---
title: Operations
description: Branch model, environments, CI gates, and deployment state for TALA — including what is unenforced, why, and what is not deployed at all.
---

**[Branching](/operations/branching)**

dev → staging → main, and the drift guard.

**[Environments](/operations/environments)**

Three environments and the Supabase rules.

**[Deployment](/operations/deployment)**

Nothing is deployed. Here is the plan.

## State as of 2026-09-09

| | Status |
| --- | --- |
| Deployed frontend | none — GitHub Pages torn down 2026-08-13 |
| Deployed backend | none — the Render instance exists but nothing references it |
| Branch protection | **unenforced in both repos** |
| CI | runs on PRs and pushes to `dev` / `staging` / `main` |
| Blocking CI check | `npm run build` only |
| Report-only CI checks | lint and backend tests |

:::danger[Direct pushes to `main` are not blocked]
Rulesets require a paid plan on private repos, and both repos are private on the free org. The frontend repo has rulesets, but they cannot be opened to inspect or change, so what they contain is unknown. Nothing mechanically prevents a push to `main` — until the org is on a paid plan, `main` is protected by convention only. A direct push will succeed and nothing will flag it.
:::

## Repository facts

Both repos are private. They were renamed from `Tala_Api` and `Tala_Frontend` on 2026-08-13; the old GitHub URLs still redirect.

:::warning[The frontend repo's history was public for months]
The repo is private again — verified 2026-09-09 — but that history has never been audited for leaked `VITE_*` values, and nobody is assigned to audit it. Until someone is, treat every value ever committed to the frontend repo as disclosed, and rotate anything still in use.
:::