Internal Dogfood Drill — V1 Launch Gate

Gate owner: Release Captain. Source-of-truth: this file. Status: template + procedure. Each drill cycle produces a dated evidence snapshot at docs/releases/v1/verification/dogfood/YYYY-MM-DD/.

The dogfood drill is the 30-day pre-GA window during which the OSHUN core team exercises every launch-critical customer and admin journey on production-grade infrastructure with production-shaped data. The drill is the last gate before private beta in §33.1.

1. Scope and duration#

• Duration: ≥ 30 consecutive calendar days ending no later than 14 days before the targeted GA date.
• Build cadence: nightly canary build promoted from main after CI green; release-candidate build cut every Monday.
• Infrastructure: production-equivalent cluster (oshun-stage-prod-mirror) with production-shaped fixtures from testing/fixtures/ and tests/integration/fixtures/, plus the per-domain seed-data inventory in docs/content/v1-bundles.md#seed-data-inventory.
• Cohort: every named OSHUN engineer, PM, designer, content lead, support operator, moderator, reviewer, persona operator, model operator, privacy operator, compliance operator (~80 participants).

A drill that runs for less than 30 days, or skips any required journey, does not satisfy this gate and the release captain must re-open it.

2. Required journey coverage#

Every participant runs at least one customer journey and one admin journey per day, logged via the dogfood telemetry channel (#dogfood-evidence in Slack, mirrored to dated journal files under docs/releases/v1/verification/dogfood/<date>/journal.md). Coverage matrix:

2.1 Customer journeys (every room this release ships + cross-domain)#

V1.0 scope. Rows for Veritas and Metis are struck: those rooms are deferred to V1.2, so nobody can run their journeys and a required-hit target against them would only ever be met by fabricated evidence. They return to this matrix in the release that opens them. Mobile rows are V1.1.

2.2 Admin journeys (all critical operator workflows)#

Hits are counted by structured journal entries containing journey:, outcome: (pass / defect / blocked), defect_id: (if applicable), and evidence_url:. The evidence_url MUST resolve to a screenshot, HAR, trace, or recording stored under docs/releases/v1/verification/dogfood/.

3. Daily cadence#

• 08:00 PT — release captain posts the day's focus journeys.
• Continuous — participants log journal entries as journeys complete.
• 17:00 PT — release captain triages new defects, assigns owners.
• 17:30 PT — auto-report posted to #dogfood-evidence summarising:
  • Hits per journey vs. plan.
  • New defects opened by severity.
  • Defects resolved by severity.
  • SLO compliance for production-mirror dashboards (see §5).

4. Defect handling#

Severity definitions match docs/runbooks/oshun-v1.md §4. Required SLAs:

Every S0 / S1 defect closure requires:

• Repro evidence (HAR / trace / recording).
• Fix commit linked.
• Regression test added (Playwright / Vitest / contract).
• Re-run of the failing journey by a different participant.

5. SLO mirror#

For the 30-day window the production-mirror cluster runs the same post-deploy monitoring stack as production:

Any dashboard outside threshold for > 2 consecutive days triggers a drill freeze: no new feature merges until the regression is closed.

6. Exit criteria (must all be true to advance to private beta)#

• 30 calendar days elapsed without an unrecovered drill freeze.
• Coverage matrix in §2 met or exceeded.
• Zero open S0, zero open S1, ≤ 3 open S2.
• All dashboards in §5 within threshold for last 7 consecutive days.
• Privacy DSAR drill (export, delete, restore-blocked) completed end-to-end with audit-log evidence.
• Kill-switch fire + fallback recovery drill completed at least twice.
• Backup-restore drill completed at least once with RTO ≤ 1 h, RPO ≤ 15 min.
• Release captain, security lead, privacy lead, product lead, support lead, and engineering lead each post lgtm in #dogfood-evidence with a link to the evidence snapshot.

7. Evidence snapshot#

At drill close, release captain commits:

docs/releases/v1/verification/dogfood/YYYY-MM-DD/
├── coverage-matrix.csv          # one row per journey, hit count, owner
├── defect-ledger.csv            # all defects with severity, status, fix commit
├── slo-report.md                # weekly dashboard rollup
├── kill-switch-drill.md         # narrative of fire + recovery
├── dsar-drill.md                # narrative of export+delete+restore-blocked
├── backup-restore-drill.md      # narrative of RTO/RPO measurement
└── signoffs.md                  # six lgtm comments with timestamps

Without this snapshot present in the repo at drill close, §33.1 dogfood remains unsatisfied regardless of any other state.

8. Cross-references#

• Beta program (week 31-day private-beta gate): docs/launch/private-beta.md.
• Safety review pass (Lilith + T&S + Privacy board): docs/launch/safety-review.md.
• Quality review pass (content + AI eval thresholds): docs/launch/quality-review.md.
• Beta-blocking-issue remediation: docs/launch/beta-blocking-remediation.md.
• Go/no-go: docs/launch/go-no-go.md.
• Rollback plan: docs/reference/rollback-procedures.md.