Gate production rollout behind manual approval

[DCLXAI]

What changed

• remove the automatic workflow_run production trigger
• require a manual workflow_dispatch operation and exact approved main SHA
• add explicit deployment_authorized confirmation and the production environment scope
• run the value-redacting rollout preflight before build, migration, canary creation, or promotion
• add a read-only verify operation for production database connectivity and schema parity
• verify schema parity again immediately after an approved migration
• add CI fitness rules that reject automatic triggers, ungated deploy steps, and unsafe ordering
• document the manual verification and rollout procedure

Why

Merging PR #102 caused the existing successful-main-CI trigger to start a production release automatically. The run was stopped before domain promotion, but cancellation arrived after additive PostgreSQL migrations had already applied. Production deployment must be an explicit operator action with the approved ticket, rollback owner, source commit, Railway access, latency budgets, alert acknowledgment, and canary timestamp checked before any mutation.

Impact

A push or successful CI run can no longer deploy production. Operators can run operation=verify without building, migrating, creating a Vercel deployment, or changing domains. operation=deploy remains fail-closed and preserves the prebuilt canary → readiness/backend verification → promote sequence.

Validation

• actionlint v1.7.7 passed
• scripts TypeScript configuration passed
• targeted ESLint passed
• CI quality fitness passed with all 119 test scripts assigned to six suites
• rollout readiness regression passed
• readiness guard passed against a fresh pgvector PostgreSQL database with all 66 migrations
• live production /api/readiness returned HTTP 200 with operational PostgreSQL connectivity and no required failures
• staged secret-pattern and diff-whitespace scans passed

Follow-up after merge

1. Dispatch operation=verify for the new merge SHA and capture the 20260813085000_trace_request_correlation parity result.
2. Configure required reviewers on the GitHub production environment if an additional approval layer is desired.
3. Do not dispatch operation=deploy until the full rollout preflight inputs and Railway credential are available.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
kaxi	Ready	Preview	Aug 13, 2026 8:16am