Launch runbook

Environment model

• Local: Supabase CLI containers and local Node service.
• Staging: separate Supabase project and service deployment; receives migrations before production.
• Production: separate protected project; migrations require GitHub Environment approval.

Never reuse production credentials in local or staging environments.

GitHub setup

Create staging and production GitHub Environments and restrict production deployment to main when the GitHub plan supports environment protection. Add these secrets independently to each environment:

• SUPABASE_ACCESS_TOKEN
• SUPABASE_PROJECT_REF
• SUPABASE_DB_PASSWORD

Enable branch protection on main with CI, review, and conversation-resolution requirements when the GitHub plan supports private-repository rules. Prevent force pushes and branch deletion. CodeQL analysis runs on push/PR to main and weekly via .github/workflows/codeql.yml; storing alerts in GitHub requires Advanced Security on a private repository. CI also runs linting, tests, npm audit, and Dependabot.

Database release

1. CI rebuilds the database from zero and passes pgTAP/RLS tests.
2. Merge the reviewed migration to main.
3. Back up staging and dispatch Deploy database migrations for staging.
4. Run application smoke tests and inspect errors, query latency, and migration state.
5. Confirm a current production backup or point-in-time recovery window.
6. Obtain production approval and dispatch the same committed workflow for production, entering the required DEPLOY_PRODUCTION confirmation.
7. Verify migration history and critical read/write paths.

Use a corrective forward migration if rollback is required. Never edit shared migration history.

Service release

Merges to main publish an immutable service image to GHCR with commit-SHA metadata, provenance, and an SBOM. Version tags publish a semantic-version image.

A hosting provider has not been selected, so service rollout is intentionally not automated yet. Before launch, add a provider-specific deployment job that deploys an image digest—not a mutable branch tag—and supports health checks, gradual rollout, and rollback to the previous digest.

Mobile release

Before TestFlight automation is enabled:

• Pin Flutter and Xcode versions.
• Store signing material through App Store Connect/GitHub encrypted secrets or a dedicated signing service.
• Create separate staging and production bundle configurations.
• Add unit, widget, integration, accessibility, and release-build checks to CI.
• Use App Store Connect API credentials with the minimum role.

Do not place certificates, provisioning profiles, API private keys, or generated .env files in the repository.

Production readiness

• Supabase backups/PITR and restore drill completed.
• RLS and account-deletion tests passing.
• Service health/readiness checks configured.
• Structured logs redact tokens, transcripts, and meal-photo URLs.
• Error, latency, saturation, database, migration, and provider-cost alerts configured.
• Rate limits and AI budget caps configured.
• Privacy policy, terms, support, data export/deletion, and incident contacts live.
• On-call owner and rollback decision authority named.
• App Store privacy answers and permission messages reviewed.

Incident minimum

1. Stop the rollout or disable the affected feature flag.
2. Preserve logs without exposing private content.
3. Roll the service back by image digest when appropriate.
4. For database defects, apply a reviewed forward fix; restore only for destructive incidents.
5. Rotate exposed credentials immediately.
6. Record impact, timeline, remediation, and prevention work.