docs/release_checklist.md

Morpheus Release Checklist

Before Push

• Run focused backend tests for the changed slice.
• Run node --check on touched frontend files.
• Review git diff --stat and confirm no temp/test artifacts are included.

Before Deploy

• Push main to Hugging Face.
• Apply pending Supabase migrations in order.
• Confirm environment variables match local expectations:
  • Supabase URL / anon / service role
  • MASTER_ADMIN_KEY
  • graph/code index env vars if used
  • if hosted admin review is enabled: ADMIN_REVIEW_PROVIDER, ADMIN_REVIEW_MODEL, NVIDIA_API_KEY, NVIDIA_API_BASE_URL
  • if dual review is enabled: ADMIN_REVIEW_PRIMARY_MODEL, ADMIN_REVIEW_SECONDARY_MODEL, ADMIN_REVIEW_CONSENSUS_ENABLED
  • if Crawl4AI URL extraction is enabled: URL_INGEST_EXTRACTOR, URL_INGEST_CRAWL4AI_ENABLED, URL_INGEST_ALLOWED_HOSTS

Post-Deploy Smoke

• GET /health
• Sign in or guest auth works
• PDF upload still succeeds
• Query streaming still returns sources and a trace id
• Admin review loads traces and evaluation datasets
• Admin draft review works with the configured provider (ollama or NVIDIA hosted)
• Dual admin draft review shows primary, secondary, and consensus status when enabled
• Graph summary/search/export endpoints return tenant-scoped data
• Operator URL ingest accepts only safe public hosts and queues background ingestion
• Bounded URL crawl is constrained by allowed hosts, depth, and page budget

Operator Checks

• Confirm reviewed eval rows and active eval rows are non-zero
• Confirm query_traces are still recording version metadata
• Confirm cache invalidation by feedback still works
• Confirm graph runs appear after code indexing
• Confirm URL ingest respects allowlisted hosts and blocks private-network targets