Release acceptance

Production Readiness Tests

This page separates what the package can test automatically from what must be proven inside your real Cloudflare/Stream/OBS staging environment.

v20.4Static auditBackend integrationStaging rehearsal
Automated package tests: run TESTS/run-all.sh from the repository root. It executes three suites: the static/package audit, the Command/HVN/Iridesceux backend integration suite, and the HVN viewer-account integration suite against the actual Function modules.

What the automated suite checks

  • JavaScript/ESM syntax and JSON parsing.
  • D1 schema creation, foreign-key check, market seeds and version.
  • Local links/assets and duplicate HTML IDs across Command, Iridesceux and HVN.
  • Command/HVN CSP framing rules.
  • Cloudflare Access/JWT hardening and async API error boundaries.
  • Asset type + market validation for station IDs/bugs.
  • Screen-ad and commercial-break as-run completion/interruption behavior.
  • Timed presentation state normalization.
  • Safety expiration logic.
  • HVN public control/media-range/telemetry behavior.
  • Atomic OBS-agent command claiming and stale-command recovery.
  • HVN duplicate legal-page removal and redirect presence.
  • All six Iridesceux public form types, allowed/disallowed attachments, adult/support age gates, Resend payloads and Command inbox mirroring.
  • Site Studio URL hardening so executable/protocol-relative override URLs cannot be published.
  • HVN viewer registration/login/profile/location/watchlist/password reset/logout/deletion flows.
  • First-party public audience count and live/offline status endpoints.

Real staging acceptance — do this step by step

1

Deploy Command staging

Use Git/Pages or Wrangler with command-app as the project root and public as the static output. Keep functions/ beside—not inside—the output directory. Bind staging D1, configure Access/JWT, redeploy, and run Setup Doctor. CORE BACKEND must be green.

2

Test R2 end to end

Bind COMMAND_ASSETS. Upload one disposable station bug, one short station ID, one screen-bug ad, and one commercial. Refresh, preview each, and verify persistence.

3

Deploy HVN staging privately

Bind the shared D1/R2 resources needed by HVN. Open the HVN player in a separate browser and verify the Command preview monitor can frame it.

4

Test every market

For National plus all six local markets, verify station bug, Station ID PREVIEW/CUE/TAKE/CLEAR, butterfly trigger/hold/fade/reset, loop TAKE/CLEAR, and local inheritance behavior.

5

Test advertising

Build a break from approved inventory, preview it, TAKE it, let one complete naturally, abort another early, and verify proof-of-play/as-run outcomes. Confirm a market-specific break cannot be taken in the wrong market.

6

Test realtime

Connect the realtime Worker. Keep a viewer window open and confirm TAKE/CLEAR actions appear promptly without manually refreshing.

7

Connect the OBS agent

Use a test OBS profile/feed. Confirm heartbeat, scene change, start/stop recording, and test-only stream controls.

8

Rehearse emergencies

On a non-public test feed, rehearse Primary → Backup → Primary, emergency stop, standby loop, and Kill All Graphics.

9

Test safety

Use a manual test alert first. Confirm market targeting, expiration clearing, local time display and operator clear. Keep automatic TAKE disabled unless separately approved.

10

Test public-site forms and CMS

Use staging identities/data. Confirm Iridesceux forms deliver through the configured mail provider, Command mirror records appear where expected, Site Studio changes render on both staging sites, and no private docs/Command links are public.

Do not skip the real staging rehearsal. Automated tests cannot prove your actual DNS, Cloudflare Access policy, account bindings, mail provider credentials, Cloudflare Stream input, browser behavior, or physical OBS machine.

Release decision

Only call the system production-ready when: automated tests are green, Setup Doctor CORE is green, staging upload/preview works, live presentation controls work across markets, emergency switching has been rehearsed, and the public sites pass their own launch checklist.

Additional v20.4 automated suite: HVN viewer accounts

./TESTS/run-all.sh now runs three independent suites. The HVN viewer-auth suite covers registration, password hashing, secure session-cookie attributes, duplicate identities, session expiry, cross-origin mutations, profile/location/watchlist persistence, password changes, password-reset email/token behavior, logout and deletion.

Additional staging checks

  • Confirm a real Command schedule block appears in the HVN live schedule and draft blocks do not.
  • Confirm viewer location/watchlist changes survive reload and another signed-in browser.
  • Confirm reset mail works from the verified production sender.
  • Confirm auth rate limits/WAF rules are active before public signups.

What automation cannot prove

  • Actual Cloudflare Access policies, DNS/custom domains and production/preview bindings.
  • Actual Resend sender-domain verification and real email delivery.
  • The real Cloudflare Stream input/player ID and end-to-end broadcast latency.
  • Realtime Worker delivery in your Cloudflare account.
  • Physical OBS WebSocket/scene/audio configuration on the broadcast machine.
  • Cross-device browser playback and visual QA on the final public domains.

Those are mandatory staging acceptance items, not reasons to delay building Command.

Canonical private documentation · Iridesceux / HVN Command v20.4 · Keep internal.