# Phase 19 production deployment and handover

Date: 2026-07-19  
Status: production package prepared; host deployment remains an operator-controlled change  
Validation: 105 checks passed, 0 failed

## Implemented

- Added a production-only environment template with debug disabled, HTTPS, secure cookies, stronger password baseline, unique application-key placeholder, and least-privilege database identity placeholders.
- Added Nginx and Apache virtual-host examples that serve only `public/`, redirect HTTP to HTTPS, restrict PHP execution to the front controller, and deny hidden/private paths.
- Added PHP production/session/OPcache recommendations, MySQL 8 UTC/strict/durability recommendations, and a cron example.
- Added `php cli health:check` for environment, database, migrations, writable private storage, installer lock, cron freshness, failed integration jobs, synchronous queue status, and backup marker status.
- Added `php cli cron:heartbeat` for external cron monitoring.
- Documented immutable-release deployment, permissions, TLS, runtime/migrator database grants, backup-before-migration, seeds, upgrades, application rollback, schema rollback/restore, database health, and index verification.
- Documented the existing storage controls: private upload path, generated filenames, original-name metadata, MIME/size validation, restrictive permissions, protected download services, and upload-directory execution denial.
- Added administrator, operations, fleet, maintenance, finance, crew, developer, database, API, permission, recovery, and troubleshooting handover guides.

## Final validation

| Requirement | Evidence/result |
|---|---|
| No live aircraft tracking | No GPS, ADS-B, or live-tracking module exists; location remains manual or flight-completion-derived. |
| No passenger booking engine | No booking or passenger-reservation module exists. |
| No ticketing/check-in module | No ticketing, check-in, or boarding-pass module exists. |
| Airline data isolation | Cross-airline detail/list tests pass; production gate verifies tenant-scoped schema and architecture rules. |
| Critical actions audited | Application regression passes and more than 100 service audit/log call sites remain present. |
| Safe financial decimals | Migration scan rejects FLOAT/DOUBLE/REAL and verifies DECIMAL schema usage. |
| Grounded aircraft blocked | Eligibility service and regression tests reject Grounded/Under Maintenance/Out of Service and critical/AOG defects. |
| Critical expiry blocking | Insurance, airworthiness, mandatory maintenance, and return-to-service checks are backend enforced. |
| Server-side permissions | Middleware/service permission, API scope, role-matrix, and 403 tests pass. |
| Repeatable deployment | Immutable release, backup, migrate, health, activation, and rollback procedures plus server examples are supplied. |

## Files created

- `.env.production.example`
- `deployment/nginx/powerams.conf`
- `deployment/apache/powerams.conf`
- `deployment/php/99-powerams.ini`
- `deployment/mysql/powerams.cnf`
- `deployment/cron/powerams`
- `app/Core/ProductionHealth.php`
- `tests/production/production-readiness.php`
- `docs/handover/DEPLOYMENT_GUIDE.md`
- `docs/handover/BACKUP_AND_RECOVERY.md`
- `docs/handover/ADMINISTRATOR_GUIDE.md`
- `docs/handover/OPERATIONS_GUIDE.md`
- `docs/handover/FLEET_GUIDE.md`
- `docs/handover/MAINTENANCE_GUIDE.md`
- `docs/handover/FINANCE_GUIDE.md`
- `docs/handover/CREW_GUIDE.md`
- `docs/handover/DEVELOPER_ARCHITECTURE.md`
- `docs/handover/DATABASE_OVERVIEW.md`
- `docs/handover/API_DOCUMENTATION.md`
- `docs/handover/PERMISSION_MATRIX.md`
- `docs/handover/TROUBLESHOOTING.md`
- `docs/PHASE_19_IMPLEMENTATION.md`

## Files modified

- `cli`
- `README.md`

## Database migrations added

None. Phase 19 adds deployment/monitoring support and documentation without changing functional schema.

## Security controls added

- Production environment acceptance checks for debug, HTTPS, secure sessions, application key, and installer lock.
- Web-server examples enforce the public/private file boundary and single PHP front controller.
- Separate least-privilege runtime and migration database-account guidance.
- TLS/HSTS, PHP error masking, session hardening, upload limits, restricted ownership, and log-access guidance.
- Automated production checks for private generated uploads, metadata-only original names, CSRF/security settings, audit coverage, tenant scoping, decimal columns, eligibility rules, and excluded modules.

## Tests performed

- `php tests/run.php`: 67 passed, 0 failed.
- `php tests/quality/static-analysis.php`: 12 passed, 0 failed.
- `php tests/production/production-readiness.php`: 26 passed, 0 failed.
- CLI command discovery and syntax validation passed.

## Remaining limitations and deployment actions

1. Replace every placeholder with secrets from the production secret manager and rotate initial administrator/database/integration credentials.
2. Adjust FPM workers, MySQL buffer pool/connections, upload limits, and timeouts from measured host capacity and load tests.
3. Install organization-approved TLS certificates, test renewal, then enable the final HSTS policy.
4. Execute migrations and health checks against the target MySQL 8 instance with the separate migrator identity.
5. Complete native Chrome, Safari, Firefox, and Edge sign-off from the Phase 18 checklist.
6. Perform and document a full database/private-upload restore drill before accepting the recovery plan.
7. Connect health, cron, log, failed-job, storage, and backup-marker signals to the organization’s monitoring/on-call platform.

## Future-development recommendations

- Add a persistent queue adapter only when asynchronous workload requires it; include authenticated CLI workers, retry policy, dead-letter handling, and supervisor definitions at that time.
- Add MySQL 8 CI, migration smoke/rollback testing, production-scale concurrency tests, and measured query budgets.
- Add automated dependency/SBOM, secret, container/host baseline, and external vulnerability scanning in the release pipeline.
- Add point-in-time recovery with binlog verification and automated restore testing.
- Continue avoiding passenger commerce, certified FTL claims, full general-ledger scope, and live aircraft tracking unless separately authorized and designed.