Skip to main content

​
OACP Operator Runbook

Canonical end-to-end flow: OACP authority overview. Launch closure source of truth: OACP Runtime Launch Closure PRD.

​
Provision AgenticOrg Authority Access

  1. Store COMMERCE_C6Z_AUTHORITY_SERVICE_TOKEN through the production secret path.
  2. Add the AgenticOrg tenant id to COMMERCE_C6Z_AUTHORITY_SERVICE_TENANTS.
  3. Deploy or restart the Grantex auth service with both values available.
  4. Submit a fixture POST /v1/commerce/oacp/c6z/authority-requests for that tenant.
  5. Confirm artifact_count = 11, or record the exact refusal/blocker.
  6. To roll back, remove the tenant id from COMMERCE_C6Z_AUTHORITY_SERVICE_TENANTS and rotate the token if there is any suspicion of exposure.
Never put Shopify tokens, provider credentials, payment credentials, raw provider payloads, checkout links, raw POS callbacks, or webhook secrets in Grantex artifacts or logs.

​
Smoke Tests

​
Checklist

CheckCommand or evidence
Authority route existsapps/auth-service/src/routes/commerce-oacp-runtime.ts
AgenticOrg tenant allowlistCOMMERCE_C6Z_AUTHORITY_SERVICE_TENANTS contains only approved tenant ids
AgenticOrg service tokenCOMMERCE_C6Z_AUTHORITY_SERVICE_TOKEN is present only via secret manager
Artifact tests passnpm --prefix apps/auth-service test -- commerce-c6z-runtime-artifact-authority.test.ts
Adapter tests passnpm --prefix apps/auth-service test -- commerce-c6w4-oacp-adapter-previews.test.ts
Conformance gatenode scripts/commerce-c6oe-preview-conformance-gate.mjs --mode pr
Guardrail scanSearch changed docs for stale or overclaim wording.
Merchant config boundaryConfirm Shopify is runtime-supported and WooCommerce/ERP/bank/custom provider configs are pending-adapter unless approved.

​
Rollback

  1. Remove the AgenticOrg tenant from COMMERCE_C6Z_AUTHORITY_SERVICE_TENANTS.
  2. Rotate the service token if compromise is suspected.
  3. Ask AgenticOrg to stop refreshing artifacts and mark affected cache records stale.
  4. Leave existing historical artifacts reviewable for audit/export.
  5. Publish an operator note with affected tenants, merchant ids, artifact families, and timestamps.

​
Refusal Copy

Use exact blockers: missing source evidence, stale artifact, unsafe executable request, provider capability missing, tenant not allowlisted, or authority temporarily unavailable.