> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neobank.proofof.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Production readiness

> Validate the live runtime, controlled canary, security, load, backup, restore, deployment, CI, and independent reviews.

# Prepare the live runtime for production

Production support exists in the `live` adapter, but launch still requires repository and operational evidence. Perflo capability requests remain upstream improvements rather than startup gates.

## Meet startup requirements

Production refuses to start unless all these conditions hold:

* `NEOBANK_PERFLO_ADAPTER=live`
* PostgreSQL and isolated session and task Redis authorities are configured
* Vault uses HTTPS and the restricted `neobank-perflo-credentials` Transit key
* Auth0 customer and operator applications are configured
* Public and API origins use HTTPS
* Metrics authentication is configured
* Debug authentication is disabled
* All five Perflo service origins match the reviewed values exactly

## Reinitialize the database

Alembic migrations apply incrementally before the workloads start, and every workload refuses to serve against a database whose migration revision is stale. The application never deletes an existing database automatically.

## Run the controlled canary

Use a dedicated Perflo quality-assurance subject and an empty neobank database. Verify device link and revocation, generic Know Your Customer link, fiat-account filtering, activity, recipients, estimates, one-use transfer approval, mandate approval and revocation, card lifecycle and reveal, and read-only reconciliation.

Capture sanitized fixtures for undocumented successful bodies. Do not record credentials, approval sessions, beneficiary destinations, card credentials, token addresses, networks, or unmasked bank identifiers.

## Complete launch evidence

Before production traffic:

1. Pass `make ci`
2. Pass PostgreSQL integration tests
3. Pass Playwright end-to-end tests on desktop and mobile
4. Complete security and load validation
5. Complete backup and restore exercises
6. Validate the target deployment and rollback procedure
7. Obtain clean verdicts from the clean-code, architecture, and quality-assurance review lanes

Confidence in repository state-machine behavior is high after those checks. Confidence in undocumented provider response bodies remains moderate until the canary fixtures pass strict normalization tests.