# v78 — Production Sign-off & Deployment Rehearsal

v78 converts the v77 production-readiness primitives into a repeatable release sign-off
workflow. It does not pretend that local tests can prove a real production environment.

## Three modes

`ops/signoff/invoke-production-signoff.ps1` supports:

- `prepare`: local regression verification, Web/Agent packages, release manifest,
  checksums, non-secret release evidence, and an evidence bundle.
- `rehearsal`: prepare + external HTTPS/smoke + queue/scheduler evidence and optional
  disposable PostgreSQL restore drill.
- `production`: requires every rehearsal gate plus restore drill and explicit human
  acceptance for POS, printing, and rollback.

Production mode fails closed if those manual acceptances are not explicitly supplied.

## Release evidence

`php artisan ops:release-evidence --json` emits only non-secret runtime/release data and
the existing v77 readiness result. It does not emit DB passwords, APP_KEY, Redis
passwords, tokens, or customer/business data.

## Artifact integrity

The release manifest records:
- schema version;
- release version;
- exact Git commit;
- generation time;
- artifact file name, byte size, and SHA-256.

The manifest verifier re-hashes every artifact before sign-off.

## TLS / external verification

The external TLS gate:
- refuses non-HTTPS URLs;
- uses normal certificate validation;
- requires the expected release commit;
- requires HSTS and `X-Content-Type-Options`.

The standard external smoke also verifies liveness/readiness/version.

## PostgreSQL restore drill

`ops/postgres/restore-drill.ps1` only targets an explicitly named disposable database.
It refuses:
- source DB == drill DB;
- common production/system database names;
- execution without the destructive-target acknowledgement switch.

It verifies the backup checksum when available, creates the disposable DB, restores it,
checks required application schemas and migration history, then drops the drill DB by
default.

## Queue / scheduler

Production sign-off requires actual worker/service and scheduler-task evidence.
Rehearsal mode may explicitly use command-only evidence, but that is not accepted as a
production sign-off.

## Manual business acceptance

Automation cannot prove the physical edge. Production sign-off therefore requires:
- POS cash sale accepted;
- inventory movement confirmed;
- receipt/document accepted;
- physical or approved printer path accepted;
- next-sale continuity accepted;
- rollback rehearsal accepted.

## Rollback

Normal application rollback re-deploys the previous immutable release. It does not
automatically roll back database migrations. Destructive DB restore is disaster
recovery, not normal code rollback.

## Evidence retention

Every sign-off run writes a timestamped evidence directory and a SHA-256-protected ZIP.
The evidence bundle is the audit artifact for release approval.