# DataSBJC — Master Install & Go-Live Runbook The app is already deployed with Phases 1, 2, and the shell live. Phases 3–6 are overlays waiting in /home/voiceagent/overlays. This runbook applies them in order and takes the platform to production. Run as root; the final chown fixes ownership. Order matters: 3 → 4 → 4b → 5 → 6. Each builds on the previous schema. --- ## 0. Pre-flight cd /home/voiceagent/public_html/data.matladu.com php artisan test --filter='TenantIsolation|Rbac|Audit|AdapterContract|SyncIdempotency|CredentialEncryption' # all green = current foundation is sound before layering more cp -r . /home/voiceagent/pre-golive-backup # full snapshot, just in case ## 1. Extract all overlays cd /home/voiceagent/public_html/data.matladu.com for f in /home/voiceagent/overlays/*.tar.gz; do tar -xzf "$f"; done ## 2. Apply overlays in order (use \cp -f to force, no prompts) # Phase 3 — Salesforce \cp -rf phase3-salesforce/app/* app/ \cp -rf phase3-salesforce/config/* config/ \cp -rf phase3-salesforce/database/* database/ \cp -rf phase3-salesforce/tests/* tests/ # Phase 4 — analytics \cp -rf phase4-analytics/app/* app/ \cp -rf phase4-analytics/database/* database/ \cp -rf phase4-analytics/resources/* resources/ \cp -rf phase4-analytics/tests/* tests/ # Phase 4b — studio \cp -rf phase4b-studio/app/* app/ \cp -rf phase4b-studio/resources/* resources/ \cp -rf phase4b-studio/tests/* tests/ # Phase 5 — AI \cp -rf phase5-ai/app/* app/ \cp -rf phase5-ai/config/* config/ \cp -rf phase5-ai/database/* database/ \cp -rf phase5-ai/resources/* resources/ \cp -rf phase5-ai/tests/* tests/ # Phase 6 — hardening \cp -rf phase6-hardening/app/* app/ \cp -rf phase6-hardening/database/* database/ ## 3. Wiring edits (do each once — details in each phase's docs/) a) bootstrap/providers.php — add: App\AI\AIServiceProvider::class, b) bootstrap/app.php middleware aliases — add: 'platform.admin' => \App\Platform\Http\Middleware\EnsurePlatformAdmin::class, and append SecurityHeaders to the web group: $middleware->web(append: [ ..., \App\Platform\Http\Middleware\SecurityHeaders::class ]); c) routes/web.php — merge the route files from each phase: phase3: routes/salesforce-web.php phase4: metrics + dashboards routes (see phase4 docs/SETUP.md) phase4b: routes/studio-web.php + metrics/export phase5: routes/ai-web.php and REMOVE 'metrics','dashboards','ai' from the stub foreach loop. d) database/seeders/DatabaseSeeder.php — add MetricCatalogSeeder (dev only). e) app/Sync/Services/SyncManager.php — apply the per-user + Salesforce idField edits from phase3 docs/WIRING.md. f) app/Integrations/AdapterManager.php — register Salesforce (phase3 docs). g) resources/js/config/navigation.ts — point admin nav "Dashboard Studio" -> /admin/studio. h) resources/views/app.blade.php — ensure: ## 4. Provider credentials in .env # Salesforce Connected App (callback https://data.matladu.com/data-manager/callback/salesforce) SALESFORCE_CLIENT_ID=... SALESFORCE_CLIENT_SECRET=... SALESFORCE_REDIRECT_URI=https://data.matladu.com/data-manager/callback/salesforce # AI AI_PROVIDER=anthropic ANTHROPIC_API_KEY=sk-ant-... ANTHROPIC_MODEL=claude-sonnet-4-6 # Production admin (for ProductionSeeder) ADMIN_NAME="Your Name" ADMIN_EMAIL=you@matladu.com ADMIN_PASSWORD=a-strong-password # Harden APP_DEBUG=false ## 5. Migrate, seed (production-safe), build composer dump-autoload php artisan migrate --force php artisan db:seed --class=Database\\Seeders\\ProductionSeeder --force node node_modules/vite/bin/vite.js build php artisan config:cache && php artisan route:cache ## 6. Full test pass php artisan test # Expect green across: tenant isolation, rbac, audit, adapter contract, # sync idempotency, credential encryption, salesforce oauth, metric query, # dashboard studio, ai analyst. ## 7. Ownership (LAST) cd /home/voiceagent/public_html chown -R voiceagent:voiceagent data.matladu.com find data.matladu.com/storage data.matladu.com/bootstrap/cache -type d -exec chmod 775 {} \; ## 8. Background workers # Supervisor (preferred): install deploy/supervisor-datasbjc.conf, then # supervisorctl reread && supervisorctl update && supervisorctl start datasbjc-worker:* # OR cPanel cron: add both lines from deploy/crontab.txt (as the voiceagent user) ## 9. Backups cp phase6-hardening/deploy/backup.sh /home/voiceagent/backup.sh chmod +x /home/voiceagent/backup.sh # cron (voiceagent): 0 2 * * * /home/voiceagent/backup.sh --- ## Go-live security checklist - [ ] APP_DEBUG=false, APP_ENV=production - [ ] DemoTenantSeeder NOT run in production (ProductionSeeder used instead) - [ ] Real super admin created from env, demo Acme/Globex accounts absent - [ ] .env not web-accessible (docroot is /public — verify: curl https://data.matladu.com/.env returns 404/403) - [ ] SecurityHeaders middleware active - [ ] Rate limits on /ai/ask and sync (config/rate-limits.md) - [ ] SSL valid on data.matladu.com - [ ] Queue worker running as voiceagent (not root) - [ ] Backups scheduled and tested (run backup.sh once, confirm files) - [ ] Provider apps' redirect URIs exactly match https://data.matladu.com/... ## Per-provider live setup (do when ready; each is independent) - Salesforce: phase3-salesforce/docs/SETUP.md (Connected App) - Google Ads / Meta / QuickBooks: same OAuth pattern (adapters are a later build; Salesforce is the proven reference) - AI: add ANTHROPIC_API_KEY ## Rollback If a step breaks the site: restore /home/voiceagent/pre-golive-backup over the app dir, re-chown, and rebuild. Then bring me the exact error and we fix forward.