# Gold Master release — sign-off (1.3.0)

A **Gold Master (GM)** build is one that passes **every** item below. No GM ship without a named sign-off.

**Product:** DBAOps Sovereign™  
**Vendor:** RHOYLLE INNOVATION EMPIRE LLC  

---

## 1. Automated

- [ ] `npm run build` at repo root completes with **exit code 0**
- [ ] `npm run setup` completes on a clean clone (Node 18+) and documents next steps (`docs/INSTALL-CROSS-PLATFORM.md`)
- [ ] **Optional — Docker all-in-one:** `docker compose -f docker-compose.all-in-one.yml up --build` serves UI at **:3000** and API at **:3041**; dashboard reaches API without CORS errors in default eval config
- [ ] API starts with `NODE_ENV=production`, valid `JWT_SECRET`, and **does not** exit on startup checks
- [ ] `npm run verify:smoke` (or `node src/api/scripts/smoke-verify.js`) passes against the running API (set `API_BASE` if needed)

## 2. Contract

- [ ] `GET /api/openapi.json` returns OpenAPI **3.0.3** and **info.version** matches **1.3.0**
- [ ] `GET /api/health` returns **status: ok** and **version: 1.3.0**
- [ ] `GET /api/license` returns expected posture for the seeded or customer license row

## 3. Security (staging)

- [ ] `SOVEREIGN_REQUIRE_AUTH=true` — protected routes reject unauthenticated callers
- [ ] `SOVEREIGN_INGEST_KEY` set — ingest endpoints reject missing key (when not using Operator JWT)
- [ ] Expired or inactive **license** — **POST** ingest returns **403** `LICENSE_BLOCK` (not GET)

## 4. Dashboard (staging)

- [ ] Login, Command Center, Coverage, Telemetry load without console errors
- [ ] **Release** label in header shows **1.3.0** when API is connected

## 5. Business (external to repo)

- [ ] Order / MSA executed  
- [ ] Support path defined for the customer  
- [ ] Backup and DR for **SovereignRepository** documented  

---

## Sign-off

| Role | Name | Date |
|------|------|------|
| Build owner | | |
| QA | | |
| Release approver | | |

---

© 2026 RHOYLLE INNOVATION EMPIRE LLC.
