Release gates
Evidence required before Frawl can be called production-ready.
Release gates
The source implementation and local checks are separate from production acceptance. A checked-in command or mock fixture is not evidence of a successful provider sandbox run. Do not enable live charges or deploy production until the owner authorizes that action.
Automated local gates
The checks below record local results. The pull-request workflow independently repeats them on Linux.
- Installation, Prisma generation and eight migrations on isolated PostgreSQL 17 databases.
- Formatting, lint, all workspace type checks, domain/API/integration tests and builds.
- SDK below 5,000 minified uncompressed bytes, storage unavailable and consent denied cases.
- Actual workerd queue delivery, durable ingestion, retry and duplicate delivery.
- Non-owner RLS tenant/environment isolation and composite-key rejection.
- Delivery/financial deduplication, late attribution, refund-before-sale, cumulative refunds and disputes.
- Concurrent payout reservation, split approvals, stable exports, partial confirmations and post-payment reversals.
- Moyasar same-given_id retries, paid-vs-timeout races, 3DS, calendar renewals and consent revocation using isolated provider fixtures.
- SCIM provisioning without roles, cross-connection isolation, mapping changes, deactivation and token rotation against the installed plugin.
- Chromium, Firefox and WebKit: English/Arabic, mobile/desktop layouts, login and real campaign API writes.
- Local consistent-snapshot backup restore and ledger/payout/aggregate reconciliation.
Required external acceptance
- Each PSP sandbox: sale, renewal where native, duplicate, partial/full refund and supported dispute events.
- Real SAML and OIDC identity provider: successful login, wrong audience/state, replay and expired assertion.
- Real SCIM directory client, pagination/filter/PATCH interoperability and credential rotation.
- Actual Safari on supported hardware, including consent/storage restrictions and cross-domain checkout.
- WCAG 2.2 AA review with assistive technology and contrast measurement.
- Deployed distribution of one million clicks/day and peak 1,000 requests/second; report measurement regions.
- Edge acceptance p95 below 100 ms near ingress and dashboard freshness within 30 seconds at target load.
- Queue/database outage exercise, DLQ replay and backlog alerts before queue retention expires.
- Encrypted backup restore with ledger/payout/aggregation reconciliation.
- Production mail, DNS/TLS, identity recovery and scoped secret rotation rehearsal.
- Moyasar recurring/USD activation, owner consent, operator identity and applicable invoicing setup.
- Legal/operator details replace draft public terms/privacy disclosures.
Evidence log
Verification on 2026-09-22:
| Check | Local result |
|---|---|
| Unit and integration suites | 280 tests across 16 packages; includes 25 native PostgreSQL domain/credential tests, 38 API tests and 11 auth tests |
| Type checking | 27 workspace tasks passed |
| Production builds | Six tasks passed, including all three Next.js apps and Wrangler dry-run |
| Tracking SDK | 2,621 minified bytes before compression; no dependencies |
| Tracking round trip | Real workerd queue → Hono → PostgreSQL → referral claim → payment → one balanced commission; signed replay rejected |
| Payout browser workflow | Independent approval, CSV fingerprint, partial then full confirmation and matching affiliate history |
| Restore rehearsal | Separate local restored database matched the consistent snapshot; encrypted staging restoration is still required |
| Runtime credential | A distinct non-owner LOGIN obeyed RLS and could not assume the migration-owner role or bypass isolation after resetting its role |
Provider signature fixtures exercise adapter behavior, not live sandbox connectivity. Browser SSO tests verify the login request and error handling, not a successful external identity-provider exchange. WebKit automation does not replace the actual Safari gate. Assistive-technology and comprehensive keyboard auditing remain part of external accessibility acceptance.
The local Worker benchmark accepted 2,000 events without loss, with approximately 1,005 requests/second offered and 805 requests/second completed in that run. This single-machine result is a diagnostic, not proof of the deployed capacity or latency objective. Re-run the committed harness in a dedicated staging environment and record region, traffic shape, failures, queue drain time and p95/p99.
Local test counts and final gate results are recorded with the implementation pull request. Keep unchecked external gates visible; do not convert them to passes based on unit tests.