Managed Cloud Beta (M2)

Status	Year 2 beta — staging soak before production GA

> Cross-reference: product-plan-email-deliverability.md · feature-flags.md · infrastructure/terraform/aws-eks-tenant/

Scope

M2 enables paid Team, Business, or Enterprise managed cloud in staging/beta only:

Per-tenant EKS (anoobot-hosted) or BYO AWS cross-account role
SLA health probes + subscription lapse auto-offboard
Paid-only checkout UI (ManagedCloudSection)
No free/lite tenants on managed (enforced in M1 + M2)

Environment (staging beta)

# Enable managed beta control plane
MANAGED_BETA_ENABLED=true
VITE_ENABLE_MANAGED_CLOUD=true

# Live AWS/terraform (staging only until soak complete)
MANAGED_PROVISIONER_LIVE=true
ANOOBOT_MANAGED_BYO_ENCRYPTION_KEY=<32-byte-base64>

# Crons
DISABLE_MANAGED_LAPSE_CRON=false
DISABLE_MANAGED_SLA_CRON=false
MANAGED_LAPSE_CHECK_MS=300000
MANAGED_SLA_CHECK_MS=60000

Production (pre-GA): keep MANAGED_PROVISIONER_LIVE=false and MANAGED_BETA_ENABLED=false until external soak sign-off.

Staging soak checklist

Automated (local/CI): bash tools/scripts/validate-managed-beta-soak.sh

[ ] Deploy gateway + registry to staging with .env.staging.example values
[x] Run bash tools/scripts/validate-managed-beta-soak.sh (automated gates)
[ ] Team plan checkout → anoobot_hosted → EKS tenant URL healthy
[ ] BYO role ARN → cross-account provision → tenant URL healthy
[ ] SLA cron records slaHealthy=true for 24h
[ ] Cancel subscription → grace shortened → lapse cron offboards tenant
[ ] Tenant isolation: domain A cannot read domain B deployment
[x] Free plan blocked from managed checkout (API + UI) — covered by M1/M2 tests
[ ] Document tenant URL + rollback in ops runbook

API endpoints (beta)

Method	Path	Purpose
GET	`/api/v1/managed/beta-status`	Beta flags + slab eligibility
GET	`/api/v1/managed/deployments/:domainId`	Deployment + subscription status
POST	`/api/v1/billing/checkout`	Paid managed checkout (Airwallex)
DELETE	`/api/v1/managed/deployments/:domainId`	Manual offboard

Subscription lapse → offboard

When Airwallex sends subscription.cancelled or payment fails:

Billing shortens license expiry to grace window (BILLING_GRACE_PERIOD_DAYS, default 7)
managedLapseCron scans active managed deployments
If subscription status is cancelled / past_due / unpaid and license expiresAt is past → offboardManagedDeployment