Operational Readiness
Zone deployment checklist · Devzone
Deployment
Action| Check | Status | Owner | Blocking | Finding | Evidence | Remedy |
|---|---|---|---|---|---|---|
| zone-host | Action | - | No | Health check is not reachable. | http://127.0.0.1:9019/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-wakeel | Action | - | No | Health check is not reachable. | http://127.0.0.1:9020/api/v1/health | Start or repair this actor before marking the zone operational. |
| bawaba-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9080/api/v1/health | Start or repair this actor before marking the zone operational. |
| wakeel-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9000/api/v1/health | Start or repair this actor before marking the zone operational. |
| ain-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9101/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-ain | Action | - | No | Health check is not reachable. | http://127.0.0.1:9121/api/v1/health | Start or repair this actor before marking the zone operational. |
| baseera-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9102/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-baseera | Action | - | No | Health check is not reachable. | http://127.0.0.1:9122/api/v1/health | Start or repair this actor before marking the zone operational. |
| mizan-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9103/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-mizan | Action | - | No | Health check is not reachable. | http://127.0.0.1:9223/api/v1/health | Start or repair this actor before marking the zone operational. |
| sanad-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9104/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-sanad | Action | - | No | Health check is not reachable. | http://127.0.0.1:9124/api/v1/health | Start or repair this actor before marking the zone operational. |
| tamkeen-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9105/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-tamkeen | Action | - | No | Health check is not reachable. | http://127.0.0.1:9125/api/v1/health | Start or repair this actor before marking the zone operational. |
| miftah-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9106/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-miftah | Action | - | No | Health check is not reachable. | http://127.0.0.1:9126/api/v1/health | Start or repair this actor before marking the zone operational. |
| sahab-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9107/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-sahab | Action | - | No | Health check is not reachable. | http://127.0.0.1:9127/api/v1/health | Start or repair this actor before marking the zone operational. |
| khazna-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9111/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-khazna | Action | - | No | Health check is not reachable. | http://127.0.0.1:9129/api/v1/health | Start or repair this actor before marking the zone operational. |
| madar-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9112/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-madar | Action | - | No | Health check is not reachable. | http://127.0.0.1:9130/api/v1/health | Start or repair this actor before marking the zone operational. |
| nashr-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9109/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-nashr | Action | - | No | Health check is not reachable. | http://127.0.0.1:9128/api/v1/health | Start or repair this actor before marking the zone operational. |
| barid-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9148/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-barid | Action | - | No | Health check is not reachable. | http://127.0.0.1:9131/api/v1/health | Start or repair this actor before marking the zone operational. |
| barid-core | Action | - | No | Health check is not reachable. | http://127.0.0.1:9145/api/v1/health | Start or repair this actor before marking the zone operational. |
| barid-webmail | Action | - | No | Health check is not reachable. | http://127.0.0.1:9160/ | Start or repair this actor before marking the zone operational. |
| barid-webdesk | Action | - | No | Health check is not reachable. | http://127.0.0.1:9161/api/v1/health | Start or repair this actor before marking the zone operational. |
| site-proxy | Action | - | No | Health check is not reachable. | http://default-site-proxy:8270/api/v1/health | Start or repair this actor before marking the zone operational. |
| rasail | Action | - | No | Health check is not reachable. | http://127.0.0.1:9144/healthz | Start or repair this actor before marking the zone operational. |
| arabesque-site | Action | - | No | Health check is not reachable. | http://127.0.0.1:9240/healthz | Start or repair this actor before marking the zone operational. |
| arabesque-control-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9146/api/v1/health | Start or repair this actor before marking the zone operational. |
| alrowad-site | Action | - | No | Health check is not reachable. | http://default-alrowad-site:80/ | Start or repair this actor before marking the zone operational. |
| alhurriya-site | Action | - | No | Health check is not reachable. | http://default-alhurriya-site:80/ | Start or repair this actor before marking the zone operational. |
| smbs-site | Action | - | No | Health check is not reachable. | http://default-smbs-site:80/ | Start or repair this actor before marking the zone operational. |
| solitaire-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9108/api/v1/health | Start or repair this actor before marking the zone operational. |
| game-of-life-ui | Action | - | No | Health check is not reachable. | http://127.0.0.1:9110/api/v1/health | Start or repair this actor before marking the zone operational. |
| ai-email-service-agent | Action | - | No | Health check is not reachable. | http://127.0.0.1:9016/api/v1/health | Start or repair this actor before marking the zone operational. |
| ai-clamav-scan-agent | Action | - | No | Health check is not reachable. | http://127.0.0.1:9017/api/v1/health | Start or repair this actor before marking the zone operational. |
| ai-document-repository-agent | Action | - | No | Health check is not reachable. | http://127.0.0.1:9018/api/v1/health | Start or repair this actor before marking the zone operational. |
| Operational Readiness | Ready | - | No | Bawaba exposes the readiness checklist launcher. | /readiness/ | - |
| wakeel-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| ain-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| baseera-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| mizan-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| sanad-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| tamkeen-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| miftah-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| sahab-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| khazna-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| madar-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| nashr-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| barid-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| barid-webmail | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| barid-webdesk | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| rasail | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| arabesque-site | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| arabesque-control-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| alrowad-site | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| alhurriya-site | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| smbs-site | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| solitaire-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
| game-of-life-ui | Ready | - | No | Bawaba has a launcher for this actor. | - | - |
Configuration
Review| Check | Status | Owner | Blocking | Finding | Evidence | Remedy |
|---|---|---|---|---|---|---|
| Zone host platform readiness | Review | Tamkeen | Yes | Host identity, filesystem paths, Docker readiness, resources, and monitoring targets must be confirmed before go-live. | Zone host and Nashr target readiness | Complete Tamkeen zone-host bootstrap values and confirm Nashr target readiness. Open |
| Wakeel operations readiness | Review | Wakeel | Yes | Operations diagnostics, event policy, dispatcher integration, and actor runtime visibility should be reviewed before go-live. | Wakeel operations readiness | Open Wakeel settings and confirm operations readiness. Open |
| Ain security supervisor readiness | Review | Ain | Yes | Security scan policy, posture checks, and alert routing must be configured before go-live. | Ain settings/readiness | Open Ain settings and confirm security supervisor readiness. Open |
| Baseera analytics supervisor readiness | Review | Baseera | Yes | Analytics sources, retention, dashboards, and reporting cadence must be configured before operational analytics use. | Baseera settings/readiness | Open Baseera settings and confirm analytics readiness. Open |
| Mizan finance readiness | Review | Mizan | No | Finance sources, thresholds, reporting periods, and alert routing should be reviewed before go-live. | Mizan settings readiness | Open Mizan settings and complete finance readiness evidence. Open |
| Sanad support settings | Review | Sanad | Yes | Support queues, escalation policy, SLA posture, and intake routing must be configured before operational support use. | Sanad settings/readiness | Open Sanad settings and complete support readiness. Open |
| Sanad support readiness | Review | Sanad | No | Support queues, categories, assignment defaults, and SLA thresholds should be reviewed before go-live. | Sanad support readiness | Open Sanad and confirm support readiness. Open |
| Tamkeen bootstrap readiness | Review | Tamkeen | Yes | Bootstrap values, secrets backend, and required actor configuration should be reviewed before go-live. | Tamkeen configuration readiness | Open Tamkeen and complete all required actor configuration readiness. Open |
| Miftah identity readiness | Review | Miftah | Yes | Bootstrap admin, roles, password policy, SSO/session policy, and user validation must be complete before go-live. | Miftah identity readiness | Open Miftah settings/readiness and complete identity evidence. Open |
| Sahab infrastructure settings | Review | Sahab | Yes | Provider credentials, host pools, IP pools, templates, and SSH keys must be configured before VM provisioning is operational. | Sahab settings/readiness | Open Sahab settings and complete infrastructure readiness. Open |
| Sahab supervisor readiness | Review | Sahab | Yes | Libvirt endpoint, command timeout, console routing, and provisioning state must be configured before VM operations are reliable. | Sahab settings/readiness | Open Sahab settings and confirm supervisor readiness. Open |
| Khazna backup coverage | Review | Khazna | Yes | Backup targets, datasets, schedules, restore validation, and retention must be configured before go-live. | Khazna backup readiness | Open Khazna settings/readiness and complete backup evidence for zone actors. Open |
| Madar entitlement readiness | Review | Madar | No | Subscription policy, entitlement defaults, and license/offline behavior should be reviewed before customer-facing go-live. | Madar settings readiness | Open Madar settings and confirm entitlement policy. Open |
| Nashr deployment readiness | Review | Nashr | Yes | Target profile, deployment-vs-operational readiness, and known-repair posture should be reviewed before deployment go-live. | Nashr deployment readiness | Open Nashr and confirm target readiness and deployment profile health. Open |
| Barid settings and go-live readiness | Review | Barid | Yes | Mail identity, domains, mailboxes, webmail, TLS, scanner policy, backup coverage, and deliverability sign-off must be completed by the operator. | Barid settings/readiness | Open Barid settings/readiness and complete all production gates before go-live. Open |
| Barid desired configuration | Review | Barid | Yes | Desired configuration, audit trail, restart/redeploy impact, readiness output, and Rasail event publication must be active before production. | Sup Barid desired configuration readiness | Open Barid settings and confirm desired configuration, readiness publication, and Rasail event routing. Open |
| Barid core production validation | Review | Barid | Yes | Deliverability, backup/restore, cleanup, hardening, and load/failure validation must be complete before production mail service. | Barid production readiness | Open Barid production readiness and complete mail DNS/TLS, SES relay, backups, storage, scanner, queue, and soak-test evidence. Open |
| Barid webmail settings | Review | Barid | Yes | Webmail public URL, HTTPS posture, IMAP/SMTP endpoints, session policy, upload limits, and secret key must be confirmed before go-live. | Barid settings and webmail readiness evidence | Open Barid settings and complete the Webmail and Readiness groups. Open |
| MailWorks Webdesk route | Review | Barid | No | Webdesk must be reachable separately from Roundcube webmail before operator sign-off. | Webdesk health and route probe | Open Webdesk through Bawaba or the /webdesk/ route and confirm the health endpoint. Open |
| Site proxy route, TLS, and backend readiness | Review | Tamkeen | Yes | Public routes, TLS termination, backend mappings, and host-header policy must be confirmed before public-site go-live. | Site proxy deployment readiness | Confirm route/TLS/backend values in Tamkeen and paired control-app readiness evidence. Open |
| Rasail contact routing | Review | Rasail | Yes | Contact forwarding rules, mailbox handling, retention, and failed-message handling must be configured before public sites can be operational. | Rasail settings/readiness | Open Rasail settings and complete contact routing, forwarding, retention, and readiness checks. Open |
| Arabesque public-site go-live | Review | Arabesque Control | Yes | DNS, Host header policy, HTTPS, analytics, contact routing, backup coverage, and owner sign-off must be completed before go-live. | arabesque-control-ui readiness evidence | Open arabesque-control-ui and complete the public-site readiness checklist. Open |
| Arabesque control production safety | Review | Arabesque Control | Yes | Miftah/SSO, private routing, deployment packaging, and public-site evidence must be confirmed before production use. | Arabesque Control settings/readiness | Open arabesque-control-ui settings and complete the control-app readiness checklist. Open |
| Alrowad public-site go-live | Review | Alrowad Control | Yes | DNS, Host header policy, HTTPS, analytics, contact routing, backup coverage, and owner sign-off must be completed before go-live. | alrowad-control-ui readiness evidence | Open alrowad-control-ui and complete the public-site readiness checklist. Open |
| Alhurriya public-site go-live | Review | Alhurriya Control | Yes | DNS, Host header policy, HTTPS, analytics, contact routing, backup coverage, and owner sign-off must be completed before go-live. | alhurriya-control-ui readiness evidence | Open alhurriya-control-ui and complete the public-site readiness checklist. Open |
| SMBS public-site go-live | Review | SMBS Control | Yes | DNS, Host header policy, HTTPS, analytics, contact routing, backup coverage, and owner sign-off must be completed before go-live. | smbs-control-ui readiness evidence | Open smbs-control-ui and complete the public-site readiness checklist. Open |
| Solitaire settings evidence | Review | Solitaire | No | Game defaults and launch evidence should be reviewed, but this is not a go-live blocker. | Solitaire settings/readiness | Open Solitaire settings and confirm defaults and launcher evidence. Open |
| Game of Life settings evidence | Review | Game of Life | No | Simulation defaults and launch evidence should be reviewed, but this is not a go-live blocker. | Game of Life settings/readiness | Open Game of Life settings and confirm defaults and launcher evidence. Open |
| Email service provider | Review | Tamkeen | Yes | SMTP host, port, security mode, sender address, username, and password must be supplied before the worker can send zone notifications safely. | Tamkeen actor readiness for ai-email-service-agent | Open Tamkeen for ai-email-service-agent, enter provider values and secret references, then mark the actor configuration ready. Open |
| Email service limits | Review | Tamkeen | No | Daily limits, timeouts, and optional test domains should match the provider contract to avoid throttling or rejected messages. | Tamkeen defaultable configuration values | Review the default limits in Tamkeen and adjust them for the selected SMTP provider if needed. Open |
| ClamAV worker setup | Review | Tamkeen | Yes | The scan worker must have an approved timeout, size limit, update policy, data directory, and API token before the zone can rely on malware scanning. | Tamkeen actor readiness for ai-clamav-scan-agent | Open Tamkeen for ai-clamav-scan-agent, confirm the scanner values and secrets, then mark the actor configuration ready. Open |
| Domain scanner policy | Review | Tamkeen | Yes | Domain managers such as Barid decide how the zone uses ClamAV for attachments, quarantine, and failure handling. | Domain manager readiness evidence for scanner policy | Configure the domain manager scanner policy and keep the worker endpoint referenced through deployment values. Open |
| Document repository storage | Review | Tamkeen | Yes | Storage root, database path, upload size, retention, and backup coverage must be configured before operational use. | Tamkeen actor readiness for ai-document-repository-agent | Open Tamkeen actor setup for ai-document-repository-agent and confirm storage, retention, and backup settings. Open |
Identity
Action| Check | Status | Owner | Blocking | Finding | Evidence | Remedy |
|---|---|---|---|---|---|---|
| Miftah identity UI | Action | Miftah | Yes | Miftah identity service is not reachable. | http://127.0.0.1:9106/api/v1/health | Start or repair Miftah before operational sign-off. Open |
| Miftah supervisor | Review | Miftah | Yes | Sup Miftah health needs review. | http://127.0.0.1:9126/api/v1/health | Confirm identity supervisor health before go-live. |
Security
Review| Check | Status | Owner | Blocking | Finding | Evidence | Remedy |
|---|---|---|---|---|---|---|
| Ain security UI | Review | Ain | Yes | Ain security UI needs review. | http://127.0.0.1:9101/api/v1/health | Open Ain and review current security findings before go-live. Open |
| TLS certificates | Skipped | Bawaba | No | Production-only TLS gate skipped in devzone. | - | - |
Services
Action| Check | Status | Owner | Blocking | Finding | Evidence | Remedy |
|---|---|---|---|---|---|---|
| zone-host | Action | - | No | Health check is not reachable. | http://127.0.0.1:9019/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-wakeel | Action | - | No | Health check is not reachable. | http://127.0.0.1:9020/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-ain | Action | - | No | Health check is not reachable. | http://127.0.0.1:9121/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-baseera | Action | - | No | Health check is not reachable. | http://127.0.0.1:9122/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-mizan | Action | - | No | Health check is not reachable. | http://127.0.0.1:9223/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-sanad | Action | - | No | Health check is not reachable. | http://127.0.0.1:9124/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-tamkeen | Action | - | No | Health check is not reachable. | http://127.0.0.1:9125/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-miftah | Action | - | No | Health check is not reachable. | http://127.0.0.1:9126/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-sahab | Action | - | No | Health check is not reachable. | http://127.0.0.1:9127/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-khazna | Action | - | No | Health check is not reachable. | http://127.0.0.1:9129/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-madar | Action | - | No | Health check is not reachable. | http://127.0.0.1:9130/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-nashr | Action | - | No | Health check is not reachable. | http://127.0.0.1:9128/api/v1/health | Start or repair this actor before marking the zone operational. |
| sup-barid | Action | - | No | Health check is not reachable. | http://127.0.0.1:9131/api/v1/health | Start or repair this actor before marking the zone operational. |
| barid-core | Action | - | No | Health check is not reachable. | http://127.0.0.1:9145/api/v1/health | Start or repair this actor before marking the zone operational. |
| barid-webmail | Action | - | No | Health check is not reachable. | http://127.0.0.1:9160/ | Start or repair this actor before marking the zone operational. |
| barid-webdesk | Action | - | No | Health check is not reachable. | http://127.0.0.1:9161/api/v1/health | Start or repair this actor before marking the zone operational. |
| site-proxy | Action | - | No | Health check is not reachable. | http://default-site-proxy:8270/api/v1/health | Start or repair this actor before marking the zone operational. |
| rasail | Action | - | No | Health check is not reachable. | http://127.0.0.1:9144/healthz | Start or repair this actor before marking the zone operational. |
| arabesque-site | Action | - | No | Health check is not reachable. | http://127.0.0.1:9240/healthz | Start or repair this actor before marking the zone operational. |
| alrowad-site | Action | - | No | Health check is not reachable. | http://default-alrowad-site:80/ | Start or repair this actor before marking the zone operational. |
| alhurriya-site | Action | - | No | Health check is not reachable. | http://default-alhurriya-site:80/ | Start or repair this actor before marking the zone operational. |
| smbs-site | Action | - | No | Health check is not reachable. | http://default-smbs-site:80/ | Start or repair this actor before marking the zone operational. |
| ai-email-service-agent | Action | - | No | Health check is not reachable. | http://127.0.0.1:9016/api/v1/health | Start or repair this actor before marking the zone operational. |
| ai-clamav-scan-agent | Action | - | No | Health check is not reachable. | http://127.0.0.1:9017/api/v1/health | Start or repair this actor before marking the zone operational. |
| ai-document-repository-agent | Action | - | No | Health check is not reachable. | http://127.0.0.1:9018/api/v1/health | Start or repair this actor before marking the zone operational. |
Backups
Ready| Check | Status | Owner | Blocking | Finding | Evidence | Remedy |
|---|---|---|---|---|---|---|
| Backup coverage | Skipped | Khazna | No | Production-only backup gate skipped in devzone. | - | - |
Validation
Ready| Check | Status | Owner | Blocking | Finding | Evidence | Remedy |
|---|---|---|---|---|---|---|
| Devzone manifest | Ready | - | No | Local devzone actor manifest is available. | /home/abdullah/ai-operations/scripts/devzone/actors.json | - |
| Local actor profile | Ready | - | No | Devzone local actor profile is populated. | devzone-apps-local | Add local actors to the devzone-apps-local profile before relying on local launchers. |
| DNS and public routes | Skipped | Bawaba | No | Production-only DNS/public route gate skipped in devzone. | - | - |