Skip to main content

Go-Live Checklist

Automated Evidence​

  • File upload abuse: oversized, empty, MIME mismatch, corrupt, and password-protected inputs are tested.
  • Auth bypass: missing, invalid, repeated-failure, and cross-client access paths are tested.
  • Rate-limit bypass: protected endpoints return 429 with rate-limit headers after the configured limit.
  • Metadata/filter abuse: reserved client_id and system metadata paths are rejected.
  • Path traversal: unsafe document ids are rejected before staging.
  • Load evidence: run python scripts/load_performance_report.py with measured samples and retain its JSON output. It exits 0 only when go_live_ready=true, evidence_status=pass, and evidence_failures=[].
  • Tagged runtime smoke: just prod-rebuild includes just prod-smoke, which imports the API and embedding runtime dependencies and verifies the Product Version.
  • Security evidence: review the advisory Gitleaks workflow artifacts, and record the disposition of any findings. Image vulnerability scanning is no longer performed by CI; see Security Scanning for current coverage.

Human-Gated Items​

These items are blocked until a human records real evidence:

  • Security sign-off owner and review date.
  • Independent operator runbook-only deployment walkthrough. Use Production and Staging Deploy and Recovery for the tagged-deploy path and post-deploy checks.
  • Go-live owner.
  • First-30-day success metrics.
  • Alert test-fire: before UAT sign-off, test every alert and record the firing query, Alertmanager notification, and operator acknowledgement as described in Monitoring Metrics — Test-Fire Evidence.
  • Post-launch review rhythm.

Do not fill these with placeholders or inferred names.