Public Launch Readiness
Superseded — 2026-08-16
This dated readiness record and its
NO-GOare superseded by 2026-08-17 launch readiness. Preserved as observed.
Release boundary:
releaseEligible: false. This is a bench-local readiness record. It is not a canonical patch, locked build, signed package, provenance record, legal approval, or authorization to launch or ship.
Verdict
Public launch is not ready. The host health probe is green, but the newest-backup restore drill fails because the restored quiz count is 13 while the live count is 18. Public legal pages expose 45 placeholder occurrences. WordPress has no container healthcheck, alerting and off-host backups are absent, image definitions are not digest-pinned, owner/operator values are unresolved, and canonical release inputs are unavailable.
The exact E1 command outputs and E2 observations are preserved in evidence/2026-08-16-readiness/verify.json. No extra backup was forced; the restore drill exercised the newest timer-produced artifact.
Readiness matrix
| Area | State | Evidence | Owner input required |
|---|---|---|---|
| Seven-check host health probe | proven | E1 observation: verify.json.commands.health exited 0 with seven ok results. | None. |
| Hourly health timer and latest health service result | proven | E1 observation: verify.json.commands.timers lists wrdp-health.timer; verify.json.commands.healthService records Result=success, ExecMainStatus=0. | None. |
| Nightly backup timer and latest backup service result | proven | E1 observation: verify.json.commands.timers lists the 03:30 wrdp-backup.timer; verify.json.commands.backupService records Result=success, ExecMainStatus=0. | None. |
| Newest backup archive checks and restored schema family | proven | E1 observation: verify.json.commands.restoreDrill.stdout records four archive checks OK, matching table count, matching siteurl, and 15 restored QuizWizz tables. | None. |
| Newest backup content freshness | failing | E1 observation: verify.json.commands.restoreDrill exited 1; restored qw_quiz count 13 did not match live count 18. | None to establish the failure; the operator must produce and successfully drill a current backup before launch. |
| Restore-drill scratch cleanup | proven | E1 diagnosis: verify.json.commands.restoreDrill.diagnosis.scratchDatabasePresentAfterExit is false. | None. |
| Backup-directory access hardening | proven | E1 observation: verify.json.commands.backupDirectoryPermissions records root:root 700 /home/loca/backups/wrdp. | None. |
| TLS certificate | proven | E1 observation: verify.json.commands.tls records notAfter=Oct 21 20:15:39 2026 GMT, after the 2026-08-16 observation date, for CN=wrdp.loca.zone. | None. |
| Loopback-only WordPress backend with nginx TLS ingress | proven | E2 observation: verify.json.observations.exposure records 127.0.0.1:${WP_PORT:-51080}:80, the available vhost, and its enabled symlink; citation docker-compose.yml:26-27; /etc/nginx/sites-available/wrdp.loca.zone:1-50. | None. |
| MariaDB container healthcheck | proven | E2 observation: verify.json.observations.healthcheckCoverage.database is true; citation docker-compose.yml:14-18. | None. |
| WordPress container healthcheck | failing | E2 observation: verify.json.observations.healthcheckCoverage.wordpress is false; restart: unless-stopped cannot detect an unresponsive PHP container. | None to establish the failure; an operator-approved healthcheck implementation is required. |
| Current debug and file-edit posture | proven | E2 observation: verify.json.observations.runtimeDebug records WORDPRESS_DEBUG=true, log path /var/log/wp/debug.log, WP_DEBUG_DISPLAY=false, and DISALLOW_FILE_EDIT=true; citation docker-compose.yml:33-37. | None. |
| Public-launch debug-logging posture | blocked-owner | The host proves the current bench posture, but cannot decide whether public production keeps debug logging enabled. docker-compose.yml:33-37. | Supply the explicit public-launch choice: keep WORDPRESS_DEBUG logging enabled or disable it. |
| Resolved runtime image rollback identities | proven | E1 observation: verify.json.commands.resolvedImages records immutable local IDs and repository digests for MariaDB, WordPress, and WordPress CLI. | None. |
| Compose image immutability | failing | E2 observation: verify.json.observations.imagePosture.digestPinnedInCompose is false; definitions are mariadb:11.4, wordpress:latest, and wordpress:cli, cited at docker-compose.yml:3,21,50. | None to establish the failure; the image policy inputs below remain owner-blocked. |
| WordPress core runtime | proven | E1 observation: verify.json.commands.wordpressCore records WordPress 7.0.4. | None. |
| Administrator inventory | proven | E1 observation: verify.json.commands.administrators records one administrator, ID 1, login admin, registered 2026-07-23 18:43:07. | None. |
| QuizWizz runtime status | proven | E1 observation: verify.json.commands.plugins records quizwizz active at 1.10.0 with no available update. | None. |
| External alerting | failing | E2 observation: verify.json.observations.alertingConfigured is false; failures are visible only through systemd and the journal, cited at q5vault/operations.md:74. | None to establish the failure; five concrete alerting values remain owner-blocked below. |
| Off-host backup | failing | E2 observation: verify.json.observations.offHostBackupConfigured is false; the operated copy is on-host only, cited at q5vault/operations.md:53. | None to establish the failure; seven concrete off-host values remain owner-blocked below. |
| Public legal placeholder surface | failing | E2 observation: verify.json.observations.legalPlaceholderCounts records Privacy 14, Terms 12, Operator Information 19, total 45; rendered HTML and visible-body counts agreed. | None to establish the failure; legal/operator values and review remain owner-blocked below. |
| Access-log review cadence | blocked-owner | Placeholder at q5vault/operations.md:32. | Supply the exact review cadence. |
| Access-log review owner | blocked-owner | Placeholder at q5vault/operations.md:33. | Supply the named review owner. |
| Access-log escalation destination | blocked-owner | Placeholder at q5vault/operations.md:34. | Supply the exact escalation destination. |
| Access-log data-minimization review | blocked-owner | Placeholder at q5vault/operations.md:35. | Supply the data-minimization review procedure and cadence. |
| Off-host backup destination | blocked-owner | Placeholder at q5vault/operations.md:54. | Supply the destination URI or service. |
| Off-host backup credentials | blocked-owner | Placeholder at q5vault/operations.md:55. | Supply the credential source, not secret material in this page. |
| Off-host backup encryption | blocked-owner | Placeholder at q5vault/operations.md:56. | Supply the transport-encryption and at-rest-encryption requirements. |
| Off-host backup retention | blocked-owner | Placeholder at q5vault/operations.md:57. | Supply the remote retention and immutability policy. |
| Off-host backup schedule | blocked-owner | Placeholder at q5vault/operations.md:58. | Supply the transfer schedule. |
| Off-host restore ownership | blocked-owner | Placeholder at q5vault/operations.md:59. | Supply the restore owner and contact route. |
| Off-host restore proof | blocked-owner | Placeholder at q5vault/operations.md:60. | Supply the date and evidence location for the last successful remote-copy restore proof. |
| Alert destination | blocked-owner | Placeholder at q5vault/operations.md:75. | Supply the alert destination. |
| Alert transport or endpoint | blocked-owner | Placeholder at q5vault/operations.md:76. | Supply the alert transport and exact endpoint. |
| Alert credentials | blocked-owner | Placeholder at q5vault/operations.md:77. | Supply the credential source, not secret material in this page. |
| Alert severity routing | blocked-owner | Placeholder at q5vault/operations.md:78. | Supply severity routing and quiet hours. |
| Alert delivery proof | blocked-owner | Placeholder at q5vault/operations.md:79. | Supply the test recipient and last received-delivery proof. |
| Image review cadence | blocked-owner | Placeholder at q5vault/operations.md:91. | Supply the image review cadence. |
| Image maintenance window | blocked-owner | Placeholder at q5vault/operations.md:92. | Supply the maintenance window. |
| Image approver and operator | blocked-owner | Placeholder at q5vault/operations.md:93. | Supply the approver and operating owner. |
| Image digest-pinning policy | blocked-owner | Placeholder at q5vault/operations.md:94. | Supply the digest-pinning policy. |
| Image pre-update backup rule | blocked-owner | Placeholder at q5vault/operations.md:95. | Supply the pre-update backup requirement. |
| Image rollback policy | blocked-owner | Placeholder at q5vault/operations.md:96. | Supply rollback image digests and maximum rollback age. |
| Legal effective date | blocked-owner | Open Terms input at q5vault/audits/qwizz/frontier.md:95. | Supply the effective date. |
| Legal operator identity | blocked-owner | Open at q5vault/audits/qwizz/frontier.md:93-95 and q5vault/audits/qwizz/2026-08-02-f-program.md:84-85. | Supply the legal operator identity. |
| Legal operator address | blocked-owner | Visible deployment placeholder at q5vault/audits/qwizz/2026-08-02-f-program.md:84-85. | Supply the operator address. |
| Legal contact routes | blocked-owner | Visible deployment placeholder at q5vault/audits/qwizz/2026-08-02-f-program.md:84-85. | Supply the required operator and legal contact routes. |
| Governing jurisdiction | blocked-owner | Open Terms input at q5vault/audits/qwizz/frontier.md:95 and visible placeholder at q5vault/audits/qwizz/2026-08-02-f-program.md:84-85. | Supply the governing jurisdiction. |
| Retention owner | blocked-owner | Visible deployment placeholder at q5vault/audits/qwizz/2026-08-02-f-program.md:84-85. | Supply the named retention owner. |
| Comparable deployment-specific legal facts | blocked-owner | Visible deployment placeholders at q5vault/audits/qwizz/2026-08-02-f-program.md:84-85. | Supply every remaining deployment-specific value requested by the installed drafts. |
| Legal review | blocked-owner | Required before launch at q5vault/audits/qwizz/frontier.md:93-95. | Supply completed legal review and approval of the public drafts. |
| Canonical source identity | blocked-owner | q5vault/audits/qwizz/2026-08-16-current-source-preservation.md:53; SOURCE-PROVENANCE.md:3-27 forbids inferring identity from this bench. | Supply the canonical repository URL and immutable commit SHA. |
| Locked release toolchain | blocked-owner | q5vault/audits/qwizz/2026-08-16-current-source-preservation.md:54; required by BUILDING.md:7-12. | Supply the locked toolchain and required lockfiles. |
| Canonical quality, compatibility, and provenance gates | blocked-owner | q5vault/audits/qwizz/2026-08-16-current-source-preservation.md:55-56; required by BUILDING.md:64-91. | Supply protected CI results, compatibility-gate results, deterministic manifests, SBOM, provenance, and release-eligible attestation. |
| Protected signing and release comparison | blocked-owner | q5vault/audits/qwizz/2026-08-16-current-source-preservation.md:57; required by BUILDING.md:106-117. | Supply authorized signing and independent release-comparison evidence without exposing key material. |
Launch gate
- decision:
NO-GO - host-health probe: green
- newest-backup restore: failing
- public legal placeholders: failing
- owner/operator values: blocked
- canonical release authorization: blocked
- production wiki publish: not performed