20 — Release Readiness and Verification Evidence

Status: Active launch control

Hard freeze: 2026-07-29

Production go-live target: 2026-07-30

Required before merge

• browser identity has one configured authority;
• Gateway rejects missing or conflicting user/account/tenant context;
• connector records require provider workspace, Spine Connection, and compatible
  schema evidence;
• stale bindings fail closed in every reader;
• Pipeline is the only canonical writer;
• public MCP tool inventory is exactly nineteen;
• approval and Hermes cannot be bypassed;
• credentials never enter browser, Spine, prompts, logs, or repo;
• projections never silently fall back to demo data;
• cross-tenant read/write tests pass;
• migration, rollback, and compatibility tests pass.

Required before production cutover

• Clerk production Organisation and callback configuration;
• Vercel Workbench build and authenticated route verification;
• Cloudflare Gateway, OAuth, MCP, Pipeline, connector, queue, and service bindings;
• Neon, D1, KV, R2, retrieval, and migration readiness;
• Nango production provider configurations;
• DNS, TLS, health, status, and support endpoints;
• Customer Zero golden journey and evidence pack;
• stale, repair, revoke, provider-failure, and callback-loss tests;
• monitoring, alerts, ownership, incident response, and rollback drill;
• privacy, terms, security, support, and deletion/export paths.

Stop-ship list

• Descope selected for browser sessions while Clerk is configured;
• no authoritative account and tenant resolution;
• browser-supplied identity accepted;
• connector operational without complete binding and schema tuple;
• stale connector visible as connected or usable;
• direct UI, Twin, MCP, connector, or projection write to Neon;
• public MCP drift;
• no approval token for a consequential action;
• Hermes bypass;
• production endpoint unhealthy;
• no clean rollback target;
• any cross-tenant access.

Evidence record

Each release candidate records:

• commit, package, build, deployment, and migration IDs;
• environment and configuration version;
• test suite and negative-case results;
• Customer Zero journey evidence;
• connector and schema binding references;
• audit correlation IDs;
• security and legal review;
• known exceptions with owner and expiry;
• release decision and rollback target.

Acceptance statement

The launch is accepted when a clean verified user enters the correct tenant,
installs a launch connector, completes provider auth, binding, schema validation,
initial sync, and Pipeline promotion, sees canonical Integration Manager and
Workbench state, executes one approved action through Hermes, and observes stale
or cross-tenant state fail closed.