UCCA — Pre-Production Checklist¶
What this is. The gate between "building" and "real client jobs flowing." Items are parked here deliberately (Tim's call) — recorded so nothing sinks, each with a sequence-before trigger. Ground- breaking is not blocked; these land before the trigger fires.
| # | Item | Sequence-before | Status | Source |
|---|---|---|---|---|
| 1 | Split the broad deploy token from narrow runtime secrets. The ucca-deploy token (Workers AI:Edit + broad) is fine for build/setup, but runtime workers must hold narrow scoped secrets, not the deploy token. |
before real client jobs flow | parked | Tim, 2026-07-02 |
| 2 | Stand up 1Password CLI secret management UCCA-side (= the L5 vault move: secrets out of the project tree), mirroring the RTOpacks pattern. | before build-time secrets multiply in configs (i.e. early — sequence it soon) | parked | Tim, 2026-07-02 · fossil-ledger L5 |
| 3 | Rotate the 4 provider secrets — CLOUDFLARE_API_TOKEN · ANTHROPIC_API_KEY · STRIPE_SECRET_KEY · GITHUB_PAT (dev-phase exposure via the L4 stray was accepted; rotate before real traffic). |
before production | deferred (pre-launch) | Tim, 2026-07-04 · fossil-ledger L4 |
| 4 | Execute real sub-processor DPAs. Redacted copies publish on the trust surface once executed (it currently states "in progress"). Bound by UCCA-RULING-TRUST-ATTESTED-01. |
before launch | deferred (pre-launch) | Tim, 2026-07-04 · D3 truth-pass |
| 5 | Conduct the penetration test and publish summaries on the trust surface (it currently states "planned pre-launch"). Bound by UCCA-RULING-TRUST-ATTESTED-01. |
before production launch | deferred (pre-launch) | Tim, 2026-07-04 · D3 truth-pass |
| 6 | Trust-surface deploy wiring + audit — wire the ucca-trust Pages project to git or Terraform-import it, and audit the deploy path. Today it is direct-upload (Git Provider: No): git push does not deploy trust.ucca.online — changes need a manual mkdocs build + wrangler pages deploy. |
before launch | DEFERRED (pre-launch) — explicitly not done | Tim, 2026-07-04 · UCCA-DISK-CENSUS-01 |
| 7 | Queue-depth true read — create a scoped read-only Queues-analytics API token (Account Analytics: Read), set it as a wrangler secret on ucca-admin-api, and wire the true CF ucca-jobs/ucca-jobs-dlq backlog read (replacing the D1 proxy shipped in B-OPS Unit 2). Token to be created, scoped, ledgered, and rotation-scheduled in this pass alongside item 3. Deferred ≠ done — the D1 proxy is shipped and labelled a proxy; it is not the true read. |
before production | deferred (pre-launch) — own gated increment | Tim, 2026-07-04 · B-OPS-SUCCESSOR Unit 2 |
| 8 | Cognition spend price basis — the engine's cost_usd is NULL for the production GLM-5.2 throat (fossil-ledger L9). A real spend basis (proper pricing entry and/or live usage/billing read) is owed. |
before production | SUBSUMED by UCCA-CAPTURE-COST-LEDGER-01 (its own build lane, queued behind the console) — not a standalone item |
Tim, 2026-07-05 · B-OPS-SUCCESSOR Unit 4 |
| 10 | Prove stripe-webhook live end-to-end — the relocated billing webhook (stripe.ucca.online/webhook, worker stripe-webhook, binds engine-db-oc) is deployed but NOT proven: no proof event was fired (Tim ruling — no customers/route-to-market yet). Before first customer: fire a real Stripe event (dashboard test webhook or a real purchase) and confirm the worker receives → verifies signature → writes to engine-db-oc purchases. |
before first customer | deferred — deployed not proven | Tim, 2026-07-05 · B-OPS Unit 8 |
| 9 | Public-key endpoint challenge-exempt — keys.ucca.online/v1/public-key/{v} (the seal's verification_method) currently returns a Cloudflare managed challenge to a plain fetch, so an external verifier cannot fetch the key to verify a UCCO seal. Add a WAF/bot bypass so /v1/public-key/* is publicly fetchable (public key only — no other keys-worker route relaxed). |
before external verification is offered | deferred (pre-launch) — console works around it via the keys KV | Tim, 2026-07-05 · B-OPS-SUCCESSOR Unit 7 |
Notes¶
- Item 1 is a security-hardening step: today the single
CLOUDFLARE_API_TOKEN(the deploy token) is broad. Runtime services (the gate worker, the reasoner) should each get a minimal-scope secret — not the deploy token. Do this before any client payload flows through a runtime worker. - Item 2 is sequenced earliest of the two: 1Password CLI before build-time secrets multiply
across
wrangler.toml/.dev.vars/CI. The RTOpacks side already runs this pattern — mirror it. Non-blocking for ground-breaking, but cheaper the sooner it lands.
Append here as pre-prod items surface. An item leaves this list only when done (with evidence) or ruled out (with reason).