# Zavvion Events Commercial Lite - Immediate Architect Handover Note

Cham is handing over the Commercial Lite MVP for urgent human architect review.

## Start Here

1. Open `README-FIRST.md`.
2. Open `00-executive/GO-NO-GO-DECISION-SHEET-20260526.md`.
3. Open `00-executive/FINAL-HANDOFF-MANIFEST-20260526.md`.
4. Review `01-project-docs/commercial-lite-production-readiness-report-20260526.md`.
5. Assign testers using `03-human-testing-pack/Zavvion-Commercial-Lite-Test-Matrix-20260526.xlsx`.

## Current Handover Verdict

- Local/demo review: ready for architect review.
- Staging deployment: conditional on environment setup and database install.
- Real paid commercial events: not yet approved.

## First-Day Architect Priorities

1. Confirm exact deployed branch/commit.
2. Confirm whether local dirty-tree changes are already pushed or need review.
3. Configure staging/production `.env` using safe templates only.
4. Configure Stripe test keys, webhook signing secret, and connected organiser account.
5. Run one signed Stripe test checkout and prove order, ticket, QR, and ledger creation.
6. Confirm PHP GD and ClamAV/equivalent media scanning.
7. Block/remove public local review/showcase/password-free role pages before production.
8. Run the human P0 test matrix on deployed staging.
9. Repeat mobile/tablet testing on real devices.
10. Decide go/no-go using the executive decision sheet.

## Non-Negotiable Launch Blockers

- Do not launch real paid events until signed Stripe webhook payment is proven.
- Do not expose public cash/counter/external-terminal payment methods.
- Do not let browser redirect alone mark payment successful.
- Do not allow unallocated ticket types to appear on public event pages.
- Do not leave local review/showcase/password-free role pages publicly accessible.
- Do not launch with `.env`, source artifacts, schema files, logs, or backups publicly reachable.
- Do not launch with `APP_DEBUG=true`.
- Do not launch without Composer audit rerun on a normal networked machine.

## Where To Put Evidence

Use `04-staging-evidence-placeholders/` for:

- Stripe signed webhook proof.
- Mobile/tablet screenshots.
- Role-boundary/security evidence.
- Deployment environment proof.
- Completed human test results.