Today we deployed the first production cell, worked through staging registration and invitation problems, and continued testing how users move between systems, models and component configuration. The latest application changes are now running on staging Cell-1. Production customer admission remains paused while launch requirements are completed.
Production infrastructure and recovery
Orion, our first production cell, is deployed with persistent database storage. Its application and worker are healthy, and production Control can see its heartbeat, release and storage information.
Dedicated production identity, gateway, onboarding and billing services are also deployed. Production and staging use separate identity installations and internal application credentials. The image registry and backup storage are shared for now, with separate backup paths; provider credentials are not yet fully isolated between environments.
We configured encrypted, signed backups for Orion, Control and the identity service, with scheduled backups and retention protection. We then restored an Orion backup independently with each of the two offline recovery keys into fresh disposable databases. Both restores passed integrity and restoration checks. Temporary restored data and private-key copies were removed afterward.
This verifies complete cell-database restoration on the existing host. Recovery onto another host and recovery of one tenant remain separate tasks.
Staging payments, registration and invitations
The staging payment-confirmation problem came from a sandbox webhook still pointing at the domain that had moved to production. We corrected the destination and successfully replayed six failed notifications. Both affected checkouts reached completed billing state with Starter Plus trial entitlements. Their full onboarding journeys still need final user verification.
We also corrected account-switching behavior in onboarding and invitations. The gateway now ends the previous identity session before continuing with the verified registration or invitation email. This includes the path taken after organization creation has already completed.
Organization deletion now queues identity cleanup in staging. A user with another organization membership is retained; a user without remaining memberships is removed from the identity service. Failed provider calls remain queued for retry. Temporary identities verified both outcomes. This currently covers the self-service deletion flow, not every operator deletion path.
Earlier in the day, we restored access to both staging cells after expired startup verification evidence and missing proxy-network attachments left them unavailable. Both passed health and readiness checks after recovery.
Permissions and everyday workflows
A normal-member audit checked 37 read-only handlers against staging data. After the fixes, 24 returned successful responses and 13 correctly denied access; none returned a server error. This was a handler and database audit, not a complete browser test of every member journey.
Manage users now exposes all 27 access properties. Model lifecycle, system lifecycle and automation-rule management have explicit permissions, enforced in both the application and database. Restricted pages explain the missing access instead of failing with a generic error.
Settings now directs users to Manage users for invitations. Same-computer invitation links were added specifically for local Community testing.
Keeping context visible
The UI audit covered 65 browser checkpoints and an inventory of 85 page templates. We corrected context loss through model attachment, component and LLM configuration, and readiness-profile workflows. Opening a readiness profile from a system now retains that system as the origin.
Other fixes preserve context after model creation and during API-client setup, keep local runtime examples pointed at the local installation, allow corrected invalid forms to be submitted, and preserve component membership when capturing an architecture template.
User review also exposed problems in our first visual corrections: an added navigation layer and competing brand and object headings created clutter. We removed the extra layer, retained the existing menus, corrected the heading hierarchy and reduced context-bar loading shifts. Further visual testing is still needed; this is not an every-page design certification.
Deployment and verification
Cell-1 now runs release 20260908.4 / v1.1.0-rc95. The application and worker use the same immutable image, migration 163 completed successfully, and public health and readiness checks passed. Verified encrypted recovery points were recorded before and after deployment before the previous serving slot was retired.
Validation included application tests, database and release-control integration, backup and restore checks, and 57 passing desktop and mobile browser tests. An outdated test that still forced Starter placement into Cell-1 was corrected to verify the selected destination cell.
The latest application release was deployed to Cell-1 only. CellPro and production have not received this rollout.
What remains before launch
- Complete live payment verification, checkout-domain approval, public policy pages and final billing credential setup.
- Deploy the selected-cell placement fix to Orion and finish production registration, payment, invitation and login acceptance before enabling admission.
- Complete production provisioning and automated deployment validation.
- Implement tenant-selective recovery and test it without affecting other tenants.
- Continue member and UI regression testing, including the affected users’ full signup and invitation journeys.