Trichakra Nexus® DACC v4.00.6

Section C Launch Readiness Demo — Static HTML, no external calls, no real secrets.

1. Install / Update / Rollback Flow

1
Fresh Install
DOMAIN=www.trichakra.ltd bash deploy/fresh_install.sh
Creates DB, generates secrets, prints VAULT KEY once. Never shows again.
2
Update existing
bash deploy/update_release.sh /path/to/package.zip
Backs up first, preserves .env, runs migrations forward only.
3
Rollback
bash deploy/rollback_release.sh /root/nexus-backups/backup-20240101
Restores code only. .env preserved. DB rollback is manual.
4
Deploy Doctor
bash deploy/deploy_doctor.sh
Checks: migration 009, nexus_modules, commerce_engine=not_installed, /health, /auth/setup-status, /modules/my.

2. Module Activation Flow

1
Check module registry — GET /api/v1/modules — lists 19 modules (admin only)
2
Activate module — POST /api/v1/modules/{key}/activate — checks dependencies, audit-logged
3
Inactive module access — returns 403 module_disabled
4
Staff visibility — GET /api/v1/modules/my — returns only allowed active modules; hidden modules not exposed

3. Permission Matrix

ActionAdminStaff
Activate/deactivate module✅ Yes❌ 403 + audit
Change module permissions✅ Yes❌ 403 + audit
See hidden module names✅ Yes❌ Not exposed
View audit logs✅ Yes❌ No
Apply ad recommendation❌ Never❌ Never

4. Vault Model

1
All credentials stored via Vault (AES-256-GCM encrypted). AAD frozen: rklifeops-vault-v1
2
VAULT_ENCRYPTION_KEY generated at install, printed ONCE — never stored in code or DB
3
Modules with secret access require explicit approval: nexus_module_secrets_access.approved = true
4
No tokens/keys in frontend, logs, or API responses

5. First Admin Setup

1
python3 backend/app/scripts/create_first_admin.py --email admin@yourdomain.com --name "Name"
2
Verify: GET /api/v1/auth/setup-status → {"admin_exists": true, "module_system_ready": true}
3
Log in → complete TOTP setup → save VAULT_ENCRYPTION_KEY offline
4
Open Module Center → activate needed modules → run deploy_doctor

6. Backup / Restore Flow

1
bash deploy/backup.sh → saves code + frontend + DB dump + .env (restricted 600)
2
bash deploy/test_restore.sh /root/nexus-backups/backup-XYZ → verifies backup integrity
3
bash deploy/restore_backup.sh /root/nexus-backups/backup-XYZ → restores code; .env preserved

7. Launch Checklist

CheckStatus
Migration head = 009Verify with deploy_doctor
Module registry seeded (19 modules)Auto on startup
commerce_engine = not_installedEnforced
No write-enabled modulesDefault false
No API keys in frontendVerified by test
No browser LLM callsVerified by test
Admin created + TOTP enabledManual step
VAULT_ENCRYPTION_KEY saved offlineManual — do not skip

Static demo — no external calls, no real secrets, no private data · DACC v4.00.6 · www.trichakra.ltd