Raxx v1 — Plan to Production

Filed: 2026-07-11 UTC
Adjudicator / PM: raxx-pm-bot
Parent epics: #94 (Production Release v1.0), #146 (raxx-console), #3483 (Paper Trading v1), #3126 (Pre-launch readiness)
Branch: feature/beta-walkthrough-activation-scaffold (commit to develop after operator review)
Companion docs (in progress): - docs/architecture/defense-in-depth-to-production.md — architect defense-in-depth design (being drafted in parallel; referenced as security gate in Waves 2 and 9) - docs/marketing/production-launch-portfolio.md — marketing outcome portfolio (being drafted in parallel; referenced as go/no-go input in Wave 9)

1. Definition of "Finished Product" — v1 Launch Bar

Raxx v1 is a trust milestone, not a feature-completeness milestone. Three gates must be true simultaneously on the day public traffic is admitted.

Gate 1 — Self-onboarding works end-to-end. A net-new user visits raxx.app, registers a passkey, connects a paper-trading broker account, lands on a working Dashboard, and can submit a paper order through the Simulate surface. No operator shortcuts, no console hand-holding, no SQL. Kristerpher walks this exact path on staging and signs off before prod traffic opens.

Gate 2 — Paper trading is stable and the core product is shippable. FLAG_PAPER_TRADING_V1 is flipped on staging, soaked for 7 calendar days with drift < 2%, then promoted to prod. The Simulate surface (unified forward/backward toggle) renders without errors. MBT securities-only backtest remains the existing quality bar. Options backtesting stays behind ENABLE_OPTIONS_BACKTEST=false. The LCC engineering sprint has NOT shipped; it starts after paper trading soak completes.

Gate 3 — The operator can run the platform safely without manual CLI operations. Velvet token rotation works end-to-end via HTTP API (no shell-out to gh/heroku CLIs in the dyno). Console shows real deploy status. Every secret is rotatable from the console. WAF Phase 1 rules are in Block mode on all surfaces. BFM is re-enabled. The first customer email can land and be triaged in FreeScout. Nightly security scan produces output (scan-output absence is treated as HIGH).

What v1 explicitly is NOT (confirmed deferrals): - Live Stripe billing / billing console (#403 and all sub-cards) - iOS companion (#167 and all sub-cards) - Full BYOB broker aggregator (#495) - AI-Assisted Trading (#80) - Options backtesting (#256 gated — Alpaca/ORATS licensing unresolved) - LCC engineering (#3313) — ships in post-v1 wave 0 once paper trading is soaked - Shape 2/3 real-time Rack sentiment (#1398) - Full RBAC/SAML/Workspace OIDC Phase 3+ (#972, #973) - Burr v2 multi-region HA (#1876–#1884) - demo.raxx.app (#482) - Heroku exit strategy (#2075) - Self-serve passkey account recovery (Card 2 of #3842 — full Stripe Identity flow) - Terraform PR automation (#1834 and sub-cards) - WAF Phase 3 CRS block mode (7 days post-launch, not a launch gate)

2. Card Inventory and Disposition

2a. Must-Ship-v1

Cards that gate one of the three v1 launch criteria. In wave order.

Wave 1 — CI Stability

Wave 2 — Security Hardening

Wave 3 — Queue Cutover

Wave 4 — Paper Trading v1

Sub-cards for #3483 are referenced by label in the epic body. card-groomer files them as discrete sub-issues at Wave 4 kickoff. Dependency chain from epic:

SC-15 (flag + B1 migration) — first
  SC-1, SC-2, SC-3 (schema migrations) — parallel
    SC-4 (Alpaca Data API client) — after schema
      GAP-1 (1-min bar provider)
        GAP-2 (bid/ask fill model)
          SC-5 (market order endpoint)
            SC-6 (limit orders)
            SC-7 (IC builder wiring)
            SC-8 (LCC roll wiring)
            GAP-3 / SC-9 (expiry sweep)
            SC-10 (dividend / split batches)
            GAP-5 (equity MTM)
    GAP-4 (tax wire-up, Founders-gated) — parallel with order chain
      SC-12 (trade history + tax section)
  SC-11 (Simulate UI forward mode)
    SC-12 (history tab inside Simulate)
  SC-13 (reset endpoint + UI)
  SC-14 (live-broker CTA placeholder)

Additional paper trading-adjacent card: | #3292 | feat(tax): gain/loss estimator — after-tax P&L for realized trades (Founders-gated) | feature-developer |

Wave 5 — Antlers / Onboarding / Shape 1

Wave 6 — FreeScout + Support

Wave 7 — Velvet + Operator Tooling

Wave 8 — Marketing Site + Docs

Wave 9 — Go/No-Go + Launch

2b. Defer — Post-v1

These cards will not block launch. Confirmed deferred.

iOS: #167, #175, #176, #177, #178, #179, #180, #181, #182, #2448
Billing console: #403, #408, #409, #410, #411, #1633, #1635
BYOB/Hybrid broker: #495
AI-Assisted Trading: #80, #245
LCC engineering: #3313
Shape 2/3: #1385, #1390, #1398, #1401, #1402, #1403, #1404, #1405, #1406
Obfuscate mode + Founders promo mechanics: #204 sub-cards #207–#240
Heroku exit strategy: #2075
demo.raxx.app: #482, #493
i18n: #1463
Full RBAC Phase 3+4: #972, #973, #1474, #1475, #1476, #1479, #1725
RBAC compliance role: #1479
Console break-glass full suite: #1692, #1693, #1694, #1695, #1696
Burr v2 multi-region HA: #1876, #1877, #1878, #1880, #1881, #1882, #1883, #1884, #1888, #1889
Terraform PR automation: #1834, #1836, #1837, #1838, #1839, #1840, #1841, #1842, #1843, #1844, #1845, #1846, #1847, #1848, #1849
Ubicloud runners: #728
CI billing posture: #726
Self-serve passkey recovery (Card 2): #3844
Percentage-rollout for flags: #1590
WCB sparkline + account merge v2: #1660, #1661, #1662, #3301, #3302
Workflow UUID tracing replay UI: #500, #513
Passkey E2E encryption: #250, #272
Support portal public SPA: #652, #655, #657, #658, #663, #664, #665
Docs BLR full audit: #2681
Polygon contract: #3504
Amazon Associates signup: #2769
Console flag decommission sunset notification: #1589
pg_audit extension + audit archiver: #1493, #1494
RBAC drift detection service: #1967
Console Recents autocollapse flag fix: #2210
WAF Phase 3 CRS block mode: (7 days post-launch)
CF Pages logs to S3 Logpush: #3458
Status dashboard Variant B service map: #3448
Status dashboard alerts/paging vendor: #3449
Flag operator UX hardening + Pony docs: #2299
Demo session continuation: #493
SC-12 replay UI in console: #513
Console flag operator UX hardening: #2299
FreeScout productionize Phase 2 (email notifications sub-6, SPA sub-4): deferred to post-v1 launch window
Reasonator Pro tier badge: #1405
Reasonator review queue: #1691, #1693, #1695, #1696
OpenAPI spec Phase 2 (full docs site publish): beyond #575
Heroku exit strategy trigger conditions: #2075
Local dev environment design: #2054
Burr v1 audit + pentest: #1869 (post-v1; Burr v1 stays in place at launch)
HEROKU_API_KEY rotation cadence (calendar event): post-Wave 7 operator action

Legal/compliance items (out of scope per operator directive):

3858, #3840, #3149, #3141, #3142, #3143, #3144, #3145, #3146, #3148, #2847, #2850, #2856, #2859, #2862, #2863, #2864, #2865, #2855, #1642, #197 (gates flag flip but is not an engineering card), #185, #152, #300

2c. Closed as Obsolete or Superseded

3. Release Waves — Sequenced Plan

Pre-Wave: Immediate Operator Actions (do now, unblocks everything)

1. Provision raxx-ci-config GitHub App (#4139) — 10-step browser procedure in the card; store App ID, private key, and installation ID in SSM. Unblocks Wave 1 wp-config-svc cutover.
2. Authorize CF WAF skip rules + BFM re-enable sequence (#3634 Action A) — confirm sre-agent has Zone:Bot Management:Edit scope, or provision CLOUDFLARE_RAXX_AUTOMATION_API_TOKEN for the BFM toggle. Unblocks Wave 2.
3. Confirm Alpaca data redistribution posture — FLAG_PAPER_TRADING_V1 stays OFF until the operator either receives written confirmation from Alpaca sales or makes an explicit documented decision to proceed under the existing terms. File the decision as a comment on #3483. Unblocks Wave 4 flag flip only (engineering proceeds regardless).

Wave 1 — CI Stability

Entry: Pre-wave operator actions done (specifically #4139 GitHub App provisioned).
Exit criteria: - gh workflow list --all returns exactly woodpecker-healthcheck.yml and ios-ci.yml (disabled) - wp-config-svc in active mode; CloudWatch shows zero forge fallbacks for 48h - #4148 and #4149 merged; FLAG_IDEMPOTENCY_MIDDLEWARE soaking on staging - All WP cron and deploy pipelines show a 24h green run

Dependencies: #4141 shadow soak must complete before #4142 dispatches. #4107 and #4108 are shared-infra prerequisites for the deliberate-holds batch (#4106).

Agent responsibilities: sre-agent owns wp-config-svc cutover (#4141, #4142) and Terraform/runner infra (#4012, #4039). feature-developer owns all WP pipeline port cards in parallel batches.

Risk and mitigation: If the forge connectivity probe added by #4141 fails during cutover, roll back by setting SHADOW_MODE=true and re-enabling the forge path. Do not proceed to Wave 2 with CI unstable.

Wave 2 — Security Hardening

Entry: Wave 1 CI stable.
Exit criteria: - CF Managed Ruleset in Block mode on all 9 surfaces - Auth endpoint rate limits live and tested against synthetic traffic - BFM re-enabled on raxx.app zone (skip rules verified live) - CF Access removed from raxx.app + api.raxx.app (#1025, #3209) - Per-agent scoped Infisical identities provisioned (#3738) - Nightly security scan producing output for 3 consecutive nights - WAF Phase 2 (OWASP CRS in Log mode on api.raxx.app) active - Architect defense-in-depth doc (docs/architecture/defense-in-depth-to-production.md) signed off

Dependencies: WAF skip rules must precede BFM re-enable. CF Access removal must follow WAF Phase 1 block mode. Never remove CF Access while WAF is not blocking.

Agent responsibilities: sre-agent owns all WAF Terraform, BFM, and CF Access removal. software-architect reviews WAF rule set against defense-in-depth doc.

Risk and mitigation: WAF false-positive on WebAuthn CBOR payloads (large bodies). Mitigation: deploy WAF in Challenge mode on api.raxx.app for 48h before Block mode; add a size-exception whitelist rule on /api/auth/register. CRS stays in Log mode at launch.

Wave 3 — Queue Cutover

Entry: Wave 2 security stable; prod Queue dyno confirmed live (not zero-dyno state).
Exit criteria: - FLAG_QUEUE_V1 ON in prod - All consumer services (Console, Antlers, Velvet, Reasonator) read from Queue API, not direct-DB - Raptor customers and sessions tables read-only (no new writes outside Queue) - 7-day dual-write audit soak complete with < 0.1% row discrepancy - QC-8 audit unification flag flipped and stable for 24h

Dependencies: #1517 (session-mint cutover) must soak before #2445, #2447, #2449, #2450 dispatch. #1473 (console blueprint cutover) must land before #2445. QC-5 (iOS) deferred.

Agent responsibilities: feature-developer owns all QC-* cards in strict dependency order.

Risk and mitigation: Stripe webhook receiver (QC-3, #2446) touches the billing path. At v1 there are no live Stripe keys on prod (billing deferred per ADJ-7), so this is a safe schema/routing change. Proceed.

Wave 4 — Paper Trading v1

Entry: Wave 3 Queue stable; Alpaca redistribution posture confirmed (operator comment on #3483).
Exit criteria: - All SC- and GAP- cards under #3483 merged and CI green - FLAG_PAPER_TRADING_V1 ON on staging; 7-day soak with drift < 2% - market_data_access_log populated with every Alpaca fetch (redistribution audit trail) - Simulate UI forward mode renders paper portfolio tile and trade history - Backtest tab functions without regression - Paper reset cooldown enforced server-side; cooldown_expires_at returned in API when blocked - Tax section in SC-12 is Founders-gated and confirmed hidden (not grayed) for Free/Pro - Securities attorney sign-off on MBT profile narrative (#197) confirmed before flag flip to prod

Dependency chain: SC-15 first, then SC-1/2/3 in parallel, then SC-4, then GAP-1, GAP-2, then the order endpoint chain. See epic #3483 for the full tree.

card-groomer should break SC-1 through SC-15 and GAP-1 through GAP-5 into discrete sub-issues under #3483 at Wave 4 kickoff. Each becomes a standalone PR.

Agent responsibilities: feature-developer owns all paper trading cards. data-scientist reviews fill model against reference implementation (PR #3481).

Risk and mitigation: Alpaca redistribution clause is the top risk. If operator has not confirmed posture by the time SC-4 is ready to merge, SC-4 must not merge. Escalate to operator immediately rather than proceeding.

Wave 5 — Antlers / Onboarding / Shape 1

Entry: Paper Trading scaffolding in place (SC-15 flag card merged); Wave 2 security stable.
Exit criteria: - Beta walkthrough PR (#3513, current branch) merged to develop - Beta tester program intake form, signed walkthrough links, and scoring pipeline operational - Onboarding Wizard (#469) allows a net-new user: passkey register → email verify → broker connect (paper) → working Dashboard, zero operator assistance - Shape 1 SHAPE1-1 through SHAPE1-5 merged; FLAG_SENTIMENT_JOURNAL stays OFF at launch - Console ghost-reset tool (#3842 Card 1) tested against a ghost-enrolled staging account - DemoContext pre-mount flag access design resolved (#2281) before routing refactor (#2280) - pytest-cov hang (#3928) resolved so CI is not flaky during this wave

Note on Onboarding Wizard open questions (ADJ-11 closes these): Q1 = 14-day trial, no card required. Q2 = Free / Pro $39 / Pro+ $79 / Founders intro $29. Q3 = demo persistence is Phase 2 (deferred).

Agent responsibilities: feature-developer for all engineering. ux-polisher for copy review (#3147) and illustration passes (#1110). software-architect for DemoContext design (#2281).

Wave 6 — FreeScout + Support Readiness

Entry: Wave 4 product stable.
Exit criteria: - support@raxx.app mailbox live in FreeScout and confirmed not claimed by Google Workspace - DMARC monitoring record published - Auto-reply on new ticket functioning - Slack DM webhook fires on new ticket creation - privacy@raxx.app routes DSR intake - FreeScout admin TOTP enrolled; recovery codes in vault - Audit webhook provisioned and #3286 resolved - Canned responses and basic KB pre-loaded

Agent responsibilities: sre-agent owns all FreeScout infra. Operator performs TOTP enrollment manually (#3285).

Risk and mitigation: If Google Groups non-delivery bug (#1215) cannot be resolved quickly, route directly via Postmark into FreeScout, bypassing Google Groups entirely. Do not let email routing block support readiness.

Wave 7 — Velvet + Operator Tooling

Entry: Wave 6 support ready.
Exit criteria: - Velvet three-stage rotation modal shipped; zero shell-out to gh/heroku CLIs in any dyno - HEROKU_API_KEY rotated end-to-end through Velvet and confirmed clean (#251) - CD freshness monitor (#1372) active; alert fires if prod lags main > 24h - Flag promotion UI (#2016, #798 sub-cards) merged; FLAG_CONSOLE_FLAG_PROMOTIONS flipped ON after smoke test - FLAG_IDEMPOTENCY_MIDDLEWARE soaked and flipped ON in prod - Billing DB path (#2595) set correctly - BCP restore drill (#2655) completed and documented - #417 and #253 closed (Velvet is now the canonical rotation system)

Agent responsibilities: feature-developer for Velvet UI and flag system. sre-agent for secrets rotation, BCP drill, and monitoring.

Wave 8 — Marketing Site + Docs

Entry: Wave 5 onboarding stable; runs in parallel with Wave 7.
Exit criteria: - getraxx.com engineering items live: Privacy/ToS placeholder pages (#586), pricing copy update, pillar refresh - status.raxx.app surface taxonomy wired; 3P upstream polling live; tile polish complete (#3439–#3444, #3447) - docs.raxx.app public (noindex removed from docs subdomain; all links valid) - OpenAPI 3.1 spec generated from backend_v2 routes (#575) and linked from docs index - PostHog instrumentation live on Antlers + Raptor (#214)

Note: Marketing copy items gated on attorney review (dual-audience messaging #2856–#2865, investment-adviser disclaimers #2859) are legal-blocked. Only engineering-unblocked items ship in this wave. Blocked copy cards defer until attorney signs off.

Wave 9 — Go/No-Go + Launch

Entry: ALL waves 1–8 complete or explicitly confirmed deferred.

Entry gate checklist (every item must be TRUE before prod traffic):

Infrastructure: - [ ] Woodpecker CI stable; zero GHA workflows active except healthcheck and ios-ci (disabled) - [ ] wp-config-svc active mode; forge fallbacks zero for 48h - [ ] WAF Phase 1 Block mode live on all 9 surfaces - [ ] BFM re-enabled on raxx.app zone - [ ] CF Access removed from raxx.app + api.raxx.app - [ ] Per-agent scoped Infisical identities active (#3738)

Product: - [ ] FLAG_PAPER_TRADING_V1 on staging; 7-day soak green; drift < 2% - [ ] Alpaca redistribution posture documented (operator comment on #3483) - [ ] FLAG_IDEMPOTENCY_MIDDLEWARE on prod; Waves 2 and 3 soaked - [ ] FLAG_QUEUE_V1 on prod; Queue cutover soaked 7 days - [ ] Onboarding Wizard E2E working on staging (zero operator shortcuts) - [ ] Kristerpher completes full self-onboarding on staging and files sign-off comment on #94

Security: - [ ] Architect defense-in-depth doc signed off - [ ] Securities attorney sign-off on MBT narrative (#197) OR explicit written operator waiver filed on #197 - [ ] HEROKU_API_KEY rotated through Velvet; rotation confirmed clean end-to-end - [ ] Nightly security scan: 7 consecutive nights with output (zero silent-dark events) - [ ] FreeScout TOTP enrolled; recovery codes in vault (#3285)

Support: - [ ] support@raxx.app live in FreeScout - [ ] Auto-reply functioning - [ ] privacy@raxx.app routes DSR intake

Marketing: - [ ] getraxx.com engineering items live (pricing, Privacy/ToS placeholders, pillars) - [ ] Marketing outcome portfolio (docs/marketing/production-launch-portfolio.md) complete - [ ] noindex removal scheduled (remove on launch day, not before)

Exit (launch is live): - FLAG_PAPER_TRADING_V1 flipped ON in prod (#4167) - noindex headers removed from raxx.app and getraxx.com - First closed-beta tester cohort invite sent via signed walkthrough links - Operator files sign-off comment on #94 confirming Gate 1 (self-onboarding) passed on PROD

4. Adjudication Log

Every open decision found in the backlog. Ruling and rationale are final.

5. Definition of Done per Surface

Antlers (raxx.app customer frontend)

• Self-onboarding flow complete end-to-end (passkey register, email verify, profile, broker connect paper, working Dashboard)
• Simulate surface renders paper portfolio tile and trade history; forward/backward toggle is URL-persisted; backtest tab not regressed
• Paper order submit sends Idempotency-Key header on every request
• All surfaces are CE-skinned (zero raw react-bootstrap chrome)
• useFlag() used for all flag checks; isEnabled() removed from routing layer (#2280)
• Beta walkthrough 5-screen flow renders; per-tester signed token works
• Error and empty states use Jupiter/Bandz illustrations (#1110)

Raptor (backend_v2 / api.raxx.app)

• Paper trading fill engine stable: market + limit orders, resting evaluation, expiry sweep, equity MTM, dividend/split adjustments, Founders-gated tax integration
• Idempotency middleware active on Tier-1 endpoints; replay returns correct 201 idempotently; replay events logged separately from audit rows
• Queue is the authoritative writer for customers/sessions; Raptor tables read-only
• OpenAPI 3.1 spec generated, accurate, and linked from docs
• All migrations through 0060 clean on Heroku Postgres prod and staging
• No gh or heroku CLI shell-outs in any dyno process
• Nightly security scan produces output for 7 consecutive nights

raxx-console (console.raxx.app)

• Deploy button shows accurate live deploy status without leaving the dashboard
• Flag promotion flow (mark-promote, promote) works without heroku config:set
• Ghost-reset tool allows operator to re-invite a stuck user without SQL
• Rotation modal (three-stage: verify, distribute, validate+revoke) works end-to-end for HEROKU_API_KEY
• CD freshness alert fires if prod lags main > 24h

Queue (C++ identity service)

• All consumer services read from Queue API (confirmed by QC-8 audit unification soak)
• Stripe webhook receiver deployed to Queue (no live billing at launch, but correct architectural home)
• FLAG_QUEUE_V1 ON in prod
• No direct-DB reads from Raptor/Console/Antlers into Queue Postgres tables

iOS

Deferred. #4020 (disable ios-ci.yml) is the only iOS-related action in this plan.

6. Go/No-Go Checklist for Launch

Tracked as actionable checkboxes in #4166 (filed in Appendix A). Summary above in Wave 9 entry gate. No launch proceeds until every checkbox is TRUE.

7. Handoffs

software-architect: docs/architecture/defense-in-depth-to-production.md is a required input for the Wave 2 WAF design review and the Wave 9 security gate. When it ships, its WAF rule set is the canonical spec for #1735 and phases. Its idempotency-at-rest section confirms or escalates ADJ-1.

Marketing agent: docs/marketing/production-launch-portfolio.md is a required input to Wave 9 go/no-go (#4166). The portfolio defines the market-facing launch-ready bar. If it surfaces a feature gap not covered by v1 engineering, file a card immediately; the adjudicator will re-classify it.

card-groomer: Wave 4 kickoff requires breaking #3483 SC-1 through SC-15 and GAP-1 through GAP-5 into discrete sub-issues. File them at Wave 4 start with area:paper-trading, size:*, epic-linked, and needs-grooming labels. Use the dependency chain in the epic body to set blockers. Tag card-groomer ready for grooming pass on each.

Appendix A — New Cards Filed by This Plan

NEW-PTP-1: v1 launch go/no-go gate — staging walkthrough + checklist

See filing below.

NEW-PTP-2: Flip FLAG_PAPER_TRADING_V1 to prod — post-7-day-soak activation step

See filing below.

Appendix B — Closed Issues (by this plan)