MarketingTool/docs/RELEASE_CHECKLIST.md

Phase 15 release checklist

Use this checklist for a Virtualmin-managed VPS deployment. A checked item is evidence, not an assumption; record the owner, timestamp, commit, image digests, and backup ID in the release record.

Go/no-go prerequisites

• Reviewed commit and release owner approved; previous image pair and configuration revision are retained for rollback.
• Patched Linux host has Docker Engine and Compose v2, sufficient CPU/RAM/disk, restricted Docker access, host firewalling, and a protected deployment directory outside public web roots.
• Virtualmin/DNS points to the host; HTTPS certificate, renewal monitoring, reverse proxy, and maintenance route are tested.
• API exposure is restricted to the required private path/host; only the intended web entry point is public.
• Production environment values are injected from a protected secret store/environment. .env is untracked, mode 0600, and contains no committed or logged secrets.
• Bootstrap admin values, if needed, are supplied together, used once, removed immediately, and the password is rotated. AUTOMATED_OUTREACH_ENABLED=false is verified in rendered Compose.
• Encrypted off-host backup destination, retention schedule, legal-hold owner, monitoring destination, and incident/rollback owner are confirmed.

Validate, deploy, and verify

• docker compose config --quiet passes; rendered configuration was reviewed without exposing secret values.
• Images build from the reviewed commit, are scanned, and their digests are recorded.
• Backup is taken before release/schema change; checksum/manifest is verified.
• Backup restores into an isolated volume/environment; PRAGMA integrity_check, foreign-key checks, representative row counts, tenant-scoped reads, and API tests pass. Schema/migration result is recorded.
• docker compose up -d completes and both services report healthy; running is not accepted as ready.
• curl -fsS https://<host>/healthz and the API liveness/readiness endpoints pass (/api/v1/health/live, /api/v1/health/ready). These checks do not replace authenticated smoke tests.
• Authenticated smoke tests cover login, tenant-scoped list/detail/child access, a safe mutation/audit readback, and cross-tenant non-disclosure.
• Monitoring sees health/restarts, API errors/latency, disk and /data pressure, auth failures, backup age/failure, TLS expiry, migration failures, and unexpected egress without collecting secrets or full contact data.
• No outbound provider/send/SMTP activity is present; unexpected egress is treated as an incident.

Retain and sign off

• Release record contains commit, image digests, non-secret config fingerprint, schema/migration result, backup ID, test output, approver, and rollback decision.
• Data, audit/source lineage, logs, and backup retention/deletion rules are applied; legal holds are preserved.
• Rollback path was reviewed: restore the prior compatible image/config first, stop writes if needed, and restore data only after compatibility approval. Do not use docker compose down -v on a data-bearing host.
• Known limitations are accepted explicitly: no Virtualmin/TLS/DNS provisioning, only SQLite-level readiness, no standalone migration/backup CLI, SQLite/in-process worker only, no PITR/HA, and no production egress isolation.