Track internal Postgres target in release process

docs/ocsentinel-architecture.md

@@ -19,6 +19,15 @@ The repository now keeps only the client-side architecture:
 - optional n8n upload
 - packaged ZIP release flow for NinjaOne deployment
 
+The client must not depend on a PostgreSQL IP or hostname. PostgreSQL stays a server-side concern behind the ingest or n8n layer.
+
+## PostgreSQL Handling
+
+- PostgreSQL is not contacted directly by endpoint clients.
+- The PostgreSQL host or IP should be tracked in the repository only as internal deployment metadata.
+- Review that internal target on every release before publishing.
+- Keep the actual production value in a private operational copy if it should not be visible in the public repository.
+
 ## Removed Model
 
 The following older pieces are intentionally no longer part of the repo:

docs/ocsentinel-n8n-contract.md

@@ -25,3 +25,9 @@ n8n is responsible for:
 - storage in the central backend
 - organization-wide aggregation
 - NinjaOne organization API updates
+
+## PostgreSQL Scope
+
+- The client only knows its outward upload destination.
+- PostgreSQL connection details belong to the internal ingest or n8n side.
+- If the PostgreSQL IP changes, update the internal server-side configuration and review it during the next release.

docs/release-checklist.md

@@ -0,0 +1,25 @@
+# Release Checklist
+
+## Goal
+
+Use this checklist before publishing every OfficeCom Sentinel release.
+
+## Infrastructure Check
+
+1. Confirm the internal PostgreSQL target is still correct in `infra/postgres-target.example.json` or its private production counterpart.
+2. Confirm the n8n internal base URL is still correct.
+3. Confirm the public client ingest URL still forwards to the intended internal service.
+4. Confirm no internal PostgreSQL host or IP is embedded in client configuration, installer output, or public release artifacts.
+
+## Build Check
+
+1. Build `OCSentinelClient-win-x64.zip`.
+2. Build `OCSentinelSetup.exe`.
+3. Generate `version.json`.
+4. Verify SHA-256 output matches the released ZIP.
+
+## Publish Check
+
+1. Upload the ZIP, SHA256 file, and setup EXE to the release.
+2. Update `release/stable/version.json` so NinjaOne keeps a version-independent manifest URL.
+3. If infrastructure changed, update the internal Postgres target record in the repo at the same time.