# KAMAKESI production checklist

## Mandatory before public launch

1. **Upgrade the supplied Laravel 10 starter to a currently supported Laravel release.** The supplied archive is pinned to Laravel 10.50.3. This workspace has no Composer/network access, so application code was implemented and validated against the supplied runtime but the framework packages could not be safely upgraded here. Do not expose an unsupported framework to the public internet.
2. Set `APP_ENV=production`, `APP_DEBUG=false`, a unique `APP_KEY`, production database credentials, Redis and SMTP credentials.
3. Set `KAMAKESI_ADMIN_EMAIL` and a unique high-entropy `KAMAKESI_ADMIN_PASSWORD` before seeding. Production seeding refuses to run without a password.
4. Configure TLS at the load balancer / Cloudflare and force HTTPS.
5. Run `php artisan storage:link`, migrations and the platform seeder once.
6. Run queues under a process manager or the supplied queue container.
7. Configure scheduled execution: `php artisan schedule:run` every minute.
8. Back up PostgreSQL and object/media storage; test restoration.
9. Configure monitoring/error reporting and external uptime checks.
10. Run an application security review before enabling investor/government/customer workflows.

## Deployment commands

```bash
composer install --no-dev --prefer-dist --optimize-autoloader
php artisan key:generate --force
php artisan migrate --force
php artisan db:seed --force
php artisan storage:link
php artisan config:cache
php artisan route:cache
php artisan view:cache
```

After content or route changes, rebuild caches deliberately.

## Security posture included

- Laravel CSRF/session protections
- rate limiting on login, contact, newsletter and applications
- admin authentication + active-account enforcement
- simple role gate for control platform
- restrictive content security and browser security headers
- resumes stored on the private/default disk, not the public disk
- media MIME/size validation
- audit log records for administrator content changes
- admin responses marked no-store
- concept/development lifecycle labels to avoid presenting roadmap products as shipping products

## Recommended next security iteration

- replace the starter's role string with granular RBAC policies/permissions
- require MFA/passkeys for all administrators
- integrate Sentry or another error monitor
- malware scan uploaded documents
- use a managed secret store
- configure automated dependency and container scanning
- add a WAF/rate rules at Cloudflare