# Production launch checklist

## Required environment

- `APP_ENV=production`, `APP_DEBUG=false`, HTTPS `APP_URL`
- a secret generated `APP_KEY`
- `LOG_LEVEL=warning` or stricter with centralized retention and alerting
- MySQL 8 with TLS where traffic leaves the host
- `SESSION_SECURE_COOKIE=true`
- explicit trusted proxy, CORS, Sanctum stateful-domain, and cookie-domain values
- real SMTP credentials stored in the deployment secret manager
- dedicated cache/queue stores and supervised queue workers

## Release gates

- Clean reviewed commit and green CI.
- Dependency audit has no unresolved high/critical advisory.
- Production build artifact is generated from the reviewed commit.
- Database backup and restore drill are successful.
- Migration, rollback, incident owner, and maintenance window are documented.
- Rate limiting, access-control regression tests, file authorization, and password reset pass.
- Health check `/up` is monitored externally.

## Post-deploy checks

- Login/logout/password reset and forced reauthentication after password change.
- Role and record-level authorization with two users from different projects.
- Project, task, sprint, meeting, file, notification, and settings workflows.
- Queue failures, HTTP 5xx, database latency, disk use, and backup freshness.