Beta RC Release Gate — Evidence and Decision

Reading guide

This release gate records evidence and a decision for a specific candidate and staging environment.

Do not generalize its decision to later source commits or production without rerunning the required checks.

Current branch: feat/pg-magician Candidate source SHA: d83e29adfaf07be8a9ac1a620ba9cd56bb921a36 Staging deployment under verification:

• Frontend: https://staging.nougat-devpay.pages.dev
• API: https://api.staging.devpay.chu.plus
• Worker: nougat-devpay-api-staging, deployed version dc0caf4a-d26a-423e-85c3-59e3ad8e6f01
• D1: nougat-devpay-d1-staging (0d9d565e-6090-4e67-9723-f21e31f11ee1)

Decision

PUBLIC_BETA_READY_WITH_LIMITATIONS

This is a release-candidate recommendation, not authorization to deploy production. Production deployment, production D1 mutation, DNS/secret/configuration changes, and real vendor/customer actions still require explicit user authorization.

Verified evidence

Area	Evidence	Result
Identity and authorization	Staging Worker/D1 authorization matrix with anonymous, buyer, seller A/B, admin, and dev-header cases	53/53 checks passed
Seller settings/product persistence	Staging save/read-back, product CRUD/status/field persistence, cross-seller isolation	Passed
Operator console contract	Staging admin matrix including /me, admin overview/users/verification/audit, seller rejection, missing-user 404	29/29 checks passed
Real user flow	Staging visitor → signup → login → seller onboarding → product create → publish → anonymous store	19 checks passed
Commerce reliability	Staging checkout/idempotency/concurrency, paid/mock policy, refund/license/subscription/settlement, outbox, ledger, audit	32/32 checks passed
Deployment smoke	Staging frontend root, SPA deep link, API health, unauthenticated GET/POST /api/v1/projects	All expected 200/401 responses passed
CORS	Allowed staging origin returned 200 with matching Access-Control-Allow-Origin; denied origin returned 403 CORS_ORIGIN_DENIED	Passed
Rate limit	Five failed logins returned 401; sixth and seventh returned 429 RATE_LIMITED	Passed
Worker observability	X-Request-ID response headers and matching request_id error bodies verified; /api/v1/metrics returned 401 anonymous, 403 buyer, 200 admin with aggregate counts only	Passed
Staging browser E2E	v9-landing-signup.spec.ts against deployed staging artifact	4/4 passed
Staging public/role E2E	staging-public-role.spec.ts with isolated buyer/seller/product data against deployed staging artifact	5/5 passed
Control Plane gates	Task-head and merged-candidate checks for integrated release work	All submitted release tasks passed
FE build/typecheck	vue-tsc, pnpm build:staging, pnpm build:production on candidate SHA	Passed
Worker build	worker-build --release on candidate source	Passed
Local backend regression	cargo test --locked --offline	29 passed, 1 PostgreSQL-dependent test ignored
D1 migration tracking	Staging schema_version contains versions 1–11, each with a checksum	Passed
D1 backup/restore rehearsal	wrangler d1 export staging → scratch SQLite restore → live row-count comparison	23/23 tables matched
Environment API alignment	Deployed staging HTML references https://api.staging.devpay.chu.plus; no 127.0.0.1:8080/localhost:8080	Passed

Current limitations

• Real PG payment capture, provider callbacks, settlement payout, and provider refund are not integrated. Production must continue to fail closed with NOT_LIVE_PAYMENT/402 until separately approved and verified.
• Real email delivery and email ownership proof are not integrated. Mock email must not verify ownership or claim historic purchases/licenses.
• Account recovery and full deletion are not complete; deactivation exists, but customer-facing recovery/deletion flow remains a limitation.
• Customer support channel, incident-response ownership, and external public-launch scope are not fully established.
• Legal/privacy pages exist and are reachable, but the actual operating/legal entity review is not independently verified here.
• Latest Worker/CORS and release-candidate changes were deployed and verified on staging only. Current production runtime must not be claimed verified for this candidate without a new authorized production deployment and production smoke check.
• Official staging custom domain https://staging.devpay.chu.plus has been registered in the Pages project and its CNAME points to nougat-devpay.pages.dev, but Cloudflare certificate validation was still pending at evidence time. The completed browser run verified the actual Pages alias https://staging.nougat-devpay.pages.dev.
• Local Axum/SQLite tests are regression evidence only; they are not a substitute for Worker/D1 verification.

Production gate before any public deployment

1. Obtain explicit user authorization for the production deployment and any production DNS/secret/D1 changes.
2. Deploy the locally built Worker artifact and locally built Pages artifact corresponding to the approved candidate.
3. Run non-mutating production smoke: frontend root, SPA deep link, API health, unauthenticated protected-route 401, CORS denied-origin check, and environment API-base check.
4. Confirm production PAYMENT_MODE remains live-payment-only and paid mock checkout is rejected with 402 NOT_LIVE_PAYMENT.
5. Record production deployment IDs/versions, source SHA, smoke output, rollback target, and operator approval.