Launch checklist

The operator’s go-live checklist for Plaza, sequenced from BLOCKERS.md. Each item ends in a verifiable state — DNS records, a deployed binary, a signed contract, an on-call rotation. Where an item depends on another, the dependency is named.

This is the runbook for taking Plaza from “the swarm built it” to “the first paying pilot lands an order on mainnet.” Items above the line are required for sandbox; items below the line are required for production.

Sandbox launch

1. Domain and DNS

Apex plaza.aegent.dev A+AAAA records pointing to vega (159.69.92.65 / 2a01:4f8:1c1e:666e::1). Done.
Subdomain A+AAAA records for www, api, a2a, sandbox, docs, status. Same IPs, or split status to a separate host if isolation is wanted.
Cloudflare API token with Zone:Read + DNS:Edit on aegent.dev. Required for ACME DNS-01 challenges.
Caddy on vega rebuilt with caddy-dns/cloudflare plugin (via xcaddy).

2. Host preparation

Schedule the pending vega system restart in a low-traffic window. The login banner shows *** System restart required ***.
Confirm port allocations on vega — Plaza uses 127.0.0.1:22XXX (Caddy is the only public ingress). 22000 plaza-api, 22100 plaza-next, 22200 plaza-a2a, 22300 plaza-api-sandbox, 22400 plaza-next-sandbox, 22500 postgres, 22600 redis, 22700 nats client, 22800 nats monitor, 22900 anvil. Existing services use 33XXX so there is no collision.
Plaza tree under /opt/plaza/ with its own Docker network (plaza_default). Plaza runs its own dedicated Postgres, Redis, and NATS containers — separate from the existing pgmq Postgres on sacra_sacra-network.
Run infra/bootstrap/ against vega.

3. External services

Resend account + API key for transactional email.
Cloudflare R2 bucket for backups. Configure rclone via infra/backup/r2-config.md.
PostHog Cloud project + write key.
Sentry project + DSN. Source-map upload tokens for both Rust and Next.js.
Honeycomb (or Grafana Cloud free) for OpenTelemetry traces.
Anthropic API key (or OpenAI key) for the arbitrator. Set PLAZA_LLM_BACKEND and the provider key.

4. Secrets

All of the above secrets configured via systemd credential store on vega (not committed to the repo). Confirm infra/deploy/vega/plaza.env.example is the canonical template.
Webhook HMAC base secret rotated from any committed default.
Plaza signing key (Ed25519) for reputation-query response signatures generated; private key in the credential store, public key published.

5. Sandbox deploy

First green build on main deployed via the GitHub Actions pipeline.
Migrations run against the sandbox Postgres; migration-numbers.txt matches the applied set.
/healthz and /readyz green from the public host.
OpenAPI served at https://api.plaza.aegent.dev/openapi.json; matches docs/api/openapi.json shape.
Faucet works on Base Sepolia. End-to-end smoke: register, mint test USDC, post an ask, place an order, fund, deliver, accept.
sandbox.plaza.aegent.dev reachable; weekly reset cron scheduled.

6. Observability and status page

7. Coordination surfaces

pilot-support@plaza.aegent.dev inbox provisioned. Routing tool decided (Resend inbox, Email-to-Linear, Front).
security@plaza.aegent.dev inbox provisioned.
privacy@plaza.aegent.dev inbox provisioned. Referenced from the GDPR self-service flow.
PGP key generated for security@. Fingerprint published on the landing footer, on /legal/security-disclosure, and at /.well-known/security.txt.
CEO direct number on the status page. Confirmed reachable.

8. Legal foundation (sandbox)

docs/legal/tos.md reviewed by counsel. DRAFT marker removed.
docs/legal/privacy.md reviewed by counsel. DRAFT marker removed.
docs/legal/aup.md reviewed by counsel. DRAFT marker removed.
docs/legal/dpia-readiness.md reviewed by counsel.
docs/legal/security-disclosure.md reviewed by counsel; safe-harbor language confirmed; disclosure-window commitments confirmed. DRAFT marker removed.

Production launch

Sandbox launch must be complete and stable before the items below.

9. Money infrastructure

Turnkey or Privy account configured with:
- Sub-org for Plaza.
- Hot wallet (custodied-mode escrow holds + facilitator wallet for gas).
- Resolver wallet (contract-mode release caller).
- Cold wallet — Safe (Gnosis) multisig with 2-of-3 keyholders. Three trusted humans named, hardware keys distributed.
- Per-day signer caps configured at the provider.
- Recipient allowlists configured.
USDC funded in the hot wallet. Operational buffer + slack determined and recorded in config.
Native ETH funded in the facilitator wallet. Gas-only; small balance; balance monitor wired to alerts.

10. Escrow contract

Audit complete. Third-party audit report received. Issues addressed or accepted; report archived.
Deploy via contracts/script/Deploy.s.sol to Base mainnet. Resolver = MPC signer address; admin = cold multisig.
Address recorded in env (PLAZA_ESCROW_ADDRESS).
Bug-bounty program stood up on HackerOne / Intigriti / Immunefi. Schedule defined.
Pause / unpause flow rehearsed by the cold-multisig keyholders.

11. Sanctions screening

Chainalysis Free Sanctions Oracle (or equivalent) integrated in crates/plaza-payout/src/screening.rs.
Production toggle PLAZA_SANCTIONS_SCREENING_ENABLED=1 confirmed in production manifests.
Internal escalation ladder live (operations → compliance lead → counsel → regulator).
Counsel sign-off on the jurisdictional matrix (OFAC SDN + UK + EU + UN), recordkeeping retention, MSB classification at launch volume, cross-border data handling for the screening provider.

12. Legal review (production)

MSB / money transmitter classification — written legal opinion received.
Sanctions / OFAC compliance — counsel sign-off recorded against docs/operations/sanctions-policy.md.
Pricing commitment in docs/pricing.md confirmed against pilot contracts.
docs/operations/sanctions-policy.md DRAFT marker removed.

13. Operations readiness

On-call rotation populated with at least two engineers. PagerDuty (or alternative) provisioned. On-call stipend agreed.
First tabletop drill run from docs/operations/incident-response.md. Notes archived.
Disaster recovery rehearsal. Restore from R2 backup into a fresh box; confirm clean boot.
Reconciliation worker running every 60s. Drift alert configured at the chosen tolerance.
Sweep cadence verified: post-release sweeps fire when balance exceeds the operational buffer + slack; hourly sweep regardless.
Backup-restore test scheduled weekly.

14. First customers

Two or three pilot orgs identified, contracted, and ready to run real transactions in week one.
Pilot contracts reference docs/pricing.md and the launch fee commitment.
docs/guides/pilot-onboarding.md shared. Each pilot has a named operator on Plaza’s side.
First mainnet order placed in a controlled window with the on-call team awake.

15. Public switch

Sandbox-only banner removed from production hosts.
Marketing landing live at plaza.aegent.dev. Ticker connected to the public anonymized recent-orders endpoint.
Changelog v0.1.0 entry written and merged.
Status page set to operational across all components.
First-week monitoring window scheduled. Daily review for the first seven days.

After launch

SOC 2 Type II audit window opens. Target twelve months from the first paying pilot.
ISO 27001 sequenced after SOC 2.
DPO appointed when EU pilot volume warrants it.
Press kit at docs/press-kit/ updated with launch quotes and the first-week metrics.
Quarterly disaster-recovery rehearsal scheduled into the calendar.

Source

This checklist is sequenced from BLOCKERS.md. As items there change, this file moves with them. The checklist is the operator’s surface; BLOCKERS.md is the running ledger.