Deployment evidence

Record private VPS validation without turning logs into a secret store.

The deployment evidence ledger is an operator-local, git-ignored record of preflight, external edge smoke, authenticated member smoke, cleanup, owner dashboard visual review, backup restore drill, and provider-review evidence. It stores short sanitized metadata plus optional SHA-256 artifact hashes, not raw smoke logs, credentials, IP ledgers, or identity fields.

Local operator artifact Hash logs, don't store logs Evidence before exposure

Record

Append a sanitized evidence record

cargo run -- deployment-evidence-record \
  --stage production_preflight \
  --status passed \
  --origin https://members.final-domain.example \
  --app-commit 15496a9 \
  --proxy nginx \
  --artifact-file /secure/operator/preflight-output.txt \
  --summary "production preflight passed before proxy exposure"

The default evidence file is deployment_evidence/evidence.log, which is ignored by git. NOCTURNE_DEPLOYMENT_EVIDENCE_FILE or --evidence-file can point to an operator-controlled location. If --artifact-file is supplied, the command stores only its SHA-256 digest.

Privacy rule: summary and proxy text reject URLs, email-like values, IP-like values, and newlines. Put the public origin in --origin; keep raw logs and credentials in the operator's sealed store.

Stages

Evidence stage names

Stage	When to record it	Typical artifact hash
`production_preflight`	After `production-preflight` passes on the VPS with production environment loaded.	Preflight command output.
`external_edge_smoke`	After `scripts/external-edge-smoke.sh` and a controlled `429` check pass from outside the VPS network. Use `--proxy nginx`, `caddy-trusted-edge`, or `trusted-edge` only for the corresponding validated control.	Sanitized external edge/throttle output without raw source identifiers.
`smoke_member_provision`	After `smoke-member-provision` creates a disposable recovery-confirmed member.	Provision command output without the recovery key.
`external_member_smoke`	After `scripts/external-member-smoke.sh` passes against the final origin.	Authenticated member smoke output.
`smoke_member_cleanup`	After `smoke-member-cleanup` revokes active disposable access and sessions.	Cleanup command output.
`owner_dashboard_visual_review`	After `local-owner-visual-smoke` or the private VPS owner dashboard browser checklist passes without leaking secrets or requiring scripts. Use `owner-dashboard-review-plan --artifact-file ... --review-result passed`, then `owner-dashboard-review-artifact-check --artifact-file ...`, for the preferred verified hash-ready artifact.	Generated review artifact digest; raw screenshots stay outside git.
`backup_restore_drill`	After an isolated restore drill proves backup usability. Use `restore-drill-plan` to print the checklist and evidence command.	Restore drill notes or doctor/smoke output digest.
`payment_provider_review`	After written adult/AI-adult processor review evidence is captured outside the app. Prefer `payment-provider-review-plan --artifact-file ... --review-result passed\|warning\|failed`, then `payment-provider-review-artifact-check --artifact-file ...`, before recording.	Generated provider review artifact digest; raw approval emails/contracts/dashboard screenshots stay outside git.
`manual`	For narrow operator notes that do not fit a structured stage.	Optional digest.

List & check

Review readiness before widening testing

cargo run -- deployment-evidence-list
cargo run -- deployment-evidence-list --stage external_member_smoke

cargo run -- deployment-evidence-check \
  --origin https://members.final-domain.example

The check command requires passed records for production_preflight, external_edge_smoke, smoke_member_provision, external_member_smoke, and smoke_member_cleanup. The edge record satisfies widening only when its proxy label is nginx, caddy-trusted-edge, or trusted-edge; plain caddy, other, and missing labels fail because they do not attest request-rate enforcement. It reports owner_dashboard_visual_review, payment_provider_review, and backup_restore_drill as advisory warnings until launch readiness, and the gated owner dashboard mirrors derived deployment evidence, payment-provider review, owner visual QA, backup manifest/custody, restore-drill, and VPS readiness posture as browser-safe status/count/command metadata only. The deployment-rehearsal-plan command prints the full evidence-record sequence, and restore-drill-plan can print the exact backup-restore evidence record command after the sealed drill notes are hashed.

After required evidence is recorded, sealed backup artifact hashes are manifest-recorded, and encrypted/offsite custody metadata is current, run private-vps-readiness to combine the evidence ledger with production preflight, backup posture, backup manifest completeness, and custody retention before widening private testing.

Not a launch permit: a clean deployment-evidence check means the private VPS validation loop has recorded required proof. Public launch still needs payment approval, legal/vendor review, trust/safety operations, backup/restore completion, and production monitoring/WAF decisions.

Storage boundary

Where evidence belongs

Keep deployment_evidence/ local, operator-owned, and out of git.
Use artifact hashes to link to sealed logs without copying raw outputs into the repository.
Do not paste recovery keys, owner keys, database URLs, provider secrets, raw logs, email addresses, raw IP addresses, or user-agent strings into summaries.
Evidence records are operational notes; they do not replace backups, restore drills, legal advice, payment approval, or trust/safety escalation procedures.