Owner Commissioning

Production Readiness

Fail-closed commissioning view for environment, secrets, infrastructure, rollback, disaster recovery and external authorities.

Commissioning decision

BLOCKED

Readiness score

11%

Blocking conditions

Release version

v43-production-release-evidence-gate

Owner action register

Domain	Check	Severity	Owner	Status	Required action
ENVIRONMENT	Production mode	CRITICAL	Platform Engineering	READY	No action required.
ENVIRONMENT	HTTPS public URL	HIGH	Platform Engineering	BLOCKED	Configure NEXT_PUBLIC_SITE_URL with the final HTTPS origin.
SECRETS	Managed PostgreSQL secret	CRITICAL	Database Owner	BLOCKED	Provision a non-superuser application role and inject ENTERPRISE_DATABASE_URL from the secret manager.
SECRETS	OIDC authority	CRITICAL	Identity Owner	BLOCKED	Configure OIDC_ISSUER, OIDC_AUDIENCE and OIDC_JWKS_URL.
SECRETS	Immutable evidence storage	HIGH	Evidence Owner	BLOCKED	Configure an Object-Lock enabled bucket and retention policy.
INFRASTRUCTURE	Immutable OCI image	CRITICAL	Release Engineering	BLOCKED	Build, scan, sign and pin the release by sha256 digest.
INFRASTRUCTURE	Container registry	HIGH	Release Engineering	BLOCKED	Configure the approved registry and image-pull credentials.
INFRASTRUCTURE	Production cluster	CRITICAL	Infrastructure Owner	BLOCKED	Provide the approved cluster context and execute the commissioning runner.
INFRASTRUCTURE	TLS certificate	CRITICAL	Security Owner	BLOCKED	Issue and bind the production certificate; verify hostname and renewal.
INFRASTRUCTURE	Observability endpoint	HIGH	SRE Owner	BLOCKED	Connect logs, metrics and alert routing before traffic activation.
ROLLBACK	Rollback evidence	CRITICAL	Release Engineering	BLOCKED	Execute rollback-readiness and a real deployment rollback; record PASS evidence.
DISASTER_RECOVERY	Restore evidence	CRITICAL	Business Continuity Owner	BLOCKED	Run backup restore/PITR validation and record measured RPO/RTO.
EXTERNAL_AUTHORITY	External approval provider	HIGH	Governance Owner	BLOCKED	Configure the approval authority and verify signed approval callbacks.
EXTERNAL_AUTHORITY	Independent assessor	MEDIUM	Board Assurance Owner	WARNING	Provide the evidence bundle to an independent assessor and record the signed result.

Production acceptance gates

Gate	Owner	Evidence	Production meaning	Status
Repository integrity	Engineering	Package contains GTOS App Router, API routes, governance docs, audit scripts and Design System gates.	The release candidate is a structured application repository, not a collection of static mockups.	verified
Build and dependency verification	Engineering	npm ci, TypeScript, ESLint, audit suite, production build and npm audit are mandatory before release acceptance.	The release must remain reproducible and free of moderate-or-higher dependency vulnerabilities.	verified
Docker image verification	External Runner	Dockerfile and docker-verification workflow are prepared; real docker build requires Docker-enabled runner.	Container acceptance is not claimed until a Docker daemon or CI runner creates and smoke-tests the image.	external-required
CI/CD evidence	External Runner	GitHub/GitLab pipeline must run npm ci, lint, typecheck, audits, build and Docker verification.	Production Ready requires a reproducible external CI result, not only local sandbox execution.	external-required
Live deployment acceptance	Operations	Production URL must pass /api/health, /api/readiness, SEO, legal, security header and RFQ smoke checks.	A deployment is accepted only after the live host proves runtime health and route availability.	external-required
Playwright browser E2E	External Runner	Browser tests must execute on an unrestricted runner because sandbox Chromium policies can block localhost.	User journeys are accepted only after real browser execution against preview or production deployment.	external-required
Legal and compliance boundary	Compliance	Legal Center, Export Control Notice, no-public-offer disclosures, Trust/Vault/RFQ gates are present.	GTOS remains a controlled B2B operating system, not an uncontrolled public offer or retail storefront.	verified
Security acceptance boundary	Security	Security headers, RBAC/ABAC matrix, audit evidence hashing and API permission gates are enforced in code.	Application-side security controls are ready for external penetration/security validation.	verified

External verification checklist

HANDOFF READY

01Run npm ci on the release candidate archive or clean repository checkout.
02Run npm run typecheck and npm run lint.
03Run npm run audit:all and npm run audit:production-release-evidence.
04Run npm run build and archive build logs.
05Run npm audit --audit-level=moderate and archive the zero-vulnerability result.
06Run docker build on a Docker-enabled runner and record image digest.
07Run container smoke test against /api/health and /api/readiness.
08Run Playwright E2E on unrestricted CI/browser runner.
09Deploy to preview/production URL and run live acceptance smoke checks.
10Attach CI logs, deployment URL, Docker image digest and E2E report to release evidence.

Release claim policy

Forbidden claim: Do not claim live production readiness from local code checks alone.

Approved claim: Release candidate handoff ready for external production verification.