launch: go-live readiness checklist

[jonmatum]

Priority: P0 — final gate
Parent: #34

Context

Single issue that gates the production launch. Cannot be closed until every checkbox passes.

Checklist

Code & tech debt

• Tech debt and code review findings — deep audit 2026-03-23 #32 🔴 Critical items closed (C-1, C-2, C-3)
• Tech debt and code review findings — deep audit 2026-03-23 #32 S-7 IAM s3:DeleteObject fix shipped

Infra parity & hardening

• Prod parity sync (sub-issue) closed
• WAF enabled in prod with non-zero block count on synthetic attack traffic
• All Lambdas have DLQs; DLQ-depth alarm wired
• Deletion protection on DynamoDB + Cognito in prod

Reliability

• AWS Backup plan active; one successful restore drill recorded
• Reserved concurrency set on capture + enrich
• Enrich retry path verified (REL-3 in AWS Well-Architected Framework assessment — gaps and remediation plan #28)

Observability

• Structured logging live; correlation IDs propagate end-to-end
• CloudWatch dashboard linked from docs
• Critical vs info SNS topics wired to an on-call destination
• SLO doc published

Security & privacy

• Per-user rate limits + input length caps live
• Secret rotation procedure documented + at least one rotation executed
• User data export + deletion flows tested with a real account

Quality

• CI green on main: npm test, tsc --noEmit, terraform validate, terraform fmt -check
• Dependency scan + npm audit gate passing
• Load drill executed; p95 within SLO at target load
• Chaos drill executed (kill one Lambda, throttle DDB, block WAF rule) — system recovers

Launch

• Frontend error reporting (RUM) capturing events
• docs/ops/runbooks/ covers the top 5 incident classes
• DNS + TLS + cookies verified on the prod domain
• main deploys to prod with no manual steps and a green smoke test

Acceptance

Issue is closed only when all boxes above are ticked and all sub-issues of #34 are closed (P0 mandatory, P1 strongly recommended).