Pre-launch hardening and release readiness

[kelvinkipruto]

Source reviews

• (opus-4.8 high) Pre-Launch System Review #570
• (gpt-5.6-sol medium) Pre-Launch System Review #571
• Product feedback: (gpt-5.6-sol medium) Pre-Launch System Review #571 (issue comment dated 2026-07-16)

Goal

Complete the security, reliability, release, and operational work required for a safe public launch of Promise Tracker.

This is the coordinating issue. The implementation work is tracked in its native GitHub sub-issues and should be completed in dependency order.

Product decisions

• Editorial users are intentionally allowed to work across the entire site. Tenant-scoped user membership is not required for launch.
• Privileged administration remains separate: ordinary editors must not manage users or retrieve/change platform credentials.
• Public entity pages are universal. Political-entity slugs must therefore be enforced as globally unique, or all lookups must use an unambiguous resolved entity identifier.
• Published public content remains public. Draft content and internal processing metadata must not be anonymously enumerable.

Launch gates

• Credentials and privileged administration are protected, and existing credentials are rotated.
• Anonymous REST and GraphQL access exposes only approved published data.
• CMS embeds and remote-file ingestion have safe trust boundaries.
• Tests use isolated databases and deployment is blocked unless verification passes.
• Production uses an approval-gated immutable-image release with a single-instance migration step.
• Liveness/readiness probes, backup restoration, and rollback are verified.
• Route/entity invariants and AI workflow limits are enforced.
• Staging passes critical-flow, security, accessibility, and load validation.

Launch decision

Public launch is a no-go until every launch-blocking sub-issue is complete, the exact production image has passed staging, and rollback plus database restoration have been rehearsed.

Acceptance criteria

• All native sub-issues are closed.
• The complete production pipeline passes for the immutable release artifact.
• Staging sign-off records the security, accessibility, load, backup-restore, and rollback results.
• Product and engineering explicitly approve the production launch.

Blocked by

None - this is the coordinating parent issue.