Zero Bricked Prods

Production should never be where you discover whether a bundle actually works. If the last deploy left the portal in a weird state, the fix is process — not another hotfix at 11pm.

The problem

Bricked prod usually means one of three things: a client extension failed mid-deploy, a module version mismatch took down the JVM, or someone pushed config that only worked on their laptop. The symptom is always the same — the portal boots, but half the features are gone and nobody knows which deploy broke it.

If you cannot reproduce the deploy on a clean environment in under thirty minutes, you are not ready for production.

The rule

Zero bricked prods means every release path is rehearsed before it touches customer traffic:

1. Build artifacts in CI — same Gradle/Yarn commands, same JDK, same Node version every time.
2. Deploy to a staging DXP that mirrors prod scopes, OAuth apps, and database size order-of-magnitude.
3. Run smoke checks: login, headless token, one read tool, one write form if admin flows exist.
4. Only then promote the same artifact hash — never rebuild on the server.

What good looks like

• Rollback is boring — previous LPKG or container image is one command away.
• Client extensions version independently; a bad widget does not require a full portal restart if the backend stays compatible.
• Ops runbooks name the exact health endpoints and log lines to check, not “ask Papu.”