Date: 2026-08-20

Status: Production is fenced until the isolated staging gates and database

rehearsal pass for one exact candidate.

Status: Production cut over to OpenAgents on 2026-08-21. Use this runbook for

the retained rollback boundary and later fleet replacements.

This runbook replaces the Sarah release on the existing three-node production

fleet. It preserves the `openagents.com` load balancer and the `sarah`

  `sarah-fleet-3` in three zones.

- Global backend service `sarah-backend` and the existing `openagents.com`

  HTTPS frontend.

- The Sarah release as the serving application and the idle Sarah Cloud Run

  service as the application rollback target.

- The OpenAgents release as the serving application and the retained Sarah

  image and startup metadata as rollback inputs.

Do not rename these provider resources during the application cutover. Rename

them only in a later infrastructure migration after OpenAgents passes its

production observation window.

## Production admission conditions

## Initial cutover admission conditions

The following conditions record the initial cutover standard. Current rolling

releases do not require a fixed-duration soak. Each rollout must keep two

healthy nodes available, verify the exact revision locally on the replaced

node, wait for load-balancer health, and stop before the next node if a check

fails.

Use one exact Git SHA and application image digest for every condition. Do not

waive a failed condition by rebuilding from another commit during the cutover.

  validator. Staging does not use a production database, service account,

  bucket, or secret.

- The candidate passes all Gate 14 cases on staging.

- The same candidate passes controlled failure injection and a measured

  15-minute soak on the pinned `openagents-staging-release` service. Later

  commits can deploy to another staging service without replacing this release

  candidate or resetting its clock.

- The same candidate passes controlled failure injection and staging health

  checks on the pinned `openagents-staging-release` service.

- A fresh production backup restores into a disposable Cloud SQL instance.

  The migration-lineage bridge, all remaining migrations, candidate startup,

  last-known-good startup, row-count checks, and integrity checks pass there.

the old restart path, enable deletion protection on the fleet instances, and

schedule provider-resource renames as a separate infrastructure change.

Do not declare production ready until the staging soak and the disposable-copy

migration rehearsal complete for the exact candidate. Local parity and a

healthy staging deploy are necessary but do not replace those conditions.

Production is live. For a later rolling release, preserve the existing database

and persistent repository volumes, use one immutable image digest, replace one

node at a time, and verify all three load-balancer backends before closing the

release.

Date: 2026-08-20

Status: Implemented and locally proven; keep both lanes disabled until the Gate 12 isolated staging fleet exists

Status: Implemented. The isolated staging fleet uses the coordinated rolling

lane, and production uses the same one-node-at-a-time health boundary.

## Purpose

  configuration, migration, module-deletion, or otherwise unclassified

  changes.

Neither lane is production-approved. Gate 12 must connect the provider-neutral

coordinators to an isolated three-node staging fleet and retain staging-only

receipts before anyone enables a deployment worker.

The relup lane is not production-approved. Use rolling replacement in

production only with explicit operator authority, an immutable image digest,

two remaining healthy nodes, and exact revision checks after each replacement.

## Local release gate

  node;

- additive migration compatibility while both application versions run.

Production remains out of scope until the later staging, rollback, and soak

gates pass and receive separate approval.

Production rolling replacement requires explicit operator authority. Do not

infer that authority from a successful staging rollout.