{"slug":"operations/GO_LIVE_SEQUENCE","title":"Go-Live Sequence","section":"operations","sectionLabel":"Operations","status":"unclassified","type":"document","path":"operations/GO_LIVE_SEQUENCE.mdx","bytes":3896,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** Normative operations contract  \n**Date:** 2026-08-11  \n**Parent architecture:** [`../architecture/INTEGRATEWISE_ARCHITECTURE_v2.2.md`](../architecture/INTEGRATEWISE_ARCHITECTURE_v2.2.md)\n\nGo-live promotes the same versioned Product and Platform artifacts through isolated environments:\n\n```text\nDevelopment → Customer Zero → Customer Production\n```\n\n## Promotion sequence\n\n```text\nsource commit\n→ CI + contract validation\n→ Development deployment\n→ Customer Zero installation\n→ Customer Zero evidence\n→ version/package freeze\n→ clean external-tenant validation\n→ publication/release readiness\n→ Customer Production promotion\n```\n\n## What may be promoted\n\n- source/build artifacts\n- Product Package versions\n- schemas and migrations\n- capability manifests\n- MCP manifests/bindings\n- policy templates/defaults\n- Workbench projection definitions\n- deployment/runtime configuration definitions\n- compatibility manifests\n\n## What must never be promoted between tenants/environments\n\n- tenant business data\n- provider credentials\n- host connector grants\n- user sessions\n- runtime queues/cursors\n- D1/KV tenant cache contents\n- Memory records\n- evidence bytes\n- audit records\n- proposal/approval artifacts\n- tenant-specific connector bindings\n\n## Customer Zero exit gates\n\nCustomer Zero must prove, with live evidence:\n\n1. One Auth binds identity/tenant without creating a competing connector authority.\n2. Host connector projections do not copy provider credentials.\n3. Connector lifecycle works: discover/connect-or-project/health/revoke/recover.\n4. Product Package activation resolves schemas and effective Tool Capabilities.\n5. Initial ingestion/normalization creates correct Business Context and Spine Cache projections.\n6. User Workbench renders the expected role/subdomain projection.\n7. Twin remains contextual and non-authoritative.\n8. Execution Mode exposes actual Tool Capabilities, not only dashboard metadata.\n9. Governance proves all three outcomes: `allowed`, `approval_required`, `blocked`.\n10. `approval_required` cannot execute without a valid scoped approval artifact.\n11. Dry-run never causes the external mutation.\n12. Executed writes produce audit/evidence and reconciliation.\n13. Reconciled outcomes return to the Spine and refresh the Workbench projection.\n14. Platform Management Console can trace connector/capability/execution health end to end.\n15. Tenant isolation tests prove no Customer Zero data/credentials/runtime state can reach another tenant.\n16. Rollback and revocation paths are exercised.\n\n## Clean-tenant gate\n\nBefore Customer Production/publication, install the exact Customer Zero-verified artifact versions into an unrelated clean tenant without source changes or Customer Zero-only dependencies.\n\nThe clean tenant must establish its own identity bindings, connector projections, credentials/grants, data, caches, policy decisions, evidence and audit history.\n\n## Release manifest\n\nEach promoted release should record compatible versions for:\n\n- User Workbench\n- One Auth/auth surfaces\n- Product Package(s)\n- Platform Backend/Gateway\n- MCP/channel packages\n- capability schema version\n- canonical Spine/Business Context schema version\n- deployment configuration version\n- last-known-compatible rollback set\n\n## Stop-ship conditions\n\nDo not promote when any of the following lacks evidence:\n\n- tenant isolation\n- identity/authority correctness\n- no credential replication into projections\n- connector-aware routing\n- package/capability activation\n- schema/normalization correctness\n- Workbench projection/RBAC enforcement\n- Governance enforcement\n- approval verification\n- execution audit/evidence\n- reconciliation\n- observability\n- revocation\n- rollback\n- clean-tenant installation\n\nA green build is necessary but not sufficient. Go-live requires runtime evidence across the complete governed outcome loop.\n"}