CodeDev system / System reference

CodeDev release qualification and evidence

The exact meaning of Security-Hardened-RC versus Production-Qualified and the canonical qualification path used by local operators and GitHub Actions.

codedevreleasequalificationciplaywrightpostgresqlredis

01Two release labels, two evidence levels

Label	What it proves
Security-Hardened-RC	Dependency-light source/security/package gates passed; full runtime/browser/database qualification is not implied.
Production-Qualified	The canonical qualified build completed the required runtime, security, browser, PostgreSQL, Redis, health, backup and restore gates.

02Canonical qualification command

bashOnly supported Production-Qualified build path

python scripts/build_release.py --qualified

GitHub Actions calls this same qualification command instead of maintaining a separate weaker checklist. A qualified build emits the release ZIP, its SHA-256 sidecar, and a .qualification.json evidence file containing release identity and qualification metadata.

03Required qualification areas

syntax, secret scanning, static policy, enterprise policy, and package verification
complete pytest suite and dependency consistency
Bandit and dependency vulnerability audits
real Chromium Playwright flow covering inquiry, password/TOTP admin authentication, CMS publish/Trash/restore, mobile behavior, and logout
isolated PostgreSQL migration/security checks
digest-pinned Redis with multi-worker shared rate-limit proof
/healthz against PostgreSQL and Redis
checksummed PostgreSQL backup, isolated restore, migration-head verification, and restored-database security-check