Dara DocsReferenceDeployment
Production launch checklist
Brief §148. Status as of 2026-10-31 (owner decisions: ../decisions/OWNER_DECISIONS_20261031.md). Ready = done and evidenced in this repository; Needs owner = a decision,
approval or asset only the operator can provide; Not started = work that follows from such a decision.
| # | Item | Status | Evidence / what is missing |
|---|---|---|---|
| 1 | PRD approved | Needs owner | ../product/PRD.md written; formal approval pending |
| 2 | Asset model approved | Needs owner | Classic Stellar assets with AUTH_REQUIRED, AUTH_REVOCABLE, AUTH_CLAWBACK_ENABLED (../stellar/ASSET_MODEL_EVALUATION.md); GOLD decided; home domain still to choose |
| 3 | Issuer policy approved | Needs owner | ../security/AUTHORITY_MATRIX.md, ../operations/CLAWBACK_POLICY.md |
| 4 | Wallet model approved | Needs owner | Custodial, sponsored accounts (../stellar/STELLAR_ARCHITECTURE.md §4) |
| 5 | Reserve model approved | Needs owner | Manual four-eyes snapshots, 35-day validity (../finance/INVARIANTS.md INV-01) |
| 6 | Security review | Ready (internal) | Review passes in ../reviews/; scans and security tests in ../testing/evidence/SECURITY_PERF_20261030.md. An independent review is recommended before Mainnet |
| 7 | External audit if contracts are used | Not applicable | No smart contracts (Classic assets; no SAC admin contract) |
| 8 | Issuer signer | Ready (design and code) | One human signer, software key (owner decision); TestSingleHumanSigner on local Stellar. At the ceremony: the signer's public key and backup check |
| 9 | Treasury security | Ready (code), Not started (host) | Hot/cold split, sweep, refill; online keys in Vault Transit (SIGNER_BACKEND=vault, make vault-test); a production Vault/OpenBao cluster to provision |
| 10 | Self-hosted RPC redundancy | Ready (design), Not started (hosts) | Gateway with failover, ≥ 2 nodes enforced by config in UAT/production, failover tests; hosts to provision |
| 11 | Database HA | Not started | Synchronous replica + pgBackRest described (../operations/BACKUP_RESTORE.md); hosts to provision |
| 12 | Backups verified | Ready | Restore drill passed (BACKUP_RESTORE.md §4); repeat on UAT |
| 13 | DR test | Not started | Restore procedure written; run during UAT |
| 14 | Monitoring | Ready | Metrics, dashboards (../operations/MONITORING.md) |
| 15 | Alerts | Needs owner | 30 rules with unit tests; receivers template ready (production.yml.example); who is paged and which channel: decided later |
| 16 | Reconciliation | Ready | Every demo and e2e run; runbook ../operations/RECONCILIATION_RUNBOOK.md |
| 17 | Performance test | Ready (local baseline) | Sized for ~1 order/s: 8 AUTO + 3 GOV channels (../operations/ISSUER_OPERATIONS.md §1) |
| 18 | Security test | Ready | TestHTTPSecurity and the scans; repeat on UAT |
| 19 | UAT sign-off | Not started | UAT.md. Testnet end-to-end in the launch layout: tooling ready (TESTNET.md); not yet run (our Testnet RPC node's first sync was still downloading history) |
| 20 | Mainnet canary passed | Not started | MAINNET_CANARY.md |
| 21 | Production limits configured | Needs owner | Channel count and XLM float sized; per-trade bounds, daily limits and the GOLD hot float are console settings for two operators |
| 22 | Incident response ready | Ready (documents) | ../operations/INCIDENT_RESPONSE.md; needs named on-call |
| 23 | On-call ready | Needs owner | Rota and receivers |
| 24 | Dependency inventory complete | Ready | ../infrastructure/EXTERNAL_DEPENDENCIES.md, SBOMs in ../security/sbom/ |
Decisions still open
| Question | Unblocks |
|---|---|
Home domain for GOLD (stellar.toml) | 2, Mainnet activation |
| Alert receivers and on-call rota | 15, 23 |
| Formal approvals (PRD, asset, issuer, wallet and reserve policies) | 1–5 |
| Hosts: two RPC nodes, PostgreSQL HA, Vault cluster, Galexie disk | 9, 10, 11, UAT |