native-update 1.4.9 → 3.1.0

package/docs/deployment/HOSTINGER_DEPLOY.md

@@ -0,0 +1,370 @@
+# Hostinger Deployment Guide
+
+Step-by-step deploy of the Laravel + Nova backend to Hostinger Business
+(shared hosting, SSH-enabled). Target URL:
+**https://nativeupdatebe.aoneahsan.com**.
+
+Tested against Hostinger hPanel, shared Business plan, PHP 8.2, MySQL.
+
+---
+
+## 0. What you need before starting
+
+| Item | Where to get it |
+|---|---|
+| Hostinger SSH access | hPanel → Advanced → SSH Access → "Enable" |
+| MySQL database | hPanel → Databases → MySQL Databases → Create |
+| Nova license key | nova.laravel.com (account → licenses) |
+| PayPal Live credentials | developer.paypal.com → My Apps & Credentials → Live |
+| PayPal subscription plans | PayPal Dashboard → Subscriptions → Plans (create Pro + Enterprise, copy the `P-...` IDs) |
+| PayPal webhook ID | Set up in step 4, skip for now |
+| FilesHub API key | fileshub.zaions.com admin |
+| Google OAuth client | console.cloud.google.com → APIs & Services → Credentials (used for both dashboard sign-in and Google Drive) |
+
+---
+
+## 1. Build the production zip (local machine)
+
+Already built by the maintainer. Current artifact lives at:
+
+```
+production-deploy/nu-backend-YYYYMMDD-HHMMSS.zip
+```
+
+If you need to rebuild:
+
+```bash
+cd /home/ahsan/Documents/01-code/projects/native-update/backend
+
+# Ensure Nova + PayPal deps resolve
+composer install
+composer update --no-interaction
+
+# Production-only deps + Vite build
+php artisan optimize:clear
+composer install --no-dev --optimize-autoloader --classmap-authoritative
+npm run build
+
+# Produce the zip
+mkdir -p ../production-deploy
+zip -qr "../production-deploy/nu-backend-$(date +%Y%m%d-%H%M%S).zip" . \
+  -x "node_modules/*" ".git/*" "tests/*" ".env" ".env.*" \
+     "storage/logs/*.log" "storage/framework/cache/data/*" \
+     "storage/framework/sessions/*" "storage/framework/views/*.php" \
+     "*.sqlite" ".phpunit.result.cache" "*.DS_Store"
+
+# Restore dev deps locally
+composer install
+```
+
+The zip is ~67 MB. Upload it to Hostinger via SFTP to `~/uploads/`.
+
+---
+
+## 2. Hostinger hPanel one-time setup
+
+1. **Subdomain**. hPanel → Domains → Subdomains → Create:
+   - Subdomain: `nativeupdatebe`
+   - Domain: `aoneahsan.com`
+   - Document root: leave as Hostinger's default for now; we'll symlink
+     it to Laravel's `public/` in step 3.
+
+2. **Database**. hPanel → Databases → MySQL Databases → Create:
+   - DB name: `nativeupdate_backend` (Hostinger will prefix with your user)
+   - User: `nativeupdate_user`
+   - Password: generate a strong one; save it.
+
+3. **SSH**. hPanel → Advanced → SSH Access → Enable (if not already).
+   Note the port (usually 65002) and username.
+
+4. **Upload the deploy zip** via hPanel File Manager (or SFTP) to
+   `~/uploads/`. (No Firebase credentials file is needed — auth is Google
+   Socialite + Sanctum, configured entirely via `.env`.)
+
+---
+
+## 3. SSH deploy (first time)
+
+SSH in:
+
+```bash
+ssh -p 65002 <USER>@<HOST>
+```
+
+Create the app directory one level above `public_html` and extract:
+
+```bash
+cd ~/domains/nativeupdatebe.aoneahsan.com
+mkdir -p app && cd app
+unzip -q ~/uploads/nu-backend-*.zip -d .
+```
+
+Point `public_html` at Laravel's `public/`:
+
+```bash
+cd ~/domains/nativeupdatebe.aoneahsan.com
+rm -rf public_html
+ln -s app/public public_html
+```
+
+Configure the environment:
+
+```bash
+cd ~/domains/nativeupdatebe.aoneahsan.com/app
+cp .env.example .env
+nano .env
+```
+
+Fill in the following (paste real values for each `_________` placeholder):
+
+```dotenv
+APP_NAME="Native Update"
+APP_ENV=production
+APP_KEY=               # php artisan key:generate runs next
+APP_DEBUG=false
+APP_TIMEZONE=UTC
+APP_URL=https://nativeupdatebe.aoneahsan.com
+
+LOG_CHANNEL=daily
+LOG_LEVEL=warning
+
+# MySQL from step 2
+DB_CONNECTION=mysql
+DB_HOST=127.0.0.1
+DB_PORT=3306
+DB_DATABASE=_________
+DB_USERNAME=_________
+DB_PASSWORD=_________
+
+# FilesHub
+FILESHUB_BASE_URL=https://fileshub.zaions.com
+FILESHUB_API_KEY=_________
+FILESHUB_APP_ID=native-update
+
+# Sanctum (OAuth-issued bearer tokens)
+SANCTUM_TOKEN_EXPIRATION=10080      # minutes (7 days)
+
+# Frontend (for OAuth redirect back to the dashboard SPA)
+FRONTEND_URL=https://nativeupdate.aoneahsan.com
+
+# Google OAuth — sign-in (Socialite) AND Google Drive integration
+GOOGLE_CLIENT_ID=_________
+GOOGLE_CLIENT_SECRET=_________
+GOOGLE_REDIRECT_URI=${APP_URL}/api/auth/google/callback
+GOOGLE_DRIVE_REDIRECT_URI=${APP_URL}/api/dashboard/google-drive/callback
+
+# PayPal (live)
+PAYPAL_MODE=live
+PAYPAL_LIVE_CLIENT_ID=_________
+PAYPAL_LIVE_CLIENT_SECRET=_________
+PAYPAL_PLAN_PRO=P-_________
+PAYPAL_PLAN_ENTERPRISE=P-_________
+PAYPAL_WEBHOOK_ID=                  # fill in step 4
+
+# Nova
+NOVA_LICENSE_KEY=_________
+
+# Admin
+ADMIN_EMAILS=aoneahsan@gmail.com
+```
+
+Generate APP_KEY and lock down permissions:
+
+```bash
+php artisan key:generate --force
+
+find . -type d -exec chmod 755 {} \;
+find . -type f -exec chmod 644 {} \;
+chmod -R 775 storage bootstrap/cache
+chmod 600 .env
+```
+
+> The full, authoritative env contract (every `[REQUIRED]`/`[OPTIONAL]` key with its purpose)
+> is `backend/.env.example`. Populate the server `.env` from it — an incomplete `.env` (missing
+> a required key) is a common cause of a booting-but-500 backend.
+
+Run migrations and cache config for production:
+
+```bash
+php artisan migrate --force
+php artisan storage:link
+php artisan config:cache
+php artisan route:cache
+php artisan view:cache
+php artisan nova:publish
+```
+
+Smoke-test:
+
+```bash
+curl -sS https://nativeupdatebe.aoneahsan.com/api/health
+# Expected: {"status":"ok","app":"Native Update","env":"production","time":"..."}
+```
+
+Log in to Nova at `https://nativeupdatebe.aoneahsan.com/nova` with an
+email listed in `ADMIN_EMAILS` (sign in via Google — Socialite issues the
+Sanctum session; the first sign-in by an `ADMIN_EMAILS` address is granted
+the `super-admin` role) and verify the Apps / Builds / ApiKeys /
+SigningKeys / Subscriptions resources render.
+
+---
+
+## 4. Register the PayPal webhook
+
+In PayPal Dashboard → Webhooks → Add Webhook:
+
+- URL: `https://nativeupdatebe.aoneahsan.com/api/webhooks/paypal`
+- Events (minimum):
+  - `BILLING.SUBSCRIPTION.ACTIVATED`
+  - `BILLING.SUBSCRIPTION.CANCELLED`
+  - `BILLING.SUBSCRIPTION.SUSPENDED`
+  - `BILLING.SUBSCRIPTION.EXPIRED`
+  - `BILLING.SUBSCRIPTION.PAYMENT.FAILED`
+  - `PAYMENT.SALE.COMPLETED`
+
+Copy the webhook ID PayPal assigns (starts with `WH-`). SSH back in:
+
+```bash
+cd ~/domains/nativeupdatebe.aoneahsan.com/app
+sed -i 's|^PAYPAL_WEBHOOK_ID=.*|PAYPAL_WEBHOOK_ID=WH-xxxxxxxxxxxx|' .env
+php artisan config:cache
+```
+
+Run PayPal's Webhook Simulator from the dashboard to fire a
+`BILLING.SUBSCRIPTION.ACTIVATED` event. Expected response: `200 ok`.
+Check the logs:
+
+```bash
+tail -n 100 ~/domains/nativeupdatebe.aoneahsan.com/app/storage/logs/laravel-*.log
+```
+
+Should contain `PayPal webhook received` or `PayPal subscription activated`.
+
+---
+
+## 5. Cron for scheduled tasks (REQUIRED as of v3.1.0)
+
+The backend now runs a scheduled job: `analytics:cleanup` (defined in
+`routes/console.php`) prunes old `device_activities` **and**
+`analytics_events` rows monthly. Without the scheduler cron below those
+tables grow unbounded, so this cron is now required, not optional.
+
+hPanel → Advanced → Cron Jobs → Add (runs every minute; Laravel's
+scheduler decides internally when each job is actually due):
+
+```
+* * * * * cd ~/domains/nativeupdatebe.aoneahsan.com/app && php artisan schedule:run >/dev/null 2>&1
+```
+
+---
+
+## 6. Re-deploys
+
+For each subsequent release:
+
+1. Rebuild the zip locally (see step 1).
+2. SFTP it to `~/uploads/nu-backend-NEW.zip`.
+3. SSH in and atomic-swap:
+
+```bash
+cd ~/domains/nativeupdatebe.aoneahsan.com
+mv app app.old
+mkdir app && cd app
+unzip -q ~/uploads/nu-backend-NEW.zip -d .
+
+# Carry over secrets + stored files
+cp ../app.old/.env .env
+cp -a ../app.old/storage/app storage/ 2>/dev/null || true
+
+# Fix perms
+find . -type d -exec chmod 755 {} \;
+find . -type f -exec chmod 644 {} \;
+chmod -R 775 storage bootstrap/cache
+chmod 600 .env
+
+# Rebuild caches + apply migrations
+php artisan migrate --force
+php artisan config:cache
+php artisan route:cache
+php artisan view:cache
+
+# Re-point public_html (only needed if symlink was lost)
+cd ..
+rm -rf public_html && ln -s app/public public_html
+
+# Smoke-test then clean up old release
+curl -sS https://nativeupdatebe.aoneahsan.com/api/health
+rm -rf app.old
+```
+
+---
+
+## 7. Rollback
+
+If a deploy breaks things and you didn't delete `app.old` yet:
+
+```bash
+cd ~/domains/nativeupdatebe.aoneahsan.com
+rm -rf app
+mv app.old app
+rm -rf public_html && ln -s app/public public_html
+php artisan config:cache
+curl -sS https://nativeupdatebe.aoneahsan.com/api/health
+```
+
+Migrations that were applied on the new release may need a manual
+`php artisan migrate:rollback --step=N` depending on what they changed.
+
+---
+
+## 8. Known Hostinger constraints
+
+- **No persistent queue workers needed.** The backend uses
+  `QUEUE_CONNECTION=database`, but the only async work — the update-check
+  device-activity + analytics writes — is dispatched with
+  `dispatch(...)->afterResponse()`, which runs **in-process** during the
+  request's terminating phase (no `queue:work` daemon required). If a
+  future feature dispatches a real queued job, add a 1-minute cron running
+  `php artisan queue:work --stop-when-empty`.
+- **No Redis.** Cache + sessions use the MySQL `CACHE_STORE=database`
+  driver. The v3.1.0 latest-build cache (`App::getLatestBuildForChannel`,
+  45s TTL) works with any driver, including `database` and `file`.
+- **PHP 8.3+ is required** (Laravel 13 / `composer.json` `php: ^8.3`).
+  Select PHP 8.3 or newer in hPanel → Advanced → PHP Configuration before
+  deploying; PHP 8.2 will fail to boot the framework.
+- **Node/npm are not available via SSH on all plans.** The Vite build step
+  runs locally; the zip ships pre-built `public/build/` assets.
+- **Nova admin assets** are served from `public/vendor/nova/...` after
+  `php artisan nova:publish` — re-run after every deploy.
+
+---
+
+## 9. v3.1.0 deploy notes
+
+This release adds one migration and shifts two hot-path writes; nothing in
+the standard deploy flow above changes, but confirm each of these:
+
+1. **Run the new migration.** `php artisan migrate --force` applies
+   `2026_07_02_000001_extend_builds_channel_index` (adds a covering index
+   `builds_channel_lookup_idx` on `builds(app_id, channel, status,
+   created_at)`). Purely additive — no data change, safe to run live.
+2. **Re-cache config/routes/views** after the swap (already in the deploy
+   steps): `php artisan config:cache && php artisan route:cache &&
+   php artisan view:cache`.
+3. **Confirm the scheduler cron** from section 5 exists — `analytics:cleanup`
+   now also prunes `analytics_events`, so the monthly run matters.
+4. **No queue worker required** — see section 8 (the update-check writes run
+   via `afterResponse()`).
+
+### Large bundle downloads (optional)
+
+`BundleController@download` streams bundle files through PHP (a
+`StreamedResponse`). This is deliberate: it keeps the signed-URL / auth
+check as the single chokepoint in front of every download. On a server with
+`mod_xsendfile` (Apache) or `X-Accel-Redirect` (nginx), that streaming can
+be offloaded to the web server after the auth check by returning an
+`X-Sendfile` / `X-Accel-Redirect` header instead of the file body — freeing
+the PHP-FPM worker for the duration of the transfer. This is a documented
+option only; it is **not implemented** (Hostinger shared hosting does not
+expose the needed web-server config, and the current streaming approach is
+correct and safe as-is).

package/docs/deployment/PRODUCTION-DEPLOY-CHECKLIST.md

@@ -0,0 +1,184 @@
+# Production Deployment Checklist — Native Update Backend (Laravel 13 + Nova 5)
+
+**Last updated:** 2026-07-02
+**Scope:** `backend/` only. The plugin (`/`) and website (`website/`) ship via npm/Firebase Hosting respectively and have their own pipelines.
+**Companion:** `docs/deployment/HOSTINGER_DEPLOY.md` (host-specific steps for Hostinger).
+
+This checklist is the source of truth for "is this deploy safe to ship?". Run through it on every release until automation in `.github/workflows/release.yml` (Batch 8) replaces the manual gates.
+
+> **v3.1.0 deploy notes:** (1) Requires **PHP ≥ 8.3** (Laravel 13). (2) Runs one new migration
+> `2026_07_02_000001_extend_builds_channel_index` (additive covering index — safe live). (3) The
+> latest-build cache (`App::getLatestBuildForChannel`, 45s TTL) works with any `CACHE_STORE` incl.
+> `database`/`file`. (4) The update-check device/analytics writes use `dispatch(...)->afterResponse()`
+> — in-process, **no queue worker required**. (5) `analytics:cleanup` now prunes `analytics_events`
+> too, so the scheduler cron (§5) is **required**, not optional.
+
+---
+
+## 0 · Pre-flight (local machine, before pushing the deploy zip)
+
+- [ ] `git status` is clean on the branch you're shipping from.
+- [ ] `git pull --rebase` against the deploy branch — no unmerged remote work.
+- [ ] `composer install --no-interaction` succeeds.
+- [ ] `php artisan test` is **green** (all Feature + Unit tests pass).
+- [ ] `php artisan route:list --except-vendor` shows the routes you expect (no accidental new public routes).
+- [ ] `php -l app/` and `php -l routes/` report no syntax errors.
+
+---
+
+## 1 · `.env` for production (NOT committed; copied to server)
+
+The committed `.env.example` has `[REQUIRED]` tags on every var. On the server, populate a real `.env` with the production values. Verify each of these is set correctly:
+
+- [ ] `APP_ENV=production`
+- [ ] `APP_DEBUG=false` — **never** `true` in production (leaks stack traces, env, DB creds).
+- [ ] `APP_KEY` — generated once via `php artisan key:generate` on the server (or copied from a sealed vault). Never re-rotate without re-encrypting cookies/sessions.
+- [ ] `APP_URL=https://nativeupdatebe.aoneahsan.com`
+- [ ] `LOG_CHANNEL=daily`, `LOG_LEVEL=warning` (or `error`) — `debug` floods disk and leaks request shapes.
+- [ ] `CORS_ALLOWED_ORIGINS=https://nativeupdate.aoneahsan.com[,...]` — explicit list, no wildcards.
+- [ ] DB creds (`DB_HOST`, `DB_DATABASE`, `DB_USERNAME`, `DB_PASSWORD`) — production DB, not staging.
+- [ ] FilesHub: `FILESHUB_API_KEY`, `FILESHUB_BASE_URL`, `FILESHUB_APP_ID=native-update`.
+- [ ] Sanctum: `SANCTUM_TOKEN_EXPIRATION=10080` (minutes — 7 days; tune for security/UX trade-off).
+- [ ] Google OAuth (Socialite sign-in + Drive picker): `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, `GOOGLE_REDIRECT_URI=${APP_URL}/api/auth/google/callback`, `GOOGLE_DRIVE_REDIRECT_URI=${APP_URL}/api/dashboard/google-drive/callback`. Both redirect URIs must be registered in Google Cloud Console for the OAuth client.
+- [ ] PayPal: `PAYPAL_MODE=live`, `PAYPAL_LIVE_*` filled, `PAYPAL_PLAN_PRO`, `PAYPAL_PLAN_ENTERPRISE`, `PAYPAL_WEBHOOK_ID`.
+- [ ] RBAC bootstrap: `ADMIN_EMAILS=ahsan@…[,…]` — first sign-in by any of these emails auto-assigns `super-admin` via spatie/laravel-permission.
+- [ ] Cache + queue: `CACHE_STORE=redis` (recommended for prod), `QUEUE_CONNECTION=redis` if Redis is available. Keep `database` only on tiny single-server deploys, and ensure `queue:work` is daemonized (see step 4).
+- [ ] File permissions on `.env`: `chmod 640` and owner = web user. NEVER world-readable.
+
+---
+
+## 2 · Deploy artifact (zip)
+
+The `backend/CLAUDE.md` "Production Deployment Zip Standard" section is the canonical zip recipe. Quick version:
+
+```bash
+cd backend
+php artisan optimize:clear
+composer install --no-dev --optimize-autoloader --classmap-authoritative
+npm ci && npm run build      # builds Vite assets if Nova-themed
+# zip into ../production-deploy/backend-production-YYYYMMDD-HHMMSS.zip
+```
+
+After zipping:
+```bash
+composer install              # restore dev deps locally so tests still work
+```
+
+- [ ] Zip excludes `tests/`, `node_modules/`, `.git/`, `*.sqlite`, `storage/logs/*.log`, `storage/framework/{cache/data,sessions,views}/*`.
+- [ ] Zip includes `vendor/` (production-only), built `public/build/` Vite assets, `composer.lock`, `package-lock.json`.
+
+---
+
+## 3 · On-server deploy (after upload + extract)
+
+Run these in order on the server, as the web user:
+
+```bash
+# 1. Install production deps if you didn't ship vendor/
+composer install --no-dev --optimize-autoloader
+
+# 2. Build front-end assets if not pre-built (yarn, not npm; usually pre-built in the zip)
+yarn install && yarn build
+
+# 3. Run migrations against production DB (forced — no prompt)
+php artisan migrate --force
+
+# 4. Symlink storage if first deploy
+php artisan storage:link
+
+# 5. Cache config + routes + views (don't skip — speeds boot 5–10x)
+php artisan config:cache
+php artisan route:cache
+php artisan view:cache
+
+# 6. Refresh permissions on storage + bootstrap/cache
+chown -R www-data:www-data storage bootstrap/cache
+chmod -R u+rwX,g+rX,o-rwx storage bootstrap/cache
+```
+
+- [ ] `php artisan about` reports `APP_DEBUG=false`, correct DB, correct queue/cache drivers.
+- [ ] `php artisan health-check` (or hit `/up`) returns 200.
+- [ ] Curl an API endpoint with a known-bad token — expect `401`, not a stack trace.
+
+---
+
+## 4 · Long-running processes (must be daemonized)
+
+`QUEUE_CONNECTION=database` (or `redis`) means jobs only run when a worker is alive. Without this, PayPal webhook handling, future analytics rollups, etc. will pile up silently.
+
+- [ ] systemd unit OR supervisor entry that runs `php artisan queue:work --tries=3 --max-time=3600` on boot.
+- [ ] Worker auto-restarts on failure.
+- [ ] Worker reload on deploy: `php artisan queue:restart` is run at end of step 3.
+- [ ] Log rotation configured for `storage/logs/laravel-*.log` (Laravel's `daily` channel rotates by date but doesn't prune).
+
+If using Horizon (Redis):
+- [ ] `horizon` service is up.
+- [ ] `/horizon` route is admin-gated (NOT publicly accessible).
+
+---
+
+## 5 · Scheduler cron (if using `app/Console/Kernel.php` schedule)
+
+Every Laravel project that uses `Schedule::command(...)` needs:
+
+```cron
+* * * * * cd /var/www/nativeupdatebe && php artisan schedule:run >> /dev/null 2>&1
+```
+
+- [ ] Cron entry exists for the web user.
+- [ ] `php artisan schedule:list` shows the expected scheduled jobs.
+
+---
+
+## 6 · Security gates
+
+- [ ] HTTPS is forced at the web-server level (nginx 301 from `:80`, or Cloudflare full-strict).
+- [ ] HSTS header is set with `max-age=31536000; includeSubDomains; preload`.
+- [ ] `/.env`, `/storage/`, `/.git/`, `/composer.json` return 404 over HTTP (not the file). Test with `curl -I`.
+- [ ] `/nova` is reachable but rejects non-super-admin users (test with a `user`-role account → redirect / 403).
+- [ ] `/horizon` (if used) is admin-gated.
+- [ ] PayPal webhook (`/api/webhooks/paypal`) verifies signatures — test by POSTing junk; expect 401.
+- [ ] Rate-limit on `/api/v1/updates/check` (configured via `throttle:` middleware) — verify by sending 60+ requests; expect 429.
+- [ ] CORS preflight: `curl -X OPTIONS -H "Origin: https://evil.example" https://nativeupdatebe.aoneahsan.com/api/v1/updates/check` returns no `Access-Control-Allow-Origin` for the bogus origin (config/cors.php uses an explicit allowlist).
+- [ ] RBAC bootstrap: every email listed in `ADMIN_EMAILS` will auto-receive the `super-admin` role on first sign-in. Verify the list matches the product stance (invite-only via `ADMIN_EMAILS` + manual `php artisan native-update:role-assign` for adds; open signup = leave `ADMIN_EMAILS` empty so everyone joins as `user`).
+
+---
+
+## 7 · Post-deploy smoke
+
+- [ ] Sign in via Google OAuth on the website dashboard — token issued, Nova accessible for any `super-admin`.
+- [ ] Create an App in the dashboard — row appears in DB.
+- [ ] Generate an API key — works.
+- [ ] Hit `/api/v1/updates/check` from a real device or curl with a valid `X-API-Key` and `X-Device-ID` — returns 200 + manifest.
+- [ ] Trigger a PayPal sandbox subscription end-to-end (in sandbox mode) and verify the webhook lands as a row update.
+- [ ] Tail `storage/logs/laravel-$(date +%F).log` for 5 minutes — no `error`/`emergency` lines.
+
+---
+
+## 8 · Rollback plan
+
+- [ ] Previous deploy's zip is preserved in `production-deploy/` (immutable artifact name).
+- [ ] DB migrations were reversible OR a snapshot was taken pre-migration.
+- [ ] Rollback procedure is one of: `(a)` swap symlinks back to the prior release dir, `(b)` re-extract the prior zip.
+- [ ] `queue:restart` is run after rollback so workers pick up the prior code path.
+
+---
+
+## 9 · Sign-off
+
+| Field | Value |
+|---|---|
+| Release tag | _e.g. `backend-v1.4.0`_ |
+| Deployed at | _UTC timestamp_ |
+| Deployed by | _name + git commit SHA_ |
+| Database snapshot | _path / id_ |
+| Smoke-test result | _link to log_ |
+| Approver | _name_ |
+
+Append this row to `docs/deployment/DEPLOY-LOG.md` after each deploy.
+
+---
+
+## Future automation (Batch 8)
+
+This manual checklist will be reduced once `.github/workflows/release.yml` automates: artifact build, test gate, deployment-zip creation, and tag-pinned publish. Items in §1 (env), §6 (security gates), and §7 (post-deploy smoke) will remain manual because they touch live secrets and live traffic.