# Managed Customer Pilot Runbook

This bundle is for the Korosh technical team only. It is not a customer self-installer.

## Isolation

Create a unique database, filesystem root, storage directory, domain, APP_KEY, session cookie, cache prefix, installation ID, recovery secret and license state. Never reuse another installation's `.env`.

## Install

1. Verify `checksums/SHA256SUMS` before extraction.
2. Extract the Core artifact into a new private installation root with the domain document root set to `public/`.
3. Create `.env` from the checklist and fill unique values. Provision the trusted test signer public key from Korosh-controlled Core configuration or an external deployment secret/configuration channel. Do not derive trust from any file supplied by this bundle. The package supplies only its signature; Core supplies trust.
4. Run `php artisan key:generate --force` and set a unique `KOROSH_INSTALLATION_ID` and recovery identity.
5. Set `KOROSH_PILOT_ROOT` to the installation root and run `php installer/managed-pilot.php preflight`.
6. Run `php installer/managed-pilot.php install-core`.
7. Export `KOROSH_BOOTSTRAP_ADMIN_NAME`, `KOROSH_BOOTSTRAP_ADMIN_EMAIL`, `KOROSH_BOOTSTRAP_ADMIN_MOBILE` and a final strong `KOROSH_BOOTSTRAP_ADMIN_PASSWORD` of at least 16 characters for this shell session. Run `php installer/managed-pilot.php bootstrap-admin`, then remove those variables from the session. The command fails if a super administrator already exists.
8. Provision the controlled Advanced Accounting entitlement and one module seat through the real module/license foundation.
9. Export the per-installation recovery secret only for the technical session, then run `php installer/managed-pilot.php install-module <absolute-module-package-path>`.
10. Run `php installer/managed-pilot.php health-pilot`. Installation is ready only when it prints `PILOT HEALTH PASS`.

## Backup

Before module installation or any later update, run `php installer/managed-pilot.php backup`. Copy the resulting private backup off-host and record the health fingerprint, Core version and module versions. For MariaDB disaster recovery, also create a native encrypted database dump with the hosting backup facility; the application backup is portable JSON and does not provide automatic MariaDB restore.

## Rollback

Put the application in maintenance mode, preserve the failed state for diagnosis, restore the pre-change Core files and storage archive, restore the matching native MariaDB dump, run `php artisan optimize:clear`, rebuild caches and run `health-pilot`. Never combine files from one installation with the database or storage of another.

## Security Baseline

Keep `APP_DEBUG=false`, HTTPS and secure host-only cookies enabled. Keep CSRF and rate limits enabled. Do not expose the project root, `.env`, installer, package files, health output or backups over HTTP. Module lifecycle commands and packages remain vendor/support-only. Remove the installer directory from the web-accessible deployment after verification.