Production Readiness

Production readiness answers one question: is this node safe to admit to production traffic for its intended role?

It is an operational gate. It is not a consensus transaction, not a release checklist, not a restore procedure, and not a smart-contract package review. Use this page before launch, rejoin, upgrade activation, validator admission, or any other moment where a node is about to become trusted production infrastructure.

Related pages:

Need	Use
Release/deployment checklist	Production Release Readiness
Continuous paging and monitoring	Monitoring And Alerting
Backup and restore procedures	Backup, Restore, And Recovery
Smart-contract runtime operation	Smart Contract Runtime Operations
State-root rollout	State-Root Activation
Incidents and conflicts	Incident Response, Conflict Handling

Admission Commands

Run the readiness commands from the node folder that contains the intended production .env:

npm run noos -- production report --json
npm run noos -- production profile --profile validator
npm run noos -- production preflight

Use --profile validator, --profile observer, or --profile single-node to make the intended role explicit.

Command	Meaning
production report	Returns the full read-only readiness checklist.
production profile	Shows the role and release-compatibility subset used for admission.
production preflight	Fails closed when a required check is red.

These commands are read-only. They do not change consensus state, Raft membership, trusted peers, snapshots, payload availability, incidents, sidecar processes, or local database rows.

Readiness Model

Production readiness is layered. A green node is not only a process that starts; it is a node whose local configuration, consensus position, storage, sidecars, and operator controls match the role it is about to serve.

Layer	What readiness proves
Process and config	The node is running with production mode and expected role settings.
Operator access	Operator token and CLI access work without exposing secrets.
TLS and mTLS	HTTP, operator, node-to-node, and Raft paths use the required transport security.
Database and migrations	PostgreSQL is reachable and migration state matches the release.
Consensus and peers	Consensus is healthy, sidecars are reachable, and runtime membership matches governance intent.
State root	The current or scheduled state-root engine can execute safely on this node.
Snapshots and backups	Backup metadata exists and restore proof is available or explicitly planned.
Sync and backfill	The node is not stuck, divergent, or missing expected local payloads.
Observability	Monitoring and incident paths are available before traffic is admitted.
Smart-contract runtime	If enabled, contract runtime preflight and launch evidence are ready.

Hard blockers stop admission. Warnings do not always fail the preflight today, but operators should review every warning before launch.

What Preflight Checks

The current preflight checks include:

• CLI operator auth is configured.
• CLI operator access uses HTTPS and certificate verification is enabled.
• Local DATABASE_URL is configured for compatibility checks.
• Expected production profile matches node role and consensus mode.
• CLI package version matches node version.
• SQL migrations are applied with no unexpected migration rows.
• Supported snapshot archive format matches the release.
• Node reports NODE_ENV=production.
• Node HTTP API reports TLS enabled.
• mTLS is reported, and warned on when not required.
• Node health is healthy.
• No active incident is present.
• Database connectivity and migration readability are healthy.
• Consensus is not degraded.
• Production Raft candidates use the HashiCorp Go engine.
• HashiCorp Go Raft sidecar is running when required.
• Raft TCP TLS is enabled when HashiCorp Go Raft is active.
• Governance active validators, runtime membership, and trusted peers align.
• State-root preflight is green.
• No long-running verification is occupying the node.
• Snapshot metadata exists, or backup-readiness warning is reported.
• Payload availability has no unexpected local missing payloads, or a warning is reported.
• Sync/backfill has no last-error warning.

Use the JSON report as the artifact for launch review or incident follow-up.

Production Admission Sequence

Use this sequence for a normal launch or rejoin. The linked pages own the details; this page is the gate summary.

1. Build and stage the release artifacts.

   npm run build
   npm run build:raft-go
   npm run build:state-root-sidecar-nervos
   npm run admin:build

2. Run database migrations.

   npm run migrate

3. Start the node and required sidecars with production .env values.

   Minimum production posture normally includes:

   • NODE_ENV=production;
   • NOOS_TLS_ENABLED=true;
   • NOOS_OPERATOR_TOKEN set to a non-development secret;
   • NOOS_PRODUCTION_PROFILE=validator, observer, or single-node;
   • NOOS_CONSENSUS_MODE=raft for validator clusters;
   • RAFT_ENGINE=hashicorp-go for production Raft candidates;
   • GO_RAFT_TCP_TLS_ENABLED=true;
   • configured state-root sidecar values when using nervos-smt-v2.

4. Verify operator access.

   npm run noos -- doctor --deep

5. Verify state-root readiness.

   npm run noos -- state-root preflight

6. Run the production gate.

   npm run noos -- production profile --profile validator
   npm run noos -- production preflight

7. Export and verify a local snapshot.

   npm run noos -- snapshots export --output node-backup.noosnap.tar.gz
   npm run noos -- snapshots verify --file node-backup.noosnap.tar.gz

8. Prove the backup can restore.

   npm run noos -- production backup-drill --output ./backup-drill

9. Confirm monitoring, incident ownership, and restore/rejoin procedure.

10. Admit traffic only after blockers are green and warnings are reviewed.

Readiness Checklist

Area	What must be true	First command	Deeper page
CLI and operator auth	CLI reaches the intended node and protected operator endpoints work.	npm run noos -- doctor --deep	Operator CLI
TLS/mTLS	HTTP and operator paths use production transport security.	npm run noos -- production report --json	Production Release Readiness
Database and migrations	Database is reachable and migration rows match the release.	npm run noos -- production report --json	Operator CLI
Node health	Node health is green and there are no active incidents.	npm run noos -- node health --json	Incident Response
Consensus	Consensus is not degraded and production Raft sidecars are healthy.	npm run noos -- raft status	HashiCorp Raft Deployment
Membership	Governance validators, runtime membership, and trusted peers align.	npm run noos -- governance operator-membership plan --json	Raft Consensus Configuration
State root	Current or scheduled engine can execute safely.	npm run noos -- state-root preflight	State-Root Activation
Snapshots	Snapshot metadata exists and a verified backup artifact is available.	npm run noos -- snapshots list	Snapshots
Restore proof	Backup drill has produced a successful report.	npm run noos -- production backup-drill --output ./backup-drill	Backup, Restore, And Recovery
Sync and payloads	Sync/backfill has no current error and expected payloads are available.	npm run noos -- node sync --json	Monitoring And Alerting
Alerts	Monitoring report has no critical alert for the node role.	npm run noos -- production monitor-report --json	Monitoring And Alerting
Smart contracts	Runtime sidecar, readiness, and launch evidence are green when contracts are enabled.	npm run noos -- contracts launch-gate --profile mainnet --json	Smart Contract Runtime Operations

State-Root Readiness

State-root readiness proves that the current or scheduled engine can execute on this node. For nervos-smt-v2, readiness includes sidecar binary presence, protocol/version match, supervisor health, checkpoint validation, and fail-closed execution behavior.

Run:

npm run noos -- state-root preflight
npm run noos -- production preflight

The activation transaction only changes consensus state. It does not deploy sidecar binaries, rewrite config files, or restart validators. Every validator must be ready before the activation height arrives.

Use State-Root Activation for the operator model, Nervos Activation Runbook for planned rollout, and Nervos Sidecar Recovery for repair.

Backup And Restore Proof

production backup-drill proves that a backup artifact can restore into an isolated database and pass verification. It is not the production restore command.

Run:

npm run noos -- production backup-drill --output ./backup-drill --dry-run
npm run noos -- production backup-drill --output ./backup-drill

The drill uses local DATABASE_URL; it does not call HTTP snapshot export. It writes backup-drill-report.json and keeps the packaged snapshot artifact in the output directory.

For an actual restore, follow Backup, Restore, And Recovery. For snapshot commands and formats, see Snapshots.

Consensus And Membership

For production validator clusters, treat HashiCorp Go Raft as the current Raft candidate. Noosraft remains useful for development and deterministic tests, but it is not the production Raft engine.

Governance validator transactions do not automatically mutate runtime Raft membership. The operator flow is:

npm run noos -- governance operator-membership plan --json
npm run noos -- governance operator-membership execute --plan-file approved-plan.json --yes
npm run noos -- production preflight

Use HashiCorp Raft Deployment, Raft Consensus Configuration, and Raft Sidecar Operations for deployment and repair details.

Security Posture

Production deployments should use:

• HTTPS for TypeScript node APIs;
• mTLS for operator, node-to-node, and Raft HTTP paths where possible;
• TLS/mTLS for HashiCorp Raft TCP transport;
• non-development NOOS_OPERATOR_TOKEN;
• a certificate rotation plan;
• redacted logs and support bundles;
• no private keys, DEKs, operator tokens, plaintext payloads, or encrypted payload bytes in logs.

This page does not replace the security guides. Use Incident Response, Monitoring And Alerting, and Smart Contract Runtime Operations for operational security procedures.

Smart-Contract Readiness

When smart contracts are enabled, production readiness includes runtime and operator evidence:

• Wasmtime sidecar preflight is green;
• runtime activation is correct for the node role;
• contract readiness is green before routing calls;
• launch-gate report has no blockers;
• contract alerts are monitored;
• backup/restore drills cover contract state in the rehearsal environment.

Run:

npm run noos -- contracts launch-gate --profile mainnet --json
npm run noos -- contracts runtime provenance --json
npm run contracts:sidecar:provenance

This page does not duplicate package descriptor, provenance policy, registry approval, or publishing workflows. Use:

• Smart Contract Runtime Operations for runtime activation and preflight;
• Packages And Provenance for the package integrity chain;
• Package Provenance for descriptor signatures and active provenance policy;
• Contract Registry for network package approval;
• Publishing for package build/sign/publish flows.

Incidents And Monitoring

Preflight is not continuous monitoring. Use the read-only monitoring report for scheduled checks and paging glue:

npm run noos -- production monitor-report --json

If preflight fails because of an incident, do not mark the incident resolved just to pass the gate. Diagnose first:

npm run noos -- incidents doctor --json
npm run noos -- support bundle --output noos-support-bundle.json

Only mark an incident resolved after the cause is fixed and verification is green. Use Monitoring And Alerting, Incident Response, and Conflict Handling.

Performance Acceptance

Production preflight does not prove performance. Before launch, set local acceptance thresholds for:

• block commit p95;
• observer catch-up time;
• payload backfill throughput;
• snapshot export/import duration;
• replay verification duration;
• sidecar restart recovery time.

Use benchmark:v1-readiness and benchmark:v1-readiness:check to measure draft budgets in V1 Performance Targets. Keep soak, stability, and E2E runs separate from the admission preflight.

Release Artifact Boundary

Production artifacts should be versioned together:

• TypeScript node build;
• Admin GUI build;
• HashiCorp Raft sidecar binary;
• state-root sidecar binary when enabled;
• migration set;
• documentation and runbook version.

The current gate verifies node package version, CLI package version, local database migrations, and supported snapshot archive format. Release packaging details belong in Production Release Readiness.