{"name":"The Leo King Business Intelligence API Observability Proof","version":"v1","status":"public-contract","contractVersion":"2026-07-15.enterprise-trust-release-candidate-v6","lastReviewedAt":"2026-07-15","checks":[{"name":"Production Env Gate","status":"live","signal":"`npm run prod:env:production` verifies required Vercel production env names before push/deploy.","cadence":"Before every production deploy or config change.","publicEvidence":"Readiness docs define required production env and block deploy when sensitive env names are missing."},{"name":"Sandbox Isolation Gate","status":"release_gate","signal":"`npm run smoke:sandbox-isolation` compares token-protected runtime identities from distinct live and sandbox Convex deployments.","cadence":"After either data-plane configuration changes and before exposing sandbox keys or try-it controls.","publicEvidence":"The sandbox-isolation workflow is designed for verified GitHub environment protection and retains commit-bound origin, environment, and hashed data-plane proof without raw tokens."},{"name":"Dedicated Gateway Smoke","status":"live","signal":"`npm run smoke:api-gateway -- --mode final` verifies DNS, root JSON, status, OpenAPI, and Postman on api.theleokingai.com.","cadence":"After gateway, OpenAPI, SDK, or docs deploys.","publicEvidence":"Gateway smoke writes `inference-smoke/api-gateway-smoke.json` and fails on contract drift."},{"name":"Buyer Path Usage Proof","status":"beta","signal":"`npm run smoke:paid-routes` calls the live Core/no-AI and AI routes and confirms matching Convex usageEvents by request_id.","cadence":"Before enterprise demos, after auth/billing/usage changes, and after production deploys that affect paid routes.","publicEvidence":"Smoke output proves lane, credits, model, billable units, and ledger row for the exact request."},{"name":"Internal Deep Readiness","status":"beta","signal":"GET `/api/v1/ops/readiness?deep=1` checks provider env, usage logging, rate limits, sidecars, and AI provider state.","cadence":"Before deploy and during incident triage.","publicEvidence":"Public status links to the internal readiness boundary while keeping `x-ops-token` required."},{"name":"AI Output Quality Sampling","status":"beta","signal":"Fresh live AI outputs must be inspected for required sections, metadata, depth, and no fallback-looking copy.","cadence":"After any generation logic, prompt, RAG, model, or provider deploy.","publicEvidence":"SLA and incident policy classify fallback-quality AI output as a sev1/sev2 product regression."},{"name":"Incident Ledger","status":"live","signal":"GET `/api/v1/incidents` publishes partner-impacting incidents and reporting policy.","cadence":"Within the public incident publication window after confirmed impact.","publicEvidence":"Incident history route exposes current no-incident state and required postmortem fields."},{"name":"Error Catalog","status":"live","signal":"GET `/api/v1/errors` maps response codes to retry behavior, partner action, and support signals.","cadence":"Reviewed with API contract changes.","publicEvidence":"Public error catalog includes `INVALID_RESPONSE`, `UPSTREAM_FAILED`, rate limits, auth, and idempotency conflict."}],"productionChecklist":["Production env gate prints READY FOR PUSH/DEPLOY for the target environment.","API CI passes lint, full tests, source-only API reference smoke, and production build.","GitHub Security workflow emits a commit-bound policy report with zero high or critical CodeQL and dependency-audit findings; any moderate exception has a named owner and review date.","GitHub API Production Release Gate passes in the protected production environment after deploy.","GitHub API Sandbox Isolation Gate proves distinct live and sandbox Convex data planes before sandbox exposure.","GitHub API Operational Resilience Gate validates approved external evidence for at least 15 minutes at 2x committed traffic, including billing and tenant invariants, alert acknowledgement, incident lifecycle, restore, rollback, and forward recovery.","Dedicated gateway smoke passes in final mode on api.theleokingai.com.","Buyer-path smoke passes against the dedicated gateway with Convex proof enabled.","Core endpoints return no token usage and AI endpoints return model/token visibility.","Fresh AI outputs satisfy product quality requirements after the deploy timestamp.","Support packet includes request_id, endpoint, key prefix only, UTC timestamp, and sanitized payload shape.","Access-control review confirms server-side key custody, endpoint scope, environment separation, rotation triggers, and no public-client key exposure.","Compliance mapping review confirms public evidence links, framework-style mapping, no certification overclaim, and signed-term boundaries.","AI governance review confirms acceptable-use boundaries, prohibited/restricted use cases, human-review requirements, and no fallback-success behavior.","Conformance evidence includes local contract tests, SDK build, app build, env gate, gateway smoke, buyer-path proof, and AI output sampling when relevant.","Data-processing review confirms minimization, restricted-data boundaries, retention policy, subprocessor scope, and signed-DPA requirements.","Launch-readiness handoff includes smoke evidence, partner integration matrix, billing proof, AI quality evidence, and rollback plan."],"runbooks":{"envGate":"npm run prod:env:production","gatewaySmoke":"npm run smoke:api-gateway -- --mode final","buyerPathSmoke":"npm run smoke:buyer-path -- --base-url https://api.theleokingai.com --output inference-smoke/buyer-path-gateway-core-YYYYMMDD.json","buyerPathSmokeWithAi":"npm run smoke:paid-routes -- --base-url https://api.theleokingai.com --output inference-smoke/paid-route-contract-YYYYMMDD.json"},"deploymentEvidence":{"commitSha":"bd03b3789679c836008e02d7cfb7a72174185328","deploymentId":"dpl_7aXDPrfE4QjK6dhgWRzMfDimesS5","deploymentUrl":"https://the-leo-king-o4r0bm40m-theleoking-astrologys-projects.vercel.app","generatedAt":"2026-07-15"},"links":{"docs":"/api-docs","security":"/api/v1/security","accessControl":"/api/v1/access-control","onboarding":"/api/v1/onboarding","conformance":"/api/v1/conformance","dataProcessing":"/api/v1/data-processing","compliance":"/api/v1/compliance","support":"/api/v1/support","status":"/api/v1/status","sla":"/api/v1/sla","incidents":"/api/v1/incidents","readiness":"/api/v1/ops/readiness?deep=1"}}