Testing and release plan

Release acceptance covers legal data integrity, product behavior, tenant/security isolation, accessibility, deployment recovery and documentation. Synthetic data is mandatory in automated tests and public examples.

Test layers

Layer	Coverage
schema/static	content frontmatter, legal/source/control references, OpenAPI/events, SQL/migrations, lint/type
unit/property	domain transitions, clocks/time zones, HMAC refs, idempotency, policy precedence
component	forms/errors/focus, authorization predicates, audit append
integration	DB/outbox/worker, webhook, agent, secrets/KMS/object/message
contract	OpenAPI clients, events, connectors, backward compatibility
end to end	onboarding, grant/withdrawal, rights, retention, breach, vendor, export/exit
security	tenant negative, SAST/DAST/SCA, secrets, fuzz/injection, image/IaC, threat abuse
accessibility	automated plus keyboard/screen-reader/zoom/mobile/low bandwidth
resilience	dependency failure, queue replay, agent offline, restore/tombstone, region/tabletop
performance	consent burst, case queues, event backlog, export and large tenant

Legal/configuration tests

• all status records have authority, provision, dates, status, URL, access, confidence;
• every control requirement ID exists and every referenced control exists;
• commencement fixtures assert the three Act/Rules dates;
• no general legitimate_interest or portability enum;
• SDF designation requires notification source;
• statutory CM public status requires registration evidence;
• cross-border order lists cannot be populated without signed source;
• corrigendum/amendment impact diff requires reviewer.

Workflow scenarios

Golden synthetic tenant runs:

1. approve purpose/notice, grant, deny and withdraw offline/online;
2. duplicate/replay/conflicting idempotency;
3. request with match, no match, multiple match, clarification, partial, refusal and reopen;
4. retention with sector conflict, hold, release, processor failure and backup restore;
5. incident that triggers CERT-In only, DPDP only, both and neither;
6. child journey with parent, conflict, adulthood and blocked SDK;
7. vendor country/subprocessor/contract change;
8. mass evidence export with tamper and unauthorised scope;
9. tenant offboarding and independent import.

Security release gates

No unresolved critical/high finding unless emergency risk acceptance states exploitability, compensation, owner and deadline; no cross-tenant test failure; no secrets/PII in repository, artefacts/logs; dependency audit and SBOM reviewed; signatures/provenance verified; KMS/rotation and break-glass tests current.

Accessibility release gates

Critical Principal journeys meet WCAG 2.2 AA target with automated checks and manual keyboard, screen-reader, 200/400% zoom, 320 px and reduced-motion tests. Errors move focus/associate labels; status is non-colour; language change preserves state. Critical failure blocks release.

Deployment matrix

Docker Compose evaluation; supported Kubernetes versions; managed SaaS; customer VPC reference; external KMS/secrets/PostgreSQL/object; egress-denied operation; upgrade from last two supported minor versions; backup/restore and rollback. Air-gap remains experimental until bundle/update procedure passes twice with an external operator.

Release stages

dev → signed alpha → internal synthetic → design-partner sandbox → limited pilot → release candidate → GA/LTS

Canary tenant receives application before broad rollout but legal configuration activation remains customer-reviewed. Monitor error-budget burn, authorization denials, audit integrity, queue age and task discrepancies. Roll back application on safety regression; preserve new writes and migration compatibility.

Artefacts

Source tag/commit; change/migration/deprecation notes; image/chart/package digests; OpenAPI/event/ connector schemas; SBOM; vulnerability/licence reports; provenance/signatures; test/accessibility/ restore reports; legal source/config diff; known issues and support matrix.

Version policy

Semantic version application/API. Event and connector schema major in type. Database migrations expand/migrate/contract. Legal config uses dated independent versions. Critical security fix supports current and LTS branches; deprecation normally at least six months/two minors, subject to urgent security or law with migration path.

Release decision

Release manager, engineering owner, security and QA sign code; legal reviewer signs changed legal configuration; documentation owner signs docs. Product/sales cannot waive security/legal claims gates. A failed gate produces explicit exception or no release.