feat(launch): add Autumn production parity dry run

Author: richiemcilroy

.env.example

@@ -33,6 +33,11 @@ REND_BILLING_FEATURE_STORAGE_720P=storage_720p_second_months
 REND_BILLING_FEATURE_STORAGE_1080P=storage_1080p_second_months
 REND_BILLING_FEATURE_STORAGE_2K=storage_2k_second_months
 REND_BILLING_FEATURE_STORAGE_4K=storage_4k_second_months
+REND_AUTUMN_USAGE_CREDIT_FEATURE_ID=rend_usage_credits
+REND_AUTUMN_PLAN_PAYG_ID=pay_as_you_go
+REND_AUTUMN_PLAN_BUILDER_ID=builder
+REND_AUTUMN_PLAN_SCALE_ID=scale
+REND_AUTUMN_PLAN_ENTERPRISE_ID=enterprise
 REND_BILLING_ENTITLEMENT_FAILURE_POLICY=fail_closed
 REND_BILLING_DELIVERY_SYNC_LAG_SECS=60
 REND_BILLING_DELIVERY_SYNC_MAX_WINDOW_SECS=3600

.env.local.example

@@ -39,6 +39,11 @@ REND_BILLING_FEATURE_STORAGE_720P=storage_720p_second_months
 REND_BILLING_FEATURE_STORAGE_1080P=storage_1080p_second_months
 REND_BILLING_FEATURE_STORAGE_2K=storage_2k_second_months
 REND_BILLING_FEATURE_STORAGE_4K=storage_4k_second_months
+REND_AUTUMN_USAGE_CREDIT_FEATURE_ID=rend_usage_credits
+REND_AUTUMN_PLAN_PAYG_ID=pay_as_you_go
+REND_AUTUMN_PLAN_BUILDER_ID=builder
+REND_AUTUMN_PLAN_SCALE_ID=scale
+REND_AUTUMN_PLAN_ENTERPRISE_ID=enterprise
 REND_BILLING_ENTITLEMENT_FAILURE_POLICY=fail_closed
 REND_BILLING_DELIVERY_SYNC_LAG_SECS=60
 REND_BILLING_DELIVERY_SYNC_MAX_WINDOW_SECS=3600

.env.production.example

@@ -24,6 +24,8 @@ AWS_ACCESS_KEY_ID=replace-me
 AWS_SECRET_ACCESS_KEY=replace-me
 
 REND_API_BASE_URL=https://api.example.com
+REND_PUBLIC_API_BASE_URL=https://api.rend.so
+REND_PUBLIC_SITE_BASE_URL=https://rend.so
 REND_API_BIND_ADDR=0.0.0.0:4000
 REND_API_AUTO_MIGRATE=true
 REND_API_INLINE_MEDIA_PROCESSING=false
@@ -40,6 +42,11 @@ REND_BILLING_FEATURE_STORAGE_720P=storage_720p_second_months
 REND_BILLING_FEATURE_STORAGE_1080P=storage_1080p_second_months
 REND_BILLING_FEATURE_STORAGE_2K=storage_2k_second_months
 REND_BILLING_FEATURE_STORAGE_4K=storage_4k_second_months
+REND_AUTUMN_USAGE_CREDIT_FEATURE_ID=rend_usage_credits
+REND_AUTUMN_PLAN_PAYG_ID=pay_as_you_go
+REND_AUTUMN_PLAN_BUILDER_ID=builder
+REND_AUTUMN_PLAN_SCALE_ID=scale
+REND_AUTUMN_PLAN_ENTERPRISE_ID=enterprise
 REND_BILLING_ENTITLEMENT_FAILURE_POLICY=fail_closed
 REND_BILLING_DELIVERY_SYNC_LAG_SECS=60
 REND_BILLING_DELIVERY_SYNC_MAX_WINDOW_SECS=3600
@@ -110,6 +117,7 @@ BETTER_AUTH_URL=https://app.example.com
 RESEND_API_KEY=replace-me
 REND_AUTH_EMAIL_FROM=Rend <auth@example.com>
 REND_AUTH_EMAIL_DISABLED=false
+REND_OPERATOR_EMAIL_ALLOWLIST=ops@example.com
 REND_SITE_MAX_UPLOAD_BYTES=536870912
 NEXT_PUBLIC_REND_APP_VERSION=production
 

.github/workflows/release-deploy.yml

@@ -141,6 +141,9 @@ jobs:
       REND_EDGE_AMS_SSH_HOST: ${{ secrets.REND_EDGE_AMS_SSH_HOST }}
       REND_EDGE_AMS_SSH_USER: ${{ secrets.REND_EDGE_AMS_SSH_USER }}
       REND_EDGE_AMS_SSH_PORT: ${{ secrets.REND_EDGE_AMS_SSH_PORT }}
+      AUTUMN_SECRET_KEY: ${{ secrets.AUTUMN_SECRET_KEY }}
+      AUTUMN_API_URL: ${{ vars.AUTUMN_API_URL || 'https://api.useautumn.com/v1' }}
+      AUTUMN_API_VERSION: ${{ vars.AUTUMN_API_VERSION || '2.3.0' }}
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
@@ -184,6 +187,17 @@ jobs:
           chmod 600 "$HOME/.ssh/known_hosts"
           echo "REND_SSH_KEY_PATH=$SSH_KEY_PATH" >> "$GITHUB_ENV"
 
+      - name: Sync control-plane billing env
+        if: env.DEPLOY_CONTROL_PLANE == 'true'
+        run: |
+          set -euo pipefail
+          : "${AUTUMN_SECRET_KEY:?AUTUMN_SECRET_KEY Production environment secret is required}"
+
+          scripts/sync-control-plane-billing-env-over-ssh.sh \
+            --host "$REND_CONTROL_PLANE_SSH_HOST" \
+            --user "$REND_CONTROL_PLANE_SSH_USER" \
+            --port "${REND_CONTROL_PLANE_SSH_PORT:-22}"
+
       - name: Deploy control plane
         if: env.DEPLOY_CONTROL_PLANE == 'true'
         run: |

docs/billing-autumn-v1.md

@@ -57,6 +57,7 @@ REND_BILLING_FEATURE_STORAGE_720P=storage_720p_second_months
 REND_BILLING_FEATURE_STORAGE_1080P=storage_1080p_second_months
 REND_BILLING_FEATURE_STORAGE_2K=storage_2k_second_months
 REND_BILLING_FEATURE_STORAGE_4K=storage_4k_second_months
+REND_AUTUMN_USAGE_CREDIT_FEATURE_ID=rend_usage_credits
 ```
 
 The Autumn dev/sandbox catalog should include:
@@ -69,6 +70,51 @@ The Autumn dev/sandbox catalog should include:
 Overages should be billed by Autumn/Stripe. Rend does not hardcode plan prices
 except display fallback copy.
 
+The public V1 production plan IDs must be:
+
+```sh
+REND_AUTUMN_PLAN_PAYG_ID=pay_as_you_go
+REND_AUTUMN_PLAN_BUILDER_ID=builder
+REND_AUTUMN_PLAN_SCALE_ID=scale
+REND_AUTUMN_PLAN_ENTERPRISE_ID=enterprise
+```
+
+`rend_usage_credits` is the Autumn credit-system feature attached to those
+plans. It is not a Stripe object managed by Rend.
+
+## Sandbox and Live Separation
+
+Sandbox and production Autumn keys must never be loaded into the same runtime as
+the active `AUTUMN_SECRET_KEY`. The production launch gate requires the live
+Autumn key to come from `.env.production.local`, and the key must be visibly
+marked as live. The sandbox parity input should be a separate env file, usually
+`.env.local`, containing a visibly marked test/sandbox Autumn key.
+
+Read-only parity check:
+
+```sh
+bun run billing:autumn-parity -- \
+  --sandbox-env-file .env.local \
+  --production-env-file .env.production.local
+```
+
+This fetches only the required Autumn features and plans, compares production to
+sandbox, verifies the credit-system schema and plan attachments, and writes a
+redacted artifact under `.rend/launch/`. It does not copy customers,
+subscriptions, or Stripe objects.
+
+If production parity fails because live Autumn catalog objects are missing,
+upsert the catalog through Autumn with the explicit mutation flag:
+
+```sh
+node scripts/with-root-env.mjs --profile production --env-file .env.production.local \
+  node scripts/setup-autumn-billing.mjs --plans --mux-basic-rates --allow-production-mutation
+```
+
+This command may create or update Autumn products/plans and the Stripe live
+objects Autumn manages for them. It must not be replaced with manual Stripe
+product or price creation.
+
 Use the setup helper to upsert the required feature IDs:
 
 ```sh
@@ -177,3 +223,37 @@ POST /internal/operator/billing/delivery-sync
 Use the dashboard operator billing panel to inspect customer sync status and
 manually resync an organization. Operators must not mutate plan state directly
 in Rend; plan/product changes should go through Autumn.
+
+## Production Dry Run
+
+Run the production dry run only after parity and the production launch gate pass:
+
+```sh
+bun run launch:gate -- --mode production-check --autumn-sandbox-env-file .env.local
+
+bun run launch:production-dry-run -- \
+  --allow-production-mutation \
+  --acknowledge-real-charge \
+  --plan-id pay_as_you_go
+```
+
+Before running it, deploy or restart the production API on the current build and
+confirm migrations through `0011_billing_storage_spans.sql` are applied. The dry
+run intentionally fails if upload does not create the `upload_gate` billing
+event or if storage/delivery usage does not track through Autumn.
+
+`--acknowledge-real-charge` is required for every production dry run because
+tracked usage can create live Autumn/Stripe billing artifacts even on
+`pay_as_you_go`. Document the intended plan and expected charge before running
+it. The dry run creates or syncs the internal customer
+`Rend Internal Production Dry Run`, attaches the requested Autumn plan, creates a
+scoped live API key, uploads a synthetic fixture through the public API, waits
+for playable media, verifies upload check plus delivery/storage usage tracking,
+verifies checkout/portal URL creation, verifies public embed/watch playback
+through the edge, deletes the asset, revokes the generated API key, and writes a
+redacted artifact under `.rend/launch/`.
+
+The dry run intentionally leaves the Autumn customer, plan relationship,
+balances, usage, and Autumn-generated Stripe objects visible for dashboard
+inspection. It must not be used to create structural Stripe products or prices
+outside Autumn.

docs/deployment-v1.md

@@ -148,6 +148,11 @@ Worker:
 - all API dependency vars used for Postgres, Redis, S3, ClickHouse, playback
   signing, edge internal auth, and Autumn billing
 - `REND_API_AUTO_MIGRATE=false` after the API migration step is deployed
+
+The `Release and Deploy Backend` workflow syncs the billing-only allowlist into
+the control-plane API and worker env files before deployment. The Production
+GitHub environment must include `AUTUMN_SECRET_KEY`; the sync helper refuses to
+run unless it is visibly a live Autumn key, and logs only key names.
 - `REND_MEDIA_WORKER_ID`
 - `REND_MEDIA_WORKER_POLL_INTERVAL_SECS`
 - `REND_MEDIA_JOB_LOCK_TIMEOUT_SECS`

docs/env/profiles.md

@@ -55,6 +55,12 @@ instead of committing env files. `REND_ENV` must be `production`.
 `REND_BILLING_MODE` must be `autumn`, and `AUTUMN_SECRET_KEY` must be provided
 server-side only.
 
+Autumn production launch checks require the live `AUTUMN_SECRET_KEY` to be in
+`.env.production.local`. Keep sandbox/test Autumn keys in a separate file such as
+`.env.local` and pass that file to catalog parity with
+`--autumn-sandbox-env-file`; do not export a sandbox `AUTUMN_SECRET_KEY` in the
+shell while running production-check.
+
 Production validation rejects localhost/Docker service URLs, checked-in dev
 defaults, placeholders, insecure edge URLs, and `REND_ENV=local`.
 

docs/launch-gate-v1.md

@@ -36,22 +36,27 @@ Production-check mode validates real production env/config without mutating live
 billing:
 
 ```sh
-bun run launch:gate -- --mode production-check
+bun run launch:gate -- --mode production-check --autumn-sandbox-env-file .env.local
 ```
 
+Production-check requires `.env.production.local` to supply the live Autumn key
+used as `AUTUMN_SECRET_KEY`; inherited shell keys are rejected when they differ.
 Use `--production-env-file FILE` to validate a specific production env file from
-any mode. Production-check skips mutating live/API smoke by default. Only pass
-`--allow-live-billing-mutation` when an operator intentionally wants to call
-Autumn `customers.get_or_create` against the configured production account.
+any mode, but the Autumn live key check remains tied to `.env.production.local`.
+Production-check also runs read-only Autumn sandbox/live catalog parity using
+`--autumn-sandbox-env-file` and `--autumn-production-env-file`. It skips
+mutating live/API smoke by default. Only pass `--allow-live-billing-mutation`
+when an operator intentionally wants to call Autumn `customers.get_or_create`
+against the configured production account.
 
 ## Required Checks
 
 The gate reports explicit `pass`, `warn`, or `fail` status for each group:
 
 - env: `env:local`, `env:production:example`, loaded profile policy, and
   production env validation when supplied.
-- billing: launch mode policy, Autumn catalog expectations, customer mapping,
-  and billing denial smoke.
+- billing: launch mode policy, Autumn catalog expectations, sandbox/live
+  catalog parity, customer mapping, and billing denial smoke.
 - OpenAPI: lint/generated client check and public contract tests.
 - SDK: unit tests and integration smoke.
 - site: tests, typecheck, build, and E2E flows.
@@ -97,8 +102,11 @@ Common failures:
 - `production-env-validation`: replace placeholders, remove `REND_DEV_API_KEY`,
   set secure Better Auth config, require `REND_BILLING_MODE=autumn`, and set an
   operator email allowlist.
-- `autumn-catalog`: run the sandbox setup helper or fix the configured plan and
-  feature IDs before re-running the gate.
+- `autumn-catalog`: run the sandbox setup helper or fix the configured plan,
+  usage-credit feature, and meter feature IDs before re-running the gate.
+- `autumn-catalog-parity`: make production match the verified sandbox catalog in
+  Autumn. Do not copy customers/subscriptions and do not create Stripe
+  products/prices directly outside Autumn.
 - `site:build`: production-profile env is missing or incompatible with the
   Next.js build.
 - `docker:up` or `docker:smoke`: inspect Docker Compose health and service logs,

package.json

@@ -18,6 +18,8 @@
     "env:production:example": "node scripts/validate-env.mjs --profile production --env-file .env.production.example --allow-placeholders",
     "verify:production-local": "bun run env:production && REND_ENV_PROFILE=production turbo build --filter=@rend/site && REND_ENV_PROFILE=production turbo typecheck --filter=@rend/site && cargo check --workspace",
     "launch:gate": "node scripts/launch-gate.mjs",
+    "billing:autumn-parity": "node scripts/autumn-catalog-parity.mjs",
+    "launch:production-dry-run": "bun scripts/production-dry-run.mjs",
     "backend:up": "bun run env:local && REND_ENV_PROFILE=local docker compose up -d",
     "backend:down": "docker compose down",
     "backend:api": "bun run env:local && REND_ENV_PROFILE=local cargo run -p rend-api",