Alpha → Production Release Report (2026-05-12)
Generated: 2026-05-16
Scope: attunelogic-api + attunelogic-service (web stack)
Promotion path: Merge alpha → main (triggers production deploy via GitHub Actions)
Related QA matrix: Alpha → Production QA Matrix (2026-05-12)
Executive summary
| Repo | Production (main) last promoted | Alpha tip | Commits main..alpha | Diff size |
|---|---|---|---|---|
| API | 2026-04-26 (PR #168) | 2026-05-12 (88320fb) | ~95 | 223 files, +20.7k / −2.6k lines |
| Service | 2026-04-02 (PR #160) | 2026-05-12 (a8a90630) | ~65 | 260 files, +29.7k / −7.3k lines |
Commit date range on alpha (not yet on main): 2026-03-16 → 2026-05-12
Open promote PRs (refresh before merge — alpha moved on 2026-05-12 after PRs opened 2026-05-05):
Not in this promotion: feature/tenant-roles-permissions (TenantRole, requirePermission are not on origin/alpha).
Mobile: origin/alpha vs origin/main is a separate, older delta—not part of this web release unless a separate EAS production build is scheduled. If mobile stays on an older build, validate API contract changes (e.g. legs mobileDashboard shape) against alpha before API-only prod deploy.
1. What has changed since last production deploy
API — since last prod (2026-04-26)
Production already includes the April 2026 beta cut: billing webhooks, MFA recovery scaffolding, trucking scheduler timing, onboarding tutorial, public leads, tier/seat-cap scaffolding, tenant-scoped legs, audit logs, and related hardening from the prior alpha promote.
New on alpha since that prod deploy (2026-05-02 – 2026-05-12):
| Area | Highlights |
|---|---|
| Dynamic dashboards | New Dashboard model, /api/v1/dashboards, widget/metric registry, feature-flagged rollout (dashboards.* flags, tier defaults) |
| Super-admin leads | Admin leads inbox: list, notes, assignee, status, create customer from lead |
| Leads / onboarding | Self-serve onboarding, public onboarding routes, Turnstile fixes, CSV onboarding upload |
| Tags | Expanded tag model/API; duplicate Tag model registration hotfix |
| Settings / security | User tenant isolation in settings; template updates |
| Jobs / rates | Stabilized dashboard + job rate updates |
| Deploy / CI | Deploy env alignment, emergency deploy path, test inventory guards |
Full alpha−main themes (2026-03-16 – 2026-05-12) also include: Stripe billing checkout/webhooks, MFA + refresh-token versioning, GDPR account endpoints, schedule timing alerts, feature-tier gating, public lead capture + webhooks, onboarding tutorial on User, mobile dashboard leg shape, search/approval scoping, and extensive test/CI restructuring.
Service — since last prod (2026-04-02)
Service production is ~6 weeks behind API production. This promote is a large UI/UX release.
| Area | Highlights |
|---|---|
| Dashboard V2 | Builder UI, RTK Query integration (DashboardV2) |
| Dispatch / scheduler | Resource day view, timeline DnD, optimistic events, timing alerts UI, dispatch workspace upgrades |
| Super admin | Customer management, billing screens, leads inbox, audit-oriented admin surfaces |
| Auth | Login MFA challenge flows, password/MFA recovery pages |
| Billing | Customer billing management UI (pairs with API Stripe work) |
| Jobs | Leg create/show updates, job rates, leg audit on reports, job tags UI |
| Onboarding | Walkthrough/tutorial (auto-tutorial flow adjusted in later commits) |
| Tags & settings | Expanded tags, settings updates, tenant isolation fix (mirrors API) |
| Tier gating | UI gates aligned with API feature flags |
| Help / feedback | Getting-started help, feedback page rename |
| Infra | Socket auth centralization, app link association files, deploy workflow alignment |
Version jump (on merge): 2.28.21 (prod) → 2.31.0 (alpha).
2. QA review and test plan
Test on alpha before merging promote PRs. API and service should be promoted together—service Dashboard V2 and billing UI depend on new API routes and models.
See the dedicated matrix: alpha-to-production-release-2026-05-12-qa-matrix.md.
P0 — must pass before prod
| # | Flow | Why |
|---|---|---|
| 1 | Login / session | Refresh-token versioning + MFA challenge/recovery; risk of unexpected logouts |
| 2 | MFA enroll / verify / recovery | Email + TOTP paths, locked-out recovery |
| 3 | Tier-gated features | Starter vs Growth vs Pro: dashboards, live updates, route optimization, saved reports |
| 4 | Dashboard V2 | Create/edit layouts, widgets, role visibility; tier flags off/on per tenant |
| 5 | Dispatch / trucking scheduler | Timing alerts, resource day view, drag-drop, multi-day events |
| 6 | Jobs — rates & legs | Job show rates, leg create, leg audit on reports |
| 7 | Settings → Users | Tenant isolation (users must not leak across tenants) |
| 8 | Super-admin → Leads | Inbox, notes, status, assignee, create customer from lead |
| 9 | Public lead capture | /public/leads + Turnstile; rate limits; webhook if configured |
| 10 | Billing / Stripe | Checkout, webhook-driven status on customer; super-admin billing views |
| 11 | Onboarding | Self-serve signup path, tutorial progress persistence, CSV import |
| 12 | Tags | Create/assign on jobs/customers; no API startup errors (post duplicate-Tag fix) |
P1 — regression by module
- Invoices / manifests / payouts — tutorial flags, manifest display, leg route isolation (re-verify with scheduler changes).
- Search & approvals — scoped results after search tightening.
- Chat — read receipts / conversation updates.
- Reports — saved report limits vs tier; seat-cap behavior (monitor vs hard if enabled).
- Mobile API consumers — legs mobile-dashboard triptych shape if mobile not redeployed.
- GDPR — export/delete entry points if exposed in UI.
P2 — admin / ops
- Super-admin customer tabs, API key/email modals.
- Audit log listing (new admin route).
- Emergency deploy workflow (ops only).
Suggested QA environments
| Layer | Where to test |
|---|---|
| API | Alpha API host (per deploy workflow / APP_URL vars) |
| Web app | Alpha service host (paired with alpha API) |
| Stripe | Test mode keys + webhook endpoint pointed at alpha |
| Turnstile | Site keys for alpha/public lead forms |
Known gaps for QA
- API has many tests classified needs-review in
tests/test-inventory.md; CI runstest:non-dbon deploy, not the full DB suite—manual exploratory testing on alpha is important. - Service had periods of tests disabled for deploy in branch history; rely on alpha smoke + P0 matrix.
3. Dev team: DB models, scripts, and breaking changes
New or materially changed models (API)
| Model / area | Change | Dev action |
|---|---|---|
Dashboard (new) | Tenant-scoped saved dashboards/widgets | Ensure indexes; run seeds if using system defaults |
Customer | billing subdocument, tags[], grandfatherFullAccess, enforcementMode | Optional: node scripts/backfill-billing-customers.js (dry-run first) |
User | mfa, refreshTokenVersion, tutorialProgress, uiPreferences, metadata | Existing users default safely; MFA via enroll flow |
Lead | Public + super-admin lead flows | Verify indexes for list/filter |
Tag | Expanded tagging | Confirm no duplicate model registration on deploy |
AuthChallenge | MFA challenges | Monitor collection growth; TTL/index if configured |
AuditLog (new) | Admin audit trail | Index customerId / createdAt for admin UI |
Job / Leg / others | Minor fields for dashboards, timing, tags | Review diffs for any required backfill |
Not in alpha: TenantRole, permission middleware, backfill-tenant-roles.js (local feature/tenant-roles-permissions only).
Scripts and ops (runbook)
| Script | When |
|---|---|
scripts/backfill-billing-customers.js | If prod tenants need customer.billing synced from Stripe |
scripts/manage-indexes.js / scripts/manage-atlas-indexes.js | After schema changes; confirm Atlas search indexes |
scripts/seed-dev.js / dashboard seeds | Dev/staging unless controlled prod seed plan exists |
scripts/verify-seed.js | Post-seed validation in non-prod |
Environment variables to verify in production
- Stripe:
STRIPE_SECRET, price IDs,STRIPE_BILLING_WEBHOOK_SECRET - Public leads: Turnstile secrets,
NEW_LEAD_WEBHOOK_URL(optional) - Seat caps:
SEAT_CAP_HARD_ENFORCEand per-customerbilling.enforcementMode(monitorvshard) - Feature flags / tiers:
planTier,grandfatherFullAccess,betaAllowlistonCustomer - MFA / auth: email delivery for challenges; refresh cookie behavior behind load balancers
Breaking / behavior-change risks
| Risk | Detail | Mitigation |
|---|---|---|
| Refresh token versioning | Older sessions may invalidate on login/refresh churn | Communicate “re-login once” if auth errors spike |
| Legs tenant scoping | Cross-tenant leg IDs return 404 (not 403) | Clients must not misread 404 |
| Mobile dashboard API shape | Legs mobileDashboard triptych sections | Confirm mobile build version or accept API-only risk |
| Tier gating | Features hidden by plan | Set grandfatherFullAccess for VIP tenants if needed |
| Dashboard feature flags | Off by default per tier | Enable via config/flags before announcing Dashboard V2 |
| Stripe webhooks | Billing state driven by events | Register prod webhook URL before go-live; replay failed events |
| Duplicate Tag model | Startup crash on beta (fixed in PR #185) | Confirm fix is in promote commit |
| Service/API skew | Service 2.31.0 expects newer API | Deploy API to prod before or with service; never service-first |
Deployment mechanics
- Merge refreshed alpha → main PRs (API + service).
- Workflows deploy on push to
main(unless[no deploy]in commit message). - API runs
standard-versionon prod merge (patch bump +[no deploy]version commit). - Use production GitHub environment approvals if configured.
Recommended go-live sequence
flowchart LR
A[QA sign-off on alpha] --> B[Refresh alpha→main PRs]
B --> C[Merge API main]
C --> D[Verify API health + webhooks]
D --> E[Merge Service main]
E --> F[Smoke prod: login, jobs, dashboard, billing]
- Complete P0 QA on alpha.
- Update or recreate promote PRs so they include 2026-05-12 commits.
- Merge API → verify health, Stripe webhook, public leads.
- Merge service → smoke Dashboard V2, dispatch, super-admin.
- Monitor auth errors, 404 on legs, and Stripe webhook logs for 24–48 hours.
Out of scope for this promote
- Tenant roles & permissions (in-progress; not on alpha).
- Mobile native/OTA (separate repo; validate API contract if mobile stays on older build).
- attunelogic-landing (not reviewed for this report).
Metadata
- Source repos:
ferda-tech/attunelogic-api,ferda-tech/attunelogic-service - Comparison:
origin/main..origin/alphaas of 2026-05-16 - Owner: engineering
- Last updated: 2026-05-16