# Apollo channels release preparation — 2026-09-08

Owner authorization: apply migrations, populate NP Group with its actual configuration,
and deploy. This record does not claim activation before the E2 execution receipt exists.

## Database and existing configuration

- Full custom-format Main and Preview backups completed before migration. Backups
  are under the administrator/SYSTEM-only `local/secrets/db-backups` directory,
  excluded from version control. Data Protection keys are not in database dumps.
- Applied `ApolloLicenceChannels` and `ApolloChannelIntakeIdentity` to Main and
  Preview. A full-suite metadata check identified the nonstandard RLS policy name;
  `NormalizeApolloChannelPolicyNames` renames it to `tenant_isolation`, preserving
  the same selected-owner/admin predicates. This forward correction was applied
  to both databases; no existing migration was rewritten.
- Imported NP Group's approved `default` Apollo profile, existing Graph mailbox
  and four folder names, existing intake client binding and protected credentials,
  and the paired WhatsApp account with its five enabled licence sender scopes.
  No WhatsApp pairing material was copied. No real credentials were seeded into Preview.
- The two new channel rows are disabled desired configuration. Their presence
  does not claim operational connectors. The legacy default-home gateway and
  its two-minute email jobs remain unchanged; no duplicate intake jobs were started.
- `tools/channel-config-import` defaults to dry-run and refuses to overwrite an
  existing channel configuration. Audit actor is explicitly
  `operator:np-group-channel-import`, not an impersonated user login.

## Required web runtime preparation

The integrated release also contains the earlier scoped-reading changes. Deploying
that code without its plugin would refuse Apollo executions. Prepared the plugin
only in `D:/ApolloData/web-hermes`, enabled native plugin discovery, disabled the
tool-search facade for direct single-tool exposure, and enabled
`AiHarness:Hermes:ReadToolsEnabled` in external web secrets. The existing read-only
connection remains unchanged. Prior web config/secrets were backed up in the
protected backup directory; no credentials were printed or added to the release.
The web app pool was granted read/execute on the plugin. No service restart was
performed during preparation and the default gateway home was untouched.

The navigation interaction test now asserts the live ancestor's open property
with Playwright's retrying locator, avoiding a detached-node race during Blazor
hydration. It still requires the selected project branch to remain open.

## Activation boundary

Publish only a clean committed candidate and use the existing E2 WhatIf/Execute
workflow, including renewal guard and fresh interactive privilege proof. Do not
use the legacy deployment shortcut, force confirmation, or reuse a previous
execution proof. The operator must enter the database administrator password in
the elevated interactive launcher; it must never be supplied through chat or a log.