Full roadmap & checklist
One page, one workflow: 12 phases as toggles, numbered steps with a short summary and a link to the full page, and gate items (from each step’s checklist) as substeps you can tick off. Progress saves on this device.
12 phases · 89 steps · 501 gates 0 / 590 done
01 AI dev environment
-
Stand up the agent operating system for a CodeCanyon Laravel app — the constitution, permission modes, rules, skills, and IDE wiring that every later phase relies on.
-
Start here — create the project folder, stage the CodeCanyon download in _source/, bootstrap an anchored .gitignore + git init, promote the Laravel app to the root, prove nothing was missed with a filesystem completeness gate, commit the pristine vendor baseline on author/v* + tag, then write .vscode/ for the AI layer (committed at C2 · machine setup).
-
Authenticate the GitHub CLI, register MCP servers, and install the permission-mode switcher and deploy orchestrator — once per machine (your user account), reused by every project.
-
Write the cross-tool contract (AGENTS.md), the thin CLAUDE.md pointer, and the gitignored CLAUDE.local.md — the persistent project knowledge every agent loads at session start.
-
Write the project-wide settings.json, pick a permission mode (strict/medium/yolo), set personal model/thinking/compact defaults in settings.local.json, and wire the hard-block + vendor-edit guard hooks that no mode can override.
-
Seed .claude/rules/ with the universal behavioral + reference rule set, install the stack skills and deploy orchestrator into .claude/skills/, then restart so the new context loads.
-
Wire the project MCP servers (.mcp.json with Laravel Boost) and make Cursor, Gemini, and Codex read the same constitution via a boot rule and thin mirrors.
-
Run the AI dev environment verification checklist, confirm the gate condition, and hand off to Code & repository setup with the AI dev environment fully wired.
02 Code Repo
-
Collect everything the operator must provide, ensure every CLI tool a later phase needs is installed, then create the private GitHub repo, hosting sites, and databases — and wire passwordless SSH to both servers — before anything depends on them.
-
Choose Option A (solo/small team — one setup branch, one commit per phase) or Option B (a branch per phase, merged via PR), then learn the branch model the rest of the playbook commits against.
-
Extract the CodeCanyon vendor ZIP cleanly, initialize git with a frozen vendor snapshot and branch strategy, and wire .env templates — so every later vendor update diffs cleanly.
-
Extract the CodeCanyon ZIP into a verified Laravel root, capture vendor docs, back up a pristine copy, then inspect and classify any author edits inside vendor/ — preserving real patches, stripping license-injection backdoors, and proving a clean tree boots — before a single feature is touched.
-
Set session variables, write .gitignore BEFORE git init so secrets, installed dependencies, the installer-complete marker, and per-env symlinks never enter history, then initialize git on develop and lock down per-directory storage ignores.
-
Back up the vendor's env into the project vault, lay down local/staging/production templates, activate local and generate the app key, then verify the per-environment values that differ.
-
Verify the pristine vendor baseline from AI dev environment setup, push develop + author/vX + tag to the private remote, cut your working branch, and prove the seam is clean — without recreating the vendor import.
-
Project-structure scaffolding (Admin-Local vault + docs), commit & documentation standards with the Zaj customization strategy, and version management (SemVer + Zaj-CHANGELOG) — SHOULD, not skip-by-default.
03 Local Dev
-
Authenticate Composer to dodge the rate limit, install PHP and JS dependencies without clobbering vendor patches, audit .env.example for fail-loud placeholders, then build and commit frontend assets.
-
Confirm the Phase 2 local MySQL/MariaDB database is running, utf8mb4, and wired through .env so the installer can connect.
-
Create the storage symlink, detect and wire your app's addon system (Modules vs packages vs addons), then link the project to Herd over HTTPS and prove the installer route is reachable.
-
Install dependencies, build assets locally, run the CodeCanyon installer, and get the app booting at a local HTTPS domain with login working — the first time you see it run.
-
Raise the PHP-FPM and nginx timeouts so big migration runs don't 504, pre-flight four preconditions, complete the installer, then capture every seeded/default credential safely.
-
Confirm every migration ran (modules included), troubleshoot pending ones the right way, capture a normalized schema baseline for cross-environment diffs, then run the 11-point gate that proves the app actually works.
-
Commit the repo-safe installer artifacts, document any author patches in the shipped vendor tree, verify deploy symlinks and shared_files, then lock down /install and /update with layered defense.
-
Verify that the hosting account has the Admin-Server toolkit before the deploy pipeline starts, or run the shared-hosting playbook first.
-
Decide which local-development power-ups to adopt — Atlas schema management, a database GUI (Bytebase), Redis caching via Herd Pro, and a right-sized debug-tools stack. None block launch; each has a free fallback.
04 Deploy Pipeline
-
Install Deployer and author deploy.php for atomic releases — symlinked current → timestamped releases, shared storage and .env, retention, hooks, server binary paths, and an SSH-verified dry run.
-
Plan the environment hostname map, add A/CNAME records, provision SSL/TLS certificates, force HTTP→HTTPS, and confirm everything with a five-check CLI verification (dig, HEAD, redirect, proxy, cert details).
-
Assemble a safe production env source — bidirectional drift check against .env.example, a Git-history secret scan, production flags, and a secrets-manager render check. Server upload and runtime verification happen in Phase 5 or Phase 12.
-
Wire GitHub Actions for deploys and ServerSync — author the workflows, set the GitHub Secrets (PAT, SSH key), keep clear_paths ↔ GIT_ONLY_PATHS symmetric, and validate with actionlint. First live runs happen in Phase 5 or Phase 12.
-
Stand up everything that makes deployment possible — Deployer for zero-downtime releases, environment domains + SSL, production .env templates, and (recommended) CI, DNS email records, and a CDN — so Phase 5 can run the first observed non-production deploy.
-
Make transactional email deliverable — verify the email provider, add SPF, DKIM, and DMARC records (plus MX), interpret CAA safely, and confirm everything with dig.
-
Front the app with Cloudflare on the Free plan — nameserver cutover, API-driven DNS, Full (Strict) SSL + HSTS, WAF and rate limiting, cache rules, DNSSEC, and a final API verification probe. Rocket Loader stays OFF for Laravel.
-
Close the phase — bootstrap or update the changelog and version, tag the release, then stand up an incident-response runbook (Sentry, uptime, SSL expiry, severities, contacts) wired into the repo as dev-only.
05 Deploy Staging
-
Consume the Phase 4 handoff, pin Composer to the confirmed deploy PHP, run the canonical pre-flight, prepare and push the selected non-production branch, then scaffold the server — deploy tree, .user.ini limits, and the shared .env with APP_KEY left empty.
-
Confirm the non-production domain resolves to the server and serves a valid TLS chain before the first release lands — a deploy onto an unresolved or untrusted host wastes a round-trip.
-
Run the atomic first deploy, confirm APP_KEY and clear caches with the versioned PHP binary, verify the Deployer directory tree and the .env symlink (a 5-second check that prevents a 90-minute outage), confirm demo content, then loosen permissions for the installer.
-
Temporarily unblock /install, run the CodeCanyon web installer wizard, verify the app loads, then immediately re-block /install + /update and re-harden storage and .env permissions from the installer's insecure 777 state.
-
Take the app from "runs locally" to "runs on a real non-production server" — provision the selected target, point DNS, ship the first atomic release, run the web installer, verify the schema, prove rollback, and open any standing observation follow-up.
-
Install and verify the every-minute schedule:run cron with the provider path that fits the selected host, then verify migrations and export + diff the selected non-production schema against your local baseline.
-
Prove a one-command rollback restores a previous release, run the immediate post-deploy sweeps, and open the standing 24–48h observation follow-up without leaving Phase 5 falsely partial.
-
Run the first live ServerSync capture after the selected non-production deploy — verify workflow availability and version parity, re-audit clear_paths ↔ GIT_ONLY_PATHS, trigger the run, and review the resulting PR file-by-file.
-
A non-production deep audit of the codebase — project structure, composer security audit, Git hygiene, FVDUT storage persistence, secret + debug-code scans (with the word-boundary fix for dd()), storage-tracked-file triage, CodeCanyon frontend anti-patterns, and an optional schema audit.
-
Decide whether to register your schema with Atlas Cloud for versioned migration tracking — open the SSH tunnel, build a baseline migration from the selected non-production schema, push it to Atlas Cloud, apply the baseline to that target, and wire up GitHub CI. Requires an active Atlas Cloud license; free alternatives noted.
06 Superadmin
-
Separate the in-app superadmin from the three-tier ops model, adopt the inspect-then-configure pattern that makes this phase work on any CodeCanyon app, and learn the Playwright + Livewire traps before you touch a single form.
-
Run the up-front discovery that every later task depends on — a vendor capabilities inventory (what's admin-editable vs hardcoded, what's tier-gated), a vendor-docs digest with the APP_ENV gotcha scan, and a one-page brand profile that answers every "what colour / name / plan?" question before it's asked.
-
Lock the admin account first (default superadmin@example.com / 123456 is publicly known), generate and upload a coherent brand asset kit, resolve the correct PHP binary for every SSH command, then audit and replace the vendor's seeded demo content before any public URL goes live.
-
Wire transactional email through the admin panel, and learn the Froiden-family trap where a CustomConfigProvider loads SMTP from the database regardless of APP_ENV — meaning the panel's "APP_ENV changed" warning banner lies and .env MAIL_* values are ignored at runtime.
-
Stand up the payment gateway and subscription plans — pick a Stripe account strategy, discover the REAL webhook URL and event list (never assume /stripe/webhook), grab sandbox keys with the three-actor model, paste them into the admin panel (verifying columns with DESCRIBE first), and create plans only after market research unblocks the pricing.
-
Stand up the three legal essentials — a cookie/GDPR consent banner, a Privacy Policy, and Terms of Service — using the check-first pattern. Fill admin-panel fields when present, create missing Privacy/Terms routes when absent, and hand consent-banner code work to Phase 7 as a named blocker.
-
Log in as the superadmin and configure everything the vendor exposes in the admin panel — branding, theme, email, payments, plans, legal pages, and analytics — using a check-first pattern that adapts to any CodeCanyon app.
-
Apply your brand colours through the admin panel or capture the Phase 8 code task, confirm the error pages (404/500/503) are branded rather than raw Laravel defaults, and prepare a branded maintenance-mode page you can flip on safely with a bypass token.
-
Wire the growth surfaces — GA4 analytics via the universal 3-file Safe Vendor Deviation Pattern (the canonical example), plus the lighter check-first tasks for a chat widget, social login, the blog system, and the sitemap. Most CodeCanyon scripts ship zero built-in analytics, so the deviation path is the common case.
07 Security Monitoring
-
Treat every shipped secret as compromised — rotate vendor defaults, lock down file permissions, throttle sensitive endpoints, and audit mass assignment + session cookies before anything watches the app.
-
Enforce HTTPS with HSTS + the standard header set in .htaccess, back it with a SecurityHeaders middleware, force HTTPS in production, encrypt high-risk PII fields, and require strong passwords — for Grade A at securityheaders.com (unsafe-inline caps at A until CSP nonces/hashes).
-
Give security-relevant events a durable audit trail — install Spatie Activity Log, capture model changes, log auth and GDPR actions, and auto-prune old records so an incident always has a paper trail.
-
The one MUST of observability — assess what already exists, wire Spatie Laravel Backup to run daily, and ship to an S3-compatible off-site destination (S3 / Spaces / B2 / R2) under one BACKUP_AWS_* env prefix with the 3-2-1 rule.
-
Extend the basic Sentry DSN into cron monitors, performance, and release health; add rotated + structured logs; expose a health endpoint with external uptime monitoring; and define alert escalation backed by a quarterly restore drill.
-
Decide which legal pages you need, generate and host Privacy + Terms via one generator (GetTerms / Termly / Iubenda), wire a cookie-consent banner, build GDPR data export + deletion-with-grace-period, and finalize with ROPA + DPAs.
-
Reference for when SOC 2 and HIPAA enter the picture — applicability tests, cost and timeline, what each involves, and the platforms that automate evidence collection. Most CodeCanyon SaaS launches skip both.
-
Harden the deployed app (rotate vendor defaults, TLS/HSTS, security headers, rate limits, session/mass-assignment audit), add an audit trail, then make it observable — off-server backups, Sentry, uptime, logs — and close out the legal layer (GDPR, cookie consent) and compliance tracks (SOC 2 / HIPAA).
08 Configure App
-
The non-negotiable critical path — brand & core settings, transactional mail with DNS auth, a payment gateway with verified webhooks, plans & feature flags, then a full seed + verify pass before launch.
-
Build the single source of truth for visual identity — brand name, logo variations, a WCAG-checked color palette, typography (including bilingual RTL), reference files committed to the repo, and marketing assets.
-
Choose a payment approach from the gateway matrix (Stripe built-in vs from-scratch, PayPal, Tap for MENA, LemonSqueezy as Merchant of Record), then add the production billing depth — model, plans, verified webhooks, tax, dunning, and lifecycle documentation.
-
Confirm and test the transactional mail path, choose a provider from the deliverability matrix, customize the core template set, and (optionally) add drip campaigns and a newsletter — all with SPF/DKIM/DMARC passing.
-
Capture a Lighthouse baseline, then layer .htaccess browser caching + compression, tune the PHP runtime (OpCache, memory, extensions), verify Redis, enable Cloudflare, and apply accessibility/CSP quick wins — with realistic targets for a vendor-bundled app.
-
Surface the integration choices — Slack notifications for errors/deploys/backups, GitHub project management (labels, issue forms, project board, PR template), and privacy-first Rybbit analytics.
-
Two post-launch tasks — claim social-media handles early (even before you post) and wire the dual changelog (internal + public) so every stable release ships with an announcement.
-
Wire the live product end-to-end — branding, mail, payment gateways, integrations, and plan/feature flags — then seed and verify every flow before launch.
09 Growth Polish
-
SEO needs a reachable URL, so it leads — sitemap + robots, per-page meta + schema + titles, then Search Console verification and a PageSpeed pass.
-
Onboarding, a public changelog, a feedback collection channel, and an optional blog — the streams that keep new users reaching value and existing users informed.
-
Two customer-facing systems with several alternatives each — a live chat widget and a help center / knowledge base. Pick one tool per row and record the choice.
-
The pass that makes the product feel finished — SEO (sitemap, meta, schema, Search Console), onboarding/changelog/feedback/blog, and customer-facing chat + help center. Mostly SHOULD with many alternatives.
10 Audit QA
-
Fast, deterministic checks that need no browser — project structure, Composer security audit, git hygiene, code-quality/secrets scan — plus migration analysis and FVDUT storage classification.
-
The full security pass — header grading, ownership-aware vulnerability decisions, blocked sensitive files, admin + storage hardening, and a vulnerability register.
-
Measure Core Web Vitals (inspect before changing), audit the live database for index coverage and N+1 queries, and fix anything that blocks Google from indexing public pages.
-
WCAG 2.1 AA checks (automated scanners + manual verification) and GDPR/CCPA cookie inventory with consent gating that actually blocks non-essential cookies.
-
Drive every critical journey and role (automate with Playwright MCP), run live security tests, triage by severity, then mine Telescope/Sentry/logs and check for unmerged fixes.
-
Synthesize the Phase 10 sub-reports into one GO / CONDITIONAL GO / NO-GO verdict, then prepare the Phase 11/12 handoff without running the production launch.
-
The full pre-launch audit — static code & dependency checks, a security re-check, performance/DB/SEO/accessibility audits, functional QA across roles, debugger review, and a pre-launch sign-off gate.
11 Pre Customer
-
Transfer Phase 10 audit deferrals into the root Zaj-BACKLOG.md, then run the seven MUST gates that verify the launch-candidate system against reality — git/deploy verification, codebase + security scan, database confidence, env audit, end-to-end testing, monitoring, and final signoff.
-
The tiered launch decision — Tier 1 blockers must be 13/13, Tier 2 important items launch with documented exceptions, Tier 3 nice-to-haves must be completed or tracked in Zaj-BACKLOG.md.
-
A customer needs something to land on, a way to pay, and the legal pages that make billing legitimate — landing page, legal pages, transactional email, pricing & payment, analytics & social meta.
-
Make the path to value short and the path to help obvious — a support surface, a five-minute time-to-first-value flow, and activation funnel tracking.
-
The final go/no-go gate before the first real customer — technical verification, business and legal readiness, support and docs, then a tiered launch signoff.
12 Production
-
Never skip this — rotate every test-mode key and non-production password that touched a chat or log, migrate plaintext credentials into a secrets manager, re-scope over-privileged service accounts, and record the audit.
-
Cut the changelog and version before deploying, then promote the verified non-production branch to the release branch, stage the production .env, deploy dry-run then real, run the installer (first deploy only), and verify it's live.
-
Lock down installer-friendly permissions, verify schema parity against staging, review ServerSync, prove production mail flow, then sync all branches back to a shared base and tag the release as your rollback and audit anchor.
-
Watch closely through the first 24–48h — smoke tests, integration checks, performance/security spot-checks, log triage, and baselines — with rollback always one command away, then the abbreviated subsequent-deploy cycle.
-
Go live safely — pre-flight security hygiene, the first production release and installer, schema and branch verification, version tagging, and 24–48h post-deploy monitoring with a rollback always ready.
How to use it
Section titled “How to use it”- Read top to bottom — expand a phase, skim step summaries, open a step only when you need commands or detail.
- Execute with checkmarks — tick the step when it’s done; ticking a step checks all its gates; ticking every gate auto-completes the step.
- Expand all / Collapse all — scan the full tree or focus one phase at a time.