# Launch Readiness

## Production Checklist

- `npm run check` passes.
- `npm run smoke:production` passes in strict mode against the deployed base URL.
- `GET /health` passes through Cloudflare.
- Owner `GET /v1/ops/metrics` returns without exposing secrets.
- Signup is invite-gated unless launch explicitly approves open signup.
- Stripe checkout creates sessions and signed webhooks grant credits.
- `GET /v1/post`, `GET /v1/reel`, and `GET /v1/comments` pass with owner unbilled smoke key.
- Parse smoke passes only after hosted parser dependency `IGS-33` is configured.
- HikerAPI post/reel/comments smoke passes with production `HIKERAPI_KEY`.
- Apify fallback smoke passes with production `APIFY_TOKEN` only if Apify remains in provider order.
- Railway volume is mounted at `/data` and `IGSKILL_STATE_FILE=/data/igskill-state.json`.
- State file backup procedure is tested.
- Cloudflare bypasses cache for `/v1/*` and `/health`.
- Public docs, policy, terms, pricing, secrets, deploy, failover, error taxonomy, and runbook are current.

## Known Risks

- HikerAPI media responses expose reel video metadata/URLs, but no verified speech transcript field in the tested schema; transcript=true depends on hosted transcription fallback, relay Codex auth, and a real Reel smoke through the live HLM-537 `claudex/transcribe` endpoint.
- Live Apify transcript reliability remains optional fallback work until `APIFY_TOKEN` smoke runs against representative reels.
- Bright Data fallback remains a skeleton until account fixtures and schema verification exist.
- Hosted parser production execution depends on `IGS-33`.
- Stripe webhook verification is lightweight in MVP and should move to raw-body Stripe SDK verification before public launch.
- JSON state is single-replica only; horizontal scaling requires a database or shared storage migration.
- Provider ordering, comment ordering, metrics, and media URLs may differ from the Instagram app.
- OCR/vision and profile/search are deferred.

## Launch Gate

Do not open public signup until:

- Strict production smoke has no failures or skips.
- Provider, parser, Stripe, and state backups are verified.
- Abuse controls and invite/rate-limit policies are active.
- Terms and policy copy have operator/legal review.