P35 Shadow Migration Pilot

The P35 Restaurant ERP shadow migration is the first acceptance project for the Topoo-native deployment path.

Its purpose is not to replace the existing P35 environment during development. It proves that Topoo can take ownership of an application copy, provision its required capabilities, build one immutable application artifact, publish an independent Preview, and retain the evidence needed for later promotion or rollback.

Fixed boundary

The pilot follows four non-negotiable constraints:

1. The existing P35 source, data, resources, domain, and deployment remain unchanged.
2. The shadow Project has its own source snapshot, Database, Storage, Cache, AI binding, Runtime, and Preview identity.
3. Customers configure and operate Topoo capabilities. Topoo invokes infrastructure providers through private adapters; customers do not call those providers directly.
4. Preview acceptance does not grant Production authority and does not modify the existing P35 environment.

The shadow Project slug is:

p35-restaurant-erp-shadow

Target flow

P35 source copy
→ upload to the P35 shadow Project
→ validate topoo.app.json against that Project
→ register the Runtime Node as a Project release input
→ provision isolated Topoo resources
→ pin an immutable Source Revision
→ install and build in the Topoo sandbox
→ apply ordered Database migrations through the Topoo Database adapter
→ package Runtime and Static Assets into one immutable Artifact
→ publish an independent topoo.cloud Preview
→ verify application, assets, data isolation, logs, and audit evidence
→ retain the Artifact and migration ledger for promotion or rollback

topoo.app.json contract

The application manifest is the portable declaration that lets the Project be configured from source without repeating provider-specific setup in the UI.

For this pilot it declares:

• the Project identity
• the runtime-capable Node and its source boundary
• install and build commands
• a combined Runtime plus Static Assets Artifact
• Topoo Database, Storage, Cache, and AI bindings
• ordered Database migration directories
• scheduled work
• Preview and Production environment intent

The manifest does not contain upstream provider credentials. Topoo resolves every declared capability through its own resource and runtime adapters.

Immutable application Artifact

P35 is not treated as a loose static folder plus an unrelated runtime upload.

One build records:

• the immutable Source Revision
• the exact build configuration
• the packaged Runtime entry and modules
• the static asset inventory
• the Database migration set and checksums
• the resource binding contract
• the resulting Artifact identity

The Runtime receives Static Assets through an internal Topoo service binding. Provider credentials and the physical asset backend are not exposed to application source.

Database migration rule

Database migrations are part of the release evidence.

Topoo:

1. reads migration files in deterministic order
2. records each filename and checksum
3. skips a migration only when the same checksum is already accepted
4. rejects an already-applied filename whose content has changed
5. binds every applied migration to the resulting Artifact

This prevents a source build from silently drifting away from the Database state that it expects.

Acceptance criteria

The pilot is accepted only when all of the following are verified online:

1. the original P35 environment remains available and unchanged
2. the P35 shadow Project is visible in Topoo Cloud
3. the uploaded source is retained as an immutable Topoo Source Revision
4. the Runtime Node and its Topoo Database, Storage, Cache, and AI bindings are visible in the Project
5. the build runs in the Topoo sandbox using the manifest configuration
6. all required Database migrations are recorded in the shadow Database migration ledger
7. the combined Runtime and Static Assets Artifact is immutable and traceable
8. an independent topoo.cloud Preview URL loads the P35 application
9. application routes and static assets work through that Preview
10. no Production promotion is performed during the pilot
11. the Project audit trail records source import, manifest reconciliation, build, migrations, Artifact, and Preview

Audited status

Status is binary. A capability is Completed only after its complete user outcome is verified; otherwise it is Not completed.

Verified acceptance evidence

The accepted Preview was generated on July 28, 2026.

Source Revision
5b21ba9a-bb4a-48bd-b5ce-96e9416f6243
 
Build Run
build_run_9af1d394-a484-4973-a45c-c9fd43418d48
 
Artifact
artifact_d995b5ac-f4e1-4331-8f8f-812394e71d68
 
Deployment
deployment_562eb224-0f74-40c8-b3ec-e2b8fcf79528
 
Preview
https://preview-artifact-d995b5ac-f4e1-4331-8f8f-812394e71d68.topoo.cloud/

Open the accepted immutable P35 Preview.

The migration ledger contains:

0000_schema.sql
0001_finance_core.sql
0002_provider_credentials.sql
0003_active_provider_environment.sql
0004_settlement_lifecycle.sql
0005_open_items.sql
0006_partner_evidence_packages.sql

All seven entries reference artifact_d995b5ac-f4e1-4331-8f8f-812394e71d68.

Next action

The pilot is now at the user acceptance boundary. Review the immutable Preview and its Deployment evidence in the P35 shadow Project.

After explicit acceptance, the next release-control step is to create a Project Release Candidate from this exact Artifact. Production promotion, source replacement, and data migration from the existing P35 environment remain outside this pilot and must not happen implicitly.