feat(operations): add production readiness gate (#23)

2026-07-16 22:19:51 +02:00
parent 6bad659c12
commit 00d5ff7764
13 changed files with 782 additions and 6 deletions
@@ -116,6 +116,9 @@ rm deploy/compose/secrets/signing-key
 codes are stable automation contracts. Informational events use stdout and
 failures use stderr.

+Successful direct-connection and direct-traffic events include the coarse
+`addressFamily` value `ipv4` or `ipv6`. They never include the peer address.
+
 The deployment smoke performs the full health, publish, join, mediation, direct
 traffic, outcome-report, and cleanup flow using bounded waits:

@@ -220,3 +223,6 @@ least-scope publisher credential from the deployment secret boundary and set the
 external service, mediator, and matching scope variables described in the
 [secure Linux deployment smoke](../deployment/linux.md#http-and-udp-smoke).
 Run representative external-network tests; loopback success is not NAT coverage.
+Use the redacting, bounded
+[real-network canary procedure](../operations/production-readiness.md) for formal
+production evidence rather than committing raw TestClient JSON.