Unclassified

Go-Live Sequence

Status: Normative operations contract
Date: 2026-08-11
Parent architecture: ../architecture/INTEGRATEWISE_ARCHITECTURE_v2.2.md

Go-live promotes the same versioned Product and Platform artifacts through isolated environments:

Development → Customer Zero → Customer Production

Promotion sequence

source commit
→ CI + contract validation
→ Development deployment
→ Customer Zero installation
→ Customer Zero evidence
→ version/package freeze
→ clean external-tenant validation
→ publication/release readiness
→ Customer Production promotion

What may be promoted

  • source/build artifacts
  • Product Package versions
  • schemas and migrations
  • capability manifests
  • MCP manifests/bindings
  • policy templates/defaults
  • Workbench projection definitions
  • deployment/runtime configuration definitions
  • compatibility manifests

What must never be promoted between tenants/environments

  • tenant business data
  • provider credentials
  • host connector grants
  • user sessions
  • runtime queues/cursors
  • D1/KV tenant cache contents
  • Memory records
  • evidence bytes
  • audit records
  • proposal/approval artifacts
  • tenant-specific connector bindings

Customer Zero exit gates

Customer Zero must prove, with live evidence:

  1. One Auth binds identity/tenant without creating a competing connector authority.
  2. Host connector projections do not copy provider credentials.
  3. Connector lifecycle works: discover/connect-or-project/health/revoke/recover.
  4. Product Package activation resolves schemas and effective Tool Capabilities.
  5. Initial ingestion/normalization creates correct Business Context and Spine Cache projections.
  6. User Workbench renders the expected role/subdomain projection.
  7. Twin remains contextual and non-authoritative.
  8. Execution Mode exposes actual Tool Capabilities, not only dashboard metadata.
  9. Governance proves all three outcomes: allowed, approval_required, blocked.
  10. approval_required cannot execute without a valid scoped approval artifact.
  11. Dry-run never causes the external mutation.
  12. Executed writes produce audit/evidence and reconciliation.
  13. Reconciled outcomes return to the Spine and refresh the Workbench projection.
  14. Platform Management Console can trace connector/capability/execution health end to end.
  15. Tenant isolation tests prove no Customer Zero data/credentials/runtime state can reach another tenant.
  16. Rollback and revocation paths are exercised.

Clean-tenant gate

Before Customer Production/publication, install the exact Customer Zero-verified artifact versions into an unrelated clean tenant without source changes or Customer Zero-only dependencies.

The clean tenant must establish its own identity bindings, connector projections, credentials/grants, data, caches, policy decisions, evidence and audit history.

Release manifest

Each promoted release should record compatible versions for:

  • User Workbench
  • One Auth/auth surfaces
  • Product Package(s)
  • Platform Backend/Gateway
  • MCP/channel packages
  • capability schema version
  • canonical Spine/Business Context schema version
  • deployment configuration version
  • last-known-compatible rollback set

Stop-ship conditions

Do not promote when any of the following lacks evidence:

  • tenant isolation
  • identity/authority correctness
  • no credential replication into projections
  • connector-aware routing
  • package/capability activation
  • schema/normalization correctness
  • Workbench projection/RBAC enforcement
  • Governance enforcement
  • approval verification
  • execution audit/evidence
  • reconciliation
  • observability
  • revocation
  • rollback
  • clean-tenant installation

A green build is necessary but not sufficient. Go-live requires runtime evidence across the complete governed outcome loop.