Stage,Name,Responsible owner,Procedure,Evidence / source,Failure handling
D01,Freeze and select release,Release owner,"Confirm change scope, active UI pointer/hash, service JARs, DB/config state, gateway routes and named target. Separate full installation from incremental changes.","Release Baseline; DP01, DP18, DP22–23",Stop if expected baseline has changed; rebase/rehearse.
D02,Build and test candidate,Engineering / QA,"Build the actual source candidate; retain typecheck/build logs, dependency locks, suite scripts, hashes and test environment. Historical capture pack does not build modules.","E02, E08; DP02, DP08, DP15",Do not promote failed or untested artifact changes.
D03,Rehearse migrations and rollback,DBA / configuration owner,"Restore protected snapshots into isolated databases; apply exact ordered inventory, replay, check data preservation and execute rollback. Rehearse business and configuration DB separately.","T04, T20, T21; E08; DP12, DP16, DP20","Reject drift, non-replayable migrations or incomplete rollback."
D04,Package and seal,Release engineer,Create archive and per-file manifest. Bind readiness and acceptance to artifact/UI/runtime hashes. Keep private runtime archives outside the UAT documentation pack.,"DP08, DP09, DP15",Reject missing files or mismatched hashes.
D05,Transfer and stage,Operations,Upload over the established SSH connection; verify archive SHA256 on VM; extract into new /opt/kernel/releases/<release>; verify each manifest entry.,DP01 upload/install; DP10; DP18,Leave active release unchanged on integrity failure.
D06,Backup and guard active baseline,Operations / DBA,"Capture ACTIVE.json, private service registry, changed files/units, Boot snapshots and database undo metadata. Acquire activation lock and compare baseline hashes. Record DB backup and recovery target.","DP11, DP18; /opt/kernel/backups/<release>","Stop on lock contention, drift or missing recovery evidence."
D07,Quiesce affected producers,Operations / module owner,"For Studio release, stop Vista/Tenant producers and wait for existing render work to drain before stopping render workers. For Scheduler, prevent uncontrolled claims and track in-flight owner outcomes.",DP11 drain loop; DP18; T11,Studio cancels if queued/rendering output cannot drain; never discard queue to force release.
D08,Apply business then configuration changes,DBA / IAM / Axis owners,"Apply release-ordered transactions with time/lock bounds; register approved routes, mappings and service identity; preserve historical is_active nulls as rehearsed. Capture undo before/after state.","T20–21; DP11–13, DP18–19",Business/config databases are separate commits; use recorded compensation if later phase fails.
D09,Install and activate runtime,Operations,Install hash-pinned worker/runtime artifacts and protected environment refs. Publish Boot configuration; wait for projection; start/restart only affected services and verify readiness.,"DP11, DP18; E05, E07",Restore prior runtime/config; wait for rollback projection; verify readiness.
D10,Switch UI / gateway when in scope,Operations,"Atomically change generated UI ACTIVE.json only after prerequisites. Edge changes also validate Kong host routing and nginx -t, then reload Nginx. Preserve unrelated current sources.","DP06, DP11, DP18, DP22–23","Restore matched pointer, route/origin and source/config backups."
D11,Verify deployed installation,QA / Operations,"Check service readiness, public TLS/login, anonymous denials, allowed/denied profiles, current assets, worker heartbeat and scoped lifecycle checks. Record production mutation/delivery boundaries.","E06, E07; T02, T19; E01",Reconcile failures; use component rollback or bounded fix. Health alone is not UAT.
D12,Issue baseline and hand over,Release owner / UAT lead,"Record actual active component values, signatures, residual gaps, approved test accounts/data and source evidence. Run new business UAT in the agreed environment.",Environment; Release Baseline; Entry Gates; 280 UAT cases,Keep acceptance Pending until exit gates and authorized signatures are complete.