Status. Proposed design only. Nothing in this vault is DG client approval. No application, service or test has been executed; every scenario is Not executed. Fees and dates are open.
Deployment, recovery and ownership
Vendor-neutral topology (architecture rev 3 p. 9). DG owns production accounts and funds hosting, identity, email and any later providers; vendors, region and identity are DG decision D08 (Q09).
flowchart LR SC[Version-controlled source + migrations] --> CI[CI: tests / build / scan] --> ST[Staging<br/>synthetic data] --> UAT[DG UAT + readiness<br/>written launch approval] --> PR[Production<br/>web + worker + DB] --> OP[Backup / restore<br/>monitoring / rollback]
| Area | Plan / evidence |
|---|---|
| Environment separation | Local, staging, production have separate data and credentials. Staging uses synthetic or expressly approved sanitised examples. No live sensitive data until DG data policy is agreed. |
| Deployment and rollback | Versioned builds and migrations; reversible rollout where feasible; migration backup/forward-recovery plan; smoke checks; documented rollback decisions. |
| Operations | Monitor API errors, unauthorised attempts, worker lag, failed delivery and provider usage without private bodies in logs. DG names support and incident owners. |
| Recovery and availability | Demonstrate restoration and record measured recovery. Balanced load/recovery targets need agreement. The proposal’s 99.5% monthly availability is a planning reference, not an SLA or a staging-proven result. |
| Handover | Repository, configuration inventory, deploy/rollback and restore runbooks, failed-job recovery, escalation routes, provider ownership. Retention/deletion policy is DG-approved. |
Release sequence: staging evidence → DG UAT acceptance → separate written launch approval → smoke check and monitoring. Production is never deployed on silence.