Deployment Checkup

Merged page

This checklist has been merged into Deploy and production readiness. Keep this page only as a legacy pointer for older links.

Run this check after the implementation is reviewed and before declaring an environment ready:

• the consumer lock references a published, reachable Core commit or immutable tag;
• every exact managed path matches that lock and developer-owned CSS, adapters, configuration and catalogues remain intact;
• lint, type checks, Core contract tests, project tests, English catalogue validation and Bruno parity pass;
• the linked migration list contains only reviewed forward migrations, the dry run is understood, and a suitable backup exists;
• hosted migrations have been applied and the ledger is rechecked;
• app.custom_access_token_hook is selected under hosted Authentication Hooks and a refreshed test session contains only the expected safe claims;
• hosted Auth URLs, email templates, OTP length, MFA policy, SMTP, Storage policies and secrets match the target environment;
• logout, login, OTP, password reset, account changes, billing recovery and organisation switching have been exercised in the deployed browser;
• logs and alerting expose failures without recording passwords, tokens or private customer data.

Do not treat checked-in supabase/config.toml as proof of a hosted setting. Local and hosted Auth configuration are separate release surfaces.