# International Press Zone — release evidence contract

Status: TEMPLATE — complete for the exact release candidate before commercial go-live.

This document is the required release receipt schema. It does not authorize deployment by itself. Every value must come from the exact release candidate and the matching canonical backend deployment; historical receipts may establish regression history but do not substitute for final-RC evidence.

## 1. Release identity

- Plugin source commit: `____________________________`
- Plugin Git tag: `____________________________`
- Plugin version: `____________________________`
- Canonical backend source/deployment commit: `____________________________`
- Release date/time UTC: `____________________________`
- Release operator/automation identity: `____________________________`

Required invariant: plugin header version, `IPZ_VERSION`, `readme.txt` stable tag, archive filename, update catalog version, and installed WordPress version are identical.

## 2. Preflight

Run from a clean plugin checkout:

```bash
node tools/release-preflight.mjs
```

Record:

- Preflight JSON/receipt path: `____________________________`
- `pass: true`: `[ ]`
- Deterministic blockers: `____________________________`
- Waiting external items: `____________________________`
- Concurrent lanes still active: `____________________________`

A `WAITING_EXTERNAL` Stripe item is not a code defect, but commercial launch requiring checkout/billing remains NO-GO until the external clearance and Stripe-specific proof are complete.

## 3. Deterministic/static factory gate

Use the existing canonical gate; do not replace individual failing stages with hand-picked substitutes.

```bash
tools/factory-gate.sh all
```

Record:

- Execution environment/host: `____________________________`
- Commit tested: `____________________________`
- Gate exit: `____________________________`
- PHP syntax: `[ ] PASS`
- Unit/standalone/integration runner: `[ ] PASS`
- PHPCS baseline gate: `[ ] PASS`
- PHPStan: `[ ] PASS`
- Admin JS lint: `[ ] PASS`
- Production admin build: `[ ] PASS`
- UI inventory/gate: `[ ] PASS`
- Full log/receipt: `____________________________`

No missing dependency, skipped release-relevant test, stale `known-failing` entry, or remote-dispatch failure counts as a pass.

## 4. Browser/runtime acceptance

Browser E2E must use the repository-sanctioned remote E2E path. Record the receipts supplied by the concurrent plugin-production-completion lane.

Required first-release journeys:

- `[ ]` Connect/social sign-in -> backend-issued site credential; credential never exposed to browser/logs.
- `[ ]` Language add/edit/enable/disable/default.
- `[ ]` Real synchronous AI translation regression.
- `[ ]` Real async/bulk submit -> poll -> terminal result -> WordPress finalization regression.
- `[ ]` Async cancel and out-of-scope authorization failure.
- `[ ]` Post/page translation for the supported scope.
- `[ ]` String scan/edit/generate.
- `[ ]` Frontend localized route and language switcher.
- `[ ]` Settings/exceptions.
- `[ ]` Manual-translation overwrite protection after its concurrent lane lands.
- `[ ]` Page fidelity after its concurrent lane lands.
- `[ ]` ACF/Yoast only if present in the first customer's supported stack.

Record:

- Chromium receipt: `____________________________`
- Firefox receipt: `____________________________`
- Production-like WordPress fixture identity: `____________________________`
- PHP/WordPress/theme/plugin matrix: `____________________________`
- JS console/PHP error-log review: `____________________________`

## 5. Stripe — WAITING_EXTERNAL

Do not mark this section complete before external Stripe clearance is actually available. Do not substitute PayPal or a temporary processor.

- Stripe clearance reference/date: `____________________________`
- `[ ]` Real package catalog visible to the plugin.
- `[ ]` Embedded checkout creates exactly one intended purchase/subscription.
- `[ ]` Webhook/entitlement activation converges in the plugin without database repair.
- `[ ]` Account page shows real plan/renewal/wallet state.
- `[ ]` Customer Portal opens for the connected customer.
- `[ ]` Disconnect does not silently cancel billing.
- `[ ]` Reconnect restores correct account status.
- `[ ]` Failed/inactive entitlement blocks paid operation without content mutation.

Receipt: `____________________________`

## 6. Distribution artifact

Build only from a clean, accepted source commit using the existing builder:

```bash
node tools/build-distribution.mjs
```

The builder owns the version transaction, locked admin dependency install, production asset build, allowlisted package construction, archive validation, and required local WordPress verification.

Record:

- Archive path: `dist/international-press-zone-________________.zip`
- Archive byte size: `____________________________`
- Archive SHA-256: `____________________________`
- Runtime content digest reported by builder: `____________________________`
- File count: `____________________________`
- PHP file count: `____________________________`
- Builder source commit before version transaction: `____________________________`
- Resulting release/version commit: `____________________________`

Verify the exact final archive again:

```bash
node tools/build-distribution.mjs --verify "dist/international-press-zone-<version>.zip"
```

- Verification receipt: `____________________________`
- `[ ]` No `.env`, credentials, browser auth state, local paths, tests, docs, source-only admin files, sourcemaps, logs, SQL/db dumps, private keys, or machine-specific artifacts in the ZIP.

## 7. Clean install proof

Verify the built ZIP, not a source checkout:

```bash
node tools/verify-local.mjs --zip "dist/international-press-zone-<version>.zip"
```

Record:

- Fixture URL/identity: `____________________________`
- `[ ]` Upload/install succeeds.
- `[ ]` Activation succeeds.
- `[ ]` Required migrations/bootstrap complete.
- `[ ]` Public route has no 5xx.
- `[ ]` localized route has no 5xx.
- `[ ]` REST index responds correctly.
- `[ ]` plugin REST surface responds with expected 2xx/401/403 behavior.
- `[ ]` WordPress login/admin remain healthy.
- `[ ]` No new PHP fatal or memory error is present.
- `[ ]` verifier restores prior active-plugin state exactly.

Receipt: `____________________________`

## 8. Upgrade proof

Upgrade from the immediately previous supported production release using the same package/update path customers will use.

Previous supported release:

- Version: `____________________________`
- Source/artifact SHA: `____________________________`

Prepare representative state before upgrade and verify after upgrade:

- `[ ]` configured languages preserved;
- `[ ]` default language preserved;
- `[ ]` existing post/page translation relationships preserved;
- `[ ]` string translations preserved;
- `[ ]` plugin settings/exceptions preserved;
- `[ ]` connected-site non-secret metadata preserved as intended;
- `[ ]` usable connected credential survives when the storage key/site identity is unchanged;
- `[ ]` manual customer edits are preserved;
- `[ ]` schema migrations are idempotent on reload;
- `[ ]` frontend routes/permalinks remain correct;
- `[ ]` admin loads with no fatal/console error.

Receipt: `____________________________`

## 9. Authenticated update/package delivery

Use the canonical backend update/package path paired with this plugin release.

- `[ ]` current installed version receives correct update metadata only when a newer entitled release exists;
- `[ ]` package URL/access contains no customer credential;
- `[ ]` package download is authenticated/authorized as designed;
- `[ ]` package verification accepts the exact release digest/signature path;
- `[ ]` byte-tampered package is rejected fail-closed;
- `[ ]` wrong/unknown release hash is rejected;
- `[ ]` WordPress installs the verified package successfully;
- `[ ]` installed version equals release version;
- `[ ]` installed runtime/admin asset identity matches the approved archive.

Backend deployment/update-catalog identity: `____________________________`

Receipt: `____________________________`

## 10. Rollback proof

Use the existing rollback/release mechanisms; do not invent an emergency production mutation path during an incident.

- Last known-good version: `____________________________`
- Last known-good archive path/reference: `____________________________`
- Archive SHA-256: `____________________________`
- Source commit: `____________________________`
- `[ ]` rollback archive passes `build-distribution.mjs --verify`;
- `[ ]` restore procedure is documented and executable with current credentials/tooling;
- `[ ]` rollback preserves customer content/database state;
- `[ ]` post-rollback plugin version/activation/admin entrypoint can be verified;
- `[ ]` forward-recovery path is known after root cause is fixed.

Rollback drill/receipt: `____________________________`

## 11. Supported-scope reconciliation

Compare the final candidate with `docs/launch/FIRST-CUSTOMER-SCOPE.md`.

- `[ ]` Every SUPPORTED row has acceptance evidence in this receipt.
- `[ ]` Every CONDITIONAL row required by the actual customer stack has been promoted by evidence or explicitly excluded from that sale.
- `[ ]` No DEFERRED capability is marketed or contracted as production-ready.
- `[ ]` Customer-facing README/readme/product copy matches the final matrix.

Customer-stack scope receipt: `____________________________`

## 12. Final go/no-go

There is no partial launch state. Record exactly one:

- `[ ] GO` — all required supported-scope evidence is green, no open P0/P1 defect, Stripe clearance/proof complete when purchase is required, exact rollback artifact retained.
- `[ ] NO-GO` — at least one required criterion above is incomplete or failed.

Decision owner: `____________________________`
Decision timestamp UTC: `____________________________`
Reason / residual risk: `____________________________`