root/MarketingTool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add final acceptance verification

Browse Source
This commit is contained in:
Marco0300
2026-09-03 13:02:04 +02:00
parent 9622f76977
commit 561efe8855
10 changed files with 718 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+8
View File
@@ -240,3 +240,11 @@ Before deployment, verify the prerequisites in `docs/RELEASE_CHECKLIST.md`: a re
The API liveness endpoint (`/api/v1/health/live`) and web `/healthz` are public process checks; API `/api/v1/health/ready` additionally verifies SQLite readiness. They are suitable for Docker and monitoring but do not prove backups, tenant authorization, or external dependencies. Production ingress must not route traffic until both Compose services report `healthy` and the deployment smoke tests pass. The current image initializes SQLite from `schema.sql` and has no standalone migration runner. Treat schema changes as a versioned, backup-first migration: validate on a restored copy, record the schema/data checks, and keep the previous image/config available for rollback.
The named Docker volume is not a backup. Stop or quiesce writes, create an encrypted off-host backup, verify it, and perform a restore drill before calling a deployment protected. Define retention for the database, audit/source lineage, logs, and backups; apply legal holds and deletion rules deliberately. Do not run `docker compose down -v` on a data-bearing host. Outbound traffic is deny-by-default for product behavior: `AUTOMATED_OUTREACH_ENABLED=false` is fixed in Compose and this release has no send/provider/worker path. Unexpected egress is an incident. SQLite, the in-process worker, HTTP-only local Compose, lack of durable migrations/PITR, and the limited SQLite-only readiness check are explicit limitations, not hidden guarantees.
## Phase 17 final acceptance
Phase 17 records the final local acceptance decision in `docs/FINAL_ACCEPTANCE.md`: **local acceptance passed; production deployment was not attempted and remains blocked**. The verified local head is `9622f769776637a40fdae797adccba91445cd351`. The acceptance run passed 100 API tests, the deterministic Phase 16 benchmark, Python and shell syntax checks, JSON validation, Compose configuration validation, and safety invariants.
The bounded capacity smoke is deterministic and in-memory only: a synthetic 1,000-item collection returns a maximum page of 100, and a 5,000-item synthetic batch retains at most 100 items. This demonstrates bounded behavior, not production throughput, concurrency, durability, availability, or an SLO. Reproducibility requires the recorded commit, fixture hash, rule/algorithm versions, runtime/dependency/image versions, non-secret configuration, seed, locale/timezone, rounding, and tie-breaking; see `docs/FINAL_ACCEPTANCE.md` and `docs/BENCHMARKS.md`.
Remote push is still blocked by repository authentication and branch-permission prerequisites. Production additionally requires host/Docker/Compose access, protected deployment paths, secret injection, DNS/TLS/Virtualmin, encrypted off-host backups and restore evidence, monitoring, rollback ownership, operational approval, and all applicable provider, terms/DPA, consent/legal-basis, and retention prerequisites. No local check, benchmark, or commit is a remote push or production deployment. `AUTOMATED_OUTREACH_ENABLED=false` remains the required default.