Chapter 11 / 14

Deployment

Production surfaces

The public PWA and API deploy together on Vercel. OPS, Slides, Plan, and Docs are separate static Vercel projects. Neon provides Postgres; Redis provides sessions/queues when enabled. OTA is a self-hosted Python service behind TLS and currently listens internally on 127.0.0.1:3084.

Deployment contracts

Each project has an explicit configuration file, route rewrites, cache policy, and security headers. Generated static projects have no database, Redis, provider, signing, or mutation credentials. Custom domains are verified after deployment rather than inferred from a provider command.

Safe release sequence

Build and test locally; inspect the dirty tree; deploy the exact workspace; verify production routes, headers, hashes, and health; then update Git only with exact authorization. Database releases verify the expected Alembic head, apply additive DDL, backfill, check parity, exercise rollback, and keep legacy data until an observation window and separate cleanup approval.

Rollback means selecting the previous Vercel deployment, switching the schema compatibility mode, or reactivating the previous signed OTA bundle. It never means deleting production evidence to make a dashboard green.