Production Readiness

Complete this review before requesting production enablement. Production activation is a coordinated decision: Travel Insured owns enablement of its services and partner account; the partner owns its deployment and operations; both parties own cutover verification and incident coordination.

Travel Insured Responsibilities

• Confirm the approved integration scope, account capabilities, products, and enabled features.
• Provision production endpoints, credentials, allowed origins, and component access through an approved secure channel.
• Activate Travel Insured-owned services and account configuration.
• Provide the authoritative production support and escalation path.
• Participate in launch verification and investigate Travel Insured service or contract failures.

Partner Responsibilities

• Deploy the approved application and configure production secrets, endpoints, and exact origins without exposing credentials.
• Complete internal release, security, privacy, accessibility, QA, operations, and change approvals.
• Configure monitoring, alerts, support ownership, incident response, and rollback controls.
• Execute partner-side smoke checks using the approved production-safe scenario.
• Stop or roll back the partner release when launch criteria fail.

Joint Responsibilities

• Agree on cutover timing, contacts, launch checks, success thresholds, and rollback authority.
• Verify authenticated connectivity and the enabled journey without duplicating a transaction.
• Monitor initial production behavior and reconcile authoritative outcomes.
• Coordinate escalation, customer communication, containment, recovery, and post-incident review.

Access and Security

• Production endpoints and credentials were issued through an approved channel.
• Sandbox and production secrets are separated and stored in an approved secret store.
• Least-privilege server identities and authorization checks are in place.
• Browser bundles, logs, analytics, support tools, and error messages contain no credentials or sensitive payment data.
• Credential rotation and incident response owners are named.

Reliability and State

• Timeouts, bounded retries, jitter, idempotency, and reconciliation follow approved contracts.
• Purchase, payment, bind, and modification state transitions cannot complete twice.
• Dependency failure and partial GraphQL response behavior is tested.
• Rollback does not corrupt or replay customer transactions.

Observability and Support

• Dashboards cover traffic, latency, failure category, and completion rates without sensitive payloads.
• Alerts have owners, thresholds, and runbook links.
• Correlation identifiers connect customer support to sanitized server diagnostics.
• Support escalation and incident communication paths are rehearsed.

User Experience and Accessibility

• Loading, success, pending, cancellation, and failure states are clear and non-color-dependent.
• Keyboard, focus, labels, errors, status announcements, contrast, zoom, and reflow are manually reviewed.
• Browser events are treated as UX signals; server authority controls final confirmation.

Release Decision

The named approvers, activation scheduling mechanism, smoke-check transaction policy, and formal launch record are Requires Travel Insured Process Owner Confirmation.