Deployment model

Production readiness belongs to an exact build in an exact environment.

Runtime diagrams and repository tests describe boundaries. Production sign-off requires recorded migration, authorisation, recovery, storage, connector, browser and operational acceptance on immutable artifacts.

Runtime diagrams and repository tests describe boundaries. Production sign-off requires recorded migration, authorisation, recovery, storage, connector, browser and operational acceptance on immutable artifacts.
Deployment model
Current runtime makes workload boundaries concrete.

Tenant delivery, administrative control, durable data, asynchronous workloads, retained artifacts, controlled Python and Assurance recovery paths remain separated in the current runtime model.

Managed AWS services are a target architecture.

Database, cache, object storage, secrets, keys, logs and workload services can map to managed AWS capabilities. This repository does not claim to ship one universal production ECS or CDK stack.

Acceptance covers failure, not only startup.

Migration ledgers, negative authorisation paths, broker outage, redelivery, stale recovery, storage tamper, backup and restore, connector certification and rollback rehearsal belong in sign-off.

Public status cannot certify a customer environment.

Capability labels describe current product scope. The customer and deployment owner must record infrastructure, security, legal and operational acceptance for the selected architecture.

Current runtime makes workload boundaries concrete.

Tenant delivery, administrative control, durable data, asynchronous workloads, retained artifacts, controlled Python and Assurance recovery paths remain separated in the current runtime model.

Managed AWS services are a target architecture.

Database, cache, object storage, secrets, keys, logs and workload services can map to managed AWS capabilities. This repository does not claim to ship one universal production ECS or CDK stack.

Acceptance covers failure, not only startup.

Migration ledgers, negative authorisation paths, broker outage, redelivery, stale recovery, storage tamper, backup and restore, connector certification and rollback rehearsal belong in sign-off.

Public status cannot certify a customer environment.

Capability labels describe current product scope. The customer and deployment owner must record infrastructure, security, legal and operational acceptance for the selected architecture.

Next step

Start with the flow that cannot afford ambiguity.

Bring the systems, owners, rules, delivery obligations and evidence requirements that matter.

Discuss a critical flow

In brief

Does a deployment become production-ready automatically?

No. Production sign-off requires the exact revision, immutable images, target infrastructure and recorded migration, authorisation, recovery, storage, connector and operational acceptance.

Where does customer data live?

Deployment and job policy decide the path. Supported STANDARD work may use controlled spool, EPHEMERAL_STAGING requires verified deletion before success, and NO_STAGING permits only a content-free source-to-target path with bounded in-memory pages. Connector and production acceptance still apply.