# Production Readiness Checklist

- [ ] Composer install completed from a reviewed lock/dependency set.
- [ ] `./scripts/verify.sh` passes on staging.
- [ ] MySQL/MariaDB migrations pass on an empty database and an upgrade copy.
- [ ] HTTPS, secure cookies and production environment settings are enabled.
- [ ] Document root points only to `public/`.
- [ ] Queue worker and scheduler are monitored.
- [ ] Company, branch, chart of accounts, fiscal periods and VAT codes are approved.
- [ ] All default roles are reviewed using test users.
- [ ] Branch isolation is user-acceptance tested.
- [ ] Maker-checker, posting, reversal, contra and period-lock controls are tested.
- [ ] Invoice, bill, receipt, payment, quotation and adjustment-note PDFs are approved.
- [ ] Mandatory dual-role party accounting scenario passes.
- [ ] Bank reconciliation and VAT-to-ledger reconciliation are tested.
- [ ] Backup, off-server retention and full restore are tested.
- [ ] Logs do not expose secrets or stack traces.
- [ ] Accredited e-invoice adapter remains disabled until provider acceptance.
- [ ] Accountant, operations manager and company owner have signed off.