Context
A tenant builds its configuration in a sandbox and then needs it in live without re-entering it. People also act in the wrong environment when nothing on screen says which one they are in. The owner’s answer to the screenshot gap review of 2026-10-21 (item 11) adds promotion and a banner.Decision
- Promotion copies configuration. Configuration is copied or promoted from a sandbox to live: the catalog, settings packs and webhooks.
- Keys are never copied. API keys and other credentials are never copied; live gets newly issued keys.
- Where it runs. Promotion runs through the sandboxes module of
@figentra/service-tenancyand the packs of@figentra/service-settings. - Reviewed diff. Promotion is shown as a diff between sandbox and live, and applies only after review.
- Environment banner. A persistent environment banner (sandbox, staging) is shown in the
@stackra/panelPanelShell and in apps.
Consequences
- Live configuration has a reviewable origin, and a credential never crosses environments.
- Each promotable kind needs a diff and an apply step, which is work for the owners of the catalog, settings and webhooks.
- The banner costs a strip of screen on non-production environments.
Enforcement
planned — a promotion test asserts no key or secret appears in the copied set; a panel test asserts the banner renders on every non-production environment and not in production.Open details
The owner did not give these; the conservative default below applies until an ADR changes it.- Who approves. An owner or administrator of the live tenant; applying is a high-risk action that needs the step-up of 0207 decision 1.
- Webhooks. Endpoints and subscriptions are copied; signing secrets are new, like keys.
- Data. Tenant business data (customers, orders, records) is never promoted.
- Banner. Cannot be dismissed; production shows none.
- Direction. Sandbox to live only; live to sandbox is a reset, not a promotion.