Production Acceptance — Evulgare 2.0.0-rc.9-WIP

Status

Not executed in the build environment. The release remains WIP because the actual cPanel Python 3.13.14, MySQL, Passenger, live TLS/header, physical graphics/XR, representative browser/device, assistive-technology, qualified-human, and measured-performance acceptance activities are not available here.

This document defines the exact non-secret evidence required before promotion. Do not convert a local package check into a production claim.

Production environment contract

cPanel owns and regenerates passenger_wsgi.py. The project archive must not contain it.

Backup and upgrade sequence

cd /home/tomlzkelce/evulgare.com
cp .env ".env.backup-$(date +%Y%m%d-%H%M%S)"
bash scripts/backup_mysql.sh

Stop the cPanel Python application. Extract the root-content ZIP directly into /home/tomlzkelce/evulgare.com/, then run:

cd /home/tomlzkelce/evulgare.com
PY=/home/tomlzkelce/virtualenv/evulgare.com/3.13/bin/python

"$PY" --version
"$PY" -m pip install -r requirements.txt
"$PY" -m pip install -r requirements-dev.txt

"$PY" -m flask --app wsgi:app db upgrade
"$PY" -m flask --app wsgi:app seed

"$PY" scripts/cpanel_diagnose.py
"$PY" scripts/check_eviulon_sources.py
"$PY" scripts/check_eviulon_partnership.py
"$PY" scripts/check_release_acceptance.py
"$PY" scripts/check_acceptance_packets.py
"$PY" scripts/check_security_privacy.py
"$PY" scripts/check_static_performance.py
"$PY" scripts/check_accessibility_acceptance.py
"$PY" scripts/check_renderer_parity.py
"$PY" scripts/check_simulation_workbench.py
"$PY" scripts/check_simulation_engine.py
"$PY" scripts/check_autonomy_navigation.py
"$PY" scripts/check_autonomy_evidence.py
"$PY" scripts/check_autonomy_regression.py
"$PY" scripts/check_mission_experience.py
"$PY" scripts/check_service_engines.py
"$PY" scripts/validate_uai_memory.py
"$PY" scripts/preflight.py
"$PY" -m pytest -q

mkdir -p tmp
touch tmp/restart.txt

Restart Passenger, wait for a new worker, then capture non-secret live evidence:

"$PY" scripts/production_acceptance.py --execute \
  --report "docs/evidence/production-acceptance-$(date -u +%Y%m%dT%H%M%SZ).json"

The production acceptance command is read-only. It uses only the fixed origin https://evulgare.com, samples a bounded route inventory, checks headers and canonical metadata, verifies the repository-controlled Eviulon source lifecycle, searches sampled responses for secret leakage, and records no credentials.

The default read-only plan performs no external source refresh. Add --source-refresh-dry-run only when an operator intends to check the exact allowlist. The plan checks four permanent compatibility redirects, requires the route-specific cache contract (no-store for APIs and health; bounded public caching for public pages and static assets), and requires compression when a sampled textual response is large enough to warrant it. Gzip and deflate samples are decoded within a fixed decompressed-size bound before canonical and secret-leak checks.

Required live results

The evidence must show:

• Python 3.13.14 exactly for recorded release acceptance.
• Correct cPanel wrapper pointing to cpanel_app.py.
• All required Python distributions installed and importable.
• Production configuration present without printing values.
• /, /healthz, partnership, source lifecycle, API, static asset, robots, and sitemap routes returning 200 from the canonical HTTPS origin.
• CSP, HSTS, Referrer-Policy, Permissions-Policy, X-Content-Type-Options, COOP, and CORP present.
• Public pages cacheable according to policy and APIs marked no-store.
• Source lifecycle API returning exactly four records, an explicit lifecycle state, and runtime_network_required: false.
• No database URL, secret key, stack trace, cPanel virtualenv path, or private host path in sampled responses.
• Complete Flask/MySQL/admin/forms/CSRF/auth/API/route/sitemap/docs test suite passing against a dedicated test database.

Browser, accessibility, hardware, and performance acceptance

Production promotion also requires recorded task evidence for:

• Chrome/Chromium, Edge, Firefox, Safari/WebKit, Android Chrome, and iOS Safari.
• Keyboard-only operation.
• NVDA/Firefox, JAWS/Chrome or Edge, VoiceOver/Safari, and TalkBack/Android Chrome.
• 200% and 400% zoom/reflow, forced colors/high contrast, reduced motion, switch, and voice-control workflows.
• Physical WebGL/WebGL2/WebGPU and representative WebXR headset/controller paths.
• Core Web Vitals, API latency, time to analytical state, time to first 3D frame, steady-state frame time/FPS, memory/resource cleanup, export time/size, and repeated-run leak checks across low-, medium-, and high-capability devices.

Automated browser checks are supporting evidence, not a substitute for representative human assistive-technology and device testing.

Rollback

If any production check fails:

1. Stop the application.
2. Restore the previous root source backup or accepted release archive.
3. Restore MySQL only if the schema/data migration requires it.
4. Restore .env from the timestamped backup.
5. Confirm cPanel startup file cpanel_app.py and entry point application.
6. Touch tmp/restart.txt and rerun scripts/production_acceptance.py.
7. Preserve the failed evidence artifact and incident notes; do not delete the history.

Release interpretation

Passing deterministic package tests establishes reproducible synthetic software behavior within declared bounds. Production acceptance establishes that the packaged application operates correctly in the deployed environment. Neither establishes real-system certification, sovereign recognition, private contract authentication, operational authorization, airworthiness, legal approval, classified capability, readiness, or performance.