Environment architecture & release evidence
Promote the build. Reissue every identity.
Mappls integrations move through fixture, development, staging, and production with isolated applications, credentials, entitlements, quotas, callbacks, state, and owners. This center turns that separation into a deterministic release decision.
Fixture is a mode—not a fake production account.
Start without credentials, then introduce separately governed provider identities only when live behavior is required. Evidence becomes stricter at every boundary.
Local fixture
Learn contracts, build UI states, and prove hostile paths without a provider credential or network call.
- Identity
- No provider application identity. Use deterministic fixture identities that can never be confused with provider evidence.
- Traffic
- Fixture only
Exit evidence
- Success, empty, validation, authentication, throttling, timeout, and unavailable paths are deterministic
- No credential or provider payload appears in source, logs, screenshots, URLs, or archives
- The live adapter is disabled by default and fails closed when configuration is absent
Development
Prove one narrow integration against a separately provisioned non-production identity.
- Identity
- Dedicated development project, application, credential, entitlement, region, quota, logs, and callback boundary.
- Traffic
- Synthetic and approved test data
Exit evidence
- One exact runtime path and product set is active
- A restricted credential produces an attributable successful request
- Negative, quota, teardown, and stateful reconciliation paths are proven
Staging
Rehearse the production journey with production-like topology and isolated identities.
- Identity
- Dedicated staging application and secrets; never a production credential copied into a pre-production host.
- Traffic
- Synthetic or explicitly approved representative data
Exit evidence
- Release candidate, configuration schema, region, quotas, and dependency versions are frozen
- Stateful events, duplicate delivery, timeout reconciliation, and recovery are exercised end to end
- Monitoring, alerts, owner escalation, rollback, and support evidence are rehearsed
Production
Serve approved real workloads under the independently reviewed release contract.
- Identity
- Dedicated production project, application, least-privilege credential, entitlement, region, quotas, owners, and audit trail.
- Traffic
- Approved production data only
Exit evidence
- Product, security, operations, and required finance authorities approved immutable evidence
- Progressive rollout, live health signals, rollback trigger, and accountable owners are active
- Provider binding, entitlement, inventory, metering, webhook, and audit evidence reconcile
Fail-closed readiness assessor
Declare the evidence you can actually observe.
Unchecked evidence remains a blocker when required. The assessor accepts booleans only—never credentials, provider payloads, URLs, customer data, or release artifacts.
What moves, what is reissued, what must be proven.
Fixture → development
- Promote
- Source, tests, contract version, safe configuration schema
- Reissue
- Development application, credential, entitlement, region, callback
- Prove
- One attributable live request plus expected denial and unavailable paths
Development → staging
- Promote
- Reviewed build artifact, dependency lock, migration and event schemas
- Reissue
- Staging application, credential, quota, webhook secret, idempotency namespace
- Prove
- Full journey, duplicates, reordering, unknown outcome, recovery, alerts, teardown
Staging → production
- Promote
- Content-addressed release artifact and frozen evidence references
- Reissue
- Production identity, credential, provider binding, entitlement, callbacks, owners
- Prove
- Independent approvals, progressive rollout, health gate, rollback and post-release reconciliation
Non-negotiable separation
Six invariants prevent quiet cross-environment coupling.
- One provider application identity belongs to exactly one control-plane environment and runtime boundary.
- Credentials are created per environment and restricted at the runtime edge; secrets are never promoted or copied.
- Entitlement, quota, region, provider host, callback, data policy, and owner evidence are re-observed in every environment.
- Fixture success proves application behavior against a declared contract, not provider availability, entitlement, latency, or compatibility.
- Stateful promotion preserves schema and command semantics, but starts with separate durable state, idempotency namespaces, callbacks, and reconciliation lanes.
- Production release approval is an independent control-plane decision; a green development or staging run cannot grant it.