P0 launch readiness blocker

ottolms.com production domain readiness

Review the ottolms.com domain map, production environment gates, provider setup, auth callback requirements, RLS blockers, and final DNS cutover boundary.

Otto LMS Launch Control

Owner · Sam Founder

P0 launch readiness blocker

ottolms.com production domain readiness

Launch map for the live public ottolms.com domain while keeping production data, provider credentials, production auth, app subdomains, and school tenant access blocked until the launch gates pass.

Public domain live, app gated

GitHub, Vercel, and apex/www DNS are connected. This page still does not attach a production database, create OAuth apps, enable Stripe live mode, send email, or approve live school data. Signed-in app cutover still requires explicit Sam approval.

Domain surfaces

Public, app, demo, guide, verify, console, and wildcard surfaces.

Environments

Local, preview, staging, and production lanes.

Provider gates

External services that must be configured before launch.

Launch gates

Owner, security, database, domain, and rollback gates.

Domain surfaces

What should be available under ottolms.com

8 surfaces

ottolms.com

Public visitors

Redirect live

Purpose: Redirects public visitors to the current www production site.
Access model: Public redirect only; no student records or signed-in data.
Launch gate: GoDaddy A record, Vercel redirect, HTTPS, and rollback path verified.

www.ottolms.com

Public visitors

Production live

Purpose: Public production surface for marketing, pricing, security, AI, accessibility, and demo request pages.
Access model: Public-safe content only; no student records or signed-in role data.
Launch gate: GoDaddy CNAME, Vercel production routing, and HTTPS verified on 2026-10-14.

app.ottolms.com

Signed-in school users

Blocked by launch gates

Purpose: Main authenticated student, instructor, staff, and school admin app.
Access model: WorkOS/OAuth session, tenant membership, role permissions, withTenant, and forced RLS.
Launch gate: Production auth, tenant isolation, support access, RLS regression, and external security review pass.

demo.ottolms.com

Prospects and Otto team

Demo activation gated

Purpose: Otto Demo School with invented data and demo-specific labeling.
Access model: Demo-only identities or approved guest demo path; no production school tenant access.
Launch gate: Demo tenant creation, reset/sandbox controls, guest links, and no-customer-data audit.

guide.ottolms.com

Public help readers

Public surface planned

Purpose: Public Otto Guide for sign-in help, how-to content, references, and release notes.
Access model: Public-safe documentation with no tenant-specific private data.
Launch gate: Guide publishing workflow, content review, support routing, and public-safe link audit.

verify.ottolms.com

Public document verifiers

Verification gated

Purpose: Public signed-document verification by upload or certificate number.
Access model: Public verification response only; no broad document or student lookup.
Launch gate: Sealed PDF storage, hash persistence, public verifier, abuse controls, and retention policy.

console.ottolms.com

Otto internal team

Internal surface gated

Purpose: Separate Otto Console for setup, support, operations, and school administration.
Access model: Otto-team auth, support grants, step-up, restricted actions, and audit logging.
Launch gate: Console app boundary, internal roles, support grant implementation, and owner approvals.

*.ottolms.com

School-specific users

Wildcard planned

Purpose: Future school subdomains such as school-name.ottolms.com.
Access model: Host header resolves tenant, then membership, role, withTenant, and forced RLS must agree.
Launch gate: Wildcard domain, tenant-slug uniqueness, host-to-tenant routing, callback policy, and RLS regression.

Environment lanes

Local, preview, staging, and production stay separate

4 environments

Local

Available now

Hostname policy: localhost or 127.0.0.1 only.
Data policy: Invented fixture schools and deterministic proof data only.
Promotion gate: Focused tests, typecheck, format, build, and local smoke pass.

Preview

Available through Vercel

Hostname policy: Vercel preview URLs only; separate from www.ottolms.com production.
Data policy: No real student data; fake-school branch data only.
Promotion gate: Code gates, secret scan, fake seed check, and Sam route review.

Staging

External setup needed

Hostname policy: staging or preview hostnames, not production school hostnames.
Data policy: No real student data; staging fake-school fixtures only.
Promotion gate: Role journeys, provider sandbox checks, rollback drill, and security/privacy review.

Production

Public domain live; live data gated

Hostname policy: ottolms.com, app.ottolms.com, demo.ottolms.com, guide.ottolms.com, verify.ottolms.com, console.ottolms.com, and approved school subdomains.
Data policy: Live data only after contracts, production auth, forced RLS, backups, support grants, and owner approval.
Promotion gate: Full launch checklist and explicit Sam cutover approval.

Provider gates

What is connected and what still blocks live school operations

9 gates

Vercel project

Hosting

Connected

Requirement: Use Vercel for now, connect the deployable app with apps/web as the project root, set build command, and separate preview, staging, and production environments.
Blocked until: Completed externally: Vercel project otto-lms is connected to GitHub and serving production.

Source control

GitHub or Vercel source

Connected

Requirement: Use the private GitHub repository as the source for Vercel Git deployments.
Blocked until: Completed externally: https://github.com/ottolms/otto-lms is pushed on main and imported by Vercel.

DNS and wildcard TLS

GoDaddy domain

Apex/www live

Requirement: Guide Sam through GoDaddy DNS for ottolms.com, configure apex, www redirect, named subdomains, and decide whether wildcard subdomains require Vercel nameservers.
Blocked until: Apex and www are verified; app, demo, guide, verify, console, wildcard TLS, and tenant host routing remain future gates.

Auth callback URLs

WorkOS, Google, Microsoft

Setup required

Requirement: Register HTTPS production callback/logout URLs for app.ottolms.com and any allowed school subdomain callback pattern.
Blocked until: WorkOS redirect URIs and Google/Microsoft OAuth apps are configured and tested.

Production database

Supabase/Postgres

Blocks live data

Requirement: Provision production Postgres with secrets in the host secret store, forced RLS, RLS audit, pgTAP suite, backups, and PITR decision.
Blocked until: db:migrate, db:rls:audit, test:rls, backup restore drill, and security advisor review pass.

Stripe live mode

Payments

Live mode blocked

Requirement: Keep test mode in staging and block live money movement until Connect, webhooks, refunds, ledgers, card-fee gates, and owner review pass.
Blocked until: Payments review, live keys, webhook endpoint registration, and accounting review are complete.

Email provider and sender DNS

Provider pending

Requirement: Choose provider, configure sender domains, SPF/DKIM/DMARC, sandbox inboxes, and production send approvals.
Blocked until: Provider is selected and DNS verification passes without exposing real sends in staging.

AI zero-data-retention

Production AI blocked

Requirement: Keep production AI disabled for restricted data until Anthropic or OpenAI zero-data-retention terms are obtained and policy gates pass.
Blocked until: Zero-data-retention, minimization, evals, and Private AI policy gates are approved.

Observability and incident response

Sentry/status/paging

Setup required

Requirement: Configure error monitoring, environment labels, release tracking, uptime checks, alert ownership, and incident runbook.
Blocked until: Staging incident rehearsal and rollback communication path pass.

Launch gates

What blocks production cutover

8 launch gates

Code verification

Engineering

Local proof only

Requirement: typecheck, lint, unit tests, format, build, secret scan, dependency scan, and route smoke checks pass.
Evidence: Root verify scripts exist; this ticket remains a proof until CI and host checks run remotely.

Database isolation

Platform and database reviewer

Blocks live data

Requirement: Production-like migration, RLS audit, pgTAP, backup/restore, and non-owner app credentials pass before live data.
Evidence: Ticket 183 captures the RLS production gate.

Production auth

Identity owner

Blocks sign-in launch

Requirement: WorkOS production app, Google OAuth, Microsoft Entra, MFA, session policy, step-up, and invitation lifecycle are configured.
Evidence: Ticket 182 captures the auth provider and tenant handoff gate.

Domain and TLS

Infrastructure owner

Apex/www live; app domains gated

Requirement: Apex, www, app, demo, guide, verify, console, and wildcard subdomains resolve with HTTPS and correct routing.
Evidence: Verified on 2026-10-14: ottolms.com redirects to www.ottolms.com, and www.ottolms.com serves the Vercel production app.

Provider live-mode review

Operations owners

Live providers blocked

Requirement: Stripe, email, SMS, AI, Sentry, storage, and any outbound/live provider are approved per environment.
Evidence: Provider gates keep live calls disabled until owner approval.

Security and privacy review

Security/privacy reviewer and Sam

Expert review needed

Requirement: FERPA/DPA posture, secrets, TLS, backups, access grants, audit logging, restricted records, and external review are accepted.
Evidence: Existing hardening and external security review proofs are local evidence only.

Public/private content boundary

Product and support

Review required

Requirement: Launch public marketing first while app, console, live auth, live providers, and live school data remain gated.
Evidence: Sam approved public marketing first on 2026-10-13; domain surfaces split public, authenticated, demo-only, and internal hostnames.

Cutover and rollback

Founder and infrastructure owner

Public cutover complete; app gated

Requirement: App-domain DNS, rollback, backup restore, incident owner, and launch communication are rehearsed before signed-in production.
Evidence: Public apex/www cutover is complete; signed-in app and live data cutover remain blocked by production gates.

Sources

Product, deployment, and official provider references

12 sources

Technical architecture

docs/prd/34-technical-architecture.md

Technical architecture

Evidence: Defines browser/PWA delivery at school-slug.ottolms.com or a custom domain, Next.js on Vercel, subdomain tenant routing, and production environments.
Readiness use: Primary source for the product domain and hosting shape.

Product scope

docs/prd/08-product-scope-and-release-strategy.md

Product scope

Evidence: Requires one responsive school web application at school-slug.ottolms.com or a custom domain.
Readiness use: Confirms school portals are under the Otto LMS domain model.

Support and onboarding

docs/prd/31-support-onboarding-and-data-migration.md

Support and onboarding

Evidence: Calls out public guide, demo tenant, verify-document, and Otto Console style surfaces such as guide.ottolms.com, demo.ottolms.com, verify.ottolms.com, and console.ottolms.com.
Readiness use: Separates public help, demo school, public verification, and internal Otto operations.

Preview/staging deployment

docs/deployment/preview-staging.md

Preview/staging deployment

Evidence: Defines local, preview, staging, and production environments, with fake-school-only data before production and disabled DNS cutover.
Readiness use: Provides the promotion model this domain ticket extends.

Production auth readiness

docs/specs/182-production-auth-oauth-readiness-and-rls-handoff/spec.md

Production auth readiness

Evidence: Keeps WorkOS, Google, Microsoft, MFA, sessions, step-up, support grants, and tenant/RLS handoff as production activation gates.
Readiness use: Shows domain launch cannot happen before production auth redirects and callback URLs are configured.

Tenant isolation readiness

docs/specs/183-tenant-isolation-rls-readiness-and-production-data-gates/spec.md

Tenant isolation readiness

Evidence: Blocks production school data until db:migrate, db:rls:audit, and test:rls pass against a production-like database.
Readiness use: Keeps live data out of ottolms.com until database isolation gates are green.

Vercel domains

https://vercel.com/docs/domains/working-with-domains

Vercel domains

Evidence: Official docs describe custom domains, subdomains, and wildcard domains for scaling domain-based applications.
Readiness use: Confirms the hosting domain mechanism to verify before DNS cutover.

GoDaddy DNS records

https://www.godaddy.com/en-uk/help/manage-dns-records-680

GoDaddy DNS records

Evidence: Official GoDaddy help says domains using GoDaddy nameservers can add, edit, or delete DNS records, including TXT records used for ownership verification and sender policies.
Readiness use: Confirms Sam can make DNS record changes in GoDaddy when Vercel provides values.

GoDaddy nameservers

https://www.godaddy.com/en-uk/help/change-my-domain-nameservers-664

GoDaddy nameservers

Evidence: Official GoDaddy help says nameservers can be changed in the GoDaddy account, and that the DNS zone is managed where the active nameservers point.
Readiness use: Flags that wildcard-domain choices may require a nameserver decision rather than only record edits.

Vercel monorepos

https://vercel.com/docs/monorepos

Vercel monorepos

Evidence: Official docs describe selecting the root directory for a monorepo project before deployment.
Readiness use: Flags apps/web as the project root decision before connecting the repository.

WorkOS redirect URIs

https://workos.com/docs/reference/authkit/authentication/get-authorization-url

WorkOS redirect URIs

Evidence: Official docs require configured redirect URIs and HTTPS redirect URIs in production.
Readiness use: Blocks production sign-in until app.ottolms.com and subdomain callbacks are registered.

Supabase production checklist

https://supabase.com/docs/guides/deployment/going-into-prod

Supabase production checklist

Evidence: Official docs call out RLS, security review, availability, backups, and PITR considerations before production.
Readiness use: Anchors database and backup gates before real student records are attached.

Proof boundary

Public domain is live, live school data remains blocked

Live data gated

This is deterministic ottolms.com production-domain readiness proof. It now records the externally completed GitHub, Vercel, and apex/www DNS setup.
Sam confirmed ottolms.com is registered at GoDaddy, Vercel is acceptable for now, the private GitHub repository is connected, and public marketing should launch before the signed-in app.
No production database, WorkOS production app, Google OAuth app, Microsoft Entra app, Stripe live key, email sender, AI provider, Sentry project, app subdomain, wildcard route, or live school data is created by this page.
Production school data remains blocked until production auth, db:migrate, db:rls:audit, test:rls, backups, support grants, and owner/security review pass.
Local demo login must remain disabled outside local development; demo.ottolms.com needs a separate demo-safe access path before public demos.
Public ottolms.com surfaces may launch before live school data only if they stay public-safe and do not imply production auth, payment, signing, AI, or tenant-data activation.
The signed-in app cutover still requires explicit Sam approval after staging verification and rollback readiness.