# Fleet Ops release acceptance

This file is release-scoped evidence, not a timeless claim. Older evidence under
`artifacts/evidence/` is historical. Exact commands and production revisions are recorded
in `PROJECT_STATE.md`.

## 2026-08-21 release candidate

- Backend: **271/271** tests passed against an isolated clean PostgreSQL database.
- Browser acceptance: **155/155** Chromium tests passed in 6.0 minutes.
- Live-safe browser canary: **4/4** passed across Chromium and Firefox against the local
  deployed stack; unlike the acceptance suite, it never resets or mutates demo records.
- Accessibility: the principal login, dashboard, data-quality, knowledge, automation and
  audit routes have no automated critical/serious WCAG 2 A/AA/2.1 AA violations.
- Frontend: TypeScript, ESLint, production build, dependency audit and per-asset JS/CSS
  budgets passed; committed visual baselines cover the public entry and engineering story.
- Contracts: committed OpenAPI, event schema, MCP tools and all five n8n definitions match
  their code/manifest sources.
- Recovery: a custom-format PostgreSQL dump was restored into a disposable database; the
  Alembic revision and non-zero canonical table counts matched the source database.
- Operations: Prometheus/Alertmanager configuration validation passed, including the
  watchdog and authenticated n8n receiver route.

## 2026-08-21 production verification

- Immutable application revision `95c91797fa2c599443d69d9c96d83a85ee0711f7` was promoted
  from a checksum-verified source archive after a fresh production backup.
- Source revision and both OCI revision labels matched. Public readiness was green,
  Alembic was at head, all health-gated services were healthy and persisted demo data was
  retained without a deployment reset.
- Trivy found zero fixed HIGH/CRITICAL vulnerabilities in each exact production image.
- Prometheus successfully scraped the bearer-protected API target, Alertmanager carried
  the active delivery watchdog, and the authenticated n8n alert receiver remained active.
- The final non-destructive HTTPS canary passed **4/4** across Chromium and Firefox,
  including the core operator routes and a grounded answer from the real knowledge stack.

## 2026-08-21 resilience upgrade verification

- Immutable revision `00191e9b54ee6b961648a6e02abbb3a57957dba0` was promoted from a
  checksum-verified archive after a verified production dump. A stable gateway now routes
  to two revision-specific API and two web replicas; stateful services are no longer
  restarted by routine application releases.
- Moving host port 1236 from the legacy web container to the gateway was a one-time
  migration hand-off and produced 14 failures across 1,200 rapid probes. Future releases
  do not move that port; their acceptance gate is the zero-error versioned gateway reload.
- The subsequent M50 release exercised that steady-state path: the gateway remained online,
  atomically switched revision-specific API/web aliases and sustained **700/700** external
  readiness probes without interruption. Post-promotion Chromium/Firefox acceptance passed
  **4/4** and 360 concurrent authenticated reads had zero errors at p95 **116.4 ms**.
- The versioned gateway switch sustained **300/300** local rollout probes without an error.
  Production's non-destructive Chromium/Firefox canary passed **4/4**, and 360 authenticated
  concurrent reads returned zero errors at p95 **137.2 ms**.
- PostgreSQL, backup, Prometheus, Alertmanager, Grafana and the gateway all reported healthy;
  Alembic was at head, the protected Prometheus target was present, and backup plus real
  restore-drill evidence remained current.
- Trivy 0.74 found zero fixed HIGH/CRITICAL vulnerabilities in the exact production API,
  web and gateway images. The separately built rclone/PostgreSQL backup-tools image is also
  clean after rebuilding rclone 1.75.0 with Go 1.26.6.
- The OneDrive worker is deployed as an opt-in profile but is not represented as active:
  it requires the owner's one-time interactive Microsoft OAuth authorization. Until that
  happens, verified local backups remain the active recovery source.

## Evidence boundary

The complete local suite uses the deterministic provider and an isolated database so it is
repeatable and safely destructive. Production verification is deliberately smaller and
non-destructive; it verifies the real RAGcore/MCP/n8n health surfaces without resetting the
shared demo. A successful local result is never presented as proof that an external service
was live. The production subsection is added only after the exact committed release is
deployed and observed.

## Remaining product boundary

Fleet Ops remains a synthetic single-tenant PoC. It is not a production identity provider,
payment system, accounting package or public reservation platform. External RAGcore, MCP
Hub and n8n services remain independently operated dependencies and are accessed only
through their documented adapters.