Production hold
productionPublicationPolicy in tuturuuu.ci.ts holds Meet, Calendar, Mail and
Apps. A production push reports held for wave-1 cutover in the planner log and
summary and selects no publisher for those apps. Manual planner dispatch and
package recovery honor the same hold. All four direct legacy Vercel publishers and
Meet’s native frontend/realtime publisher check it before any production credential
use, including validation cache and public build configuration. A held direct
production Meet invocation skips validation and publication. PR/main build and
original/restored runtime validation continue. Native Calendar/Mail validation
uses fixture configuration and empty Turbo cache inputs on production; native
Apps validation uses no production secrets. Other apps’ deployment selection is
unchanged. This allows ordinary fixes to ship without native cutover.
Meet keeps its existing frontend and realtime Worker versions. Calendar, Mail and
Apps keep their existing Vercel deployments and canonical domains. Retain disabled
Vercel Git deployment and current framework settings. Never bypass the native-source
Vercel guards. A held app has no new deployment marker; Held is not delivery.
The policy schema requires a record for every protected app with state and a
nonempty, single-line reason. A held record uses state: 'held'. An admitted
record uses state: 'admitted' and explicit surfaces: ['frontend'] for Calendar,
Mail and Apps, or ['frontend', 'realtime-do'] for Meet. Missing/empty/malformed
records, unexpected fields and unknown workflow names hold publication. Deleting
a hold never admits publication. Known unrelated publishers keep normal selection,
and Supabase production migration eligibility keeps its existing gates. Root
production-publication-policy.test.js covers policy mutations, planner outcomes,
CLI outputs and the direct publishers’ dependency on the policy job.
production-publisher-secrets.test.js parses all legacy/native workflow jobs and
checks secret-bearing environments and action inputs against admission, with a
negative control for independent Meet validation.
The hold applies to runs using this source. Rerunning an older workflow retains
its original source and cannot acquire a later policy. The release owner retains
custody of pre-hold runs and their resulting deployment baselines.
Release gates
A later explicit cutover PR must admit each app independently with the required surfaces and review rationale, after:- Exact accepted main SHA passes applicable tests, types, lint, real native builds, sealed original/restored runtime acceptance and transitive supplier checks.
- Off-canonical staging uses distinct Worker identities and isolated resources, explicit account, secret names only, no canonical routes, and exact artifact bytes.
- Hosted signed-in EN/VI, auth handoff/refresh/no-loop, navigation/RPC/assets and app-specific provider acceptance pass. Mail needs provider/webhook/attachments; Calendar needs provider/offline/Tasks; Meet needs hosted media/reconnect/SFU/TURN; Apps needs redirects and canonical-host fence qualification.
- Release owner captures current routing IDs/proxy modes, immutable Vercel fallbacks, old/new Worker versions, secret names, scheduler custody, operator and rollback triggers. Meet rollback captures both frontend and realtime versions.
- Review and freeze the exact production promotion range. Source sync is not permission to attach canonical routes or activate schedulers.