# Deployment Checkup

> :::warning Merged page

# Deployment Checkup

:::warning Merged page

This checklist has been merged into [Deploy and production readiness](./deploy.md). Keep this page only as a legacy pointer for older links.

:::

Run this check after the implementation is reviewed and before declaring an environment ready:

- the consumer lock references a published, reachable Core commit or immutable tag;
- every exact managed path matches that lock and developer-owned CSS, adapters, configuration and catalogues remain intact;
- lint, type checks, Core contract tests, project tests, English catalogue validation and Bruno parity pass;
- the linked migration list contains only reviewed forward migrations, the dry run is understood, and a suitable backup exists;
- hosted migrations have been applied and the ledger is rechecked;
- `app.custom_access_token_hook` is selected under hosted Authentication Hooks and a refreshed test session contains only the expected safe claims;
- hosted Auth URLs, email templates, OTP length, MFA policy, SMTP, Storage policies and secrets match the target environment;
- logout, login, OTP, password reset, account changes, billing recovery and organisation switching have been exercised in the deployed browser;
- logs and alerting expose failures without recording passwords, tokens or private customer data.

Do not treat checked-in `supabase/config.toml` as proof of a hosted setting. Local and hosted Auth configuration are separate release surfaces.