Skip to content

System

Future staff login required Production-bound preview namespace
Review only · Staff sign-in required · Money, reward, winner, and distribution actions remain locked

Administration

System

Review current work, spot risk quickly, and keep protected actions locked until approval.

Staff auth required Review only No live money movement
Readiness areas
11
Grouped across hosting, auth, data, payments, email, fulfillment, gameplay, QA
Launch blockers
14
Tracked for owner go/no-go review
High-risk areas
6
Require controlled review before launch
Needs review
9
No production action enabled

Infrastructure readiness

Launch-critical systems stay visible.

Infrastructure readiness is visible for Render, Supabase, FanSports authorization, PostgreSQL, Stripe, SendGrid, Gooten, nflverse, backups, QA, source upload, and launch blockers without reading secrets or changing provider configuration.

Open route audit

Hosting

Render / SSR

Astro is configured for server output with the Node standalone adapter; Render config is not changed here.

Ready for review
Safe next action
Confirm Render service, build command, start command, region, runtime, and rollback plan.
Blocked action
No deploy, Render config, Render env, build/start command, DNS, or adapter change.
Owner: Platform Owner Risk: Medium

Data

Render PostgreSQL

Platform DB exists, but production table coverage, snapshot posture, and rollback checks require a controlled review.

Needs review
Safe next action
Confirm snapshot, backup retention, migration plan, read-only verification, and restore path before DB work.
Blocked action
No DB writes, migrations, destructive commands, or production shell commands.
Owner: Platform Owner / Data Risk: High

Auth

Supabase Auth

Supabase handles identity and sessions; FanSports owns role and ownership checks.

Configured
Safe next action
Confirm live domain Site URL, OAuth callbacks, magic-link redirects, and session cookie posture.
Blocked action
No Supabase config change, admin API use, service-role use, or callback mutation.
Owner: Platform Owner / Auth Risk: Medium

FanSports authorization

Staff/Admin guards are in place; Group Admin ownership and high-value action audits need final launch review.

Needs review
Safe next action
Review Staff/Admin memberships, Group Admin ownership records, action gates, audit payloads, and blocked states.
Blocked action
No bypass, role write, ownership write, or high-risk action enablement.
Owner: Platform Owner / Compliance Risk: High

Payments

Stripe test/live separation

Test checkout, metadata, webhook posture, and ledger bucket candidates exist; live money movement stays blocked.

Test mode only
Safe next action
Complete test-mode webhook signature verification, idempotency, ledger persistence, reconciliation, and live-mode go/no-go.
Blocked action
No live charges, refunds, payouts, transfers, Connect account creation, or live webhook mutation.
Owner: Finance Admin Risk: High

Stripe webhook readiness

Webhook route models safe test events and no-mutation previews; persistence must be completed before launch.

Needs review
Safe next action
Verify test webhook secret, replay handling, event idempotency, payment event writes, and reconciliation queues.
Blocked action
No live webhook writes, no payout/refund/transfer behavior, and no production payment mutation.
Owner: Finance Admin / Engineering Risk: High

Email

SendGrid transactional email

Template registry, send policy, and preview/readiness helpers exist; real sends stay blocked.

Send disabled
Safe next action
Confirm templates, sender/reply-to policy, suppression handling, bounce handling, webhooks, and test recipient allowlist.
Blocked action
No provider send, bulk send, webhook write, suppression write, or sender/domain change.
Owner: Operations Admin Risk: Medium

Fulfillment

Gooten merch fulfillment

Merch catalog foundation exists; fulfillment, shipping, tax, tracking, and vendor reconciliation are not active.

Planning
Safe next action
Confirm sandbox access, product mapping, approved artwork, fulfillment lifecycle, support path, and reconciliation.
Blocked action
No Gooten API call, order, fulfillment, shipping/tax calculation, or vendor mutation.
Owner: Merch Operations Risk: Medium

Data refresh

nflverse data and assets

Scoring lockout and refresh plan exist; next-season data and licensed assets have not been imported.

Planning
Safe next action
Confirm season target, identity mapping, source metadata, asset license posture, validation, rollback, and staging flow.
Blocked action
No large data download, player/headshot/logo import, scoring write, or Campaign Lock mutation.
Owner: Gameplay Operations Risk: High

Operations

Backup / rollback

Render snapshot posture is known at a high level; per-change backup, rollback, and read-only verification remain launch gates.

Needs review
Safe next action
Record backup owner, latest snapshot date, restore test posture, migration rollback plan, and deploy rollback plan.
Blocked action
No DB-affecting work without a checkpoint, backup posture, rollback path, and read-only verification.
Owner: Platform Owner Risk: High

Launch

QA and source upload

Validators and build are the primary gate; screenshot QA and ChatGPT source uploads must be current before launch review.

Needs review
Safe next action
Run public/Admin QA on a Codex-owned server, confirm route smoke tests, and upload updated source docs.
Blocked action
No launch approval until QA, source upload, and owner go/no-go are complete.
Owner: Platform Owner / QA Risk: Medium

Environment inventory

Names only. No secrets shown.

Expected environment names are grouped by operating area. This page does not read values, compare production values, or show provider secrets.

Render/runtime

Runtime names only; values must be confirmed in Render without exposing them.

Review needed
PUBLIC_SITE_URL NODE_ENV PORT

Database

Render PostgreSQL connection name is expected; value is secret and never shown.

Configured by environment
DATABASE_URL

Supabase

Public browser keys and server-only keys must stay separated; no values are read here.

Review needed
PUBLIC_SUPABASE_URL PUBLIC_SUPABASE_ANON_KEY PUBLIC_SUPABASE_PUBLISHABLE_KEY SUPABASE_SECRET_KEY

Stripe

Expected payment names are tracked for test checkout and webhook readiness; live mode is blocked.

Test mode only
STRIPE_SECRET_KEY STRIPE_WEBHOOK_SECRET PUBLIC_STRIPE_PUBLISHABLE_KEY

SendGrid

Transactional email names are tracked for readiness; provider sends remain blocked.

Send disabled
SENDGRID_API_KEY SENDGRID_FROM_EMAIL SENDGRID_REPLY_TO_EMAIL SENDGRID_WEBHOOK_SECRET

Gooten

Merch fulfillment names are planned only; no provider calls or orders are enabled.

Planning
GOOTEN_API_KEY GOOTEN_STORE_ID GOOTEN_ENVIRONMENT

nflverse/data

Data refresh names are planned only; no large downloads or imports are enabled.

Planning
FANSPORTS_NFLVERSE_SEASON FANSPORTS_NFLVERSE_DATA_DIR

FanSports feature flags

Internal feature flag names are listed for review; values are never shown.

Review needed
FANSPORTS_INTERNAL_PAID_TRADE_SIMULATION FANSPORTS_INTERNAL_SCORE_REFRESH FANSPORTS_INTERNAL_WEEK_SIMULATION INTERNAL_ADMIN_EMAILS

Health readiness

Generic route planned.

A future health route should return a generic status only and must not expose provider details, secrets, DB URLs, auth config, or private operational data.

Route

/api/health

Design a generic uptime/readiness response with detailed checks kept inside guarded Admin System views.

Email templates

Transactional email readiness

FanSports Admin can review template coverage, sender policy, suppression/bounce planning, and high-risk email action blockers before any provider call is enabled.

Templates
15
preview-ready
Sends
Send disabled
provider sends disabled

Launch blockers

Owner review required.

Group Admin auth and ownership launch review

Production DB/schema verification

Render/Supabase callback confirmation

Stripe Connect checkout, webhooks, and ledger persistence

SendGrid template/send enablement

Gooten merch fulfillment

nflverse data/assets refresh

Prize/compliance/Campaign Lock review

Admin access review

Public route privacy review

Backup/rollback posture

Final QA

ChatGPT Project Sources upload

Owner go/no-go approval

Blocked actions

No production infrastructure action is enabled.

Deploy production app

Change DNS

Change Render config

Change Render env vars

Change Astro adapter/output

Print secrets

Use Supabase service-role/admin API

Run Stripe live mode

Change Stripe webhook secret

Send email

Change SendGrid sender/domain

Submit Gooten order

Import nflverse data

Run DB migration

Write production DB