Operate / Release operators

Production launch

Move a Receiz integration from verified local mechanics to a bounded production release without inventing deployment truth.

release assurance and public proofrelease gate and dated attestationComplete production checklist

Implementation rail · release gate and dated attestation

Exact execution and operator checks

01
Operator check
Bind the candidate
Record the candidate commit, tree, package versions, deployment target, rollback owner, and release-key custodian before any release mutation.
Substantive records: /reference/releases · /trust/governance
Expected: One immutable candidate identity and named custodians exist.
02
Exact mechanic
Run test:release-freeze
```
pnpm test:release-freeze
```
Mechanic
pnpm test:release-freeze
Authentication and account boundary
Authorized local repository checkout; the command proves only the checked repository boundary.
Exact source
package.json · SHA-256 132f99232dfaf26f7186b73752938d1377042808f42d60d374fe7b2e57c7646b
Expected: Every repository release gate passes for the bound candidate.
03
Exact mechanic
Run release:attest
```
pnpm release:attest
```
Mechanic
pnpm release:attest
Authentication and account boundary
Authorized local repository checkout; the command proves only the checked repository boundary.
Exact source
package.json · SHA-256 132f99232dfaf26f7186b73752938d1377042808f42d60d374fe7b2e57c7646b
Expected: An authorized dated attestation is emitted for the same candidate.
04
Operator check
Observe deployment and smoke
Deploy only the attested candidate, record the deployment identifier, execute the route smoke matrix, and retain rollback evidence. A local gate does not claim deployment or smoke truth.
Substantive records: /releases/v124.0.0 · /trust/evidence
Expected: Deployment, smoke, and rollback are separately dated evidence dimensions.

Complete operating anatomy

Every boundary required to ship.

Solved outcome: A production candidate has exact proof, conformance, deployment, smoke, rollback, and attestation evidence boundaries.
Prerequisites: Hold the bound commit, tree, coordinated package identities, release-gate output location, deployment target, rollback owner, smoke plan, and authorized attestation custody.
Exact primitive: release assurance and public proof
Governing law: Production launch is governed by literal-product-law: Implemented primitives are named directly, stronger truth remains above weaker projections, and a contradiction is release-blocking. release-attestation-verify: A passing command verifies every bound attestation field for the supplied artifact. governance-controls: Required control records exist and satisfy the script's exact structural checks.
Source-of-truth order: Receiz law → sealed artifact truth → deterministic proof object state → verified durable local or register truth → authenticated snapshot → server distribution, synchronization, indexing, and publication → database, session, observability, and interface projections.
Expected artifact, receipt, or state: A complete gate result and, only after authorized emission, a dated signed release attestation bound to its commit, tree, and build.
Inspection: Inspect the attestation commit, tree, payload digest, signature, candidate identity, deployment record, and dated smoke evidence. Inspection exposes structure and receipt fields; inspection never establishes verification.
Independent verification: Independent verification for production-launch: run the repository release freeze, emit the authorized attestation, and verify the emitted dated file before publication. This establishes only the release assurance and public proof boundary named by the bound sources; The implementation rail remains beneath proof authority: release gate and dated attestation.
Offline behavior: Repository gates and committed evidence execute locally. Deployment and smoke remain unknown until separately observed and bound.
Identity and account boundary: Public Record Moment, Seal File, Verify, Export, and public proof reading are account-free. Identity is optional and adds continuity, custody, recovery, and governed private controls after proof admission.
Security boundary: Release keys remain in assigned custody; logs and Academy pages never carry private signing material or access tokens.
Conformance command: pnpm test:release-freeze
Deployment checks: Deploy only the candidate whose commit, tree, package digests, release gates, and authorized attestation agree; bind deployment ID, route smoke results, observation time, and rollback target separately.
Production checklist: Pass release freeze; emit and verify the dated attestation; publish exact packages; deploy the attested candidate; execute dated route smoke; rehearse rollback; reject every commit, tree, digest, signature, deployment, or smoke mismatch. Unobserved production state remains unknown.
Rollback and containment: Containment for production-launch: The candidate is not releasable. Remain on the last attested release. Publication is forbidden. Restore authorized custody and attest the exact passing candidate. Production health is unproven. Rollback to the last observed healthy deployment and preserve failure evidence. Preserve every stronger held artifact and admitted state while the named boundary is corrected.

Fail closed

Mutation and failure matrix

Release freeze fails a named gate.

Effect: The candidate is not releasable.
Retry: Fix the named contract and rerun the complete freeze.
Recovery: Remain on the last attested release.

Attestation commit, tree, digest, or signature mismatches the candidate.

Effect: Publication is forbidden.
Retry: Do not regenerate over mismatched evidence.
Recovery: Restore authorized custody and attest the exact passing candidate.

Deployment smoke fails or the deployed identifier is unknown.

Effect: Production health is unproven.
Retry: Repeat smoke only after identifying the deployed bytes.
Recovery: Rollback to the last observed healthy deployment and preserve failure evidence.

Exact authority

Claim-to-source bindings

Implemented primitives are named directly, stronger truth remains above weaker projections, and a contradiction is release-blocking.
docs/literal-product-law.mdnormative-doctrine · SHA-256 5548a8f32bbdf35f2ba5e4545cd31ef6e2842d2c3127a3e39e10e6eb6bc5efa1
A passing command verifies every bound attestation field for the supplied artifact.
scripts/verify_release_attestation.tssigned-evidence-verifier · SHA-256 f04e07009107c30a2c41a2f237ed08a581b4773caef3771d8167b762e23d6606
Required control records exist and satisfy the script's exact structural checks.
scripts/check_governance_controls.tsgovernance-control · SHA-256 8fa9d6429e8775c2fbea9b731078aab4a7d978f649bd6323d01b1199e8c7c4a8

One complete system

Exact execution and operator checks

Bind the candidate

Run test:release-freeze

Run release:attest

Observe deployment and smoke