Major release checklist (the "everything checked" gate)

Governs: whether a release ceremony is allowed to cut a vX.0.0 (Major) tag instead of a v0.X.0 (Minor) tag. Owner: operator (Kristerpher) Defined by: ADR-0148 (versioning scheme) Status: stub — no version has ever passed this checklist (as of 2026-07-31, Raxx has never earned a Major release; see ADR-0148 §Why 1.x has not been earned).

How this checklist is used

A release ceremony (release → main, per ADR-0115) defaults to a Minor bump (v0.X.0). It may only be tagged as a Major bump (vX.0.0) if every item below is checked for the exact commit being promoted, and the operator records that fact in the release ceremony notes (the GitHub Release body created by deploy-prod.yaml's create-github-release step, or a comment on the promotion PR).

There is no automation that enforces this today — the gate is procedural, enforced by the operator at tag-cut time. If/when this becomes a recurring decision (i.e. Raxx approaches its first credible Major candidate), the checklist below should be lifted into a CI gate (a .woodpecker/ pipeline step that fails a vX.0.0 tag push unless every item has a linked, timestamped verification artifact). That automation is out of scope for ADR-0148 — this file is the human-readable checklist that automation would eventually enforce.

Checklist

1. All surfaces smoke-tested

• [ ] Raptor (backend) — full endpoint smoke pass against a real (non-mocked) broker sandbox, all documented routes return expected shapes.
• [ ] Console (console.raxx.app) — full click-through of every nav item under every RBAC role the app defines.
• [ ] Antlers / Antlers Next (raxx.app) — full onboarding → signup → 2FA → first-strategy-view flow, on both a fresh account and an existing account.
• [ ] iOS app — TestFlight build smoke pass covering the same flows as Antlers.
• [ ] Support portal (support.raxx.app) — ticket creation, reply, and status transitions verified end-to-end.
• [ ] Velvet (token/rotation service) — a full rotation cycle exercised and verified in the target environment.

2. All flags reconciled

• [ ] feature_flags.yaml reconciler run with zero drift (docs/ops/runbooks/ flag-reconciler runbook) — every flag's declared state matches its live Heroku config state across staging and prod.
• [ ] No flag has been left in a "temporary" ON/OFF state past its documented review date.
• [ ] Flag risk classification (project_flag_risk_classification) reviewed — no HIGH-risk flag is live without an explicit operator sign-off note.

3. Security review

• [ ] Nightly security scan (security-scan-nightly.yaml) green for the 7 days preceding the tag.
• [ ] ZAP scan (security-zap.yaml) run against the exact commit being promoted, zero HIGH findings unresolved.
• [ ] Credential rotation posture reviewed — no credential is overdue per docs/ops/runbooks/ rotation schedule.
• [ ] Release-readiness policy (docs/security/release-readiness-policy.md) gates re-checked for this specific commit — no waived item remains waived without an explicit re-justification.

4. Migrations verified

• [ ] Every Alembic migration since the last Major (or since inception) has been applied to a full-scale staging database and the /health/migrations endpoint (or its successor) reports in_sync: true.
• [ ] No migration is marked -- POSTGRES-ONLY without a passing real-Postgres smoke test on record (feedback_postgres_enum_migrations_need_real_pg_test).
• [ ] Rollback plan exists and has been dry-run for every migration touching a table with production data (not just staging fixtures).

5. Monitoring green

• [ ] All CI-monitoring alerts (docs/ops/runbooks/ci-monitoring.md) quiet for the 7 days preceding the tag — no unresolved Alertmanager firing state.
• [ ] Sentry error-rate baseline reviewed — no unresolved regression-class issue (see .claude/agents/sre-agent.md §Sentry) open against the commit being promoted.
• [ ] Cron heartbeats (check_cron_heartbeats.py) all green.
• [ ] No open SEV-1 or SEV-2 incident anywhere in docs/incidents/.

Recording a passed checklist

When every box above is checked for a real Major candidate, the operator:

1. Fills in this file's checklist with [x] and a one-line pointer to the verification artifact for each item (a run URL, a dashboard screenshot link, a runbook execution log, etc.) — commit that filled-in state as part of the promotion PR.
2. Tags vX.0.0 per the normal release-ceremony procedure (docs/ops/runbooks/gatekeeper-develop-to-release.md).
3. Resets this file's checkboxes to unchecked immediately after the tag is cut, ready for the next Major candidate.

References

• ADR-0148 — versioning scheme (Major/Minor/Revision/Build definitions)
• ADR-0115 — develop → release → main branching model
• docs/security/release-readiness-policy.md
• docs/ops/runbooks/gatekeeper-develop-to-release.md