Owner launch blocker closeout

Close the four remaining external blockers without leaking secrets.

This noindex handoff page turns the launch checklist into a practical owner workflow: finish the external account or review task, record sanitized evidence, run validation, then let the launch checklist decide whether the blocker is truly closed.

Open owner wizardRecord evidencePayment/legal gatesPolicy draftsAnalytics setupShopify values

Closeout rule

Evidence records are sanitized summaries only. They never replace platform approval, legal approval, finance settlement, or secure credential storage.

1. Finish externally

Complete the platform, legal, payment, or Google account action in the real external system. Do not paste passwords, OAuth codes, access tokens, payment links, bank details, customer tokens, or private legal advice into chat or public files.

2. Record sanitized evidence

Use npm run launch:evidence with blocker id, safe title, non-secret summary, validation status, and non-sensitive URLs or document versions only.

3. Revalidate

Run the related readiness command, launch closure pack, launch checklist, and production readiness check. A blocker is not closed until the evidence and validation agree.

Blocker 1: Legal and policy review

Blocker id: legal_policy_review. Required before collecting customer funds or running sensitive/high-risk work at scale.

Owner actions

  • Open the policy review center and review service agreement, privacy policy, prohibited/high-risk goods policy, payment SOP, warehouse liability wording, sourcing/procurement liability wording, and trademark/artwork/label authorization wording.
  • Record reviewer or firm name, approval date, approved document versions, and whether unresolved issues are empty or owner-accepted.
  • Confirm customer onboarding still captures prohibited goods and brand/label authorization before warehouse work starts.

Safe evidence command

npm run launch:evidence -- --record --blocker=legal_policy_review --title="Legal policy review completed" --summary="External legal/policy review completed for service, privacy, prohibited goods, liability, sourcing, and authorization wording; approved version/date recorded outside chat; no secrets included." --validation-status=needs_review

Blocker 2: Payment business account

Blocker id: payments_business_account. Required before exact payment instructions, wallet credit, paid status, procurement, release, or shipment.

Owner actions

  • Choose and verify the launch payment stack: PayPal Business, Wise Business, Airwallex, Stripe, bank transfer, or approved combination.
  • Confirm settlement currency, payout destination, fee handling, chargeback owner, refund owner, and finance owner.
  • Run one internal invoice/deposit test. Uploaded evidence must remain a review item until finance verifies settlement.

Safe evidence command

npm run launch:evidence -- --record --blocker=payments_business_account --title="Payment account and invoice workflow approved" --summary="Business payment provider, invoice/deposit workflow, settlement verification owner, refund/chargeback owner, and release gate reviewed; exact payment instructions stored outside chat; no secrets included." --validation-status=needs_review

Blocker 3: Shopify Partner app credentials

Blocker id: shopify_partner_app_credentials. This is the core ShipBob/NextSmartShip-style customer experience blocker: store connection, order import, inventory reservation, exception status, and tracking sync.

Owner actions

  • Create or finish the Shopify Partner app with App URL https://api.prepportglobal.com.
  • Allowed redirection URL: https://api.prepportglobal.com/api/shopify/oauth/callback.
  • Webhook endpoint: https://api.prepportglobal.com/webhooks/shopify/orders.
  • Store SHOPIFY_CLIENT_ID, SHOPIFY_CLIENT_SECRET, and SHOPIFY_WEBHOOK_SECRET only through the secure local credential workflow. Do not paste secrets into chat.
  • After credentials exist, test customer-visible connection status, manual/CSV fallback, paid-unfulfilled order import, HMAC webhook validation, and tracking sync on a safe test order.

Safe evidence command

npm run launch:evidence -- --record --blocker=shopify_partner_app_credentials --title="Shopify Partner app configured" --summary="Shopify Partner app exists, callback URL and webhook endpoint accepted, approved scopes recorded, secrets stored securely outside chat, and safe test-store validation is ready or completed." --validation-status=needs_review

Blocker 4: Search Console and GA4

Blocker id: analytics_search_console. Required for acquisition measurement and launch learning, not for collecting customer funds.

Owner actions

  • Create or verify Search Console property for prepportglobal.com.
  • If Google gives a DNS TXT value, keep it out of chat and run SEARCH_CONSOLE_VERIFICATION_TXT=<Google TXT value> node scripts/configure-google-search-console-dns.mjs --json locally, then --apply, then --verify.
  • Submit https://prepportglobal.com/sitemap.xml and verify https://prepportglobal.com/robots.txt.
  • Create GA4 web stream and record GA4_MEASUREMENT_ID.
  • Confirm analytics receives only anonymous page, CTA, UTM, and conversion metadata. Do not send customer PII, raw messages, payment data, tokens, or product documents.

Safe evidence command

npm run launch:evidence -- --record --blocker=analytics_search_console --title="Search Console and GA4 configured" --summary="Search Console property verified, sitemap submitted, GA4 web stream created, measurement ID recorded in secure deployment config, and privacy-safe event boundary reviewed." --validation-status=needs_review

Validation chain

Run these after any evidence record or external setup change. Use the specific blocker command first, then the shared checks.

Specific checks

  • Legal/payment: npm run business:readiness -- --write and npm run payment:gates-dry-run -- --write.
  • Shopify: npm run shopify:production-readiness -- --write, npm run shopify:readiness-dry-run -- --write, and node --test test/shopify-integration.test.mjs test/shopify-production-readiness.test.mjs.
  • Analytics: node scripts/configure-google-search-console-dns.mjs --verify, npm run analytics:readiness-dry-run -- --write, and npm run website:events -- --write.

Shared closeout checks

  • npm run launch:evidence -- --write
  • npm run launch:closure -- --write
  • npm run launch:checklist -- --write
  • npm run owner:launch-workbench -- --write
  • npm run scheduled:ops
  • cd ../.. && node scripts/check-production-readiness.mjs

Do not record

Keep sensitive values in their secure platform or local environment. The evidence register is not a secret store.

Credentials

No passwords, API keys, OAuth codes, access tokens, refresh tokens, Shopify client secret, Shopify webhook secret, Meta token, Gmail token, or admin token.

Money

No exact bank details, PayPal links, Wise/Airwallex account numbers, card data, raw receipts, payout destination, or private settlement records.

Customers

No customer token, customer email, phone, address, raw message text, private product document, supplier private note, internal margin, or legal advice text.