ims/docs/phase-9-cutover.md

Phase 9 — Cutover Runbook

Pre-flight checklist (before cutting traffic)

Run from the project root on your local machine.

• bash db/01-load-schema.sh — schema + RLS loaded on new server (14 tables)
• SUPABASE_DB_URL="..." bash db/02-dump-and-restore.sh — all public data restored
• SUPABASE_DB_URL="..." bash db/03-migrate-passwords.sh — passwords migrated, 0 NULL rows
• SUPABASE_URL="..." SUPABASE_SERVICE_ROLE_KEY="..." bash db/04-migrate-evidence.sh — evidence files on server
• SUPABASE_DB_URL="..." bash db/05-verify.sh — row counts match, embeddings present
• /var/www/ims/.env populated on server (see docs/new-server-setup.md section I)
• bash deploy.sh — Next.js standalone build deployed, systemctl status ims shows Active
• nginx config live at ims.setia.com.my (see docs/new-server-setup.md sections E–F)
• TLS cert issued (sudo certbot --nginx -d ims.setia.com.my)
• curl -I https://ims.setia.com.my/ returns HTTP/2 200
• Cron jobs registered (see docs/vps-cron.md)
• Daily backup cron registered (see docs/new-server-setup.md section K)

DNS cutover

Point ims.setia.com.my A record to the new server's public IP. TTL: set to 60s before cutover, restore to 3600s after.

Smoke tests (run immediately after cutover)

Test as each role. All must pass before telling users to switch.

Reporter role

• Log in with a migrated user's real password — succeeds
• Submit new incident with photo evidence — reference number generated, evidence stored
• Open own incident detail — evidence renders (HMAC-signed URL serves file)

Supervisor role

• Log in
• View site incidents list — all historical incidents present
• Triage an incident — triage saved, audit_log row written with correct changed_by

HSE role

• Log in
• Run AI triage suggestion — response received (Anthropic key working)
• Run Similar Incidents — embeddings returning results
• Open dashboard — stats render, JKKP8 export downloads CSV
• AI risk flags panel loads

Admin role

• Log in
• Create new user — user created, no Supabase call
• Delete user — user removed (auth + profile)

CAPA owner role

• Log in
• View assigned CAPAs
• Mark a CAPA in-progress — status updates

Password reset flow

• Request reset for own email — Brevo email arrives
• Complete reset — new password accepted

Cron (manual trigger)

• CAPA escalation endpoint returns {"ok":true}
• Effectiveness recheck endpoint returns {"ok":true}

RLS spot-check (security)

# As app_user role with a reporter's user_id set:
sudo -u postgres psql -d ims
SET app.user_id = '<reporter-A-uuid>';
SELECT * FROM incidents WHERE reported_by != '<reporter-A-uuid>';
-- Expected: 0 rows (RLS blocks cross-user read)

Post-cutover

• Monitor /var/log/ims-cron.log for first cron run (08:00 MYT next day)
• Monitor sudo journalctl -u ims -f for runtime errors
• After 48h stable: take snapshot of new server DB (pg_dump ims > /var/lib/ims/backups/pre-supabase-decommission.sql)
• Decommission Supabase project only after snapshot confirmed

Rollback plan

If cutover fails within the first hour:

1. Repoint DNS A record back to the old VPS IP (64.176.82.100)
2. Supabase project remains live throughout — no data risk
3. Investigate failure before re-attempting