# Refute 3.0 Fresh Deployment Guide

## Architecture and order

Use four distinct releases: Refute Core, Refute Invest Web, Refute Folex, and Refute Invest Mobile. Core is the canonical identity, wallet, ledger, escrow, custody, compliance, and reporting service. Invest and Folex use separate databases and authenticate to Core with different HMAC secrets. Mobile talks to the Invest API; it must not hold a Core service secret.

Deploy in this order:

1. Refute Core in safe prelaunch mode.
2. Refute Invest Web and its private Core service credential.
3. Refute Folex and a different private Core service credential.
4. Refute Invest Mobile against the staging Invest URL.
5. Complete reconciliation and controlled pilots before enabling production financial features.

Recommended baseline: Ubuntu 24.04, Nginx, PHP 8.3-FPM with CLI/common/curl/mbstring/xml/zip/bcmath/intl/gd/mysql/redis extensions, MySQL 8, Redis 7, Node.js 20 LTS, Composer 2, and systemd. Use a managed equivalent if preferred. Each database user should be restricted to its own database.

## Refute Core

Refute Core extends LocalCoin and includes the licensed clean LocalCoin baseline under `deployment/baseline/database.sql`. The guarded importer accepts only an empty database, validates the expected baseline and `users.id` type, and requires immediate rotation of the seeded administrator credentials.

1. Extract Core to `/var/www/refute-core/releases/<release>` and point `/var/www/refute-core/current` at it.
2. Copy `deployment/.env.production.example` to `.env`. Generate `APP_KEY` with the installer. Replace every placeholder and keep all financial features disabled initially.
3. Create an empty `refute_core` MySQL database and least-privilege user, then run `chmod +x deployment/*.sh` and `./deployment/import_baseline.sh`.
4. Run `./deployment/install.sh` to add the Refute schemas.
5. Adapt `deployment/nginx.conf`, enable HTTPS, and reload Nginx.
6. Install/enable `refute-core-worker.service`, `refute-core-scheduler.service`, and `refute-core-scheduler.timer` in `/etc/systemd/system`.
7. Run `./deployment/verify.sh`.
8. Generate separate Invest and Folex service credentials using the Core credential command; place each secret only in the matching product and Core configuration.

The installer provisions Refute schemas in dependency order because many original batches used idempotent schema installers. It deliberately leaves ledger authority, P2P, deposits, and withdrawals behind safe feature flags.

## Refute Invest Web

The supplied licensed `install.zip` contains the 43-table Invest baseline. The deployable Invest release includes its `database.sql` under `core/deployment/baseline/`. The browser installer is intentionally excluded because it disables TLS verification for remote licensing/cPanel calls. The CLI importer verifies an empty target, imports the licensed SQL, immediately rotates the seeded administrator password, and clears reset/session data.

1. Extract the complete Invest web release to `/var/www/refute-invest/releases/<release>`; its public document root is the release root because the vendor front controller loads `core/`.
2. Copy `core/.env.example` to `core/.env`, configure it, and set the Invest service secret created in Core.
3. From `core/`, run `chmod +x deployment/*.sh`, then `./deployment/import_baseline.sh`. Enter a new production administrator email and a unique password of at least 16 characters.
4. Run `./deployment/install.sh` to add the Refute schemas and build assets.
5. Adapt the supplied Nginx configuration. It denies direct access to `.env`, Composer, storage, and vendor paths.
6. Install the worker and scheduler units; their working directory is `/var/www/refute-invest/current/core`.
7. Run `./deployment/verify.sh` and validate a signed Wallet request to Core.

For a brand-new system with no legacy Invest balances, keep `REFUTE_LEGACY_WALLET_MODE=legacy` during validation, then follow the launch decision for switching directly to Core after confirming no legacy liabilities exist.

## Refute Folex

1. Extract Folex to `/var/www/refute-folex/releases/<release>` and create its empty MySQL database.
2. Copy `deployment/.env.production.example` to `.env`; use the Folex-specific Core secret.
3. Run `chmod +x deployment/*.sh` and `./deployment/install.sh`. Its normal Laravel migrations create the clean schema.
4. Adapt/enable Nginx, the worker, and the scheduler timer.
5. Run `./deployment/verify.sh`.
6. Link Folex users to Core identities before enabling Wallet or live-account funding. For a new empty installation, newly registered users should follow the canonical identity-link flow; the legacy catalog command is only for imported users.

## Refute Invest Mobile

Follow `deployment/README.md`. Copy `build.env.example` to ignored `build.env`, replace URLs, set organization-owned bundle IDs/signing, and run the Android or iOS build script. Mobile receives only public endpoints/configuration; never compile Core service credentials into the app.

## Go-live

Run staging acceptance in `FINAL_DEPLOYMENT_CHECKLIST.md`, then follow `BATCH_30_LAUNCH_RUNBOOK.md`. Back up and test restoration first. Require zero unexplained reconciliation variance. Start with explicit pilot accounts and merchants. Never enable deposits, withdrawals, P2P, or ledger authority merely because installation completed.

## Rollback

Use immutable release directories and switch the `current` symlink back for application rollback. Do not roll back or edit posted ledger journals. Disable feature flags, drain workers, preserve callbacks, and use the financial recovery/reconciliation workflows. Database rollback requires an approved restore plan and must account for any transactions accepted after the backup.