P0: Assemble exact-SHA release approval package and staged rollout

Goal

Produce one auditable pre-pilot release package for the exact managed-beta candidate, then request the smallest explicit staged-deployment approval after the required code, runtime, trust, and pre-pilot validation gates have real evidence.

Current state — 2026-09-05

Current main remains:
b45170409543684a75579a13d7bdd6d8f8ffe8e8

This is not the final pre-pilot candidate. PR #95 remains unmerged but is now ready for an explicit merge decision on exact reviewed head:
431d7da80c9bac56aa16423ab61a235a176b6fd8

Exact-head PR #95 evidence:

Codex review completed with no major issues;
Ashbi Local CI passed isolated install, Prisma generation, TypeScript, ESLint, focused auth/navigation/security tests, and production Next build;
GitGuardian passed with no secrets;
all inline recovery review threads are resolved;
PostgreSQL documentation supports the FirstNormalObjectId (16384) boundary used for user-created system-schema contamination detection;
GitHub-hosted CI Build / Build failed before executable steps (steps:null), matching the known hosted-runner infrastructure incident.

Note: Ashbi Local CI does not directly execute tests/backup-restore.test.ts; the recovery contract assertions were separately checked against the exact branch text while Local CI proves compile/lint/build compatibility.

PR #95 remains unmerged and merging still requires separate explicit approval.

Candidate-binding rule

If PR #95 is approved and merged:

refetch the resulting main SHA;
freeze that resulting SHA as the new repository candidate;
build/capture the immutable image digest for that exact SHA;
rebind P0: Run production Compose image/database smoke and close configuration audit #29 runtime proof and every P0: Assemble exact-SHA release approval package and staged rollout #70 release-package evidence field to that SHA/digest;
do not reuse exact-artifact evidence belonging only to b451704… or the PR-head SHA.

The release-package validator/template are already merged (release:validate, RELEASE-RC1.md, exact SHA/digest approval binding). No approved host, immutable release image, staged rollout authorization, participant use, billing or beta deployment exists yet.

Required pre-pilot sequence

A. Candidate/code/governance gate

PR fix: reconcile restored upload target during recovery drill #95 exact head completed intended Codex/local/security validation and all review threads are resolved.
PR fix: reconcile restored upload target during recovery drill #95 is explicitly merged or explicitly rejected; then final repository candidate is frozen.
Fail-closed exact-artifact release validator/template exists.
Canonical CI includes frozen install, Prisma generation, PostgreSQL migration deploy, typecheck, lint, tests and production build.
Clean exact-SHA CI Build / Build executes successfully after hosted runner recovery, or an explicitly approved equivalent exact-SHA validation package is recorded.
P0: Restore application validation for production dependency pull requests #49 required-check/review governance is active and verified.

B. Runtime/trust gate

P0: Run production Compose image/database smoke and close configuration audit #29 disposable Compose/image/database/lifecycle/backup/restore proof passes against the post-fix: reconcile restored upload target during recovery drill #95 frozen exact candidate.
Immutable image digest for the exact candidate is captured from an approved build.
P0: Verify external email delivery and complete authentication journey QA #60 external email/DNS/auth journey passes.
P0: Complete production operations, backup, monitoring, and rollback evidence #61 host/backup/alerts/restore/rollback/responder evidence passes.
P0: Approve legal and data policy and correct license ownership #62 owner/legal decisions and qualified policy review pass.
P0: Establish beta support and incident response operations #63 support routes/responders/escalation are approved and operationally verified.
P1: Validate the complete customer lifecycle in rendered browser QA #64 complete rendered lifecycle QA passes.
P1: Run representative AI task-creation quality, safety, latency, and cost evaluation #67 AI task-creation evaluation meets safety/quality requirements or the feature is explicitly limited/disabled for beta.

C. Pre-pilot customer/economics readiness

P1: Validate goals-to-today positioning and first-value comprehension #65 Day-0 comprehension/first-value protocol is approved and ready; if not completed before deployment, it is explicitly incorporated into P1: Run the five-user 14-day managed-beta validation pilot #66 Day 0.
P1: Validate managed-beta pricing and sustainable unit economics #68 owner-approved price-test range, unaided-WTP question order and economics measurement plan are ready. Observed WTP/support/service-cost results are collected during P1: Run the five-user 14-day managed-beta validation pilot #66 and finalized under P1: Validate managed-beta pricing and sustainable unit economics #68 afterward.
Five approved target participants and a privacy-minimal external participant ledger exist for P1: Run the five-user 14-day managed-beta validation pilot #66.

D. Release package

Populate the package only with real evidence for the same final SHA/digest:

candidate SHA;
immutable image digest;
exact Prisma migration boundary;
exact-SHA CI/local validation evidence;
governance/review proof;
P0: Run production Compose image/database smoke and close configuration audit #29 runtime/lifecycle/backup/restore evidence;
rollback/alert/support evidence;
external email and rendered QA evidence;
approved legal/policy references;
known limitations and rollback triggers;
named responder;
post-release verification steps;
exact action, customer impact, incremental CAD cost, material risks and rollback summary.

Run npm run release:validate -- <package> before asking for deployment approval. Completeness validation does not authorize any mutation.

Intended first release action

The narrowest planned first action remains:
deploy one exact immutable candidate to one approved managed-beta host for five specifically approved testers, invite-only, no billing and no public launch.

This is a planning target, not current approval.

Dependency rule — no pilot cycle

Pre-pilot dependencies are final candidate disposition/#95, #29, #49, #60, #61, #62, #63, #64 and #67, plus readiness for #65/#68 as described above.

#66 is not a dependency of #70. #70 is the artifact-bound staged-deployment approval required before #66 begins.

Completed #68 economics evidence is not a dependency of #70. #68 has a pre-pilot readiness phase and a post-pilot conclusion phase.

#69 remains post-beta billing and does not block the five-user no-payment pilot. #74–#77/#80 and PR #79 remain post-RC1 Adaptive Planning and must not enter this candidate.

Acceptance criteria

After #70 approval

Run #66. During the pilot, gather #65 Day-0 evidence and #68 willingness-to-pay/support/service-cost evidence. After pilot closeout, complete #68 and make the keep/revise/stop and paid-lifecycle decisions.

Approval boundary

Merging #95, starting #29 external Docker resources, tagging, publishing images, deploying, DNS, purchasing services, outreach, participant enrolment, pricing tests, payment collection and public launch are separate explicit actions. A complete checklist alone never authorizes deployment.

Source of truth

RELEASE-RC1.md; release/rc1-release-package.example.json; current main b45170409543684a75579a13d7bdd6d8f8ffe8e8; PR #95 reviewed head 431d7da80c9bac56aa16423ab61a235a176b6fd8; resulting post-merge main SHA if approved; roadmap #71.

2026-09-03 RC1 preparation update:

PR #88 (feat: add exact-artifact RC1 release approval package) is open and mergeable at head 662150201519c20ae2414f7a0fd5b38c60358a93.

Prepared without authorizing any release mutation:

fail-closed release package template bound to full commit SHA, immutable image digest and migration boundary;
28 explicit validation/runtime/trust/release gates;
approval request requires exact action, tester/customer impact, explicit CAD cost (including $0), risk, rollback and approve/reject/request-changes choices;
normal validator can report package readiness but always leaves approvedForMutation=false;
--require-approval additionally requires explicit approval and exact approved SHA/digest equality;
staged rollout guide distinguishes package completion from deployment permission and states that jobs failing before steps execute are neither passing nor application failures.

Issue #70 remains open. The template is not release evidence and no candidate SHA/image digest has been selected because #29/#49/#60/#61/#62/#63 still require real evidence/decisions.

No merge, tag, image publication, deployment, billing/pricing change, outreach, or production mutation occurred.

RC1 release-package preparation update on 2026-09-04:

PR #88 is now reconciled onto current merged RC1 main (b16ca80a28e96ad22a6d2cae3acb4f920466712d) and is mergeable. Its prior package.json conflict was resolved from the current main tree so the merged support/operations commands are preserved while adding only release:validate.

PR #88 remains release-process preparation only. It adds exact commit/image/migration binding, fail-closed validation/runtime/trust/release gates, explicit approval-request fields, and a separate exact-artifact approval object. Package completeness does not authorize production mutation.

#70 remains open pending real exact-candidate evidence for #29, #49, #60, #61, #62, #63 and the other milestone gates. No tag, image publication, deployment, pricing/billing change, outreach, or production mutation has been performed.

Post-merge RC1 status (2026-09-04): PR #88 is merged. Current main is a09a91ac1ff90da23f3c12c397858ec0a460cd03 and now includes the exact-artifact release package validator (npm run release:validate), while preserving metrics:support, ops:preflight, and ops:evidence.

Fresh main push validation still did not execute application steps: CI run 33865453195 failed with zero Build steps on both original attempt and retry; image run 33865453206 likewise failed before execution and its read-only validation job was skipped. These are infrastructure failures, not release-pass evidence.

#70 remains open and no deployment is authorized. The release package still needs real exact-candidate evidence for #29/#49/#60/#61/#62/#63 plus accessibility/performance/security/privacy/release-operation gates, an immutable image digest, migration boundary, qualified review, explicit responder/rollback/post-release plan, and a separate approval bound to the exact SHA + image digest.

RC1 integration review — 2026-09-04

Current integrated main: 0c05e7037b5d07029401aad2d6515ef6c243a08c.

Since the prior RC1 baseline, two release-safe maintenance PRs were merged:

fix(test): restore TypeScript compatibility in runtime/operations tests #90: test-only TypeScript/contract compatibility fixes; effective main...head diff was exactly three test files.
chore(ci): skip housekeeping image builds #89: CI housekeeping only; effective diff was exactly .github/workflows/build-and-push.yml.

#89 behaved as intended on merge: the image workflow did not trigger for the workflow-only push, while canonical CI Build did trigger. That CI job again failed before executing any steps, so the hosted-runner blocker remains unresolved and no application failure is inferred.

PR #79 was reviewed and explicitly deferred to post-RC1; it is now draft and must not be merged into this release candidate without a separate release-critical justification.

Use 0c05e7037b5d07029401aad2d6515ef6c243a08c as the current integrated RC1 code line for subsequent exact-artifact evidence collection. It is not yet an approved release artifact because #29/#49/#60-#68 still require their stated evidence.

Release-freeze hold — #95 recovery correctness

Do not assemble/finalize the exact-artifact #70 package from b45170409543684a75579a13d7bdd6d8f8ffe8e8 yet.

During #29 preparation, review found that the restore drill restores files into RESTORE_UPLOAD_DIR but reconciles the default ./uploads tree. Draft PR #95 (bdaff4923d022b576ce039fc32513add939ea55d) is the focused release-blocker fix. Its effective diff is three files and does not change schema/dependencies/CI/deployment.

Hosted CI for #95 again failed before checkout with steps:null, so no executable pass/fail is claimed. Codex review is in progress.

If #95 is approved and merged, refetch main and make that resulting merge SHA the new exact #70 candidate before any Docker/image/evidence work. If #95 is rejected, #29 restore acceptance must remain blocked until an equivalent recovery-correctness fix exists.

#70 release-freeze note — PR #95 remains an RC1 correctness blocker after final review found additional recovery fail-closed defects. Do not freeze or package b45170409543684a75579a13d7bdd6d8f8ffe8e8 as the final pre-pilot artifact. Current work remains isolated to recovery scripts/tests/runbook; #70 should refresh the exact SHA only after #95 is reviewed and explicitly merged.

RC1 freeze note: do not assemble/finalize an exact release artifact from current main b45170409543684a75579a13d7bdd6d8f8ffe8e8 while recovery correctness PR #95 remains unmerged. PR #95 exact head 729094c06e8085310e3df839a5e44b025b873820 is a release-critical #29 prerequisite; after it is reviewed/merged, #70 must bind all release evidence to the resulting new main SHA/image digest. This note authorizes no merge, build publication, deployment, or external runtime action.

RC1 prerequisite update — recovery correctness PR #95 is frozen at exact head 57ece7fc80bbc3ac125131ffc03fc66598b9d7f7. Ashbi Local CI and GitGuardian pass on this head; fresh Codex review is still running after final restore-isolation fixes. Do not freeze #70 release evidence from current main until #95 is reviewed/merged and the resulting new main SHA/image digest is known.

Exact-artifact prerequisite update — 2026-09-05

PR #95 is now ready for review on exact head f8de3ee3180a455634a3261f82020675795e85fe, with clean Codex review, passing Ashbi Local CI, passing GitGuardian, and only the known zero-step hosted GitHub Actions failure.

Therefore current main b45170409543684a75579a13d7bdd6d8f8ffe8e8 must not be frozen as the final RC1 artifact: the recovery-correctness patch remains unmerged.

After explicit merge approval for #95:

record the resulting new main SHA;
rerun/reconcile exact-SHA validation and P0: Run production Compose image/database smoke and close configuration audit #29 disposable runtime evidence on that candidate;
only then construct the immutable SHA/image-digest P0: Assemble exact-SHA release approval package and staged rollout #70 release package.

No merge, image publication, deployment, tag, outreach, pricing, billing, or release is authorized by this status update.

Exact-artifact gate update: main is still b45170409543684a75579a13d7bdd6d8f8ffe8e8; do not freeze a release package from PR #95's branch head. PR #95 exact 1f0877757c79e16ebdc0b91b68f1ecf8059449c3 is now ready for merge review: manual Codex review is clean, Ashbi Local CI passed, GitGuardian passed, and all inline recovery findings are resolved. Hosted Build remains the known pre-step runner failure. #70 must wait for separate approval/merge of #95, then rebind all exact-SHA/image/runtime evidence to the resulting main candidate.

Navigation Menu

P0: Assemble exact-SHA release approval package and staged rollout #70

Goal

Current state — 2026-09-05

Candidate-binding rule

Required pre-pilot sequence

A. Candidate/code/governance gate

B. Runtime/trust gate

C. Pre-pilot customer/economics readiness

D. Release package

Intended first release action

Dependency rule — no pilot cycle

Acceptance criteria

After #70 approval

Approval boundary

Source of truth

Release-freeze hold — #95 recovery correctness

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

P0: Assemble exact-SHA release approval package and staged rollout #70

Description

Goal

Current state — 2026-09-05

Candidate-binding rule

Required pre-pilot sequence

A. Candidate/code/governance gate

B. Runtime/trust gate

C. Pre-pilot customer/economics readiness

D. Release package

Intended first release action

Dependency rule — no pilot cycle

Acceptance criteria

After #70 approval

Approval boundary

Source of truth

Activity

camster91 commented on Sep 4, 2026

camster91 commented on Sep 4, 2026

camster91 commented on Sep 4, 2026

camster91 commented on Sep 4, 2026

camster91 commented on Sep 5, 2026

Release-freeze hold — #95 recovery correctness

camster91 commented on Sep 5, 2026

camster91 commented on Sep 5, 2026

camster91 commented on Sep 5, 2026

camster91 commented on Sep 5, 2026

camster91 commented on Sep 6, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions