Skip to content

Onset Production Readiness Checklist

Use this checklist before each production release.

1) Security & Secrets

  • [ ] supabase/.env is not committed (only supabase/.env.example tracked).
  • [x] Supabase Edge secrets are set in project (verified 2026-04-28):
  • ADMIN_DASHBOARD_SECRET
  • ANTHROPIC_API_KEY
  • ONSET_API_URL
  • ONSET_API_ANON_KEY
  • SUPABASE_SERVICE_ROLE_KEY (auto-injected; ONSET_SERVICE_ROLE_JWT accepted as override)
  • Apple Sign In (consumed by apple-link and delete-account):
    • APPLE_TEAM_ID — A5TF9D2CT7
    • APPLE_KEY_ID — RV26UG9967
    • APPLE_SERVICES_ID — com.last1enterprises.onset.signin
    • APPLE_PRIVATE_KEY — contents of AuthKey_RV26UG9967.p8
    • Smoke-tested against https://appleid.apple.com/auth/token → returned invalid_grant, confirming Team / Key / Services ID + JWT signature all validate. Apple-side configuration verified on the matching App ID, Key, and Services ID in the Developer portal.
  • [ ] iOS build settings use production keys (no placeholders in Release config).
  • [ ] Certificate pinning value is validated for current backend certificate chain.

2) CI / Release Gate

  • [ ] Release Gate workflow passes on main.
  • [ ] python3 scripts/production_checks.py passes locally.
  • [ ] xcodebuild -scheme Onset -destination 'generic/platform=iOS Simulator' build passes.
  • [ ] python3 scripts/supabase-smoke.py --project-ref <ref> passes.

3) Database / Functions

  • [x] supabase db push applied with no pending migrations (last verified 2026-04-28; latest applied migration 20260429014227_advisor_initplan_jwt_wrap).
  • [x] Migration ledger drift reconciled — 4 phantom remote entries from cross-repo dashboard SQL pushes (20260427231526, 20260427232244, 20260427232855, 20260427233230) marked reverted so the Onset repo is source of truth.
  • [x] Deployed functions (verified ACTIVE 2026-04-28):
  • generate-protocol
  • daily-insight
  • client-event
  • admin-dashboard
  • parse-lab (v11 — abuse controls + per-user rate limits)
  • lab-intelligence (v1)
  • apple-link (v2 — Apple OAuth code exchange for SIWA refresh tokens)
  • delete-account (v2 — App Store 5.1.1(v) in-app deletion with Apple revoke-on-deletion)
  • [x] supabase/config.toml keeps:
  • [functions.daily-insight] verify_jwt = false
  • [functions.client-event] verify_jwt = false
  • [functions.admin-dashboard] verify_jwt = false
  • [functions.parse-lab] verify_jwt = false (auth validated inside the function)
  • [functions.delete-account] verify_jwt = false (auth validated inside the function)
  • [ ] get_admin_dashboard_metrics returns product event fields:
  • product_events_24h
  • product_events_by_name_24h
  • [x] Database advisor pass run (last 2026-04-28): 0 errors, 13 warnings remaining. All warnings introduced by the 2026-04-28 clinic + Apple migration round have been resolved (20260429014013_clinic_apple_advisor_fixes + 20260429014227_advisor_initplan_jwt_wrap). Remaining warnings are pre-existing (auth_rls_initplan on protocol_generations / ai_insights / product_events / scan_logs, multiple_permissive_policies by design, intentional SECURITY DEFINER on validate_clinic_code).

4) Product / Billing QA

  • [ ] Free and Pro flows verified on real device + simulator.
  • [ ] RevenueCat entitlement pro is active after purchase and restore.
  • [ ] Paywall shown from all entry points (Today, Insights, onboarding, mode lock).
  • [ ] Failure fallback UX verified:
  • daily insight unavailable
  • session refresh path
  • Supabase temporarily unavailable

5) Compliance & Trust

  • [ ] App Store privacy labels and public privacy policy match actual behavior (cloud AI + event telemetry).
  • [ ] In-app disclaimers remain evidence-first and non-diagnostic.
  • [ ] Female cycle-aware copy does not overclaim prediction precision.

6) Go / No-Go

  • [ ] Run ./scripts/release-readiness.sh (or equivalent CI checks) and archive output.
  • [ ] If any blocker exists, do not release; follow docs/ROLLBACK_RUNBOOK.md for remediation.