Ops · Runbook

Demo → production
Go-live checklist

Use this when green light is given. Portals UX and online training are ready; remaining work is identity, data hygiene, domains, and the email / Paybill flips. Do not execute flips until PO + ops approve.

A. Must-do before inviting real partners

Security and data — complete before real CSR/Host invites.

	Item	Notes
	Kill or rotate demo accounts	Disable *@sag.local / *@acme.local / *@sigona.local or change every password off Password123!
	Turn off auto-seed	Ensure SEED_ON_BOOT is unset on Railway prod
	Invite real ops users	Create real ops_admin (+ optional ops_readonly); stop shared seed password for invites
	Confirm JWT + CORS	Strong unique JWT_SECRET; CORS_ORIGINS locked to marketing + portal origins (not *)
	Confirm Postgres is SoT	Health shows store: postgres; no MemoryStore / .data/submissions.json in prod
	Backups	Railway Postgres daily backup on; document one restore drill
	Delete leftover Netlify site	sag-portals-unused-delete-me if still present

B. Domains & deploy posture

	Item	Notes
	Custom domains	Apex → Netlify; api.… → Railway (TLS)
	Env matrix filled	NEXT_PUBLIC_SAG_API_URL / SAG_PLATFORM_API_URL → prod API; no demo secrets in client
	Preview ≠ prod	Separate DB + JWT for preview environments
	Deprecate /ops/inbox	Redirect or banner; Admin inbox under /portal/admin is canonical
	Demo logins stay hidden	Keep NEXT_PUBLIC_SHOW_DEMO_LOGINS unset in production

C. Non-tech gates

	Item	Notes
	NGO / board registration	Clear for sponsor diligence conversations
	Child safeguarding policy	Published; hosts can acknowledge in portal
	MoU template	Ready for first Host Node
	Named ops owner	Inbox triage hours owned
	First real partners	Named CSR + Host contacts (not seed fixtures)

D. Live flips (only with PO + ops approval)

Until flipped, keep SAG_FORM_CHANNEL=simulate and SAG_PAYMENT_MODE=simulate even on the production URL.

Forms (email)

	Item	Notes
	Provider ready	Resend/SMTP + secrets
	Flip SAG_FORM_CHANNEL=email	On Netlify
	Smoke public forms	CSR / contact / need-support → email + Admin inbox copy
	Fail-closed check	Behaviour if provider is down

Payments (Paybill)

	Item	Notes
	Real Paybill / bank details	SAG_MPESA_* / SAG_BANK_*
	Flip SAG_PAYMENT_MODE=live	On Netlify
	Donate UI no longer sim	No simulation rails shown as live
	Admin labelling	Leftover payment_sim still labelled; no fake settled funds

E. Soft-launch hardening (first week)

	Item	Notes
	Invite password hygiene	Reset / forced change, or unique per invite
	Login rate-limit smoke	Confirm throttle against brute force
	Audit spot-check	After first real invites / triage
	Staff use /training/	Paths already online
	Error tracking (optional G4)	Sentry on API + Next; scrub PII

F. Explicitly not required for first production

• Daraja ledger / dollar-for-dollar receipts
• Hub Manager PWA / offline sync
• WhatsApp clinical triage
• Angular portal migration / separate admin. csr. host. apps
• Donor portal / SSO / full document upload

Suggested order when green light lands

1. A + B — secure the running stack
2. C — ops can staff it
3. Soft launch with simulate still on for forms/payments if needed
4. D — email flip, then Paybill flip
5. E — first-week polish