# Deployment Checklist

Do not handle real customer funds until all required checks pass.

## Application
- [ ] Fresh Laravel 13 project installed with Composer.
- [ ] All overlay files merged correctly.
- [ ] AppServiceProvider/UserObserver registration completed.
- [ ] VTU service providers registered.
- [ ] Route files loaded.
- [ ] Middleware alias `audit.admin` registered.
- [ ] `php artisan migrate --force` succeeds.
- [ ] Seeders succeed.
- [ ] `php artisan route:list` succeeds.
- [ ] `php artisan config:cache` succeeds.
- [ ] `php artisan test` passes.
- [ ] `scripts/php_syntax_check.sh` passes.

## Security
- [ ] HTTPS enforced.
- [ ] APP_DEBUG=false.
- [ ] Strong APP_KEY generated.
- [ ] Database user has least privilege.
- [ ] Provider/payment credentials are not committed to source control.
- [ ] Admin accounts use strong passwords and MFA/passkeys when added.
- [ ] Transaction PIN throttling tested.
- [ ] Webhook signatures tested.
- [ ] Webhook replay protection tested.
- [ ] Admin wallet adjustments audited.
- [ ] Successful transaction manual reversal policy reviewed.
- [ ] Rate limiting configured.

## Money integrity
- [ ] Concurrent wallet debit test passes.
- [ ] Duplicate purchase idempotency test passes.
- [ ] Duplicate funding webhook test passes.
- [ ] Cashback duplicate-award test passes.
- [ ] Failed provider reversal test passes.
- [ ] Pending transaction reconciliation test passes.
- [ ] Daily reconciliation report exists.

## Infrastructure
- [ ] Queue worker supervised.
- [ ] Cron runs Laravel scheduler every minute.
- [ ] Redis configured if used.
- [ ] Realtime provider configured if used.
- [ ] Database backups tested by restoring to another database.
- [ ] Monitoring/log rotation enabled.
- [ ] Storage permissions are correct.

## External providers
- [ ] Real API docs obtained.
- [ ] Sandbox/test credentials configured.
- [ ] Status mappings verified.
- [ ] Requery behavior verified.
- [ ] Timeout behavior verified.
- [ ] Live credentials enabled only after sandbox tests pass.