Operations and security

Backups and restore

Before any deploy, migration or risky admin action:

1. dump the database;
2. archive .env and storage/;
3. verify the dump can be restored on a test database;
4. keep a rollback point.

Never run migrate:fresh, migrate:reset, TRUNCATE, DROP TABLE or mass delete/update on a live database.

Deploy checklist

php artisan down
# deploy code + dependencies
php artisan migrate --force
php artisan config:clear
php artisan route:clear
php artisan view:clear
php artisan queue:restart
php artisan up

Rebuild assets with npm run build when the front-end changed. Rebuild the Flutter client when the client changed.

Queues and scheduler

The queue worker must run under a supervisor and be restarted after a deploy. Scheduled tasks include:

• quarantine expiry;
• auction settlement and expiry notifications;
• event settlement;
• bot activity and rebalance;
• retention and pruning;
• sitemap generation.

Security

• APP_ENV=production, APP_DEBUG=false.
• HTTPS only; secure, host-only session cookies.
• Two-factor authentication for operators.
• Least-privilege database user.
• Keep composer audit, npm audit and secret scans green.
• Never commit .env, credentials, tokens, dumps or generated state.
• The public demo is isolated and hardened (see Demo and editions).

Commands

php artisan animalia:data:audit
php artisan animalia:migrations:check
php artisan animalia:manifest:check
php artisan kit:verify

data:audit checks referential and state consistency. migrations:check verifies every migration applies and none is pending. manifest:check detects documentation drift.

Monitoring

Watch errors, queue backlog, disk, database size and abuse spikes. The kit exposes /api/v1/health. A status page and alerting are planned for the commercial launch.

Support bundle

A redacted kit:doctor --report bundle is planned: versions, services, health and log excerpts with no secrets.

Next steps

• Flutter client
• Demo and editions