# Phase 1 Release Gate

Phase 1 is considered packaged when the release gate succeeds and produces a signed marketplace-safe artifact.

## Command

```powershell
$env:RELEASE_VERSION="0.1.0-phase1"
node scripts/validate-phase-one-release.mjs
```

For CI or a PHP-ready machine:

```powershell
node scripts/validate-phase-one-release.mjs --require-php
```

## Gate Coverage

- Required Phase 1 files exist.
- Marketplace, environment, deployment, module, permission, feature, traceability, audit, license, update, tenant, access, billing, security, observability, support, and compliance policies validate.
- Laravel API routes, OpenAPI paths, and Markdown API contract routes stay synchronized.
- Phase 1 attestation matches the marketplace manifest and release-gate contract.
- Backup manifest validates.
- Demo license certificate signs and verifies.
- PHP syntax is scanned when PHP is available; `--require-php` makes this mandatory.
- Next.js command center builds.
- Signed release package is generated.
- Release manifest signature verifies.
- Release zip is checked for blocked generated paths and secret paths.
- Release manifest must include the control-plane files required for marketplace submission.

## Artifact Outputs

- `releases/nexobiz-0.1.0-phase1.zip`
- `releases/nexobiz-0.1.0-phase1/manifest.json`
- `releases/nexobiz-0.1.0-phase1/manifest.sig`
- `releases/phase-one-readiness-report.json`
- `phase-one-release-attestation.json`

## Production Exit Position

The repository is Phase 1 release-packaged when the gate passes. A live customer deployment still requires a PHP-ready runtime check, database migration run, queue/scheduler execution, HTTPS domain binding, and real license-server credentials.