• Three tiers is the maximum. Testing and Pre-Production share the same infrastructure realm (runnp) and cannot be told apart from the signal. If you need that distinction, use StageId or a per-stage app setting.
• Undocumented signal. Classification reads an internal platform value that is not part of a documented contract and may change on a platform update. Run ExplainClassification to confirm what the library is seeing.
• RuntimeDetails.MachineName is not meaningful on ODC. The runtime's hostname is an IP-derived label and .NET truncates a hostname at its first period, so the field returns a fragment such as 169 on every stage. Use LambdaFunctionName or AwsRegion to identify the runtime.
• Not a security boundary. Use it for logging, banners and feature flags — never as the sole control for anything security- or money-critical.

Read this first

IsProductionStage() is directional. It returns False both when the stage is confirmed non-production and when the stage could not be determined.

• Safe: If IsProductionStage() Then
• Unsafe: If Not IsProductionStage() Then

The unsafe pattern routes real production traffic into test behavior on any stage where the platform signal is missing. When the distinction matters, read GetCurrentStage() and branch on IsClassified — True only when the stage was positively identified.

Requires Secure Gateway on the stage

Stage classification reads a signal that only exists when Secure Gateway is configured. On a stage without it — a personal or trial tenant, typically — every classification action returns Unknown with reason SignalAbsent, and IsProductionStage() returns False.

That is the fail-closed design working, not a defect. GetStageId, GetRuntimeUrl, GetRuntimeDetails, GetTraceContext and GetRuntimeLifecycle are unaffected and still return real values. Run ExplainClassification to confirm which case you are in.

The library deliberately does not guess the stage from the URL. A subdomain ending in -dev is a customer-controlled naming convention, not a platform fact, and inferring from it would turn an honest Unknown into a confident wrong answer.

Actions

All actions take no input parameters. Call them anywhere in server-side logic and read the outputs.

• GetCurrentStage — classification, infrastructure realm, stage id, runtime URL and subdomain, plus the IsClassified flag.
• IsProductionStage — True only when positively identified as Production. See the warning above before using it.
• ExplainClassification — the raw platform signals, the extracted realm, the rule that fired, and the realms this version recognizes. Use it first when stage detection returns something unexpected.
• GetTraceContext — AWS X-Ray trace id plus CloudWatch log group and stream, for correlating ODC logs with infrastructure traces in Datadog, New Relic or the AWS console. The trace id changes on every invocation, so read it at the moment you log.
• GetRuntimeLifecycle — process uptime and a first-call-in-process flag, for reasoning about warm reuse of the underlying serverless worker. This describes the External Logic runtime, which is a separate Lambda from your app — it is not your app's cold start.
• GetRuntimeDetails — .NET version, operating system, CPU count, region, and serverless function name and memory.
• GetStageId and GetRuntimeUrl — single values returned directly, without reading a structure.

Classification values

StageDetails.Classification is one of Production, NonProduction, Development or Unknown.

Unknown means the stage was not identified — either the signal was absent, or it carried a realm token this version does not recognize, so a future ODC tier is never reported as a stage the library claims to understand. Read IsClassified rather than inferring anything from Unknown: it is False in exactly those cases, and Unknown must never be treated as evidence of a non-production stage.

Verified

Validated on a live ODC tenant across all four stages (eu-central-1):

https://opensource.org/licenses/BSD-3-Clause