Loading…
All projects
Creator OS
Active PrivateA production-hardening project for a creator and YouTube reporting SaaS. Before exposing customer traffic, I tied PostgreSQL workers, Docker runtime, backup/recovery, Playwright QA, and fail-closed operator preflight into one release contract.
Next.jsTypeScriptPostgreSQLDockerPlaywrightVitestBetter AuthYouTube API
How it was solved
Problem
Passing tests and a production build does not mean a SaaS is safe to expose. Database migrations, duplicate workers, wrong-host deployment, recovery state, OAuth, email, and operator policy can all drift while the application code still looks healthy.
Decision
I separated source completion from launch approval. The release uses immutable manifests, a dedicated PostgreSQL worker, Docker/Compose verification, backup-and-restore plus an independent deletion ledger, fail-closed operator/preflight checks, and a separate FINAL-QA gate. Missing external evidence stays blocked instead of being treated as success.
Evidence
The latest COS-32/33 final QA passed 22/22 focused checks and 669 regression tests; 27 database-dependent tests were skipped and explicitly not counted as passes. Typecheck, production build, release verifiers, and 29/29 read-only checks against the intended 4080 private-staging host also passed.
Result
The result is a reproducible private-staging release with explicit operational evidence. Public launch remains intentionally blocked on external gates such as authoritative DNS access, public TLS/proxy verification, real Google consent, policy/support approval, email sender identity, and encrypted recovery-key custody.