{"id":"ops/go-live-checklist","relativePath":"ops/go-live-checklist.md","title":"Go-Live & Evidence-Pipeline Checklist","markdown":"# Go-Live & Evidence-Pipeline Checklist\n\nOperationalize the live Vercel deploy: finish auth, deploy the validation\nservice, and **start the 30-day evidence clock**. Companion to\n[deployment.md](../deployment.md).\n\n> Replace `` with the production URL (e.g. `https://metamuseum-sundog358s-projects.vercel.app`\n> or a custom domain). No trailing slash.\n\n---\n\n## 1. Vercel — finish the app config\n\nProject → Settings → Environment Variables (Production), then redeploy:\n\n| Var | Value | Why |\n|---|---|---|\n| `DATABASE_URL` | Neon pooled string | already set |\n| `METAMUSEUM_STORAGE_MODE` | `postgres` | already set |\n| `AUTH_SECRET` | (already set) | — |\n| `BASE_URL` | `` | canonical URL, SLO target |\n| `METAMUSEUM_PUBLIC_READ_BASE_URL` | `` | uptime/probe target |\n| `AUTH_GITHUB_ID` | GitHub OAuth app client ID | **last preflight blocker**; enables sign-in |\n| `AUTH_GITHUB_SECRET` | GitHub OAuth app secret | (pair for the above) |\n| `VALIDATION_SERVICE_URL` | `https://metamuseum-validation.onrender.com/validate` | after step 2 |\n\nAlso: **Settings → Deployment Protection → Vercel Authentication → Disabled**\n(so the public can reach the read-only demo).\n\nGitHub OAuth app: https://github.com/settings/developers → New OAuth App →\nHomepage ``, callback `/api/auth/callback/github`.\n\n---\n\n## 2. Render — deploy the validation service\n\nThe data-quality report (validation) is the literal pilot deliverable, so it's\nthe priority Python service. `render.yaml` blueprints validation +\nreconciliation (+ Redis); the AG2 worker is intentionally excluded.\n\n1. Render → **New → Blueprint** → select this repo (reads `render.yaml`).\n2. Confirm `metamuseum-validation` builds (`pip install -r requirements.txt`)\n and starts (`uvicorn main:APP --host 0.0.0.0 --port $PORT`), health `/health`.\n3. Copy its URL → set `VALIDATION_SERVICE_URL=https://.onrender.com/validate`\n on Vercel → redeploy.\n4. (Optional) reconciliation comes up alongside with its Redis cache wired in.\n\n> Free Render web services cold-start in ~30–60s; fine for pilots, upgrade for SLAs.\n\n---\n\n## 3. GitHub Actions — start the evidence clock\n\nThe nightly `era-c-exit-gate-evidence.yml` workflow reads these. Set under\n**Settings → Secrets and variables → Actions**.\n\n### Variables (Repository variables) — minimum to start k6 + AI evidence\n| Variable | Value | Unlocks |\n|---|---|---|\n| `METAMUSEUM_EVIDENCE_BASE_URL` | `` | k6 SLO + AI-query evidence |\n| `METAMUSEUM_PUBLIC_READ_BASE_URL` | `` | uptime probe target |\n| `METAMUSEUM_EVIDENCE_IIIF_TILE_URL` | `/icon.jpg` | required gate for the k6 step |\n\nWith just those three, the nightly run begins retaining k6 p95 samples and AI\ncost telemetry. `SPARQL_URL` defaults to `/api/getty/sparql`.\n\nCLI (run once `` is known):\n```bash\ngh variable set METAMUSEUM_EVIDENCE_BASE_URL --body \"\"\ngh variable set METAMUSEUM_PUBLIC_READ_BASE_URL --body \"\"\ngh variable set METAMUSEUM_EVIDENCE_IIIF_TILE_URL --body \"/icon.jpg\"\n```\n\n### Still gated (separate workstreams, not just config)\n| Evidence | Needs | Note |\n|---|---|---|\n| Public-read uptime (99.9% / 30d) | `METAMUSEUM_UPTIME_PROMETHEUS_URL` (secret) + `METAMUSEUM_UPTIME_PROMQL_*` vars | requires a Prometheus/monitoring backend scraping the app — infra decision |\n| Activity-feed adoption (3/3) | `METAMUSEUM_ACTIVITY_CONSUMER_IDS` | requires 3 real external consumers sending `x-linked-art-consumer-id` — partnerships, not config |\n| SOTA §26 KPIs | production export to `monitoring/kpi-evidence.json` | record-enrichment + reconciliation review counts |\n\n---\n\n## Sequence\n\n1. Set Vercel env vars + GitHub OAuth + disable Deployment Protection → rerun\n `pnpm launch:preflight:production` until the `AUTH_GITHUB_ID` failure clears.\n2. Deploy validation on Render → set `VALIDATION_SERVICE_URL` → redeploy Vercel.\n3. Set the 3 GitHub evidence variables → the nightly clock starts.\n4. Decide the uptime-monitoring approach (Prometheus stack) and begin partner\n outreach for the 3 activity consumers — these are the long-pole 30-day gates.\n","sections":[{"level":2,"heading":"1. Vercel — finish the app config","anchor":"1-vercel-finish-the-app-config"},{"level":2,"heading":"2. Render — deploy the validation service","anchor":"2-render-deploy-the-validation-service"},{"level":2,"heading":"3. GitHub Actions — start the evidence clock","anchor":"3-github-actions-start-the-evidence-clock"},{"level":3,"heading":"Variables (Repository variables) — minimum to start k6 + AI evidence","anchor":"variables-repository-variables-minimum-to-start-k6-ai-evidence"},{"level":3,"heading":"Still gated (separate workstreams, not just config)","anchor":"still-gated-separate-workstreams-not-just-config"},{"level":2,"heading":"Sequence","anchor":"sequence"}],"html":"

Go-Live & Evidence-Pipeline Checklist

\n

Operationalize the live Vercel deploy: finish auth, deploy the validation

\n

service, and start the 30-day evidence clock. Companion to

\n

deployment.md(../deployment.md).

\n
Replace `<PROD_URL>` with the production URL (e.g. `https://metamuseum-sundog358s-projects.vercel.app`
\n
or a custom domain). No trailing slash.
\n

---

\n

1. Vercel — finish the app config

\n

Project → Settings → Environment Variables (Production), then redeploy:

\n

| Var | Value | Why |

\n

|---|---|---|

\n

| `DATABASE_URL` | Neon pooled string | already set |

\n

| `METAMUSEUM_STORAGE_MODE` | `postgres` | already set |

\n

| `AUTH_SECRET` | (already set) | — |

\n

| `BASE_URL` | `<PROD_URL>` | canonical URL, SLO target |

\n

| `METAMUSEUM_PUBLIC_READ_BASE_URL` | `<PROD_URL>` | uptime/probe target |

\n

| `AUTH_GITHUB_ID` | GitHub OAuth app client ID | last preflight blocker; enables sign-in |

\n

| `AUTH_GITHUB_SECRET` | GitHub OAuth app secret | (pair for the above) |

\n

| `VALIDATION_SERVICE_URL` | `https://metamuseum-validation.onrender.com/validate` | after step 2 |

\n

Also: Settings → Deployment Protection → Vercel Authentication → Disabled

\n

(so the public can reach the read-only demo).

\n

GitHub OAuth app: https://github.com/settings/developers → New OAuth App →

\n

Homepage `<PROD_URL>`, callback `<PROD_URL>/api/auth/callback/github`.

\n

---

\n

2. Render — deploy the validation service

\n

The data-quality report (validation) is the literal pilot deliverable, so it's

\n

the priority Python service. `render.yaml` blueprints validation +

\n

reconciliation (+ Redis); the AG2 worker is intentionally excluded.

\n
  1. Render → New → Blueprint → select this repo (reads `render.yaml`).
\n
  1. Confirm `metamuseum-validation` builds (`pip install -r requirements.txt`)
\n

and starts (`uvicorn main:APP --host 0.0.0.0 --port $PORT`), health `/health`.

\n
  1. Copy its URL → set `VALIDATION_SERVICE_URL=https://<svc>.onrender.com/validate`
\n

on Vercel → redeploy.

\n
  1. (Optional) reconciliation comes up alongside with its Redis cache wired in.
\n
Free Render web services cold-start in ~30–60s; fine for pilots, upgrade for SLAs.
\n

---

\n

3. GitHub Actions — start the evidence clock

\n

The nightly `era-c-exit-gate-evidence.yml` workflow reads these. Set under

\n

Settings → Secrets and variables → Actions.

\n

Variables (Repository variables) — minimum to start k6 + AI evidence

\n

| Variable | Value | Unlocks |

\n

|---|---|---|

\n

| `METAMUSEUM_EVIDENCE_BASE_URL` | `<PROD_URL>` | k6 SLO + AI-query evidence |

\n

| `METAMUSEUM_PUBLIC_READ_BASE_URL` | `<PROD_URL>` | uptime probe target |

\n

| `METAMUSEUM_EVIDENCE_IIIF_TILE_URL` | `<PROD_URL>/icon.jpg` | required gate for the k6 step |

\n

With just those three, the nightly run begins retaining k6 p95 samples and AI

\n

cost telemetry. `SPARQL_URL` defaults to `<PROD_URL>/api/getty/sparql`.

\n

CLI (run once `<PROD_URL>` is known):

\n
\ngh variable set METAMUSEUM_EVIDENCE_BASE_URL --body "<PROD_URL>"\ngh variable set METAMUSEUM_PUBLIC_READ_BASE_URL --body "<PROD_URL>"\ngh variable set METAMUSEUM_EVIDENCE_IIIF_TILE_URL --body "<PROD_URL>/icon.jpg"\n
\n

Still gated (separate workstreams, not just config)

\n

| Evidence | Needs | Note |

\n

|---|---|---|

\n

| Public-read uptime (99.9% / 30d) | `METAMUSEUM_UPTIME_PROMETHEUS_URL` (secret) + `METAMUSEUM_UPTIME_PROMQL_*` vars | requires a Prometheus/monitoring backend scraping the app — infra decision |

\n

| Activity-feed adoption (3/3) | `METAMUSEUM_ACTIVITY_CONSUMER_IDS` | requires 3 real external consumers sending `x-linked-art-consumer-id` — partnerships, not config |

\n

| SOTA §26 KPIs | production export to `monitoring/kpi-evidence.json` | record-enrichment + reconciliation review counts |

\n

---

\n

Sequence

\n
  1. Set Vercel env vars + GitHub OAuth + disable Deployment Protection → rerun
\n

`pnpm launch:preflight:production` until the `AUTH_GITHUB_ID` failure clears.

\n
  1. Deploy validation on Render → set `VALIDATION_SERVICE_URL` → redeploy Vercel.
\n
  1. Set the 3 GitHub evidence variables → the nightly clock starts.
\n
  1. Decide the uptime-monitoring approach (Prometheus stack) and begin partner
\n

outreach for the 3 activity consumers — these are the long-pole 30-day gates.

","updatedAt":"2018-10-20T01:46:40.000Z","checksum":"ae7f5d71f7dcf62e86737639f05366b32292f5697a167fcc5b1466eba88b78f2","checksumPrefix":"ae7f5d71f7dc","anchorCount":6,"lineCount":91,"rawUrl":"/api/docs/content?path=ops%2Fgo-live-checklist.md","htmlUrl":"/docs?doc=ops%2Fgo-live-checklist.md","apiUrl":"/api/docs/content?path=ops%2Fgo-live-checklist.md"}