Final launch readiness

Evidence: Terminal screenshot/log with all audits and Next build passing on the same ZIP that is deployed.

Risk if skipped: A stale audit or TypeScript/build error can reach Vercel even if feature routes look fine locally.

Evidence: artifacts/code-scan/full-project-code-scan.json showing zero blocking issues for imports, literal links, API fetches, env coverage, setup-route exposure and contact persistence.

Risk if skipped: A missing import, exposed setup route, false-success API response or undocumented env can slip past visual QA and break production only after deployment.

Evidence: artifacts/code-scan/deep-project-code-scan.json plus full-project-code-scan.json showing zero blocking issues across imports, scripts, user-facing dev-copy leaks, password-reset dev links, seed secret logs, client env boundaries, public assets and SEO title suffixes.

Risk if skipped: A release can pass feature audits but still leak local-dev copy, expose reset tokens during email misconfiguration, print seed passwords, reference broken scripts or ship duplicate title suffixes.

Evidence: artifacts/live-launch-qa/live-launch-qa-report.json with zero blockers for public routes, SEO titles, fraud blocks and prompt-leak checks.

Risk if skipped: Live deployment can serve wrong env/cached pages even when local code is correct.

Evidence: artifacts/live-launch-qa/payment-storage-readiness.json showing Razorpay, Supabase storage and webhook config are present and masked.

Risk if skipped: Paid users or document vault users can fail after launch due to missing env keys, unsafe public secrets or bucket misconfiguration.

Evidence: Mobile + desktop Lighthouse HTML reports saved under artifacts/lighthouse for home, tools, complaint, UPI help and pricing.

Risk if skipped: Slow first load, layout shifts or SEO/accessibility regressions can hurt conversion and indexing.

Evidence: Playwright report/screenshots showing no horizontal overflow, correct SEO titles, public legal pages and fraud escalation visibility.

Risk if skipped: Mobile UI, title tags, critical public copy or navigation can break only in the browser.

Evidence: Screenshots of a complaint draft, chat response and OCR output showing redaction, safe disclaimers and no OTP/PIN/CVV leakage.

Risk if skipped: Fallback mode may hide broken real AI keys, or live prompts may produce unsafe output without redaction evidence.

Evidence: Masked screenshot/checklist for production-only env values: AUTH_SECRET, DB, Supabase, Razorpay, Resend, AI and Upstash.

Risk if skipped: A missing or preview-only variable can break auth, payment, storage, email or rate-limits only after deploy.

Evidence: artifacts/live-launch-qa/launch-artifact-manifest.json and CSV with SHA-256 hashes for QA, payment/storage, Lighthouse, Playwright and final evidence files.

Risk if skipped: Without artifact hashes and secret scanning, screenshots/reports can be mixed from different runs or shared with leaked secrets.

Evidence: artifacts/live-launch-qa/production-ops-snapshot.json and CSV showing /api/health, /api/ready, /status and /launch-readiness status, latency, cache headers and blockers.

Risk if skipped: A site can pass build and still be operationally unsafe if readiness, DB connectivity or health cache headers fail after deploy.

Evidence: artifacts/live-launch-qa/rollback-drill.json and CSV showing last known-good deployment, owners, backup confirmation, rollback test and maintenance notice readiness.

Risk if skipped: A failed production deploy can become a long outage if no owner, backup, rollback target or maintenance message is ready.

Evidence: artifacts/live-launch-qa/postlaunch-support-check.json and CSV showing support email, contact page, urgent abuse lane, safe reply macros and first-24h review ownership.

Risk if skipped: Users can hit payment, login, fraud or document-vault problems after launch without a tested human support path.

Evidence: artifacts/final-deploy/final-deploy-ready-check.json showing version sync, pinned dependencies, patched lockfile, safe dev-link defaults and final deploy files.

Risk if skipped: A final ZIP can look complete but still ship an out-of-sync lockfile, unsafe local-dev verification links, stale service-worker cache or unpinned dependency updates.

Evidence: artifacts/live-launch-qa/final-evidence-gate.json and CSV showing GO only after live QA, payment/storage, Lighthouse, Playwright, owners and manual approvals are complete.

Risk if skipped: Without a final no-go gate, you can accidentally launch with missing production artifacts, untested payment/storage, or no rollback owner.

Evidence: Returns ok=true, current version, environment and no-cache headers without touching the database.

Launch rule: Must be green before Vercel traffic is moved to the final domain.

Evidence: Returns ok=true only when required env values and database connectivity are usable.

Launch rule: A 503 means soft-launch only; do not announce publicly until fixed.

Evidence: artifacts/live-launch-qa/production-ops-snapshot.json and CSV with endpoint latency, status codes, cache headers and blockers.

Launch rule: Run after every production deploy and keep the artifact with the final launch proof bundle.

Evidence: rollback-drill.json records last-good deployment, backup confirmation, owners, rollback test and maintenance notice readiness.

Launch rule: Must be saved before final evidence gate; unresolved manual-required items mean soft launch only.

Evidence: postlaunch-support-check.json proves support email, contact page, urgent abuse owner, safe macros and first-24h review are ready.

Launch rule: Must be saved before public traffic or paid campaigns.

Evidence: Named owner/contact is present in final-evidence-gate.json.

Launch rule: No owner means no public launch.

Owner: Launch owner

Evidence: artifacts/live-launch-qa/rollback-drill.json and CSV with rollback owner, incident owner, backup confirmation and last-good deployment URL.

Action: Do this before public launch so a bad deploy can be reverted without panic.

Owner: Deployment owner

Evidence: Previous stable Vercel deployment URL is saved and does not expose tokens or preview-only secrets.

Action: Use this target if final production deployment shows severe auth/payment/AI/storage failures.

Owner: Backend owner

Evidence: Masked Supabase/Postgres backup screenshot or restore-point note saved with launch artifacts.

Action: Do not run marketing launch before a fresh restore point exists.

Owner: Support owner

Evidence: Short user-facing notice is prepared for status page, WhatsApp/social post, support replies and footer banner if needed.

Action: Use it if checkout, login, AI or document vault is degraded.

Evidence: postlaunch-support-check.json records /contact reachability, support email visibility and contact/ticket readiness controls.

Launch rule: Do not run paid traffic until users have a tested path to ask for help.

Evidence: Support intake can classify fraud, payment, login and vault issues as urgent support tickets without exposing secrets.

Launch rule: UPI fraud, payment failure, account access and document-vault reports need same-day human review.

Evidence: Macros remind users not to share OTP/PIN/CVV/passwords and avoid legal/financial outcome guarantees.

Launch rule: Every reply must stay guidance-only and privacy-safe.

Evidence: Named owner, response SLA and review window are recorded in postlaunch-support-check.json.

Launch rule: Public launch needs someone watching early fraud/payment/login failures.