Production readiness

Status: Accepted · Version: 0.1

Stage 6. Before a real release to the public, treat this as a security project, not an app launch. A green prototype demo is not an entry ticket.

Checklist

Each line needs an owner and an artefact (review note, test, or runbook) before launch. Checking the box inside a slide does not count.

• Penetration test, including recipient-token and life-check abuse
• Key-management review against ADR-006
• Account-recovery threat model, with a written design (not an emailed backup of vaults)
• Recipient verification review (TITIP-009)
• Abuse-case review using architecture/threat-model.md
• Privacy review and published privacy notice (policies/privacy.md)
• Legal terms, including “not a law firm or executor”
• Data residency decision implemented in infrastructure
• Retention policy implemented, including backup expiry (policies/retention.md)
• Disaster recovery tested without restoring plaintext outside KMS
• Provider-outage behaviour tested (grace does not start on failed SMS)
• Incident response runbook
• Employee access model, including break-glass with audit
• Audit export for a single owner
• Support escalation path that cannot mark someone dead
• Manual hold on a case
• Emergency kill switch below

Global release hold

The release engine must implement:

release.disable=true

If a provider is compromised or a delivery bug is found, every controlled release stops. Owners can still open the application, edit guidance, and confirm life checks.

The switch is specified in policies/release-safety.md. Production readiness adds: who may flip it, how fast, how on-call is paged, and a drill that proves tokens die.

Launch block

If any of the following is true, do not launch:

• release.automatic can be set true
• a notice template can include instruction text
• staff can read vault plaintext without a break-glass event
• audit write failure does not roll back the domain change
• AI can influence escalation or release

After launch

Further automation of release is a new ADR, written after abuse data exists, not a config change on a Friday.