Production release

link to this sectionProduction release

The canonical runbook is `docs/runbooks/production-release.md`. This page is the orientation layer: what triggers what, and which checks must be green before and after.

link to this sectionDeploy triggers

• The web app deploys to Cloudflare on pushes to main that touch

apps/web/**, docs/product/**, or the workflow itself (.github/workflows/web-production.yml).

• The api-edge worker deploys manually from its package scripts after the

contract changes are merged.

link to this sectionRelease gates

1. The Validate workflow is green on the merge commit: package tests,

the web suite (direct node, per the AGENTS.md pnpm trap), the docs reference dirty-diff check, and the whitespace gate.

1. The Web Production deployment finishes and the production URL answers.
2. Post-deploy smoke, per the canonical runbook's mandatory checks: the

API /health response, an authenticated read, a write smoke test, and the observation-window log review - a green web permalink alone does not clear a release.

1. Web-level smoke: open a known object permalink and the docs homepage.

link to this sectionAfter an incident

Follow docs/runbooks/secret-exposure-response.md for credential events and docs/runbooks/platform-signing-key-rotation.md for key rotation - both are canonical and versioned with the repository.