Skip to main content
PALOPALO FRAMEWORK

Start and adoption | Public documentation

Production release commit checklist

Follow the PALO maintainer checklist for reviewing source changes, validating publication artifacts and preserving release and privacy boundaries.

By Fabrizio Degni |

LevelguideAudiencetechnicalProductPALO PlatformStatusMaintainer RunbookLifecycleCurrentRead4 min

Published HTML view | Source: docs/production-release-commit-checklist.md

On this page
  1. Safety rule
  2. Required branch state
  3. Commit group 1: remote OIDC fail-closed binding
  4. Commit group 2: Knowledge Reader candidate
  5. Commit group 3: Observatory and website shell
  6. Commit group 4: public documentation and generated site
  7. Mandatory validation gates
  8. Production handoff record

Status: maintainer runbook for preparing a reviewable PALO website and Knowledge Reader production-candidate change. This checklist does not qualify PALO-AI as a production authorization service.

Safety rule#

Never use git add -A for this release. The workspace may contain private research inputs, temporary browser data, unpublished papers and unrelated deliverables. Stage only the explicit paths in the relevant commit group, inspect the staged diff, and stop if the branch is not synchronized with origin/main.

Some integration files contain changes belonging to more than one group. In the current dirty workspace, a whole-file stage can therefore mix concerns even when the path is listed below. Reproduce the groups in a clean worktree or use interactive hunk staging and verify every staged line. The path lists define scope, not permission to accept unrelated hunks.

Required branch state#

Run these read-only checks before staging:

sh code
git fetch origin main
git status --short
git rev-list --left-right --count HEAD...origin/main

The final command must report 0 0 for a direct production commit. If the branch is behind or ahead, prepare the release in a clean worktree based on the current origin/main, apply the reviewed commit groups there, and rerun every validation gate. Do not rebase a dirty worktree and do not force-push a release branch.

Commit group 1: remote OIDC fail-closed binding#

Purpose: prevent a non-loopback OIDC MCP listener from starting without explicit OAuth client and tenant allowlists, and prevent a validated loopback app from being rebound to another interface.

Stage only:

sh code
git add -- \
  packages/palo-mcp-server/auth.js \
  packages/palo-mcp-server/http.js \
  packages/palo-mcp-server/network.js \
  packages/palo-mcp-server/reader-http.js \
  packages/palo-mcp-server/auth.test.js \
  packages/palo-mcp-server/mcp.test.js \
  packages/palo-mcp-server/deployment.test.js \
  packages/palo-mcp-server/README.md \
  examples/agentic-interface/mcp-server-spec.json

Suggested subject: fix(mcp): bind remote OIDC admission to listener host

Commit group 2: Knowledge Reader candidate#

Purpose: add the six-tool canonical Reader, ten-tool Curator boundary, deterministic knowledge release, host profiles, deployment controls and qualification evidence.

Stage only the reviewed files under these paths:

text code
.github/workflows/monitor-knowledge-reader.yml
.github/workflows/publish-knowledge-reader.yml
.dockerignore
audit/knowledge-reader-production-candidate-2026-08-27/README.md
audit/knowledge-reader-production-candidate-2026-08-27/copilot-studio-staging-2026-08-28.json
audit/knowledge-reader-production-candidate-2026-08-27/edge-host-origin-denial-2026-08-28.json
audit/knowledge-reader-production-candidate-2026-08-27/entra-qualification-2026-08-28.json
audit/knowledge-reader-production-candidate-2026-08-27/github-production-environment-demo-2026-08-28.json
audit/knowledge-reader-production-candidate-2026-08-27/reader-v1.0.0-candidate-evidence.json
audit/knowledge-reader-production-candidate-2026-08-27/reader-v1.0.0-live-deployment-2026-08-28.json
audit/knowledge-reader-production-candidate-2026-08-27/reader-v1.0.0-release-evidence.json
audit/knowledge-reader-production-candidate-2026-08-27/reader-v1.0.0.spdx.json
audit/knowledge-reader-production-candidate-2026-08-27/reader-v1.0.0-trivy-high-critical.json
audit/knowledge-reader-production-candidate-2026-08-27/student-funding-route-2026-08-28.json
audit/knowledge-reader-production-candidate-2026-08-27/synthetic-monitor-2026-08-28.json
data/knowledge-reader-release.json
deploy/vps/palo-ai/
deploy/vps/palo-guide-mcp-standalone/
docs/palo-knowledge-copilot-integrations.md
docs/palo-knowledge-reader-production.md
docs/palo-mcp-host-qualification.md
examples/agentic-interface/knowledge-copilot/
packages/palo-knowledge-reader-runtime/
packages/palo-mcp-server/knowledge-base.js
packages/palo-mcp-server/knowledge-base.test.js
packages/palo-mcp-server/knowledge-catalog.js
packages/palo-mcp-server/knowledge-tools.js
packages/palo-mcp-server/reader-http.js
packages/palo-mcp-server/reader-http.test.js
packages/palo-mcp-server/reader-integrity.js
packages/palo-mcp-server/reader-integrity.test.js
packages/palo-mcp-server/reader-knowledge-base.js
packages/palo-mcp-server/reader-knowledge-base.test.js
packages/palo-mcp-server/reader-server.js
packages/palo-mcp-server/reader-server.test.js
scripts/validate-knowledge-copilot-integrations.mjs
scripts/validate-knowledge-reader-gold-set.mjs

Do not stage a deployment .env, secret directory, token, certificate, private tenant inventory or unredacted qualification artifact.

Suggested subject: feat(reader): add canonical production-candidate service

Commit group 3: Observatory and website shell#

Purpose: publish the Observatory index, AI Incident case, Community brand migration, Platform Map routes and their required local assets.

Stage only:

sh code
palo_asset_dir=assets
git add -- \
  index.html \
  PALO_Community.html \
  PALO_Observatories.html \
  PALO_AIIncidentObservatory.html \
  PALO_PlatformMap.html \
  PALO_DocumentationLibrary.html \
  PALO_RegulatoryWatch.html \
  PALO_TechTrends2026.html \
  PALO_HumanAgencyRiskMap.html \
  "$palo_asset_dir/palo-v21.css" \
  "$palo_asset_dir/palo-community.css" \
  "$palo_asset_dir/palo-observatories.css" \
  "$palo_asset_dir/palo-ai-incident-observatory.css" \
  "$palo_asset_dir/palo-ai-incident-observatory.js" \
  media/social/hugging-face-incident-palo/

The supplied incident PDF is a private research input and must not be staged or copied into dist. The public page may publish source-bounded analysis and original PALO graphics only.

Suggested subject: feat(web): publish the PALO Observatory system

Commit group 4: public documentation and generated site#

Purpose: synchronize source documentation, release metadata, public file inventory and deterministic web output.

Stage source files first:

sh code
git add -- \
  .gitignore \
  CHANGELOG.md \
  README.md \
  feed.xml \
  release-manifest.json \
  sitemap.xml \
  docs/production-release-commit-checklist.md \
  docs/palo-knowledge-reader-production.md \
  docs/palo-microsoft-startup-student-credits.md \
  scripts/public-files.mjs \
  scripts/render-public-docs.mjs \
  scripts/validate.mjs \
  scripts/browser-smoke.mjs

After a clean build, stage the deterministic public output. dist is ignored for ordinary local work but is tracked as the published static release, so new generated files require the explicit force flag:

sh code
git add -u -- dist
git add -f -- dist

Suggested subject: docs(release): synchronize public site and production runbook

Mandatory validation gates#

Run from the repository root:

sh code
npm run validate:agentic
npm run validate:knowledge-reader
npm run validate:knowledge-gold
npm run validate:knowledge-copilot
npm run validate
npm run build
npm run validate:dist
npm run build:check
npm run smoke
npm run package:hostinger

Then inspect the exact staged result:

sh code
git diff --cached --check
git diff --cached --stat
git diff --cached --name-status
git status --short

The staged set must contain no U+2014 character, secret value, private key, bearer token, personal account address, private tenant identifier or third-party research PDF. A passing repository test suite proves conformance to the checked assertions, not independent production qualification.

Production handoff record#

Record the following outside the source commit and attach it to the release review:

  • source commit and tree digest;
  • build and package checksums;
  • test command, timestamp and result;
  • container digest and SBOM reference where applicable;
  • accountable release owner and independent reviewer;
  • target hostname and rollback reference;
  • unresolved gates and exact maturity label.

Only a synchronized, reviewed and reproducible commit may be promoted to the production branch or deployment workflow.