- Readiness areas
- 11
System
Future staff login required Production-bound preview namespaceGuarded /admin access
Production-bound preview
Administration
System
Review current work, spot risk quickly, and keep protected actions locked until approval.
- Launch blockers
- 14
- High-risk areas
- 6
- Needs review
- 9
Infrastructure readiness
Launch-critical systems stay visible.
Infrastructure readiness is visible for Render, Supabase, FanSports authorization, PostgreSQL, Stripe, SendGrid, Gooten, nflverse, backups, QA, source upload, and launch blockers without reading secrets or changing provider configuration.
Hosting
Render / SSR
Astro is configured for server output with the Node standalone adapter; Render config is not changed here.
- Safe next action
- Confirm Render service, build command, start command, region, runtime, and rollback plan.
- Blocked action
- No deploy, Render config, Render env, build/start command, DNS, or adapter change.
Data
Render PostgreSQL
Platform DB exists, but production table coverage, snapshot posture, and rollback checks require a controlled review.
- Safe next action
- Confirm snapshot, backup retention, migration plan, read-only verification, and restore path before DB work.
- Blocked action
- No DB writes, migrations, destructive commands, or production shell commands.
Auth
Supabase Auth
Supabase handles identity and sessions; FanSports owns role and ownership checks.
- Safe next action
- Confirm live domain Site URL, OAuth callbacks, magic-link redirects, and session cookie posture.
- Blocked action
- No Supabase config change, admin API use, service-role use, or callback mutation.
FanSports authorization
Staff/Admin guards are in place; Group Admin ownership and high-value action audits need final launch review.
- Safe next action
- Review Staff/Admin memberships, Group Admin ownership records, action gates, audit payloads, and blocked states.
- Blocked action
- No bypass, role write, ownership write, or high-risk action enablement.
Payments
Stripe test/live separation
Test checkout, metadata, webhook posture, and ledger bucket candidates exist; live money movement stays blocked.
- Safe next action
- Complete test-mode webhook signature verification, idempotency, ledger persistence, reconciliation, and live-mode go/no-go.
- Blocked action
- No live charges, refunds, payouts, transfers, Connect account creation, or live webhook mutation.
Stripe webhook readiness
Webhook route models safe test events and no-mutation previews; persistence must be completed before launch.
- Safe next action
- Verify test webhook secret, replay handling, event idempotency, payment event writes, and reconciliation queues.
- Blocked action
- No live webhook writes, no payout/refund/transfer behavior, and no production payment mutation.
SendGrid transactional email
Template registry, send policy, and preview/readiness helpers exist; real sends stay blocked.
- Safe next action
- Confirm templates, sender/reply-to policy, suppression handling, bounce handling, webhooks, and test recipient allowlist.
- Blocked action
- No provider send, bulk send, webhook write, suppression write, or sender/domain change.
Fulfillment
Gooten merch fulfillment
Merch catalog foundation exists; fulfillment, shipping, tax, tracking, and vendor reconciliation are not active.
- Safe next action
- Confirm sandbox access, product mapping, approved artwork, fulfillment lifecycle, support path, and reconciliation.
- Blocked action
- No Gooten API call, order, fulfillment, shipping/tax calculation, or vendor mutation.
Data refresh
nflverse data and assets
Scoring lockout and refresh plan exist; next-season data and licensed assets have not been imported.
- Safe next action
- Confirm season target, identity mapping, source metadata, asset license posture, validation, rollback, and staging flow.
- Blocked action
- No large data download, player/headshot/logo import, scoring write, or Campaign Lock mutation.
Operations
Backup / rollback
Render snapshot posture is known at a high level; per-change backup, rollback, and read-only verification remain launch gates.
- Safe next action
- Record backup owner, latest snapshot date, restore test posture, migration rollback plan, and deploy rollback plan.
- Blocked action
- No DB-affecting work without a checkpoint, backup posture, rollback path, and read-only verification.
Launch
QA and source upload
Validators and build are the primary gate; screenshot QA and ChatGPT source uploads must be current before launch review.
- Safe next action
- Run public/Admin QA on a Codex-owned server, confirm route smoke tests, and upload updated source docs.
- Blocked action
- No launch approval until QA, source upload, and owner go/no-go are complete.
Environment inventory
Names only. No secrets shown.
Expected environment names are grouped by operating area. This page does not read values, compare production values, or show provider secrets.
Render/runtime
Runtime names only; values must be confirmed in Render without exposing them.
PUBLIC_SITE_URL NODE_ENV PORT Database
Render PostgreSQL connection name is expected; value is secret and never shown.
DATABASE_URL Supabase
Public browser keys and server-only keys must stay separated; no values are read here.
PUBLIC_SUPABASE_URL PUBLIC_SUPABASE_ANON_KEY PUBLIC_SUPABASE_PUBLISHABLE_KEY SUPABASE_SECRET_KEY Stripe
Expected payment names are tracked for test checkout and webhook readiness; live mode is blocked.
STRIPE_SECRET_KEY STRIPE_WEBHOOK_SECRET PUBLIC_STRIPE_PUBLISHABLE_KEY SendGrid
Transactional email names are tracked for readiness; provider sends remain blocked.
SENDGRID_API_KEY SENDGRID_FROM_EMAIL SENDGRID_REPLY_TO_EMAIL SENDGRID_WEBHOOK_SECRET Gooten
Merch fulfillment names are planned only; no provider calls or orders are enabled.
GOOTEN_API_KEY GOOTEN_STORE_ID GOOTEN_ENVIRONMENT nflverse/data
Data refresh names are planned only; no large downloads or imports are enabled.
FANSPORTS_NFLVERSE_SEASON FANSPORTS_NFLVERSE_DATA_DIR FanSports feature flags
Internal feature flag names are listed for review; values are never shown.
FANSPORTS_INTERNAL_PAID_TRADE_SIMULATION FANSPORTS_INTERNAL_SCORE_REFRESH FANSPORTS_INTERNAL_WEEK_SIMULATION INTERNAL_ADMIN_EMAILS Health readiness
Generic route planned.
A future health route should return a generic status only and must not expose provider details, secrets, DB URLs, auth config, or private operational data.
Route
/api/health
Email templates
Transactional email readiness
FanSports Admin can review template coverage, sender policy, suppression/bounce planning, and high-risk email action blockers before any provider call is enabled.
- Templates
- 15
- Sends
- Send disabled
Launch blockers
Owner review required.
Group Admin auth and ownership launch review
Production DB/schema verification
Render/Supabase callback confirmation
Stripe Connect checkout, webhooks, and ledger persistence
SendGrid template/send enablement
Gooten merch fulfillment
nflverse data/assets refresh
Prize/compliance/Campaign Lock review
Admin access review
Public route privacy review
Backup/rollback posture
Final QA
ChatGPT Project Sources upload
Owner go/no-go approval
Blocked actions
No production infrastructure action is enabled.
Deploy production app
Change DNS
Change Render config
Change Render env vars
Change Astro adapter/output
Print secrets
Use Supabase service-role/admin API
Run Stripe live mode
Change Stripe webhook secret
Send email
Change SendGrid sender/domain
Submit Gooten order
Import nflverse data
Run DB migration
Write production DB