# Beta Release Runbook (closed beta)

> Status: **template**. No release has been executed. Every unchecked item is
> still open; do not check items from this document without doing them.

## Preconditions (launch gate)

- [ ] One-shot Alembic migration applied from an empty database on staging.
- [ ] Provider-neutral images built and tagged (API/worker: `infra/docker/Dockerfile.backend`; frontend: `infra/docker/Dockerfile.frontend`) and pushed to the registry.
- [ ] Same-origin reverse proxy live at the edge with TLS + HSTS; `/api/v1` verified end-to-end (login round-trip).
- [ ] `/healthz` (API) and readiness probes wired to the platform; queue-depth and parser-failure metrics visible.
- [ ] Backups configured and a **restore drill passed** (`backup-and-restore.md`).
- [ ] KEK and secrets present in the secret manager; nothing secret in `VITE_*` or Git (ADR 0004).
- [ ] Legal/privacy gate for RF data localization **signed by qualified counsel** — hard gate before any real invite.
- [ ] Deletion workflow (30-day window, purge, ledger) reviewed against `deletion-ledger.md`.
- [ ] Bank adapters enabled only per `docs/parsers/private-fixture-gate.md`; unsupported formats are not advertised.
- [ ] Invites limited to an explicit allowlist; public registration stays off.

## Launch sequence

1. Deploy images; run migrations one-shot (`alembic upgrade head`), never on container start.
2. Smoke test on production data (synthetic only): invite → register → create space/account → plan month → manual operation → import synthetic statement → review/confirm → close month → reports.
3. Verify Mailpit-equivalent SMTP path against the production SMTP relay (invite email delivered).
4. Enable email invites for the allowlist; monitor error rates, queue depth, parser failures for the first sessions.

## Rollback

- Redeploy previous image tags; migrations are **forward-fix preferred**.
- Downgrade only where the migration is marked reversible in Alembic; otherwise restore from backup and re-apply the deletion ledger (see `backup-and-restore.md`).
- Never roll forward a parser version without a review diff (ADR 0003).

## Incidents

- Financial-data suspected exposure: revoke sessions, rotate `SESSION_SECRET`, preserve audit events, follow the (to-be-written) privacy incident procedure.
- Break-glass access: separate role, mandatory reason, short-lived grant, append-only audit — never through ordinary admin tooling.

## Post-launch

- Record adapter gate statuses and any layout-drift events.
- Keep the restore drill quarterly; update `backup-and-restore.md` drill log.