{"slug":"business/2026-07-27-to-30-go-live-runbook","title":"July 27–30, 2026 Go-Live Runbook","section":"business","sectionLabel":"Business","status":"unclassified","type":"document","path":"business/2026-07-27-to-30-go-live-runbook.mdx","bytes":7648,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** Approved operational runbook\n\n**Hard freeze:** July 29, 2026\n\n**Go-live:** July 30, 2026\n\n## Accountable Roles\n\n- Release owner: final go/no-go and rollback authority.\n- Identity owner: Clerk, organizations, OAuth providers, webhooks, and sessions.\n- Web owner: Vercel, environment, domains, build, routes, and observability.\n- Platform owner: Cloudflare Gateway, auth, MCP, bindings, queues, DNS, and\n  secrets.\n- Integration owner: Nango, provider apps, bindings, schemas, sync, and\n  webhooks.\n- Data owner: Pipeline promotion, Spine integrity, migrations, and projections.\n- Verification owner: Customer Zero evidence, negative tests, and release\n  record.\n\nOne person may hold multiple roles, but each role has one accountable owner.\n\n## July 27 — Decide, Provision, Restore\n\n### Identity\n\n- Freeze Clerk as the only browser identity.\n- Activate the Clerk production instance.\n- Configure `app.integratewise.ai`, DNS, allowed origins, and redirects.\n- Enable required Organizations and disable personal accounts.\n- Create the Customer Zero organization and verified memberships.\n- Configure only launch-ready sign-in providers.\n- Provision Clerk webhook signing.\n- Remove Descope from production browser configuration.\n\n### Web\n\n- Upgrade the Vercel CLI from 54.18.6 to the current 58.1.0 release with\n  `pnpm add -g vercel@latest` (or `npm i -g vercel@latest`).\n- Correct the linked Vercel project for the Next.js application.\n- Configure preview environment values.\n- Deploy the release candidate to preview.\n- Verify `/sign-in`, `/sign-up`, `/onboarding`, `/marketplace`, and\n  `/workbench`.\n\n### Platform\n\n- Restore `gateway.integratewise.ai` DNS and Worker routing.\n- Restore `auth.integratewise.ai` and OAuth discovery.\n- Verify CORS, TLS, security headers, rate limits, health probes, and secrets.\n- Confirm Gateway validates Clerk and rejects invalid sessions.\n- Remove email-derived tenant authorization and first-membership selection.\n- Require active organization and canonical membership.\n\n### Integration\n\n- Freeze Nango as the launch credential wall.\n- Verify provider credentials, callbacks, and scopes for golden connectors.\n- Keep legacy Descope outbound adapters disabled.\n- Confirm the connector binding envelope and Pipeline promotion contract.\n\n**End-of-day gate:** a clean preview session signs in through Clerk and receives\na Gateway-resolved Customer Zero account and tenant.\n\n## July 28 — Customer Zero and Failure Proof\n\n- Run the complete Customer Zero journey for the golden connector set.\n- Verify initial and incremental sync.\n- Verify webhook resolution where applicable.\n- Verify schema binding and canonical Spine promotion.\n- Verify Integration Manager projections.\n- Exercise missing organization, identity override, cross-tenant, revoked\n  credential, incompatible schema, failed promotion, and stale repair cases.\n- Capture evidence and fix only launch-blocking defects.\n- Run unit, integration, boundary, and browser tests.\n- Produce release and rollback candidates.\n\n**End-of-day gate:** Customer Zero passes without bypasses and every negative\ncase fails closed.\n\n## July 29 — Hard Freeze\n\nNo new connectors, features, dependencies, architectural changes, or\npublication claims.\n\n- Merge only approved release blockers.\n- Run the complete required test and release suite.\n- Rebuild from the frozen commit.\n- Deploy the final preview candidate.\n- Repeat identity, connector, sync, stale, and tenant-isolation smoke tests.\n- Validate production environment and secret names without printing values.\n- Validate DNS and certificate readiness.\n- Record commit, artifacts, checksums, environments, endpoints, owners,\n  evidence, and rollback target.\n- Conduct the go/no-go review.\n\n**Freeze output:** one signed release record with no open critical or\nhigh-severity launch blocker.\n\n## July 30 — Production Cutover\n\n1. Confirm required providers and status pages are healthy.\n2. Confirm the frozen commit and artifacts.\n3. Promote the web deployment.\n4. Deploy or promote required Cloudflare Workers from the release record.\n5. Confirm DNS and TLS.\n6. Run unauthenticated public-route checks.\n7. Run Clerk sign-in and organization checks.\n8. Run the Customer Zero connector read/sync smoke test.\n9. Verify Spine and Workbench projection results.\n10. Verify MCP discovery and OAuth if included in launch scope.\n11. Monitor identity, HTTP errors, OAuth, sync, queues, schemas, and binding\n    failures.\n12. Announce availability only after the smoke gate passes.\n\n## Required Release Gates\n\n### Identity\n\n- [ ] Production Clerk instance, domain, DNS, redirects, and webhooks are ready.\n- [ ] Organizations are required and personal accounts are disabled.\n- [ ] Customer Zero membership is verified.\n- [ ] Descope browser configuration is absent.\n- [ ] Sign-in, refresh, sign-out, and expired-token behavior pass.\n- [ ] No email-derived tenant or owner fallback remains.\n- [ ] Multi-tab organization behavior uses a fresh authorization token.\n\n### Connector and Spine\n\n- [ ] Installation requires verified user, account, and tenant.\n- [ ] Provider workspace and opaque credential reference are captured.\n- [ ] Schema compatibility and Pipeline promotion pass.\n- [ ] A canonical Spine Connection exists before operational state.\n- [ ] Initial and incremental synchronization pass.\n- [ ] Stale bindings are excluded from all operational and cognitive consumers.\n- [ ] Repair, reconnect, and disconnect preserve audit history.\n\n### Tenant Isolation\n\n- [ ] Missing membership returns unauthorized.\n- [ ] Client identity override is rejected.\n- [ ] Cross-tenant binding, sync, and capability requests are rejected.\n- [ ] Provider callbacks cannot change tenant ownership.\n- [ ] Webhooks resolve to exactly one tenant binding.\n- [ ] Audit events contain subject, account, tenant, and correlation ID.\n\n### Infrastructure\n\n- [ ] `app.integratewise.ai/sign-in` succeeds.\n- [ ] `app.integratewise.ai/marketplace` succeeds.\n- [ ] `gateway.integratewise.ai/health` succeeds.\n- [ ] OAuth discovery at `auth.integratewise.ai` succeeds.\n- [ ] TLS, CORS, preview/production separation, monitoring, and rollback pass.\n\n### Customer Zero\n\n- [ ] Clean-browser sign-in resolves to `iw-customer-zero`.\n- [ ] Golden connector authorization and binding succeed.\n- [ ] Schema promotion and canonical Connection succeed.\n- [ ] Initial/incremental sync and projection evidence exist.\n- [ ] Deliberate stale state fails closed and repair succeeds.\n- [ ] No manual data edit or demo fallback is used.\n\n## Rollback Triggers\n\nRollback immediately for identity outage, incorrect tenant mapping,\ncross-tenant visibility, credential exposure, incorrect-tenant Spine writes,\nwidespread route failure, destructive migration, inability to stop connector\nexecution, Governance/Hermes bypass, or unbounded queue/error growth.\n\n## Rollback Sequence\n\n1. Stop new connector installations and outbound execution.\n2. Preserve logs and correlation evidence.\n3. Roll web to the recorded previous deployment.\n4. Roll affected Workers to recorded versions.\n5. Disable affected provider callbacks or feature flags.\n6. Pause queues if continued work could corrupt state.\n7. Verify identity and tenant isolation after rollback.\n8. Communicate status and the next checkpoint.\n9. Require a new go/no-go record before another cutover.\n\n## Final Sign-Off\n\n- Release owner:\n- Identity owner:\n- Platform owner:\n- Integration owner:\n- Data owner:\n- Verification owner:\n- Frozen commit:\n- Web deployment:\n- Worker versions:\n- Customer Zero evidence:\n- Rollback target:\n- Go/no-go decision:\n- Decision timestamp:\n"}