Sprint 24 Manual Test Runbook

Use this when: verifying actual staging deployment and staging QA.

Local Preflight

1. Confirm branch sprint-24-actual-staging-deployment-and-qa.
2. Run pnpm env:check.
3. Run pnpm env:check:staging.
4. Run pnpm db:generate.
5. Run pnpm db:seed.
6. Run pnpm db:seed again.
7. Run pnpm db:migrate:status.
8. Run pnpm typecheck.
9. Run pnpm lint.
10. Run pnpm test.
11. Run pnpm test:smoke.
12. Run pnpm build.
13. Run pnpm dev and check web/docs locally.
14. Run pnpm dev:lan and check the login page.

Staging Deployment Checks

1. Confirm .env.staging exists only on the staging host or secret manager.
2. Confirm APP_URL and BETTER_AUTH_URL are https://staging-app.submicrons.net.
3. Confirm all external integration flags are false.
4. Run deploy-mode migrations against the staging database.
5. Run staging seed once, then again.
6. Confirm safe demo users exist or can be created through the documented seed flag.
7. Start web and docs containers.
8. Confirm logs are accessible.
9. Confirm no .env, local imports, private imports, or production exports are deployed.

Staging Smoke

Run:

pnpm test:smoke:staging

Expected checks:

• login page loads
• failed login shows a visible error
• successful login reaches dashboard
• logout works
• protected pages redirect unauthenticated users
• Command Center, CRM, deals, quote, proposal summaries, finance, projects, support, inventory, imports, data quality, tasks, approvals, notifications, settings, manager rehearsal, agents, agent drafts, communication outbox, and docs load
• /api/health and /api/ready pass without exposing secrets

Staging UX Package

After staging is live and demo credentials are available, run:

UX_REVIEW_BASE_URL=https://staging-app.submicrons.net UX_REVIEW_DOCS_BASE_URL=https://docs.submicrons.net pnpm ux:review

The package must include metadata with the staging URL and must not include secrets, private imports, or real customer data.

Not Allowed

• production deployment
• production secrets
• real customer data
• external message sending
• live Gmail, WhatsApp, Google Drive, WooCommerce, social, or payment sync
• autonomous AI actions
• destructive database reset behavior