ced4568
74033b4cb8
Phase 9.5: reconfirmed no canonical commit exists (broader content search across full history — still zero hits outside this session's own commits); Chase confirmed the real document lives on PC #2, unpushed. Not duplicated here per Chase's explicit instruction — he owns bringing it to canonical Gitea. Infisical: Phase 10's 'project does not exist' finding was incomplete, not wrong about what it checked — a proper org-scoped API enumeration (8 projects) still shows no RootNode Academy project visible to the claude-code-migration machine identity, even though Chase confirms it exists. Root cause narrowed to a missing per-project access grant (Infisical scopes identity visibility per-project, separate from org membership) rather than the project not existing. Corrected docs/SECRETS_AND_INFISICAL.md and docs/PHASE10_CANONICAL_STATE_AUDIT.md accordingly, with the exact one-step fix (grant the identity access via Project Settings -> Access) and the identity id needed to do it. No duplicate project was created. Website pricing: a read-only fetch of rootnodeacademy.com found stale founding-price RANGES that don't match the exact fixed V1 prices Chase gave directly this phase; Chase confirmed the fixed prices in this repo's docs are correct and current. Noted as a real discrepancy for his own awareness, not something this repo's scope covers fixing. Updated the Phase 10 launch matrix with a Category column (TECHNICAL READY / OWNER DECISION REQUIRED / EXTERNAL BLOCKER / HARDWARE BLOCKER) distinguishing who needs to act on each remaining gate. No application code changed — audit/documentation reconciliation only.
108 lines
8.4 KiB
Markdown
108 lines
8.4 KiB
Markdown
# Winter Break Camp — Launch Checklist
|
|
|
|
The single go/no-go list for opening the Winter Break Linux & Systems Foundations Camp
|
|
(`docs/WINTER_BREAK_CAMP_CURRICULUM_OPTIONS.md` Option A) to real public registration. Every
|
|
item is tagged **COMPLETE**, **BLOCKED**, **DECISION REQUIRED**, or **MANUAL OWNER ACTION** —
|
|
see `docs/PHASE10_LAUNCH_READINESS.md` for the full evidence matrix behind each tag. Nothing on
|
|
this list is invented by the platform — every non-COMPLETE item is a real decision, asset, or
|
|
piece of hardware that has to come from Chase, a legal reviewer, or Stripe, not from more code.
|
|
|
|
- [x] **Canonical repo reconciled** — COMPLETE. `docs/PHASE10_CANONICAL_STATE_AUDIT.md`: this
|
|
workstation's HEAD, Gitea's `origin/main`, and every claimed milestone SHA all verified
|
|
consistent. No stranded branches/tags on the remote.
|
|
- [ ] **Second-PC state reconciled** — DECISION REQUIRED (verification only, not a code
|
|
blocker). Gitea shows no evidence of stranded work, but this session cannot see the other
|
|
workstation directly — run the commands in `docs/PHASE10_CANONICAL_STATE_AUDIT.md` §1.3
|
|
there. **Confirmed with Chase (Phase 10.1): the real Phase 9.5 pricing document lives on
|
|
PC #2, unpushed** — bringing that to Gitea would also close this item.
|
|
- [ ] **Secrets centralized (Infisical)** — MANUAL OWNER ACTION, one step. The "RootNode
|
|
Academy" project does exist (per Chase) — Phase 10.1's re-investigation (a proper API
|
|
enumeration, not just the CLI picker) found the `claude-code-migration` machine identity
|
|
simply isn't listed as having access to it. Grant it access via Project Settings → Access
|
|
→ Machine Identities. See `docs/SECRETS_AND_INFISICAL.md` for the exact identity id and
|
|
the full secret inventory ready to migrate in once granted.
|
|
- [ ] **Production server** — BLOCKED. Not purchased/provisioned — verified via empty
|
|
`terraform.tfvars`/no state file and placeholder `group_vars/production.yml`. See `docs/
|
|
PHASE10_PRODUCTION_DEPLOYMENT.md`.
|
|
- [ ] **Production VMs (rn-platform-01 / rn-lab-host-01)** — BLOCKED. Depends on the server above.
|
|
- [x] **Firewall/isolation (code)** — COMPLETE. `docs/PHASE10_SECURITY_AUDIT.md` — RFC1918
|
|
egress denial, mTLS wiring, firewall Ansible role all present and unchanged from Phase 4/
|
|
4.1; cannot be verified against a live host until one exists.
|
|
- [ ] **Production database** — BLOCKED. Depends on the server above. Migrations themselves
|
|
reconfirmed idempotent this phase (37/37, both a fresh apply and a same-DB restart).
|
|
- [x] **DNS (marketing site)** / [ ] **DNS (Platform API)** — PARTIAL. `rootnodeacademy.com` is
|
|
live and real (Cloudflare-fronted, confirmed this phase); no subdomain exists yet for the
|
|
Platform API itself — needs a real server first.
|
|
- [x] **HTTPS (marketing site)** / [ ] **HTTPS (Platform API)** — PARTIAL, same split as DNS.
|
|
- [x] **Monitoring (code)** — COMPLETE. `/healthz`/`/metrics` live and exercised in every
|
|
regression run this phase; deployment itself needs the production server.
|
|
- [x] **Backups (code)** / [ ] **Backups (executed)** — PARTIAL. Ansible `backup` role exists,
|
|
never run against a real host.
|
|
- [ ] **Restore test** — BLOCKED. Never executed — no target exists. A backup that has never
|
|
been restore-tested does not count as launch-ready.
|
|
- [x] **Stripe TEST validation** — COMPLETE. A real Stripe TEST Checkout Session, a real TEST
|
|
payment at the actual $399.00 price, a genuine signed webhook, the existing
|
|
registration→enrollment conversion, a real duplicate-delivery proof, a real automated
|
|
abandoned-checkout proof, and a real refund with the non-cascade rule reconfirmed — all
|
|
proven end to end in Phase 9.1 (`docs/PHASE9_1_STRIPE_TEST_VALIDATION.md`). One real
|
|
defect (webhook-event correlation) was found and fixed as a direct result.
|
|
- [ ] **Stripe LIVE configuration** — BLOCKED. Not configured, not attempted — requires Chase's
|
|
own Stripe account business/identity verification (only Chase can do this) plus real LIVE
|
|
credentials placed in Infisical (blocked on the missing project above), never invented or
|
|
substituted by this phase.
|
|
- [ ] **Live webhook configuration** — BLOCKED. Depends on LIVE credentials and a real HTTPS
|
|
Platform API endpoint, neither of which exist yet.
|
|
- [x] **Google Workspace** — COMPLETE. `[email protected]`, `gmail.send` scope,
|
|
domain-wide delegation — validated in Phase 5C (`docs/
|
|
RUNBOOK_GOOGLE_WORKSPACE_EMAIL.md`); deployment to production needs the real server.
|
|
- [x] **Website integration** — COMPLETE. Full contract tested end to end, including against
|
|
real Stripe. The website itself (separate repo, not RootNode-owned) is live and real;
|
|
this phase did not access or modify it.
|
|
- [x] **Winter Break price** — COMPLETE. **$399.00 launch ("Founding Cohort") / $449.00
|
|
standard reference, paid in full, no deposit, no payment plan** — founder-approved by
|
|
Chase directly, validated against real Stripe TEST mode at this exact amount, reconfirmed
|
|
current in Phase 10.1. Note: `rootnodeacademy.com` itself currently shows different,
|
|
stale founding-price RANGES (not this fixed figure) — Chase confirmed this repo's price is
|
|
the correct one; updating the live site is separate, not-RootNode-owned work.
|
|
- [ ] **Winter Break dates** — DECISION REQUIRED. Chase's call, not invented.
|
|
- [ ] **Venue** — DECISION REQUIRED. Chase's call (or confirm fully online/remote), not invented.
|
|
- [ ] **Capacity** — DECISION REQUIRED. Chase's call, not invented.
|
|
- [ ] **Agreements (legal text)** — BLOCKED. `agreement_definitions.body_summary` remains a
|
|
plain-language placeholder; no attorney-approved text exists for any required category
|
|
(program terms, guardian consent, participation waiver, acceptable-use/lab rules,
|
|
cancellation acknowledgment, privacy notice). See `docs/PHASE10_LAUNCH_READINESS.md` Gate
|
|
12 for the full taxonomy — none of it was authored or treated as approved by this phase.
|
|
- [ ] **Refund/cancellation policy** — DECISION REQUIRED. The platform's mechanical behavior
|
|
(record, never auto-cascade into registration/enrollment status) is real and proven
|
|
against actual Stripe money movement; the customer-facing POLICY text is Chase's decision.
|
|
- [ ] **Tax decision** — DECISION REQUIRED. No tax treatment is configured anywhere in this
|
|
codebase (Phase 9's own explicit "no complex tax automation" boundary) — this is not an
|
|
implicit "no tax owed" determination, it requires Chase or a professional to actually
|
|
decide.
|
|
- [ ] **Production offering** — BLOCKED. Cannot legitimately open registration until dates/
|
|
venue/capacity/agreements/refund policy/tax are all resolved — the mechanism itself
|
|
(`PATCH /api/admin/offerings/:id`, transition to `enrollment_open`) is ready the moment
|
|
they are.
|
|
- [ ] **Instructor assignment** — MANUAL OWNER ACTION. Mechanism ready
|
|
(`instructor_offerings`); Chase assigns the real instructor once the real offering exists.
|
|
- [x] **Roster process** — COMPLETE. Rehearsed end to end (classroom session, real Lab task,
|
|
instructor visibility) in this phase's dress rehearsal, 13/13.
|
|
- [x] **Student activation** — COMPLETE. Proven real twice — Phase 9.1's real-Stripe run and
|
|
this phase's deterministic rehearsal.
|
|
- [x] **Lab capacity (mechanism)** / [ ] **Lab capacity (real sizing)** — PARTIAL. Race-safe
|
|
capacity logic is proven; real-world capacity planning for actual concurrent students
|
|
needs the real server's actual specs, unknown until Gate "production server" resolves.
|
|
- [x] **Complete dress rehearsal** — COMPLETE (deterministic). 13/13 this phase, against
|
|
current `main`. Cannot yet be repeated against the REAL Winter Break offering because that
|
|
offering cannot legitimately open (dates/venue/capacity/agreements/policy/tax all pending).
|
|
|
|
## Final go/no-go
|
|
|
|
## PHASE 10 PARTIAL / WINTER BREAK LAUNCH BLOCKED
|
|
|
|
Registration must not open to the public until every BLOCKED and DECISION REQUIRED item above
|
|
is resolved. Every COMPLETE item has real evidence behind it, not a self-assessment — see
|
|
`docs/PHASE10_LAUNCH_READINESS.md`'s full matrix. **Even once every gate above passes, this
|
|
platform will not open registration on its own — that action requires Chase's explicit,
|
|
separate authorization, given directly, not inferred from a checklist being green.**
|