Deployment checklist

Production checks for authentication, storage, browser hardening, recovery, observability, upgrades, rollback, and operational ownership.

Complete this checklist for the host application, not only the Ownfold repository.

Identity and server boundary

Derive userId from the authenticated server session on every request. Never trust a browser user ID, vault ID ownership claim, or device owner claim.
Enforce ownership and optimistic revisions inside the server and storage adapter transaction.
Protect cookie-authenticated coordination routes from CSRF and reject unsupported content types, methods, origins, sizes, and schema versions.
Configure rate-limit and audit hooks for vault creation, recovery verification, device operations, pairing, and rotation. Audit only non-secret metadata.
Treat checkRateLimit as fail-closed infrastructure. Send VaultAuditEvent values to the host’s durable audit sink and alert through onAuditDeliveryError; events contain operation, user ID, timestamp, and authorization decision, never request bodies or key data.
Confirm no server package, route, background job, analytics pipeline, or support tool can decrypt application records.

Apply adapter migrations in order and run the shared adapter compliance suite against the actual database engine and configuration.
Back up vault, device, pairing, rotation, and encrypted application-record tables together. Test restoration without copying plaintext into fixtures or logs.
Preserve opaque encrypted fields exactly. Do not truncate, normalize, index their contents, or deserialize and rewrite them outside Ownfold’s validated format layer.
Set retention for expired pairing requests and revoked-device metadata without deleting active envelopes or rotation checkpoints.

Verify secure-context Web Crypto, IndexedDB, file download/import, and required browser versions.
Verify the production worker bundle loads from the application origin under worker-src 'self'. Test worker failure and replacement without a main-thread cryptographic fallback.
Test IndexedDB quota exhaustion, blocked upgrades with another application tab open, and malformed local state. Confirm failed writes preserve the previous encrypted device state.
Deploy the host security controls, including CSP and telemetry exclusions.
Test create, download, import, verify, lock, unlock, restore, pair, revoke, rotate, resume, and destructive confirmation flows with keyboard and screen readers.
Explain permanent data loss before vault creation and Recovery Kit replacement. Do not provide a fake support or password-reset recovery path.

Run the release checklist and the host application’s own encrypted fixtures.
Record the deployment order, database migration, rollback compatibility, incident owner, and support escalation path.
Alert on typed error-code rates, revision conflicts, failed rotations, and storage availability without capturing request bodies or plaintext.
Exercise the incident-response runbook and lost-device scenarios before serving real user data.