59 lines
2.7 KiB
Markdown
59 lines
2.7 KiB
Markdown
# Release Gate: Membership Platform (v1)
|
|
|
|
This gate controls deploy/no-deploy decisions for membership-gated commerce changes.
|
|
|
|
## Gate Categories
|
|
|
|
1. Contract/API compatibility
|
|
2. Conformance vectors
|
|
3. Security checks
|
|
4. Legal/policy checks
|
|
5. Observability checks
|
|
|
|
## Deploy Criteria (All Required)
|
|
|
|
1. `docs/conformance/membership-gating-vectors.md`: all vectors pass.
|
|
2. `docs/conformance/member-channel-vectors.md`: all vectors pass.
|
|
3. `docs/conformance/governance-install-vectors.md`: all vectors pass.
|
|
4. `docs/conformance/availability-boundary-vectors.md`: all vectors pass.
|
|
5. OpenAPI and implementation remain compatible.
|
|
6. Signature replay tests pass.
|
|
7. Quote expiry tests pass.
|
|
8. Tx mismatch tests pass.
|
|
9. Membership gate blocks non-members in all checkout paths.
|
|
10. Member channel blocks inactive memberships.
|
|
11. Governance activation blocks inactive/unknown entitlement states.
|
|
12. Boundary mismatch paths fail closed for paid execution.
|
|
13. `PARKED` availability state blocks paid execution while preserving read/export paths.
|
|
14. Admin/support channel endpoints are owner-gated (`org_root_owner` only).
|
|
15. Terms/privacy copy still match utility-access framing.
|
|
16. Structured logs and metrics are emitted for each state transition.
|
|
17. Bundled membership line-item disclosure is present on first checkout quotes.
|
|
18. Public web deployment blocks anonymous production catalog and quote endpoints.
|
|
19. `docs/public-content-standard.md` requirements are satisfied for all changed public pages.
|
|
20. `docs/ai-answer-conformance-checklist.md` passes across Claude, GPT, Grok, and Gemini for changed public URLs.
|
|
|
|
## No-Deploy Triggers
|
|
|
|
1. Any conformance vector failure.
|
|
2. Any path that allows purchase without active membership.
|
|
3. Any activation path that proceeds with non-active entitlement.
|
|
4. Any member channel path serving events to suspended/revoked memberships.
|
|
5. Any governance runtime activation without valid signed package verification.
|
|
6. Any missing audit evidence on successful purchase.
|
|
7. Any breaking API change without version bump and migration note.
|
|
8. Any checkout quote total that cannot be reconciled to disclosed line items.
|
|
9. Any production public route exposing active catalog/checkout without app session auth.
|
|
10. Any boundary mismatch path that still allows paid execution.
|
|
11. Any `PARKED` state that still allows paid execution.
|
|
12. Any non-owner path that can open admin/support channel actions.
|
|
13. Any required public-content conformance fact fails on any required model.
|
|
|
|
## Evidence Bundle Required for Release
|
|
|
|
1. Test result artifact references.
|
|
2. Contract address/version snapshot.
|
|
3. Policy hash snapshot.
|
|
4. Change summary and rollback plan.
|
|
5. AI-answer conformance artifact for changed public URLs.
|