> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tuturuuu.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Wave-1 native cutover

> Publication hold, native staging acceptance, and explicit production cutover gates.

## Production hold

`productionPublicationPolicy` in `tuturuuu.ci.ts` holds Meet, Calendar, Mail and
Apps. A production push reports **held for wave-1 cutover** in the planner log and
summary and selects no publisher for those apps. Manual planner dispatch and
package recovery honor the same hold. All four direct legacy Vercel publishers and
Meet's native frontend/realtime publisher check it before any production credential
use, including validation cache and public build configuration. A held direct
production Meet invocation skips validation and publication. PR/main build and
original/restored runtime validation continue. Native Calendar/Mail validation
uses fixture configuration and empty Turbo cache inputs on production; native
Apps validation uses no production secrets. Other apps' deployment selection is
unchanged. This allows ordinary fixes to ship without native cutover.

Meet keeps its existing frontend and realtime Worker versions. Calendar, Mail and
Apps keep their existing Vercel deployments and canonical domains. Retain disabled
Vercel Git deployment and current framework settings. Never bypass the native-source
Vercel guards. A held app has no new deployment marker; **Held** is not delivery.

The policy schema requires a record for every protected app with `state` and a
nonempty, single-line `reason`. A held record uses `state: 'held'`. An admitted
record uses `state: 'admitted'` and explicit `surfaces`: `['frontend']` for Calendar,
Mail and Apps, or `['frontend', 'realtime-do']` for Meet. Missing/empty/malformed
records, unexpected fields and unknown workflow names hold publication. Deleting
a hold never admits publication. Known unrelated publishers keep normal selection,
and Supabase production migration eligibility keeps its existing gates. Root
`production-publication-policy.test.js` covers policy mutations, planner outcomes,
CLI outputs and the direct publishers' dependency on the policy job.
`production-publisher-secrets.test.js` parses all legacy/native workflow jobs and
checks secret-bearing environments and action inputs against admission, with a
negative control for independent Meet validation.

The hold applies to runs using this source. Rerunning an older workflow retains
its original source and cannot acquire a later policy. The release owner retains
custody of pre-hold runs and their resulting deployment baselines.

## Release gates

A later explicit cutover PR must admit each app independently with the required
surfaces and review rationale, after:

1. Exact accepted main SHA passes applicable tests, types, lint, real native builds,
   sealed original/restored runtime acceptance and transitive supplier checks.
2. Off-canonical staging uses distinct Worker identities and isolated resources,
   explicit account, secret names only, no canonical routes, and exact artifact bytes.
3. Hosted signed-in EN/VI, auth handoff/refresh/no-loop, navigation/RPC/assets and
   app-specific provider acceptance pass. Mail needs provider/webhook/attachments;
   Calendar needs provider/offline/Tasks; Meet needs hosted media/reconnect/SFU/TURN;
   Apps needs redirects and canonical-host fence qualification.
4. Release owner captures current routing IDs/proxy modes, immutable Vercel fallbacks,
   old/new Worker versions, secret names, scheduler custody, operator and rollback
   triggers. Meet rollback captures **both** frontend and realtime versions.
5. Review and freeze the exact production promotion range. Source sync is not
   permission to attach canonical routes or activate schedulers.

For Meet restore the captured frontend version, then realtime if changed; preserve
Custom Domains. For Calendar/Mail/Apps retain their immutable Vercel deployments.
Reverting Worker code does not restore routing. Restore exact captured Route/Custom
Domain and DNS/proxy topology before disabling a candidate. Never replay uncertain
Mail sends or change ingestion/R2 ownership as a frontend rollback. Rehearse recovery;
DNS TTLs and provider convergence prevent assuming instantaneous rollback.

Observe Apps for at least 14 days and Meet/Mail/provider-critical Calendar flows for
30 days or the relevant business cycle before separately authorized decommissioning.
No hold removal, resource provisioning, deployment or DNS change is authorized by
this runbook alone.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.