# CHIMBO Pre-Launch Checklist

Use this before onboarding real paying brokers. Check only items actually verified.

## Domain & edge

- [ ] Production domain registered
- [ ] DNS apex + wildcard configured
- [ ] TLS valid for apex and `*.ROOT_DOMAIN`
- [ ] HTTP → HTTPS enforced
- [ ] Cloudflare (or equivalent) configured; origin firewalled
- [ ] Cache bypass for authenticated/HTML/API routes
- [ ] `TRUST_CLOUDFLARE` set correctly

## Application

- [ ] Production `.env` complete (no placeholders)
- [ ] `npm run build` succeeds on release artifact
- [ ] `npm test` / typecheck / lint clean for release
- [ ] Prisma `migrate deploy` applied on production DB
- [ ] Super Admin account provisioned via ops procedure
- [ ] Maintenance mode message reviewed

## Data & recovery

- [ ] Automated MySQL backups enabled
- [ ] Off-host copy verified
- [ ] Restore rehearsal completed and logged
- [ ] Session / password-reset / rate-limit cleanup job scheduled

## Auth & security

- [ ] SMTP recovery end-to-end tested
- [ ] Security headers verified in production response
- [ ] Broker A/B live IDOR tests passed
- [ ] Super Admin denial tests passed for normal users
- [ ] Payment provider webhook verified (or billing kept trial-only)
- [ ] No `ALLOW_DEV_BILLING` in production

## Product surfaces

- [ ] Storefront + product SEO spot-checked
- [ ] Sitemap includes active stores; excludes offers
- [ ] Robots.txt reviewed
- [ ] Quick Offer noindex confirmed
- [ ] PWA install on Android Chrome
- [ ] iOS Add to Home Screen guidance checked
- [ ] Offline page loads when network down
- [ ] Legal pages (Terms / Privacy) published if required

## Payments & email

- [ ] Real payment provider connected **or** launch limited to trials
- [ ] Provider secrets in secret manager
- [ ] Transactional email from verified domain

## Observability

- [ ] Error monitoring sink configured
- [ ] Uptime check on `/api/health` (+ separate readiness if needed)
- [ ] Log retention / redaction reviewed

## Mobile / browser QA

- [ ] 320–430px widths: landing, store, offer, dashboard, super-admin
- [ ] Chrome / Edge / Firefox / iOS Safari smoke
- [ ] Slow-3G storefront offer path acceptable

## Sign-off

- [ ] Security owner sign-off
- [ ] Ops owner sign-off
- [ ] Product owner sign-off