Capability,Entry_points,Source_specifications,Data_fields,Consent_requirements,Adapter,External_destination,Analytics_events,Tests,Security_controls,Privacy_controls,Open_issues,Status
Demo presentation,header; mobile header; hero; final CTA; footer,Phase 9 demo contract; Phase 14 prompt,approved DemoRequest,Final legal text blocked,DemoDialogHost,none,demo_open; demo_close,schema; browser EN/FR/AR; axe; visual,native dialog; focus return,no storage or URL PII,P9-003; P14-002,partially-implemented
Submission API,POST /api/demo,Phase 9 contract; server authority rules,DemoRequest plus guard envelope,Production disabled,submission service,local discard only,none server-side,schema; integration; security/privacy validators,origin; request marker; content type; 16 KiB; strict schema; timeout; idempotency,no raw logging or body echo,P9-002; P9-003; P14-001,partially-implemented
Lead destination,submission service,typed adapter boundary,approved DemoLead,Production blocked,LocalLeadDestinationAdapter; BlockedLeadDestinationAdapter,none,success/failure client events,adapter and orchestration,server-only selection; timeout,local adapter discards payload,P9-002; P14-001,blocked
Analytics,demo lifecycle,Phase 9 analytics spec,allowlisted non-PII context,analytics consent required,disabled/test sink,none,demo_open; validation; attempt; success; failure; close,contract; browser no-PII; privacy validator,strict event schema,consent gate; no network/storage,P9-004; P14-003,blocked
Destinations,homepage/header/footer,Phase 13 policy; Phase 14 registry,none,n/a,typed registry,none approved,none activated,destination unit and validator,no external URL/open redirect,no arbitrary query forwarding,P9-008; P9-012; P9-014; P9-015,partially-implemented
