platepilot

Deployment runbook

• Status: M0 placeholder — CDK synthesis only
• Cloud deployment: Prohibited
• Target direction: Future AWS beta in us-east-1

Purpose

M0 validates a local scaffold and reviewable infrastructure template. It does not provision, update, or publish a shared environment.

Allowed M0 procedure

From the repository root with Node 22.x, pnpm 10.34.5, and Docker available:

corepack pnpm install --frozen-lockfile
corepack pnpm check
corepack pnpm compose:config
corepack pnpm prisma:validate
corepack pnpm expo:check
corepack pnpm coverage
corepack pnpm cdk:synth

Review synthesis output locally for unexpected resources, broad permissions, public data paths, missing encryption, and placeholder configuration. Confirm that the versioned source bucket expires current and noncurrent quarantine/, processing/, and temporary legacy originals/ versions after 1 day and that the separate non-versioned diary-retention bucket expires diary/ objects after 365 days. Synthesis success is not deployment approval.

Task 7 compatibility migration notes

Before releasing the matching mobile/API code, apply Prisma migrations in timestamp order:

1. 20260919201000_photo_upload_client_operation adds adult-scoped authorization idempotency. Existing rows receive deterministic legacy-<publicId> operation IDs before the column becomes required and unique.
2. 20260919202500_legacy_photo_source_drain records the exact legacy source key/version and deletion time while a worker transactionally repoints an outstanding job from originals/ to its sanitized processing/ object.

Keep the versioned originals/ lifecycle fallback until monitoring confirms no outstanding legacy jobs or versions remain. Do not remove it in the same rollout as the compatibility worker.

The mobile SQLCipher migration is runtime and adult-scoped. Offline command schema version 1 rows are normalized to version 2 in one transaction (occurredAt from the canonical command timestamp, portion amount 1, unit serving) and corrupt rows still fail closed. The encrypted photo workflow database also creates a durable upload-attempt table; it stores identifiers, stage, and an optional app-owned temporary URI, never photo bytes. Native SQLCipher, SecureStore, camera, and filesystem migration behavior still requires simulator/device validation.

Prohibited in M0

• Running cdk deploy or equivalent provisioning commands
• Creating cloud accounts, roles, certificates, DNS, secrets, databases, buckets, queues, or services for PlatePilot
• Publishing API/worker images or mobile/admin releases
• Inserting production credentials or customer data
• Treating public placeholder container images as releasable artifacts

Future beta gate

Every item below is PENDING:

• Named environment owner, approvers, account strategy, and on-call roster
• Privacy, threat-model, data-residency, and vendor approval
• Reviewed and scanned API/worker images with immutable identifiers
• Least-privilege deployment/runtime roles and managed secret delivery
• Private network paths, controlled ingress/egress, TLS certificate, and DNS
• Runtime database connection built from the managed database secret
• Database migration compatibility and recovery plan
• Encrypted database/object/queue resources and validation of the synthesized photo lifecycle rules
• Production identity, email identity, and optional social-provider configuration
• Logs, metrics, traces, audit events, alerts, budgets, and redaction tests
• Backup/restore test meeting 15-minute RPO and four-hour RTO targets
• Load evidence for cached dashboard under 1 second, normal API p95 under 500 ms, and meal-analysis p90 under 15 seconds
• Queue, provider-outage, rollback, and incident exercises
• Mobile/admin distribution, signing, review, and release process
• Explicit deployment approval

Future deployment procedure

PENDING: define only after the environment and release mechanism exist. It must identify inputs by immutable version, include a change record, require pre-deployment evidence, use staged health checks, prevent concurrent deploys, and link the tested rollback point. Never add secret values to this document.

Evidence

For M0, retain only the command results and reviewed synthesized diff in the normal development workflow. Do not describe synthesis artifacts as a deployed stack.