# SokoKilimo production launch checklist

## Before staging
- [ ] Install supported PHP 8.2+ and Composer; run `composer install --no-dev --prefer-dist`, `php artisan key:generate`, migrations and seed on a clean database.
- [ ] Configure production `APP_ENV=production`, `APP_DEBUG=false`, TLS, safe trusted-hosts, MySQL least-privilege user, secure session cookies, private filesystem, DB/cache/queue, and protect `.env` outside public root.
- [ ] Run `php artisan test`; run static analysis/Pint and dependency audit. Verify SQLite and actual MySQL migration behavior.
- [ ] Create first admin through interactive `php artisan admin:setup`; verify no second initial admin can be made. After setting `APP_KEY`, enroll every privileged operator with `php artisan admin:mfa:setup +255…`; verify authenticator and one-time recovery-code custody, privileged API token abilities, and role segregation. Revoke all pre-deployment API tokens.
- [ ] Review rate limiting for login, registration, verification, report, offer, upload and messaging; configure monitoring/alerting without sensitive payloads.

## Product and legal checks
- [ ] Qualified Tanzanian counsel reviews privacy, data protection, electronic transactions, consumer protection, communications and payments. Review provider terms and relevant approvals.
- [ ] Publish final Kiswahili/English privacy notice, terms, acceptable use, consent and complaint procedure with actual official support contacts.
- [ ] Define retention/deletion, backup retention, access/export and incident-response policies. Document data controller/contact information.
- [ ] Have local farmer/buyer users review all translated screens, SMS, validation and accessibility in both languages.
- [ ] Confirm verification criteria, evidence list, tier assessment/review/appeal, no pay-for-trust rule and reviewer independence.
- [ ] Verify no made-up testimonials, statistics, prices, sales, identities or support telephone number are shown.

## Integrations
- [ ] Select a Tanzania-capable SMS provider only after official documentation, +255 routing, sender ID, delivery receipts/signatures, price, quotas, security, consent and legal checks.
- [ ] Implement provider-specific payload, signed webhook, redacted event logging, opt-out/preference checks, failure/retry behavior, idempotency, cost report and staging tests.
- [ ] Configure FCM and test notification token registration, refresh, removal, language, preferences and real devices; keep service account server-side.
- [ ] Configure email provider if email verification/reset is enabled. Configure payment gateway only via official API; otherwise manual payment state remains pending until authorized finance review.

## Security, operations and acceptance
- [ ] Audit IDOR, role boundaries, CSRF/session/token expiry, XSS, upload MIME/content, malware scanning, limits, rate limiting, secrets, logging, cache/privacy and private storage. Production uploads deliberately fail closed unless `UPLOAD_SCAN_DRIVER=clamav` and a working ClamAV binary are configured; test infected, clean, timeout and scanner-unavailable cases before accepting uploads.
- [ ] Test backup and restore on a separate database and private file store. Check encryption, recovery keys, access separation and recovery-point objective.
- [ ] Load test search, order/offer concurrency, queue worker, FCM/SMS provider callbacks; measure image and low-bandwidth performance.
- [ ] Run all 36 scenarios in `docs/acceptance-test-plan.md` and record evidence, failures and external blockers. Required tests not executable in this workspace are not counted as passed.
- [ ] Configure status page/health endpoint, structured safe logs, alerting, dependency updates, deploy/rollback and incident response.
- [ ] Rehearse cPanel or VPS deployment using the target host. Verify document root is `public/`, cron/scheduler, queue and storage paths are correct.

## Verified locally (not production evidence)
- [x] `composer test`: 26 tests / 111 assertions passed on PHP 8.4 with PHPUnit 11.
- [x] `php artisan migrate:fresh --seed --force`: clean SQLite migration and seed passed.
- [x] Laravel `route:cache`, `config:cache`, `view:cache` passed under production environment settings.
- [x] `composer audit --locked`: no known advisories at verification time.
- [x] Android `clean assembleDebug`: passed with Gradle 8.10.2, SDK 35, JDK 21 and a placeholder HTTPS API URL. It is a debug APK, not a signed production bundle; physical-device testing has not occurred.
- [x] GitHub Actions CI workflow added; it has not yet run on a repository/remote.

**Release status:** NOT RELEASED. User selected cPanel and manual payment at launch, but no public domain/API URL, cPanel deployment access, production MySQL credentials, SMS account/configuration, Firebase project config, Android release signing key/Play Console setup, or legal retention/privacy approval has been supplied. Real MySQL migration/rollback, provider delivery, malware-scanner behavior, production backups/restore, load/security review, user acceptance, and cPanel staging are still unchecked. Never send credentials or signing keys in chat; configure them only in the host/provider secrets interface. A debug build, passing local test suite, and test-domain URL do not establish production readiness.