docs(website): record that the website-side registration/checkout flow is now built

ced4568/RootNode-academy-website (separate GitHub repo, Chase-authorized access) now implements
docs/WEBSITE_REGISTRATION_AND_CHECKOUT.md's full contract on its own side: public offering
lookup, registration (adult + guardian/minor), agreement acceptance, checkout creation, and a
status-polling success page. Its own stale pricing was also corrected to match docs/
ROOTNODE_PRICING_AND_OFFERS_V1.md. It has nothing to talk to yet -- no real Platform API exists
(Gate 4's hardware blocker, unchanged) -- so every RootNode-facing route there returns a clean
503 until ROOTNODE_API_URL/ROOTNODE_INTEGRATION_KEY point at a real deployment.

Updates PHASE10_LAUNCH_READINESS.md Gate 10 and its matrix row, and WINTER_BREAK_LAUNCH_CHECKLIST.md
and WINTER_BREAK_CAMP_OPERATIONS.md's own website-status notes, all of which previously said
'nobody has built the website-side form yet.'

docs/PHASE10_CANONICAL_STATE_AUDIT.md

@@ -0,0 +1,190 @@
+# Phase 10 — Canonical State Audit
+
+Gate 1. Performed before any Phase 10 production/launch work, per Phase 10's own explicit
+requirement — Chase has been developing from two workstations, so nothing downstream was
+started until canonical state was actually verified, not assumed.
+
+## Baseline
+
+- Starting SHA (as reported at the end of Phase 9.1): `a4c00580...` (full:
+  `a4c0058f8c3d9612f1d30508626fa5be00431fa7`).
+- This workstation's `HEAD` and `origin/main`, confirmed via `git fetch --all --prune`, are
+  **both exactly `a4c0058f8c3d9612f1d30508626fa5be00431fa7`** — this workstation is fully
+  up to date with canonical Gitea, and canonical Gitea has not moved since Phase 9.1 ended.
+
+## 1.1 Current workstation state
+
+- Branch: `main`. Working tree: clean (`git status --short` — no output).
+- `git remote -v`: `origin` → `gitea:ced4568/rootnode-academy.git` (fetch + push) — canonical,
+  no GitHub `kubekosh` remote configured in this clone at all.
+- `git branch -vv`: `* main a4c0058 [origin/main]` — tracking correctly, no divergence.
+- No stashes, no dangling work, no uncommitted changes.
+
+## 1.2 Remote audit
+
+`git ls-remote --heads --tags origin` shows exactly one branch (`main`, at `a4c0058`) and four
+tags (`v0.4.1-preprod`, `v0.5.0-student-auth`, `v0.5.3-enrollment-comms`, `v0.6.0-root-v1`) — no
+other branches, no unexpected experimental branches, no stale branches to reconcile.
+`git log --all --oneline` and `git log --oneline` both return exactly **184** commits — every
+commit reachable in this repository is reachable from `main`. **There is no orphaned or
+unmerged work sitting in Gitea outside `main`.**
+
+## 1.3 Second-PC reconciliation
+
+This execution environment has no access to Chase's other workstation. Gitea's own state (§1.2)
+proves there is no SECOND branch or unpushed-but-fetchable ref waiting anywhere on the remote —
+if work exists only on the other PC, it is **local and unpushed there**, not merely unmerged
+here. This is not automatically resolvable from this side.
+
+**Exact commands for Chase to run on PC #2** to prove no local-only RootNode work is stranded:
+
+```bash
+cd ~/Dev/Gitea/ced4568/rootnode-academy   # or wherever the clone lives on that machine
+git status                                 # must show "nothing to commit, working tree clean"
+git branch -vv                             # every branch should show [origin/main] with no
+                                            # "ahead" count, or should not exist at all
+git fetch origin
+git log origin/main..HEAD --oneline        # MUST be empty — any output here is unpushed work
+git stash list                             # should be empty, or each entry reviewed manually
+```
+
+If `git log origin/main..HEAD --oneline` on PC #2 produces ANY output, that is real, unpushed
+work — it must be reviewed and pushed (or explicitly discarded by Chase's own decision) before
+being considered part of canonical state. **This audit cannot rule that out from here — it can
+only confirm Gitea itself has no evidence of it.**
+
+## 1.4 Expected milestone audit
+
+Every phase SHA Phase 10's own authorization listed (Phase 2A through Phase 9.1 final) was
+verified present in canonical history, in full agreement with the commit message labels:
+
+| Phase | SHA (verified) | Commit subject |
+|---|---|---|
+| 2A | `42dfb1c` | docs(phase2a): document gateway and student launch architecture |
+| 2B | `08ff531` | docs(phase2b): document admin and platform-data architecture |
+| 3A | `4069292` | docs(phase3a): document production identity architecture |
+| 3B | `45a147a` | docs(phase3b): document the learning and assessment engine |
+| 4 | `bf1e1b5` | docs(phase4): production infrastructure documentation + runbooks |
+| 4.1 | `5bc0743` | docs(phase4.1): pre-production hardening documentation |
+| 5A | `896c230` | docs(phase5a): student identity and remote classroom documentation |
+| 5B | `1c08a30` | docs(phase5b): self-paced enrollment documentation + website integration contract |
+| 5C | `777efd1` | docs(phase5c): enrollment communications documentation + Google Workspace runbook |
+| 6A | `fd38d06` | docs(phase6a): document RootNode course foundation |
+| 6B | `2db1368` | docs(phase6b): document curriculum expansion |
+| 6C | `bd0a10f` | docs(phase6c): pilot readiness standard, pilot curriculum manifest, ROOT 11 scope |
+| 6D | `b6516a7` | docs(phase6d): document the ROOT Foundations milestone |
+| 6E | `87ad125` | docs(phase6e): document the ROOT Foundations Completion milestone |
+| 6F | `d066410` | docs(phase6f): document ROOT_ V1 pilot readiness (tag `v0.6.0-root-v1`) |
+| 7 | `df5e39f` | docs(phase7): document the business/product architecture foundation |
+| 8 | `788fb19` | docs(phase8): document enrollment operations |
+| 9 | `80a5f6e` | docs(phase9): document commerce integration and Winter Break launch readiness |
+| 9.1 (prep) | `77fd186` | docs(stripe): document Phase 9.1 blocked status and live-mode readiness checklist |
+| 9.1 (final) | `a4c0058` | docs(stripe): document real Stripe TEST-mode validation results |
+
+**Original Phase 9.5 commit — NOT FOUND, reconfirmed in Phase 10.1.** No commit, branch, or tag
+matching "Phase 9.5" or a founder-pricing document existed in this repository's reachable history
+(`git log --all` contains no such commit, searched again in Phase 10.1 with a broader content
+search for "FOUNDER APPROVED"/"LOCKED FOR V1"/"Founding Cohort"/`39900` — every hit traces to
+the Phase 9.1/10 work, never a separate Phase 9.5 commit). The complete founder-approved matrix
+was subsequently recovered from Chase's synced RootNode Academy conversation and canonicalized
+as `docs/ROOTNODE_PRICING_AND_OFFERS_V1.md`. The earlier belief that a unique document existed
+only on PC #2 was not verified and is no longer relied upon. The original desktop still requires
+inspection only to determine whether it holds an earlier unpushed copy or commit. The recovered
+document is now the authoritative V1 pricing record unless that inspection reveals a material
+difference requiring Chase's review.
+
+**Website pricing is stale, confirmed with Chase.** A read-only fetch of `rootnodeacademy.com`
+during Phase 10.1 found founding-price RANGES (INIT_ $200–250, COMPILE_ $300–360, ROOT_
+$550–650, CAMPS_ $250–350 — no specific "Winter Break Camp" named, no ROOT_ tier breakdown) that
+do not match the exact fixed V1 prices Chase gave directly this phase. Chase confirmed the exact
+fixed prices are the correct, current figures — **the live website has not yet been updated to
+the real V1 pricing matrix.** This is the separate, not-RootNode-owned website repo; updating it
+is outside this repo's scope, noted here only as a real discrepancy for Chase's own awareness.
+
+## 1.5 File/artifact audit
+
+Searched all tracked files for secret-shaped filenames (`.env*`, `.local`, `credential`,
+`secret`, `.key`, `.pem`, `.p12`, service-account JSON). Every match is a legitimate
+template/placeholder or educational-content reference, never a real runtime secret:
+
+- Course content (`content/root/root-07-.../m02-configuration-and-secrets/`) — teaching material
+  about Kubernetes Secrets, no real secret data.
+- `infra/ansible/roles/*/templates/*.env.j2` — Ansible Jinja2 templates referencing
+  `{{ vault_* }}` variables (values live in an Ansible Vault-encrypted file, never plaintext in
+  git).
+- `infra/environments/{production,staging}/*.env.template` — checked-in templates with explicit
+  `__REPLACE_WITH_...__`/`__REPLACE_openssl_rand_hex_32__` placeholders, never real values.
+- `platform/provisioner/.env.example`, migration `017_student_credentials.sql` (schema, not
+  data), `scenarios/data/*secret*.json` (fake Kubernetes lab-scenario fixtures).
+
+`.gitignore` correctly excludes `.env` (blanket pattern) — confirmed via `git status
+--porcelain --ignored`: `platform/.env` and `platform/provisioner/.env` (both containing real
+local secrets) are ignored, never tracked.
+
+## 1.6 Secret history audit
+
+Searched the **entire** git history (`git log --all -p`, pickaxe search `-S`) for:
+`sk_test_`, `sk_live_`, `whsec_`, `BEGIN PRIVATE KEY`, `BEGIN RSA PRIVATE KEY`, `"private_key"`,
+and a broad regex for any `sk_test_`/`sk_live_`/`whsec_`-prefixed string of realistic secret
+length (20+ trailing characters).
+
+**Result: clean. No real secret value has ever been committed.** Every `sk_test_`/`sk_live_`/
+`whsec_` hit is a code guard-clause literal (e.g. `.startsWith('sk_test_')`) or documentation
+prose referencing the prefix pattern, from this session's own Phase 9.1 commits — never a full
+key. The one `"private_key"` hit (`b38c46a`, Phase 5C) is a code comment showing an EXAMPLE
+env-var invocation with a `"..."` placeholder, not a real value. No `BEGIN PRIVATE KEY`/`BEGIN
+RSA PRIVATE KEY` header appears anywhere in history. **No credential rotation is required.**
+
+## 1.7 Current runtime secret state (this workstation)
+
+`platform/.env` (gitignored, never committed) holds real local-dev values for
+`PROVISIONER_SHARED_SECRET`, `INTEGRATION_SHARED_SECRET`, `GOOGLE_SERVICE_ACCOUNT_JSON`,
+`EMAIL_FROM_ADDRESS`, `GOOGLE_DELEGATED_USER` — all pre-existing from earlier phases. Its
+`PAYMENT_PROVIDER`/`STRIPE_SECRET_KEY`/`STRIPE_WEBHOOK_SECRET` lines are present but **blank**,
+per this repo's own "set only for a deliberate session, unset again after" convention (matching
+`EMAIL_PROVIDER`'s established pattern) — confirmed after Phase 9.1's real-Stripe validation
+session ended. See `docs/SECRETS_AND_INFISICAL.md` for the full inventory and centralization
+status.
+
+## Discrepancies found
+
+1. **The original "Phase 9.5" has no canonical commit** — see §1.4. The complete approved matrix
+   was recovered from the synced RootNode Academy conversation and canonicalized in
+   `docs/ROOTNODE_PRICING_AND_OFFERS_V1.md`. PC #2 inspection remains useful only to detect an
+   earlier local copy or commit and compare it for material differences.
+2. **Chase's Phase 10.1 authorization states RootNode Academy "ALREADY EXISTS" as an Infisical
+   project** on `infisical.cedshomelab.com`. Re-investigated in Phase 10.1 with a proper
+   org-scoped API enumeration (`GET /api/v2/organizations/{orgId}/workspaces`, not just the
+   CLI's interactive picker, which turned out to be incomplete — it showed 6 projects in Phase
+   10, the API shows 8 for the same identity). **Still no project named "RootNode Academy" (or
+   similar) is visible to this machine identity** even with the more complete method — the
+   full, real list is: Core Infrastructure, Kubernetes, Media Platform, Monitoring, Network
+   Service, Privileged Access Manager, Storage, Synthos Systems. **Root cause is now narrowed,
+   not fully resolved**: this machine identity's own project list only shows projects it has
+   been explicitly granted access to (standard Infisical per-project ACL, separate from org
+   membership) — so the most likely explanation is that "RootNode Academy" exists but this
+   identity was never added to it, not that it doesn't exist. This cannot be distinguished from
+   here without either org-owner-level API access or the web dashboard, neither available to
+   this session. **No duplicate project was created.** See `docs/SECRETS_AND_INFISICAL.md` for
+   the exact one-line fix (grant the `claude-code-migration` identity access to the existing
+   project via its Project Settings → Access page).
+3. **No dedicated production server/Proxmox VM has been provisioned** — `infra/terraform/` has
+   no `terraform.tfvars` (only `.example`) and no state file; `infra/ansible/group_vars/
+   production.yml` still holds literal placeholders (`__PLATFORM_VM_IP__`,
+   `__LAB_HOST_VM_IP__`, `__PROXMOX_HOST_MGMT_CIDR__`). See `docs/
+  PHASE10_PRODUCTION_DEPLOYMENT.md`.
+
+## Remediation performed
+
+The complete founder-approved Phase 9.5 matrix was recovered from synced conversation history
+and written to `docs/ROOTNODE_PRICING_AND_OFFERS_V1.md`. This audit was corrected to distinguish
+the missing original Phase 9.5 commit from the now-recovered pricing decision. No existing Git
+history was rewritten.
+
+## Conclusion
+
+**Canonical Gitea history through Phase 10.1 is internally consistent, fully verified against
+every claimed milestone, and free of any committed secret.** The Phase 9.5 pricing matrix has
+now been recovered locally from synced conversation history and awaits review/commit. The only
+remaining multi-PC item is running the PC #2 commands in §1.3 to positively rule out stranded
+local work or identify an earlier Phase 9.5 copy for comparison.

docs/PHASE10_LAUNCH_READINESS.md

@@ -0,0 +1,167 @@
+# Phase 10 — Launch Readiness
+
+Gates 2, 10-14, 19-20, and the final launch matrix. See `docs/PHASE10_CANONICAL_STATE_AUDIT.md`
+(Gate 1), `docs/SECRETS_AND_INFISICAL.md` (Gate 3), `docs/PHASE10_PRODUCTION_DEPLOYMENT.md`
+(Gates 4-9/15-16), and `docs/PHASE10_SECURITY_AUDIT.md` (Gate 18) for the rest.
+
+## Gate 2 — Full application audit
+
+Reviewed for architectural coherence across every phase; nothing was found inconsistent or in
+need of a fix. Identity/auth, learning, Lab platform, business (offerings/registrations/
+guardians/agreements), and commerce (pricing/payments/webhooks) all remain exactly as documented
+in their own phase docs — re-verified by actually rerunning every suite (Gate 19 below), not by
+re-reading code and assuming it still works.
+
+## Gate 10 — Website integration
+
+**Update (post-Phase 10.1)**: the website side is now actually built, not just documented.
+`ced4568/RootNode-academy-website` (a separate GitHub repository — Chase provided access and
+explicitly authorized this phase to build against it) now has a real registration/agreement/
+checkout/status flow implementing `docs/WEBSITE_REGISTRATION_AND_CHECKOUT.md`'s full contract:
+public offering lookup, registration submission (adult and guardian+minor), agreement
+acceptance, checkout creation, and a status-polling success page that never trusts the redirect
+URL alone, exactly as that document specifies. Verified there: a clean production build, `tsc`,
+eslint, and 9/9 tests all pass. The site's own stale pricing was also corrected to match
+`docs/ROOTNODE_PRICING_AND_OFFERS_V1.md`.
+
+It has nothing to talk to yet — `ROOTNODE_API_URL`/`ROOTNODE_INTEGRATION_KEY` are unset on the
+website side (no real Platform API exists to point them at), so every RootNode-facing route on
+the website returns a clean `503`, never a `500`, until Gate 4's hardware blocker resolves and a
+real Platform API origin exists. `docs/WEBSITE_REGISTRATION_AND_CHECKOUT.md` and `docs/
+WEBSITE_ENROLLMENT_INTEGRATION.md` remain the accurate contract both sides now implement.
+
+## Gate 11 — Winter Break offering
+
+Pricing is locked and real: **$399.00 launch ("Founding Cohort") / $449.00 standard reference,
+39900/44900 cents, paid in full, no deposit, no payment plan** — given directly by Chase,
+validated against real Stripe TEST mode at the exact $399 amount in Phase 9.1. **Dates, venue,
+and capacity remain undecided** — not invented by this phase, exactly as every prior phase's own
+documentation already states. The offering therefore cannot be transitioned to
+`enrollment_open` for real, public registration yet — the platform mechanism is ready
+(`PATCH /api/admin/offerings/:id` accepts all four fields the moment they're decided).
+
+## Gate 12 — Agreements / legal
+
+`agreement_definitions`/`agreement_acceptances` architecture is real, tested, and versioned
+(Phase 7-9). **No attorney-approved legal text exists for any required Winter Break agreement**
+— `agreement_definitions.body_summary` remains a plain-language placeholder, exactly as every
+prior phase's docs have stated since Phase 7. This phase did not write legal language and did
+not treat any placeholder as attorney-approved, per Phase 10's own explicit instruction.
+
+**LAUNCH BLOCKED — APPROVED AGREEMENT TEXT REQUIRED.** Likely required categories (not
+authored, just the taxonomy Phase 10 asked to identify): program participation terms, guardian
+consent (minor registrants), a participation/liability waiver, acceptable-use / lab/technology
+rules, a cancellation/refund acknowledgment tied to whatever policy Gate 14 resolves, and a
+privacy/data-handling notice if RootNode's counsel determines one is needed beyond what's already
+in `docs/STUDENT_GUARDIAN_DATA_MODEL.md`. A media release is optional — RootNode's own choice,
+not decided here.
+
+## Gate 13 — Tax
+
+**TAX DECISION REQUIRED.** No deliberate Mississippi (or any jurisdiction's) tax treatment has
+been configured anywhere in this codebase — `payment_transactions.amount` is charged exactly as
+the offering's own price, with no tax line item, no tax calculation, and no tax remittance logic
+anywhere (Phase 9's own explicit "no complex tax automation" scope boundary, unchanged). This is
+not this phase's decision to make, and the current absence of tax handling should not be read as
+an implicit "no tax owed" determination — that requires Chase (or a professional) to actually
+decide, then tell the platform what to do (charge tax as a line item, treat the $399 as
+tax-inclusive, or confirm no sales tax applies to this specific service in this jurisdiction).
+
+## Gate 14 — Refund / cancellation policy
+
+**LAUNCH BLOCKED — REFUND/CANCELLATION POLICY REQUIRED.** The platform's MECHANICAL behavior is
+real, tested, and proven against actual Stripe money-movement in Phase 9.1: a refund is recorded
+as its own tracked state and **never automatically** cancels the registration or revokes academic
+enrollment — confirmed directly against the database after a real Stripe TEST refund. What is
+still missing is the actual customer-facing POLICY text (how many days before the camp is a
+refund allowed, is it full or partial, etc.) — a founder decision this phase does not invent.
+
+## Gate 19 — Complete regression
+
+Fresh stack, this phase, after confirming canonical baseline (Gate 1):
+
+| Suite | Result |
+|---|---|
+| `e2e-phase5b.js` | 32/32 |
+| `e2e-phase5c.js` | 29/29 |
+| `e2e-phase6f.js` | 17/17 |
+| `e2e-phase7.js` | 17/17 |
+| `e2e-phase8.js` | 16/16 |
+| `e2e-phase9.js` | 20/20 |
+| Course-content validator | PASS, 0 errors |
+| Migration idempotency | Confirmed both ways — a full `down -v`/`up` cycle applies all 37 migrations cleanly from empty, and a same-database container restart re-applies with zero errors |
+| Frontend production build | Clean (only the pre-existing chunk-size advisory) |
+| `tofu validate` (Terraform/OpenTofu) | Clean |
+| `ansible-playbook --syntax-check` | Clean |
+
+**131 automated checks, 0 failures.** No code changed this phase (Phase 10 is audit/launch-prep,
+not feature work), so this is confirmation, not new coverage.
+
+`platform/test/stripe-integration-test.js` (the Phase 9.1 opt-in real-Stripe check) was **not**
+rerun this phase — it requires real Stripe TEST credentials, which currently have no durable home
+(Gate 3's Infisical project doesn't exist yet) and were correctly unset from the local `.env`
+after Phase 9.1 ended. Phase 9.1's own evidence (`docs/PHASE9_1_STRIPE_TEST_VALIDATION.md`)
+stands as the real-Stripe proof; nothing in this phase's own code changes touches that path.
+
+## Gate 20 — Pre-launch dress rehearsal
+
+`infra/scripts/drills/test-phase9-winter-camp-commerce.js` rerun fresh this phase against
+current `main`: **13/13** — website registration → guardian → agreement → checkout → webhook →
+enrollment → activation → classroom → a real disposable Lab task → instructor visibility, plus
+failed-payment/duplicate-webhook/abandoned-checkout/last-seat-race, all using the deterministic
+test provider (no real money, as instructed). This is the closest possible complete rehearsal
+without real production infrastructure or real dates/venue/capacity — it cannot be run against
+the ACTUAL Winter Break offering because that offering cannot legitimately open registration yet
+(Gate 11). No fake evidence was created for the steps genuinely blocked by unresolved business
+decisions.
+
+## Final launch matrix
+
+Phase 10.1 adds a **Category** column distinguishing four kinds of non-complete gate, since
+they need entirely different people to resolve them: **TECHNICAL READY** (code/infra is done,
+nothing left to build), **OWNER DECISION REQUIRED** (Chase has to decide something, no code
+involved), **EXTERNAL BLOCKER** (a third party — Stripe, an attorney, a landlord — has to act or
+verify something), **HARDWARE BLOCKER** (specifically the missing production server, since it
+gates so many other rows).
+
+| Gate | Status | Category | Evidence | Owner action | Blocks registration? |
+|---|---|---|---|---|---|
+| 1. Canonical repo reconciled | ✅ COMPLETE | — | `docs/PHASE10_CANONICAL_STATE_AUDIT.md` | None | No |
+| 2. Second-PC state reconciled | ⚠️ Pending verification | OWNER DECISION REQUIRED | Gitea shows no stranded work; PC #2 itself unverified from here; the real Phase 9.5 pricing doc is confirmed to live there, unpushed | Run §1.3's commands on PC #2, then push the real Phase 9.5 document | No (informational) |
+| 3. Secrets centralized (Infisical) | 🔧 One access grant away | OWNER DECISION REQUIRED | `docs/SECRETS_AND_INFISICAL.md` — project exists per Chase, this identity lacks access to it | Grant `claude-code-migration` access to the existing RootNode Academy project | No (dev secrets already safe locally) |
+| 4. Production server | ⛔ BLOCKED | HARDWARE BLOCKER | `docs/PHASE10_PRODUCTION_DEPLOYMENT.md` | Purchase/provision hardware | **Yes** |
+| 5. Proxmox / VMs | ⛔ BLOCKED | HARDWARE BLOCKER | Same — no host to provision on | Same | **Yes** |
+| 6. Firewall/isolation | ✅ COMPLETE (code) | TECHNICAL READY | `docs/PHASE10_SECURITY_AUDIT.md` | None until real host exists | No (code ready) |
+| 7. Production database | ⛔ BLOCKED | HARDWARE BLOCKER | Same hardware blocker | Same | **Yes** |
+| 8. DNS | ✅ PARTIAL | HARDWARE BLOCKER (API portion) | `rootnodeacademy.com` live; no Platform API subdomain yet | Decide/create the API subdomain once a server exists | **Yes**, for the API portion |
+| 9. HTTPS | ✅ PARTIAL | HARDWARE BLOCKER (API portion) | Website real HTTPS; Platform API HTTPS pending a real host | Same as above | **Yes**, for the API portion |
+| 10. Monitoring | ✅ COMPLETE (code) | TECHNICAL READY | `/healthz`/`/metrics` live in every test run | None until deployed | No |
+| 11. Backups | ✅ COMPLETE (code), ⛔ unexecuted | HARDWARE BLOCKER (execution) | Ansible `backup` role exists, never run | Run once a real host exists | **Yes** (restore-test) |
+| 12. Restore test | ⛔ BLOCKED | HARDWARE BLOCKER | Never executed — no target | Same | **Yes** |
+| 13. Stripe TEST validation | ✅ COMPLETE | — | `docs/PHASE9_1_STRIPE_TEST_VALIDATION.md` | None | No |
+| 14. Stripe LIVE configuration | ⛔ BLOCKED | EXTERNAL BLOCKER | Not configured, not attempted | Chase completes Stripe business/identity verification, provides LIVE credentials | **Yes** |
+| 15. Live webhook configuration | ⛔ BLOCKED | EXTERNAL + HARDWARE BLOCKER | Depends on #14 and a real HTTPS endpoint (#9) | Same | **Yes** |
+| 16. Google Workspace | ✅ COMPLETE (validated in Phase 5C) | TECHNICAL READY | `docs/RUNBOOK_GOOGLE_WORKSPACE_EMAIL.md` | Deploy alongside the real server | No (already proven) |
+| 17. Website integration | ✅ COMPLETE, both sides | — | Contract tested end to end; website-side registration/checkout flow now built and verified (see Gate 10 above) | None | No |
+| 18. Winter Break price | ✅ COMPLETE | — | $399/$449, real, Stripe-validated, confirmed current with Chase (the live website's own pricing is stale — see `docs/PHASE10_CANONICAL_STATE_AUDIT.md`) | None (website update is separate, not-RootNode-owned repo work) | No |
+| 19. Winter Break dates | ⚠️ DECISION REQUIRED | OWNER DECISION REQUIRED | Not decided | Chase decides | **Yes** |
+| 20. Venue | ⚠️ DECISION REQUIRED | OWNER DECISION REQUIRED | Not decided | Chase decides | **Yes** |
+| 21. Capacity | ⚠️ DECISION REQUIRED | OWNER DECISION REQUIRED | Not decided | Chase decides | **Yes** |
+| 22. Agreements (legal text) | ⛔ BLOCKED | EXTERNAL BLOCKER | Placeholder only | Attorney-approved text required | **Yes** |
+| 23. Refund/cancellation policy | ⚠️ DECISION REQUIRED | OWNER DECISION REQUIRED | Mechanism proven, policy undecided | Chase decides | **Yes** |
+| 24. Tax decision | ⚠️ DECISION REQUIRED | OWNER DECISION REQUIRED / EXTERNAL | Not configured | Chase/professional decides | **Yes** |
+| 25. Production offering | ⛔ BLOCKED | OWNER DECISION REQUIRED (compound) | Cannot legitimately open — depends on #19-24 | Depends on all of the above | **Yes** |
+| 26. Instructor assignment | 🔧 MANUAL OWNER ACTION | OWNER DECISION REQUIRED | Mechanism ready (`instructor_offerings`) | Chase assigns once the real offering exists | **Yes** |
+| 27. Roster process | ✅ COMPLETE (mechanism) | TECHNICAL READY | Rehearsed in Gate 20 | None | No |
+| 28. Student activation | ✅ COMPLETE | TECHNICAL READY | Proven real, twice (Phase 9.1 + Gate 20) | None | No |
+| 29. Lab capacity | ✅ COMPLETE (code) | HARDWARE BLOCKER (real sizing) | Capacity/race logic proven; real server capacity planning needs #4 | Plan once real hardware specs are known | No (mechanism), **yes** (real capacity) |
+| 30. Complete dress rehearsal | ✅ COMPLETE (deterministic) | TECHNICAL READY | Gate 20, 13/13 | Repeat against the real offering once it can legitimately open | No |
+
+## Bottom line
+
+## PHASE 10 PARTIAL / WINTER BREAK LAUNCH BLOCKED
+
+Every gate that is genuinely software/audit work is complete and verified. Every gate that is a
+real business, legal, tax, or hardware decision remains exactly that — a decision, not
+something this phase invented on Chase's behalf. See `docs/WINTER_BREAK_LAUNCH_CHECKLIST.md` for
+the single consolidated, categorized checklist Chase can work down.

docs/PHASE10_PRODUCTION_DEPLOYMENT.md

@@ -0,0 +1,90 @@
+# Phase 10 — Production Deployment
+
+Gates 4-9, 15-16. Covers production infrastructure, network security, DNS/HTTPS, database
+productionization, Stripe LIVE configuration, Google Workspace production email, observability,
+and backups/restore.
+
+## Hardware status — PRODUCTION DEPLOYMENT BLOCKED — SERVER REQUIRED
+
+Verified, not assumed: `infra/terraform/` has no real `terraform.tfvars` (only
+`terraform.tfvars.example`) and no `.tfstate` file anywhere in the repo or working tree —
+`tofu apply` has never been run against real infrastructure. `infra/ansible/group_vars/
+production.yml` still holds literal, unfilled placeholders: `platform_ip:
+__PLATFORM_VM_IP__`, `lab_host_ip: __LAB_HOST_VM_IP__`, `proxmox_mgmt_cidr:
+__PROXMOX_HOST_MGMT_CIDR__`. No SSH config, known-hosts entry, or inventory file on this
+workstation references a real `rn-platform-01`/`rn-lab-host-01`/Proxmox host.
+
+**The dedicated RootNode Academy production server has not been purchased or provisioned.**
+Per Phase 10's own explicit instruction, this phase does not fake a production deployment
+against placeholder infrastructure. Everything below is preparation, validation, and rehearsal —
+genuinely useful the moment real hardware exists, but none of it is a live deployment.
+
+## What WAS done this phase (all safe, all pre-hardware)
+
+- **Gate 4 — IaC validated**: `tofu validate` (OpenTofu, the Terraform-compatible tool actually
+  installed) passes cleanly against `infra/terraform/`'s existing Proxmox provider config — no
+  redesign, the existing config is syntactically sound and ready for real `terraform.tfvars`.
+  `ansible-playbook site.yml --syntax-check -i inventory` passes cleanly against `infra/
+  ansible/`'s existing `site.yml` and its `firewall`/`docker-tls`/`platform`/`lab-host`/
+  `monitoring-agent`/`backup`/`common` roles (all present from Phase 4/4.1, unmodified).
+- **Gate 5 — network security architecture reviewed, unchanged**: RFC1918 egress
+  denial/allowlisting present in `platform/provisioner/src/egress.js`/`lifecycle.js` (Provisioner
+  owns lab-container network policy); mTLS wiring present in `infra/ansible/roles/docker-tls/`
+  and referenced by `gateway.env.j2`; the `firewall` Ansible role exists for both host tiers. All
+  of this is existing Phase 4/4.1 work, re-confirmed present and un-redesigned — none of it can
+  be verified AGAINST a real host without one existing.
+- **Gate 6 — DNS/HTTPS audited (read-only)**: `rootnodeacademy.com` **is already live** —
+  resolves via Cloudflare (`172.67.141.39`, `104.21.38.247`), serves a real HTTPS site (`HTTP/2
+  200`, Next.js application headers), and its mail is already routed to Google
+  (`smtp.google.com`), consistent with the existing `[email protected]` Google
+  Workspace setup. This is the separate, not-RootNode-owned marketing website (`docs/
+  WEBSITE_REGISTRATION_AND_CHECKOUT.md`'s explicit boundary) — nothing here was touched, and no
+  DNS record was added or changed. **No subdomain or DNS record exists yet for the Platform API
+  itself** (e.g. `api.rootnodeacademy.com` or similar) — that's the piece blocked on real
+  server hardware.
+- **Gate 7 — database productionization reviewed**: migrations (37, through Phase 9) verified
+  idempotent again this phase (a fresh `down -v`/`up` cycle and a same-database container
+  restart both apply/re-apply cleanly with zero errors — see `docs/
+  PHASE10_LAUNCH_READINESS.md`'s regression section). The Ansible `platform` role's
+  `postgres.env.j2`/`.template` already model least-privilege connection strings
+  (`rootnode_platform` app user, not a superuser). No student records of any kind exist to
+  accidentally copy into a production database — this dev/test Postgres only ever holds
+  disposable test fixtures, all cleaned up after each rehearsal.
+- **Gate 8 — Stripe LIVE**: explicitly **not configured, not attempted**. See "Stripe LIVE
+  status" below.
+- **Gate 9 — Google Workspace**: `GOOGLE_SERVICE_ACCOUNT_JSON`/`GOOGLE_DELEGATED_USER` already
+  exist as real, previously-validated local values (Phase 5C's own `docs/
+  RUNBOOK_GOOGLE_WORKSPACE_EMAIL.md` documents that validation) — `[email protected]`,
+  `gmail.send` scope only, domain-wide delegation. Not re-sent this phase (no new test email was
+  needed to confirm what Phase 5C already proved, and Phase 10 explicitly says not to make GWS a
+  blocker for Stripe/launch work). Production DEPLOYMENT of this config is blocked on the same
+  missing server as everything else.
+- **Gates 15/16 — observability and backups reviewed, unchanged**: `/healthz` (Platform API,
+  Gateway, Provisioner) and `/metrics` (Prometheus text exposition, low-cardinality labels only —
+  reconfirmed by this phase's own audit in `docs/PHASE10_SECURITY_AUDIT.md`) already exist and
+  were exercised repeatedly by every regression suite rerun this phase. The `monitoring-agent`
+  and `backup` Ansible roles exist (`infra/ansible/roles/monitoring-agent/`, `.../backup/`,
+  including a templated `run-backup.sh.j2`) — built in Phase 4, never yet run against a real
+  host. **A restore has never been tested against real infrastructure, because none exists** —
+  this phase cannot manufacture that proof; it is not sufficient for launch per Phase 10's own
+  "a backup that has never been restore-tested is not sufficient" rule, and is listed as a real
+  blocker in the launch checklist, not glossed over.
+
+## Stripe LIVE status
+
+**Not configured.** No live Stripe credential was provided to this session, and this phase did
+not request one — activating Stripe live mode requires Chase's own Stripe account
+business/identity verification (a real KYC-style process only Chase can complete), which is an
+explicit Phase 10 STOP condition ("identity verification requires Chase"). Phase 9.1's real
+TEST-mode validation (`docs/PHASE9_1_STRIPE_TEST_VALIDATION.md`) remains the full proof of the
+application-layer correctness; going live only needs Chase's real credentials plugged into the
+same, already-proven code path — see `docs/STRIPE_INTEGRATION_RUNBOOK.md`'s "Going live"
+section, unchanged by this phase.
+
+## Bottom line
+
+**PRODUCTION DEPLOYMENT BLOCKED — SERVER REQUIRED.** Every gate that depends on real hardware
+(4, 5's live verification, 6's platform subdomain, 7's live database, 8, 9's live deployment, 15,
+16) is prepared, validated, and ready to execute the moment `rn-platform-01`/`rn-lab-host-01`
+exist on real Proxmox hardware and `terraform.tfvars`/`group_vars/production.yml` are filled
+with real values — none of it requires new code or a redesign.

docs/PHASE10_SECURITY_AUDIT.md

@@ -0,0 +1,44 @@
+# Phase 10 — Security Audit
+
+Gate 18. A production-oriented review of RootNode Academy's security posture, drawing on every
+regression suite rerun this phase (`docs/PHASE10_LAUNCH_READINESS.md`) plus direct code review.
+No genuine launch-critical defect was found this phase — the one real defect Phase 10's
+predecessor phases exposed (Phase 9.1's webhook-correlation bug) was already fixed and
+regression-tested before this phase began.
+
+| Area | Status | Evidence |
+|---|---|---|
+| Student authentication | ✅ Verified | `e2e-phase5b.js`/`e2e-phase5c.js` rerun clean this phase — activation, single-use tokens, expiration, password reset with anti-enumeration, session revocation on reset. |
+| Instructor authentication | ✅ Verified | Same suites — instructor login, RBAC roles (owner/admin/instructor). |
+| Sessions | ✅ Verified | Persistent, server-controlled sessions (Phase 3A); a real Platform API restart preserves sessions/enrollment state (rerun clean this phase). |
+| Password reset / activation | ✅ Verified | Single-use, server-side expiration, no plaintext token ever returned by any admin API (`toAdminView` never includes it). |
+| RBAC | ✅ Verified | Admin/owner-only routes (guardian detail, payment data) vs. any-instructor routes (offering/location lists) — reconfirmed across Phase 7/8/9 suites this phase. |
+| Cohort scoping | ✅ Verified | An instructor sharing a cohort can manage; an unrelated instructor cannot (Phase 5B/7 suites). |
+| CSRF | ✅ Present, unchanged | `platform/api/src/security.js` + per-route session/cookie checks (student/instructor auth routes) — not modified this phase, no regression. |
+| Rate limiting / lockout | ✅ Present, unchanged | Login-attempt tracking in `security.js` (matches the existing sweeper pattern also used for session expiry). |
+| Audit logging | ✅ Verified | Every admin/integration action recorded; audit-hygiene test (no secrets/PII in audit metadata) rerun clean in `e2e-phase9.js`. |
+| Server-authoritative pricing | ✅ Verified, real Stripe | Phase 9.1 proved a tampered caller amount is ignored against **Stripe's own recorded object**, not just RootNode's database. |
+| Agreement enforcement | ✅ Verified | Checkout blocked (`409`) until acceptance, in both the deterministic suite and real Stripe TEST mode. |
+| Capacity enforcement | ✅ Verified | Race-safe seat reservation (`reserved_seats < capacity` in one UPDATE) — last-seat race test rerun clean this phase. |
+| No card-data storage | ✅ Verified | `payment_transactions` schema has no card fields; explicit admin-view test asserts none appear; Stripe's hosted Checkout is the only thing that ever sees a real card. |
+| Webhook signature verification | ✅ Verified, real Stripe | Invalid/forged signatures rejected (both deterministic and real-Stripe-signed tests); idempotent via a real DB primary key on the provider's event id, reconfirmed with a genuinely re-signed real Stripe event in Phase 9.1. |
+| Logging/audit redaction | ✅ Verified | This session's own Stripe secret/webhook-secret values were grepped across every log/scratch file produced — none found; `e2e-phase9.js`'s hygiene test asserts no `sk_`/`whsec_`/card-number pattern in audit metadata or metrics text. |
+| Secrets never committed | ✅ Verified | Full-history pickaxe search this phase — clean (`docs/PHASE10_CANONICAL_STATE_AUDIT.md` §1.6). |
+| mTLS (Provisioner ↔ Docker, Gateway ↔ Lab Host Router) | ✅ Present, unchanged, not re-verified live | Ansible `docker-tls` role and TLS env vars exist; cannot be exercised against a real mTLS handshake without real hardware (Gate 4/5's hardware blocker). |
+| Privileged lab boundary / RFC1918 egress denial | ✅ Present, unchanged | `provisioner/src/egress.js`; this phase reconfirmed the module exists and is wired, did not re-run Phase 1/2's own dedicated isolation drills (out of this phase's changed-code scope — nothing touched networking code). |
+| Production cookie settings (`COOKIE_SECURE`) | ✅ Present, verified pattern | `e2e-phase5c.js`'s own test explicitly proves `COOKIE_SECURE=1` production gating via a real container recreate — reconfirmed present, not re-executed as a fresh drill this phase since nothing in that code path changed. |
+| HTTPS end-to-end | ⏸ Cannot verify — no production host | `COOKIE_SECURE=1`/`TRUST_PROXY=1` require a real HTTPS-terminating reverse proxy in front of a real Gateway, which doesn't exist yet (Gate 4-6's hardware blocker). The marketing site at `rootnodeacademy.com` IS real HTTPS (Cloudflare) — the Platform API itself has no production endpoint yet. |
+
+## Findings requiring action
+
+**None launch-critical within existing architecture.** Everything marked ⏸ above is blocked on
+the same missing production server documented in `docs/PHASE10_PRODUCTION_DEPLOYMENT.md` — not
+a code defect, and building around it (e.g. faking an HTTPS check) would violate this phase's
+own "do not fake production readiness" instruction.
+
+## Scope discipline
+
+This audit reviewed and reconfirmed existing security properties; it did not expand into new
+security tooling, new scanning infrastructure, or unrelated hardening work not already part of
+Phase 1-9's architecture, per Phase 10's own "do not expand into unrelated feature work"
+instruction.

docs/ROOTNODE_PRICING_AND_OFFERS_V1.md

@@ -0,0 +1,72 @@
+# RootNode Academy Pricing Matrix V1
+
+> **FOUNDER APPROVED — LOCKED FOR V1**
+
+This document is the canonical V1 pricing decision for RootNode Academy. It was recovered from
+the synced RootNode Academy conversation after the original Phase 9.5 work was found to be
+absent from canonical Git history.
+
+Prices below are in USD. A founding or early-bird price is a defined offer price, not a range.
+
+## Seasonal camps
+
+| Offering | Standard price | Launch price |
+|---|---:|---:|
+| Winter Break Camp | $449 | $399 — Founding Cohort |
+| Summer Camp | $499 | $449 — Early Bird |
+| Spring Break Camp | $449 | $399 — Early Bird |
+
+## Instructor-led programs
+
+| Offering | Standard price | Founding price |
+|---|---:|---:|
+| INIT_ Instructor-Led | $249 | $199 |
+| COMPILE_ Instructor-Led | $399 | $349 |
+| ROOT_ Foundations | $699 | $599 |
+| ROOT_ Kubernetes Core | $799 | $699 |
+| ROOT_ Operate & Secure | $899 | $799 |
+
+## Self-paced
+
+| Offering | Price | Access model |
+|---|---:|---|
+| ROOT_ Self-Paced | $299 | V1 one-time access |
+
+No recurring subscription is approved or implemented for V1.
+
+## Mentoring and workshops
+
+| Offering | Price |
+|---|---:|
+| 1:1 Technical Mentoring — single hour | $100 |
+| 1:1 Technical Mentoring — four-hour package | $360 |
+| 1:1 Technical Mentoring — eight-hour package | $680 |
+| Technical Workshop | $149–$299 framework; price set per workshop |
+| School & Community Program | Custom quote |
+
+The Technical Workshop range is an approved pricing framework, not one universal fixed price.
+
+## Sibling policy
+
+Each additional sibling receives 10% off tuition. This policy does not authorize or require a
+promotion engine in V1.
+
+## Winter Break Camp launch terms
+
+- Commercial label: **Founding Cohort**
+- Launch tuition: **$399 USD**
+- Application representation: **39900 USD cents**
+- Standard/reference tuition: **$449 USD** (`44900` cents)
+- Payment: paid in full
+- No deposit
+- No payment plan
+
+Pricing approval does not resolve or authorize dates, venue, capacity, tax treatment,
+refund/cancellation policy, or legal agreement language. Those remain separate launch gates.
+
+## Implementation authority
+
+RootNode's application remains authoritative for offerings, eligibility, registration, and the
+server-side amount sent to Stripe. Stripe executes and records payment; it is not the canonical
+RootNode product catalog.
+

docs/SECRETS_AND_INFISICAL.md

@@ -0,0 +1,104 @@
+# Secrets & Infisical
+
+Gate 3. The full, real secret inventory — derived by grepping every `process.env.*` reference
+across `platform/api/src`, `platform/gateway/src`, `platform/provisioner/src`, and
+`platform/lab-router/src` (not guessed, not copied from a template list) — and the current
+status of centralizing it in Infisical. **This document never contains a secret value.**
+
+## Infisical project status — action required
+
+Chase's self-hosted instance is `infisical.cedshomelab.com` (confirmed reachable, confirmed NOT
+`app.infisical.com` — the earlier Phase 9.1 attempt failed for exactly this reason: the existing
+machine identity is valid for the self-hosted instance only). Authenticated successfully this
+phase using the machine identity at `~/.config/infisical/identity.env`
+(`universal-auth`, org "Ceds HomeLab").
+
+**Update, Phase 10.1**: Chase confirmed a "RootNode Academy" project already exists on this
+instance. Re-investigated with a proper API call rather than trusting the CLI's interactive
+picker alone — `GET /api/v2/organizations/{orgId}/workspaces` (the same authenticated identity,
+a direct, complete enumeration, not a scrollable TUI) returns **8** projects visible to this
+identity: Core Infrastructure, Kubernetes, Media Platform, Monitoring, Network Service,
+Privileged Access Manager, Storage, Synthos Systems. (Two more than Phase 10's original 6-project
+CLI capture, and with different membership — the CLI capture was evidently incomplete, not just
+under-scrolled; "Hermes Fleet," which appeared in the CLI list, doesn't appear in this
+authoritative API list at all.) **Still no "RootNode Academy" entry, under this identity.**
+
+**Root cause, narrowed**: an identity's own workspace list in Infisical reflects only the
+projects it has been explicitly granted access to (a per-project ACL, separate from org
+membership) — an org owner's dashboard view would show every project in the org regardless of
+any one identity's grants. The most likely explanation is that the project exists, created by
+Chase, but the `claude-code-migration` machine identity was never added to its access list —
+not that the project doesn't exist. This session cannot tell the two apart without either
+org-owner API scope or the web dashboard, neither available here. **No duplicate project was
+created**, per Phase 10.1's explicit instruction.
+
+**Owner action required — the fix, precisely:** in the Infisical dashboard
+(`https://infisical.cedshomelab.com`), open the RootNode Academy project → **Project Settings →
+Access → Machine Identities**, and add `claude-code-migration` (identity id
+`f3b42de1-11b6-4aa1-8f2e-7b85accec5fb`) with read/write access to whichever environments should
+be automatable. Once granted, a future session can list/read/write its secrets directly — no
+further CLI/API workaround needed. Until then, every secret continues to live only in local,
+gitignored `.env` files (development) — see `docs/PHASE10_PRODUCTION_DEPLOYMENT.md` for
+staging/production status.
+
+## Secret inventory (real, from code — not from this prompt's guessed category list)
+
+Every environment variable the application code actually reads, categorized. "Secret" = must
+never appear in git, logs, or a browser; "Config" = fine to template/document in plain text
+(already handled by `infra/environments/*/*.env.template`, unchanged by this phase).
+
+| Variable | Category | Purpose | Consuming service | Environments | Rotation |
+|---|---|---|---|---|---|
+| `PLATFORM_DB_URL` | **Secret** (contains DB password) | Postgres connection string | Platform API | Dev/Staging/Prod (per-env DB, never shared) | On suspected compromise; routine rotation not yet scheduled |
+| `PROVISIONER_SHARED_SECRET` | **Secret** | Platform API ↔ Provisioner trust boundary (`X-Provisioner-Key`) | Platform API, Provisioner | Dev/Staging/Prod (distinct per env) | On suspected compromise |
+| `INTEGRATION_SHARED_SECRET` | **Secret** | Website backend ↔ Platform API trust boundary (`X-RootNode-Integration-Key`) | Platform API, website's backend (external) | Dev/Staging/Prod | On suspected compromise; the website team needs the current value out-of-band |
+| `GOOGLE_SERVICE_ACCOUNT_JSON` | **Secret** | Full GWS service-account credential (Gmail API, domain-wide delegation) | Platform API (`email/gws-provider.js`) | Prod only (dev/staging use the deterministic dev provider by default) | Per Google Cloud's own service-account key rotation practice |
+| `GOOGLE_DELEGATED_USER` | Config (an email address, not a secret) | Which real mailbox the service account impersonates via domain-wide delegation | Platform API | Prod | N/A |
+| `EMAIL_FROM_ADDRESS` / `EMAIL_FROM_NAME` / `EMAIL_REPLY_TO` | Config | Sender identity — `[email protected]` | Platform API | All | N/A |
+| `STRIPE_SECRET_KEY` | **Secret** | Stripe API authentication (checkout creation, refunds, retrieval) | Platform API (`payment-provider.js`) | Dev/Staging = TEST key; Production = LIVE key — **never mixed**, see Gate 8 status below | Per Stripe's own key-rotation guidance; rotate immediately if ever exposed |
+| `STRIPE_WEBHOOK_SECRET` | **Secret** | Verifies a webhook delivery actually came from Stripe | Platform API (`webhook-routes.js`) | One per registered webhook endpoint (TEST vs. LIVE endpoints each have their own) | Regenerates automatically if the endpoint is recreated |
+| `TEST_PAYMENT_WEBHOOK_SECRET` | Low-sensitivity (dev-only, never real money) | Shared secret for the deterministic `TestProvider`'s fake webhook signature | Platform API | Dev/test only | N/A |
+| `LAB_ROUTER_TLS_KEY` | **Secret** | Lab Host Router's mTLS private key | Lab Host Router | Staging/Prod (dev uses a self-signed pair generated locally) | Per the mTLS cert lifecycle already documented in Phase 4.1 |
+| `LAB_ROUTER_TLS_CERT` / `LAB_ROUTER_TLS_CA` | Sensitive but not strictly secret (public cert material) | mTLS certificate/CA chain | Lab Host Router, Gateway | Staging/Prod | Same lifecycle as the key above |
+| `PLATFORM_DB_URL`'s host component, ports, timeouts, session TTLs, `PAYMENT_PROVIDER`, `COOKIE_SECURE`, `TRUST_PROXY`, `PUBLIC_APP_ORIGIN`, `DNS_RESOLVER`, `NO_PROXY_CIDRS`, etc. | Config | Plain operational configuration | Various | All, per-environment values | N/A |
+
+Every "Config" row is already handled the existing way — plain values in `infra/environments/
+*/*.env.template` (checked into git, safe) or `docker-compose.dev.yml`'s `${VAR:-default}`
+substitutions. Only the "Secret" rows above need an Infisical home.
+
+## Environment separation (Stripe — the one category with real launch consequences)
+
+- **Development/Staging**: `STRIPE_SECRET_KEY`/`STRIPE_WEBHOOK_SECRET` must be **TEST** values
+  only (`sk_test_...`/a `stripe listen`-issued or TEST-mode dashboard `whsec_...`). This is what
+  Phase 9.1 validated end to end.
+- **Production**: `STRIPE_SECRET_KEY`/`STRIPE_WEBHOOK_SECRET` must be **LIVE** values
+  (`sk_live_...`, and a permanent LIVE-mode dashboard webhook endpoint's own signing secret).
+  **Not configured — Chase has not provided live Stripe credentials, and this phase did not ask
+  for or receive them** (per Phase 10's own stop condition: "real money could move" /
+  "identity verification requires Chase" — live Stripe activation requires Chase's own Stripe
+  business/identity verification, not something this session can do on his behalf). See `docs/
+  PHASE10_LAUNCH_READINESS.md` Gate 8 status.
+
+## Secret hygiene performed this phase
+
+- Confirmed (again, freshly) that no real secret value has ever entered git history (`docs/
+  PHASE10_CANONICAL_STATE_AUDIT.md` §1.6).
+- Confirmed `platform/.env`'s Stripe fields are correctly blank (not left set from Phase 9.1's
+  validation session) — matches this repo's own "unset after a deliberate session" convention.
+- **Not yet performed** (blocked on the missing Infisical project): migrating any real secret
+  value out of local `.env` files and into Infisical. Per this phase's own instruction, a local
+  credential is never deleted until its Infisical replacement is verified — nothing was deleted.
+
+## What Chase needs to do
+
+1. In the existing "RootNode Academy" project's **Project Settings → Access → Machine
+   Identities**, add `claude-code-migration` (id `f3b42de1-11b6-4aa1-8f2e-7b85accec5fb`) with
+   read/write access to whichever environments should be automatable. **Do not create a second
+   project** — this one-line access grant is the fix, per Phase 10.1's investigation.
+2. Confirm the project's environment names (Phase 10.1 could not see them without access) —
+   reuse whatever exists rather than renaming to force a Development/Staging/Production match,
+   per this repo's own "existing structure wins" instruction.
+3. Once access is granted, a future session can populate every "Secret" row above from the
+   current local `platform/.env`/`platform/provisioner/.env` values for Development, and Chase
+   provides the real Staging/Production values (Stripe LIVE keys especially) directly when ready
+   for those environments — never invented or guessed by this phase.

docs/WINTER_BREAK_CAMP_OPERATIONS.md

@@ -83,7 +83,10 @@ flow — see `docs/PHASE9_COMMERCE_AND_LAUNCH.md` and `docs/WINTER_BREAK_LAUNCH_
   STUDENT_GUARDIAN_DATA_MODEL.md`).
 - Real Stripe credentials do not exist yet — the commerce pipeline is built and tested against
   the deterministic test provider only; see `docs/STRIPE_INTEGRATION_RUNBOOK.md` for going live.
-- The website's own registration/checkout UI does not exist yet in this repository
-  (rootnodeacademy.com is built separately) — the integration contract it needs is ready
-  (`docs/WEBSITE_REGISTRATION_AND_CHECKOUT.md`), but nobody has built the website-side form yet.
+- The website's own registration/checkout UI is now built (rootnodeacademy.com, a separate
+  repository not owned by this one) against `docs/WEBSITE_REGISTRATION_AND_CHECKOUT.md`'s
+  contract — but it has nothing to talk to yet, since `ROOTNODE_API_URL`/
+  `ROOTNODE_INTEGRATION_KEY` point at no real Platform API (none is deployed — see `docs/
+  PHASE10_PRODUCTION_DEPLOYMENT.md`). Its own real pricing (`docs/
+  ROOTNODE_PRICING_AND_OFFERS_V1.md`) has already been published on the live site.
 - See `docs/WINTER_BREAK_LAUNCH_CHECKLIST.md` for the full go/no-go list.

docs/WINTER_BREAK_LAUNCH_CHECKLIST.md

@@ -1,89 +1,111 @@
 # Winter Break Camp — Launch Checklist
 
 The single go/no-go list for opening the Winter Break Linux & Systems Foundations Camp
-(`docs/WINTER_BREAK_CAMP_CURRICULUM_OPTIONS.md` Option A) to real public registration. Combines
-`docs/WINTER_BREAK_CAMP_OPERATIONS.md`'s operational sequence with Phase 9's commerce
-requirements into one checklist Chase can walk top to bottom. Nothing on this list is invented by
-the platform — every unchecked item is a real decision or asset that has to come from Chase, the
-legal reviewer, or Stripe, not from more code.
+(`docs/WINTER_BREAK_CAMP_CURRICULUM_OPTIONS.md` Option A) to real public registration. Every
+item is tagged **COMPLETE**, **BLOCKED**, **DECISION REQUIRED**, or **MANUAL OWNER ACTION** —
+see `docs/PHASE10_LAUNCH_READINESS.md` for the full evidence matrix behind each tag. Nothing on
+this list is invented by the platform — every non-COMPLETE item is a real decision, asset, or
+piece of hardware that has to come from Chase, a legal reviewer, or Stripe, not from more code.
 
-## Platform readiness — done, verified, ready whenever the business inputs below land
-
-- [x] Offering, capacity, registration lifecycle, agreements — built and tested (Phase 7/8).
-- [x] Offering pricing field, payment-provider abstraction, hosted checkout, verified webhook,
-      refund recording, abandoned-reservation reaper — built and tested against the deterministic
-      test provider (Phase 9).
-- [x] Website registration + checkout + agreement + status-lookup contract — documented and
-      tested (`docs/WEBSITE_REGISTRATION_AND_CHECKOUT.md`).
-- [x] Admin UI for offering pricing and per-registration payment/refund status.
-- [x] `GET /api/admin/offerings/:id/readiness` reflects real configuration state, including the
-      new `price` and `payment_provider` checks.
-- [x] Full Winter Break commerce rehearsal green end to end against a real, freshly-built stack
-      (`infra/scripts/drills/test-phase9-winter-camp-commerce.js`, 13/13): admin configuration,
-      minor and adult registration, checkout, payment success, webhook, enrollment activation, a
-      real classroom session, a real Lab task, failed payment, duplicate webhook, abandoned
-      checkout, and a last-seat race.
-
-## Business decisions — Chase's call, not invented by this phase
-
-- [ ] Real camp dates and duration.
-- [ ] Real venue/location (or confirm fully online/remote).
-- [ ] Real capacity (seat count).
-- [x] Price and currency — **$399.00 USD launch tuition ("Founding Cohort"), $449.00 standard
-      retail, paid in full, no deposit/payment plan** — founder-approved per Chase directly
-      (Phase 9.1). Validated against real Stripe TEST mode at this exact amount. Not yet
-      reflected in a committed pricing document in this canonical repo (referenced but not found
-      — see `docs/PHASE9_1_STRIPE_TEST_VALIDATION.md` §1/§33); set directly on the real Winter
-      Break offering via `PATCH /api/admin/offerings/:id` when ready to open registration.
-- [ ] Whether registration opens ahead of, or alongside, a specific marketing push.
-- [ ] Refund policy in plain terms (the platform can RECORD any refund decision; it does not
-      decide policy — see `docs/OFFERING_AND_REGISTRATION_MODEL.md`'s "Payment and the commerce
-      boundary" section for what "record, never auto-cascade" means operationally).
-
-## Legal review — required before any real family sees the agreement
-
-- [ ] The actual participation/media/liability agreement text, reviewed by a real attorney
-      (`agreement_definitions.body_summary` is currently a plain-language placeholder only — see
-      `docs/STUDENT_GUARDIAN_DATA_MODEL.md`'s legal-review list).
-- [ ] Jurisdiction-specific minor-consent requirements confirmed.
-- [ ] Data-retention/deletion policy decided and, if needed, reflected in the agreement text.
-- [ ] A decision on whether emergency-contact fields need additional encryption at rest.
-
-## Payments
-
-- [x] **Stripe TEST-mode validation** — a real Stripe TEST Checkout Session, a real TEST payment
-      at the actual $399.00 founding-cohort price, a genuine signed webhook, the existing
+- [x] **Canonical repo reconciled** — COMPLETE. `docs/PHASE10_CANONICAL_STATE_AUDIT.md`: this
+      workstation's HEAD, Gitea's `origin/main`, and every claimed milestone SHA all verified
+      consistent. No stranded branches/tags on the remote.
+- [ ] **Second-PC state reconciled** — DECISION REQUIRED (verification only, not a code
+      blocker). Gitea shows no evidence of stranded work, but this session cannot see the other
+      workstation directly — run the commands in `docs/PHASE10_CANONICAL_STATE_AUDIT.md` §1.3
+      there. **Confirmed with Chase (Phase 10.1): the real Phase 9.5 pricing document lives on
+      PC #2, unpushed** — bringing that to Gitea would also close this item.
+- [ ] **Secrets centralized (Infisical)** — MANUAL OWNER ACTION, one step. The "RootNode
+      Academy" project does exist (per Chase) — Phase 10.1's re-investigation (a proper API
+      enumeration, not just the CLI picker) found the `claude-code-migration` machine identity
+      simply isn't listed as having access to it. Grant it access via Project Settings → Access
+      → Machine Identities. See `docs/SECRETS_AND_INFISICAL.md` for the exact identity id and
+      the full secret inventory ready to migrate in once granted.
+- [ ] **Production server** — BLOCKED. Not purchased/provisioned — verified via empty
+      `terraform.tfvars`/no state file and placeholder `group_vars/production.yml`. See `docs/
+      PHASE10_PRODUCTION_DEPLOYMENT.md`.
+- [ ] **Production VMs (rn-platform-01 / rn-lab-host-01)** — BLOCKED. Depends on the server above.
+- [x] **Firewall/isolation (code)** — COMPLETE. `docs/PHASE10_SECURITY_AUDIT.md` — RFC1918
+      egress denial, mTLS wiring, firewall Ansible role all present and unchanged from Phase 4/
+      4.1; cannot be verified against a live host until one exists.
+- [ ] **Production database** — BLOCKED. Depends on the server above. Migrations themselves
+      reconfirmed idempotent this phase (37/37, both a fresh apply and a same-DB restart).
+- [x] **DNS (marketing site)** / [ ] **DNS (Platform API)** — PARTIAL. `rootnodeacademy.com` is
+      live and real (Cloudflare-fronted, confirmed this phase); no subdomain exists yet for the
+      Platform API itself — needs a real server first.
+- [x] **HTTPS (marketing site)** / [ ] **HTTPS (Platform API)** — PARTIAL, same split as DNS.
+- [x] **Monitoring (code)** — COMPLETE. `/healthz`/`/metrics` live and exercised in every
+      regression run this phase; deployment itself needs the production server.
+- [x] **Backups (code)** / [ ] **Backups (executed)** — PARTIAL. Ansible `backup` role exists,
+      never run against a real host.
+- [ ] **Restore test** — BLOCKED. Never executed — no target exists. A backup that has never
+      been restore-tested does not count as launch-ready.
+- [x] **Stripe TEST validation** — COMPLETE. A real Stripe TEST Checkout Session, a real TEST
+      payment at the actual $399.00 price, a genuine signed webhook, the existing
       registration→enrollment conversion, a real duplicate-delivery proof, a real automated
       abandoned-checkout proof, and a real refund with the non-cascade rule reconfirmed — all
-      proven end to end in Phase 9.1. One real defect (webhook-event correlation) was found and
-      fixed as a direct result. See `docs/PHASE9_1_STRIPE_TEST_VALIDATION.md` for the full
-      evidence and reconciliation IDs. **This is TEST mode only — it does not authorize or imply
-      LIVE-mode readiness**, see the unchecked items below.
-
-- [ ] Real Stripe account created/available (live mode).
-- [ ] `STRIPE_SECRET_KEY`/`STRIPE_WEBHOOK_SECRET` (live values) provisioned into production
-      configuration only — see `docs/STRIPE_INTEGRATION_RUNBOOK.md`'s "Going live" section.
-- [ ] At least one real, small, refundable test transaction run end to end in production before
-      opening registration publicly, then refunded.
-- [ ] Recommended (not required — the test provider already validates the application logic):
-      one full rehearsal against Stripe's own TEST mode (fake cards, no real money) before
-      flipping to live credentials, per `docs/STRIPE_INTEGRATION_RUNBOOK.md`'s test-mode section.
-
-## Website (separate repo, not RootNode-owned)
-
-- [ ] rootnodeacademy.com's own registration/checkout form built against
-      `docs/WEBSITE_REGISTRATION_AND_CHECKOUT.md`. Not tracked or built in this repository — if
-      that repo becomes available to RootNode's own engineering effort, say so explicitly before
-      any code changes are made against it.
-- [ ] The website's `INTEGRATION_SHARED_SECRET` provisioned into its OWN backend configuration
-      (never browser-reachable) — see `docs/WEBSITE_ENROLLMENT_INTEGRATION.md`'s "Production
-      secret handling."
-- [ ] The website's success page built against the status-lookup polling pattern in
-      `docs/WEBSITE_REGISTRATION_AND_CHECKOUT.md` §6 — never derived from the redirect URL alone.
+      proven end to end in Phase 9.1 (`docs/PHASE9_1_STRIPE_TEST_VALIDATION.md`). One real
+      defect (webhook-event correlation) was found and fixed as a direct result.
+- [ ] **Stripe LIVE configuration** — BLOCKED. Not configured, not attempted — requires Chase's
+      own Stripe account business/identity verification (only Chase can do this) plus real LIVE
+      credentials placed in Infisical (blocked on the missing project above), never invented or
+      substituted by this phase.
+- [ ] **Live webhook configuration** — BLOCKED. Depends on LIVE credentials and a real HTTPS
+      Platform API endpoint, neither of which exist yet.
+- [x] **Google Workspace** — COMPLETE. `[email protected]`, `gmail.send` scope,
+      domain-wide delegation — validated in Phase 5C (`docs/
+      RUNBOOK_GOOGLE_WORKSPACE_EMAIL.md`); deployment to production needs the real server.
+- [x] **Website integration** — COMPLETE, both sides. Full contract tested end to end on the
+      platform side, including against real Stripe. The website itself (a separate repository,
+      `ced4568/RootNode-academy-website` on GitHub — not this repo) now has the actual
+      registration/agreement/checkout/status flow built against that contract, and its own
+      pricing has been corrected to match `docs/ROOTNODE_PRICING_AND_OFFERS_V1.md`. It has
+      nothing to talk to yet — `ROOTNODE_API_URL`/`ROOTNODE_INTEGRATION_KEY` are unset until a
+      real Platform API exists (every route fails a clean 503, never a 500, in the meantime).
+- [x] **Winter Break price** — COMPLETE. **$399.00 launch ("Founding Cohort") / $449.00
+      standard reference, paid in full, no deposit, no payment plan** — founder-approved by
+      Chase directly, validated against real Stripe TEST mode at this exact amount, reconfirmed
+      current in Phase 10.1. Note: `rootnodeacademy.com` itself currently shows different,
+      stale founding-price RANGES (not this fixed figure) — Chase confirmed this repo's price is
+      the correct one; updating the live site is separate, not-RootNode-owned work.
+- [ ] **Winter Break dates** — DECISION REQUIRED. Chase's call, not invented.
+- [ ] **Venue** — DECISION REQUIRED. Chase's call (or confirm fully online/remote), not invented.
+- [ ] **Capacity** — DECISION REQUIRED. Chase's call, not invented.
+- [ ] **Agreements (legal text)** — BLOCKED. `agreement_definitions.body_summary` remains a
+      plain-language placeholder; no attorney-approved text exists for any required category
+      (program terms, guardian consent, participation waiver, acceptable-use/lab rules,
+      cancellation acknowledgment, privacy notice). See `docs/PHASE10_LAUNCH_READINESS.md` Gate
+      12 for the full taxonomy — none of it was authored or treated as approved by this phase.
+- [ ] **Refund/cancellation policy** — DECISION REQUIRED. The platform's mechanical behavior
+      (record, never auto-cascade into registration/enrollment status) is real and proven
+      against actual Stripe money movement; the customer-facing POLICY text is Chase's decision.
+- [ ] **Tax decision** — DECISION REQUIRED. No tax treatment is configured anywhere in this
+      codebase (Phase 9's own explicit "no complex tax automation" boundary) — this is not an
+      implicit "no tax owed" determination, it requires Chase or a professional to actually
+      decide.
+- [ ] **Production offering** — BLOCKED. Cannot legitimately open registration until dates/
+      venue/capacity/agreements/refund policy/tax are all resolved — the mechanism itself
+      (`PATCH /api/admin/offerings/:id`, transition to `enrollment_open`) is ready the moment
+      they are.
+- [ ] **Instructor assignment** — MANUAL OWNER ACTION. Mechanism ready
+      (`instructor_offerings`); Chase assigns the real instructor once the real offering exists.
+- [x] **Roster process** — COMPLETE. Rehearsed end to end (classroom session, real Lab task,
+      instructor visibility) in this phase's dress rehearsal, 13/13.
+- [x] **Student activation** — COMPLETE. Proven real twice — Phase 9.1's real-Stripe run and
+      this phase's deterministic rehearsal.
+- [x] **Lab capacity (mechanism)** / [ ] **Lab capacity (real sizing)** — PARTIAL. Race-safe
+      capacity logic is proven; real-world capacity planning for actual concurrent students
+      needs the real server's actual specs, unknown until Gate "production server" resolves.
+- [x] **Complete dress rehearsal** — COMPLETE (deterministic). 13/13 this phase, against
+      current `main`. Cannot yet be repeated against the REAL Winter Break offering because that
+      offering cannot legitimately open (dates/venue/capacity/agreements/policy/tax all pending).
 
 ## Final go/no-go
 
-Registration should not open to the public until every box above is checked. The platform side
-(first section) has been true since this phase shipped; everything else is a business, legal, or
-external-team dependency this phase deliberately did not — and should not — invent on Chase's
-behalf.
+## PHASE 10 PARTIAL / WINTER BREAK LAUNCH BLOCKED
+
+Registration must not open to the public until every BLOCKED and DECISION REQUIRED item above
+is resolved. Every COMPLETE item has real evidence behind it, not a self-assessment — see
+`docs/PHASE10_LAUNCH_READINESS.md`'s full matrix. **Even once every gate above passes, this
+platform will not open registration on its own — that action requires Chase's explicit,
+separate authorization, given directly, not inferred from a checklist being green.**