Release Readiness

Current status: external release is blocked

🚫

Static configuration checks are useful but do not authorize an external release. The full platform must demonstrate isolated runtime behavior and a governed end-to-end loop.

Verified configuration evidence

Strict architecture-boundary checks pass.
MCP Connector test and external release-profile validation pass.
Production MCP Connector explicitly binds Governance to govern-prod and agent runtime to iw-agent-runtime-prod.
A production dry-run bundles the MCP Connector with those isolated targets.
External MCP OAuth is deliberately disabled.

Current external-release blockers

The Cloudflare deployment token is invalid.
Hermes has no complete isolated prod Worker profile.
Hermes production resource IDs, bindings, queue topology and secrets are not verified.
Customer Zero deployment and tenant-isolation proof are not demonstrated.
The governed action → receipt → reconciliation → Workbench readback loop is not independently demonstrated in a deployment-like environment.
A clean external-tenant proof is not demonstrated.

Hermes production completion definition

Hermes prod needs an evidence-backed Worker name, Governance/Connector/Pipeline/Spine/Knowledge/Continuity/Workflow service bindings, durable-object compatibility, production KV namespaces, outcome queue topology, production-only secrets and proof that every resource belongs to the intended external ring. Do not copy test identifiers or bind production to unsuffixed/development Workers.

Required proof sequence

Restore least-privilege deployment access

Use a valid Cloudflare token to inspect and deploy only the intended Worker/runtime resources.

Complete isolated Hermes production wiring

Inventory real production resources; configure the complete prod profile; provision secrets without exposing values; run static validation.

Deploy Customer Zero

Prove isolated bindings, data, queues, secrets, health and rollback behavior for the internal dogfooding tenant.

Prove Flow D and one connector lifecycle

Demonstrate server-derived identity, tenant membership, consent, ConnectionBinding, policy, capability grant, revocation and cross-tenant denial.

Prove the governed golden path

Ingest → normalize → Pipeline promotion → Workbench read → proposal → approval → Hermes → provider receipt → re-ingestion → reconciliation → durable user-visible readback.

Prove failure and clean-tenant paths

Test provider failure, duplicate events, idempotent retry, expired approval, revoked connection, compensation and a clean external tenant without Customer Zero data or credentials.

Evidence vocabulary

Label	Meaning
Verified runtime	Reproduced from deployed/provider evidence or an end-to-end execution in the named environment
Verified static/configuration	A command validated the narrow code/configuration property stated
Intended/canonical	Architecture decision; implementation proof may still be missing
Drift	Current source/configuration disagrees with canon
Blocked	A prerequisite is missing; do not make a launch claim

Full System Reference Source Intake & Authority