Deployment
Production readiness
The evidence required before IBEX Harness can claim production readiness.
IBEX Harness is not production-ready. This page is the promotion checklist, not a marketing summary. Each item needs an artifact, an owner, a date, and a scoped claim.
Provisional Ledger class: provisional
Verified 2026-10-21Promotion gates remain open
Status summary
| Gate | Status | Why it is open |
|---|---|---|
| G0 documentation and contract freeze | PROVISIONAL | Contract shapes accepted; runtime seams provisional; no independent reviewer |
| G1 principal and tenant invariants | PROVISIONAL | Runtime propagation and cross-tenant matrix incomplete |
| G2 errors and idempotency | PROVISIONAL | Reconciliation and broader coverage open |
| G3 provider and admission | PROVISIONAL | Hosted and reconciliation evidence open |
| G4 evidence MVP | PROVISIONAL | Production sink and hosted recovery open |
| G5 request and streaming slice | PROVISIONAL | No published hosted/reference p99 run |
| G6 typed memory and context | PROVISIONAL | Typed lifecycle, revision ledger, deletion certification open |
| G7 read-only operator and MCP | PROVISIONAL | Policy-store enforcement and durable audit open |
| G8 operations and recovery | PROVISIONAL | Hosted/HA recovery and restore drills open |
| G9 governed side effects | PROPOSED | No runtime or acceptance evidence |
| G10 advisory intelligence | PROPOSED | DecisionService and model registry do not exist |
| G11 deferred extensions | DEFERRED | Requires separate evidence and ADR |
Must be true before promotion
Identity and tenancy
- Hosted AuthService session, MFA, secure cookies, CSRF, and exact credentialed CORS are accepted.
- Two-tenant negative tests cover proxy, memory, context, management API, MCP, Operator Console, ClickHouse, Redis, and backups.
- Cross-tenant resource behavior is consistent and does not leak existence.
- Provider credentials are sealed and never returned in plaintext.
Data and deletion
- Typed memory lifecycle and revision ledger are accepted.
- Deletion covers caches, projections, backups, and archives with measured timing.
- Restore drills prove the documented RPO/RTO.
- ClickHouse projection delivery and retention are verified, not inferred.
Request path
- A hosted or reference-profile p99 run proves the latency budget with workload, hardware, and profile attached.
- The Go benchmark gate is not mistaken for a p99 SLO.
- Streaming failures, cancellation, and upstream timeouts are covered.
- Budget holds are reconciled and overshoot is measured.
Evidence and operations
- The relay delivers to a production sink with dedupe/replay and redaction evidence.
- Dead letters, reaper behavior, and crash recovery are exercised.
- Key rotation and revocation propagation are tested.
- Alerts have runbooks and owners.
- Rollback by image digest is rehearsed.
Deployment
- Real image digests replace sentinels.
- External Secrets are provisioned.
- Data-plane templates or managed services exist.
- Migrations run with a preflight and rollback plan.
- A deployment workflow and release approval path exist.
- NetworkPolicy and service-to-service authentication are configured.
Explicit non-claims
- No hosted HA guarantee.
- No measured hosted p99.
- No exactly-once side effects.
- No complete tenant-isolation proof.
- No certified restore or RPO/RTO.
- No production Support/SLO contract.
When a gate closes, update the ledger first, then the page. A page cannot promote a capability by itself.