remove from copy; queue 2FA as a real ticket.
4. Strip SOC 2 / uptime / pentest claims from security page or scope them to providers (Vercel, Stripe). Recommend: scope to providers; queue real compliance work.
5. Strip fabricated named testimonials from pricing page. Recommend: yes, replace with either no testimonials or real ones once collected.
6. Time Tracking: docs claim it works, actions are stubs. Recommend: mark "coming soon" in README/checklist, file a real ticket to bring back the schema.
7. Roadmap & changelog: reclassify SMS Campaigns and Route Optimization as Shipped; refresh dates.
8. OG image fix: rename og-default.svg to og-default.jpg, or generate a JPG. Recommend: rename references in metadata to /og-default.svg.
9. Permission to apply any subset of the above in this session? If yes, which?

(Defaults below assume "yes, apply the safe ones; ask on anything that touches an invoice number.")