Environments and activation path

Environment model

Development begins locally with test data, moves to sandbox for external contracts, then staging with non-production data, and finally a limited canary before production.

• Local: implementation, unit tests, and contract tests.
• Sandbox: isolated integration credentials and data.
• Staging: deploy and connectivity verification.
• Canary: an explicitly approved tenant or branch scope.
• Production: monitored runtime with rollback ready.

Credential boundaries

Every credential belongs to an environment, scope, and permission set. Mixed environments or missing scope must fail closed instead of falling back to an unsafe path.

Promotion gate

A successful build is not enough for promotion. Contract tests, tenant-isolation checks, smoke tests, runtime observation, and a known rollback point are required.