Enterprise deployment evidence

Containerized, audited, and continuity-ready VaultAI deployment package.

This surface summarizes the production artifacts that allow an institution to evaluate VaultAI beyond a hosted demo: isolated containers, local database replay, authenticated ledger stress testing, automated security gates, and disaster recovery procedures.

Open API specification Open bank admin plane

Containerized control plane

VaultAI ships with a multi-stage Next.js standalone Dockerfile running under an unprivileged Linux user with reduced filesystem write access.

On-prem ledger database

The on-prem compose stack initializes local PostgreSQL with Supabase-compatible auth stubs and the immutable ledger/control-plane migrations.

k6 concurrency proof

The load suite targets the live ledger transaction endpoint with unique idempotency keys, two-leg postings, and deadlock/invariant assertions.

Enterprise CI gates

GitHub Actions now gates changes through CodeQL SAST, npm vulnerability audit, SQL migration linting, ledger invariant tests, Docker build, and production build.

Continuity playbook

The DR guide defines PITR, failover routing, webhook replay, compromised-token response, and cryptographic key rotation procedures.

Evidence artifacts

OpenAPI, VDR, financial VDR, audit evidence, and operational readiness pages remain available for diligence review from the public domain.

Artifact index

Files added for diligence execution.

The repository now separates infrastructure, load tests, CI governance, and operational runbooks in a structure that enterprise reviewers can execute directly.

Dockerfile

Standalone Next.js application image with non-root runtime

docker-compose.yml

App plus local PostgreSQL on-prem demonstration stack

infrastructure/onprem/postgres/00-supabase-auth-compat.sql

Supabase-compatible auth roles and auth.uid() harness

tests/load/ledger-concurrency.k6.js

Authenticated 1,000-VU ledger concurrency test

.github/workflows/enterprise-ci.yml

SAST, dependency, SQL, ledger math, Docker, and build gates

DISASTER_RECOVERY.md

PITR, failover, webhook replay, and key-rotation playbook

scripts/test-ledger-invariants.mjs

Zero-float and double-entry invariant test runner

Execution runbook

Four commands prove portable readiness.

Credentials remain externalized through environment variables and secrets.

Build isolated image

docker build --tag vaultai/web:local .

Start on-prem stack

docker compose up --build vaultai-web vaultai-postgres

Run ledger invariant gate

npm run test:ledger-math

Run authenticated k6 load test

docker compose --profile load-test run --rm k6-ledger-load

Availability posture

Failover routing, health checks, PITR, immutable audit evidence, and webhook replay are documented as a single continuity posture.

Security gates

SAST, dependency scanning, SQL linting, zero-float ledger invariants, and Docker builds are wired into the enterprise CI path.

Recovery discipline

Administrative token compromise, secret rotation, webhook replays, and audit-chain verification are handled as repeatable procedures.