# Completion Blueprint

## Gate 1: controlled pilot

1. Apply migrations and reseed permissions.
2. Create named staff accounts and remove shared credentials.
3. Assign least-privilege roles; verify the Super Admin, Approver, and Quote Creator access matrix, account limits, and quote ownership boundaries.
4. Configure a non-production public HTTPS URL and exercise QR verification from an external device.
5. Run the full automated suite, workflow audit, dependency audits, and manual role smoke tests.

## Gate 2: tax and communications

1. Complete KRA OSCU production onboarding and execute approved invoice scenarios, failures, retries, and duplicate submissions.
2. Specify and implement KRA credit/debit note documents, original-invoice references, approval rules, and eTIMS responses.
3. Configure a verified mail provider; implement queued document delivery records, failure visibility, retry, and recipient audit.
4. Commission Daraja only if automated M-Pesa is required; implement transaction persistence, STK initiation, callback idempotency, query reconciliation, exception queues, and finance sign-off.

## Gate 3: production operations

1. Deploy with `APP_ENV=production`, `APP_DEBUG=false`, HTTPS, secure cookies, trusted hosts/proxies, and non-local database credentials.
2. Run scheduler and queue workers under monitored process ownership.
3. Configure encrypted off-host database and private-document backups; prove restore time and data integrity.
4. Centralize logs/alerts for 5xx rate, queue failures, eTIMS failures, authentication lockouts, disk capacity, database availability, and backup age.
5. Establish release, rollback, incident-response, access-review, retention, privacy, and business-continuity runbooks.

## Gate 4: acceptance

Finance signs off quote-to-cash, adjustments, receipts, VAT, aging, statements, and reconciliation. HR signs off attendance/payroll scenarios. Management signs off approval limits and segregation of duties. Security signs off vulnerability scanning and recovery evidence. KRA/Safaricom acceptance is retained with the release evidence where applicable.