PM_Console/docs/runbooks/production-launch.md

Production launch checklist

Required environment

• APP_ENV=production, APP_DEBUG=false, HTTPS APP_URL
• a secret generated APP_KEY
• LOG_LEVEL=warning or stricter with centralized retention and alerting
• MySQL 8 with TLS where traffic leaves the host
• SESSION_SECURE_COOKIE=true
• explicit trusted proxy, CORS, Sanctum stateful-domain, and cookie-domain values
• real SMTP credentials stored in the deployment secret manager
• dedicated cache/queue stores and supervised queue workers

Release gates

• Clean reviewed commit and green CI.
• Dependency audit has no unresolved high/critical advisory.
• Production build artifact is generated from the reviewed commit.
• Database backup and restore drill are successful.
• Migration, rollback, incident owner, and maintenance window are documented.
• Rate limiting, access-control regression tests, file authorization, and password reset pass.
• Health check /up is monitored externally.

Post-deploy checks

• Login/logout/password reset and forced reauthentication after password change.
• Role and record-level authorization with two users from different projects.
• Project, task, sprint, meeting, file, notification, and settings workflows.
• Queue failures, HTTP 5xx, database latency, disk use, and backup freshness.