# 1. Application code (in the release build)
- Add the production Auth0 client IDs to the ACUL bundle brand map (apps/auth0-acul/src/login.ts)
> JiDtizzzIAE516WLaCrXFYOvAWNLcrBz -> NetFoundry Console (classic)
> NyJe4ojIAKEFQCkYmB5OHkpy8KPyGlDC -> Customer Connect (modern)
- Set domain to login.netfoundry.io and newUniversalLogin to true in the production environment files
> apps/cloud-ziti/src/environments/environment.prod.ts
> apps/nfconsole/src/environments/environment.prod.ts
> apps/nfconsole/src/environments/environment.siemens-production.ts
> Customer Connect (separate repo): src/environments/environment.production.ts
- Confirm the rendering configuration declares all six ext- parameters: ext-idps, ext-brand, ext-logol, ext-logod, ext-app, ext-theme

# 2. Backend prerequisites (required before the application deploy)
- Configure the identity gateway to trust login.netfoundry.io as a token issuer (accept its iss claim and JWKS), retaining trust for netfoundry-production.auth0.com for a zero-downtime cutover
- Update the CSP (Lambda@Edge) headers on the production distributions: add login.netfoundry.io to frame-src, child-src, and connect-src

# 3. Application deploy
- Deploy the production build so login.js and login.css are published to https://cloudziti.io/assets/acul
- Verify both assets return HTTP 200 and include the header Access-Control-Allow-Origin: https://login.netfoundry.io
- Ensure deploys reliably reach users. Today the tenants point at the stopgap <env>-cloudziti.io/assets/acul path (no Cache-Control, non-SRI head_tags), so browsers/CDN can keep serving a stale bundle after a deploy (observed on staging: the passkey-enrollment card showed the pre-deploy version until a hard refresh). The proper fix is already built and live: the versioned immutable origin acul.<console_domain> (terraform/acul.tf) plus SRI head_tags from gen-rendering.mjs - no app code needed. Wire the deploy to it: upload to s3://nf-acul-<env>/v/<build-id>/, run gen-rendering with ACUL_ASSET_BASE_URL=https://acul.<console_domain>/v/<build-id>, then apply that rendering.json (SRI) to every tenant screen. See acul-asset-caching-recommendation.md

# 4. Production Auth0 tenant configuration (after the build is live)
- Confirm the custom domain login.netfoundry.io is verified and set as primary
- Set the tenant Universal Login logo_url to a valid hosted logo to prevent a broken image on standard-rendered screens such as passkey enrollment
> Example: https://nfconsole.io/assets/icons/android-icon-192x192.png
- Configure the login screen: set rendering_mode to advanced, point head tags to the production asset path, and include the six ext- parameters in context_configuration
- Apply the same rendering configuration to the signup-id and signup-password screens (the branded create-account screens invitees see; requires the identifier_first flow)
- On each enterprise connection, enable Display connection as a button (show_as_button true) and set a clear display_name
- Optional (passkeys / Identifier-First): apply the same rendering configuration to the login-id and login-password screens, enable the passkey method on the database connection, then set identifier_first to true. This changes the login to a two-step flow for all users
- Passkeys: apply the same rendering configuration to the passkey-enrollment and passkey-enrollment-local screens so the post-login "Set up a passkey" prompt shows the branded card instead of Auth0's default. In the Management API these live under the "passkeys" prompt (PATCH /prompts/passkeys/screen/passkey-enrollment/rendering), not a passkey-enrollment prompt. Copy head_tags and context_configuration verbatim from the login-id screen
- Verify the Customer Connect production Auth0 client callback, logout, and web-origin URLs are correct

# 5. Verification
- Complete an end-to-end login for each application (CloudZiti, NetFoundry Console, Customer Connect) and confirm a successful redirect into the application with no authorization errors
- Confirm the correct theme (organization default for the consoles, browser preference for Customer Connect), page title, and subtitle
- Confirm identity provider buttons render with the correct icons and labels, and that enterprise email-domain routing works
- If passkeys are enabled, confirm passkey enrollment shows the branded screen and completes
- Send a test invitation and confirm the invitee lands on the branded Create Account screen, not Sign In

# 6. Rollback
- Revert the tenant login screen rendering_mode to standard, or set newUniversalLogin to false and redeploy. Retain the dual-issuer gateway configuration