Incident lesson
The database telemetry incident passed type checks and unit tests because the failure lived in runtime composition: Sentry preload owned one global OpenTelemetry provider while Effect emitted through a different scoped provider. A later fix also exposed duplicate SDK Postgres spans containing raw parameterized SQL. GitHub deployment jobs completed before ECS reached steady state, so workflow success alone was not production proof.
The runtime contract/redaction tests added in #244 and #245 prevent the known provider and privacy regressions locally. We should add a production release gate to catch unknown composition/deployment regressions.
Acceptance criteria
- After infrastructure deployment, wait for the GBFM ECS service to reach one completed deployment with
running=desired, pending=0, and failedTasks=0.
- Probe
/health and at least one representative database-backed route.
- Query Sentry for the exact deployed release after a bounded ingestion wait, with aggregate extrapolation disabled or raw span APIs.
- Require a recognized, parented
db.query span on the representative request.
- Fail on forbidden SDK
span.op:db auto-spans, raw SQL-shaped descriptions, missing release/environment correlation, or unparented DB spans.
- Publish a concise verification artifact/link in the workflow summary.
- Keep secrets in GitHub Actions; treat the Sentry org/project slugs as non-secret configuration.
- Exercise the gate once in production and document its expected failure modes/timeout behavior.
Incident lesson
The database telemetry incident passed type checks and unit tests because the failure lived in runtime composition: Sentry preload owned one global OpenTelemetry provider while Effect emitted through a different scoped provider. A later fix also exposed duplicate SDK Postgres spans containing raw parameterized SQL. GitHub deployment jobs completed before ECS reached steady state, so workflow success alone was not production proof.
The runtime contract/redaction tests added in #244 and #245 prevent the known provider and privacy regressions locally. We should add a production release gate to catch unknown composition/deployment regressions.
Acceptance criteria
running=desired,pending=0, andfailedTasks=0./healthand at least one representative database-backed route.db.queryspan on the representative request.span.op:dbauto-spans, raw SQL-shaped descriptions, missing release/environment correlation, or unparented DB spans.