Platform Operations

The platform operations area exposes the same command-backed workflows operators already needed, but now from the app shell.

• Inspect self-serve clinic readiness, onboarding posture, and launch blockers without dropping into the database.
• Launch the clinic onboarding wizard and demo concierge flows without dropping into hidden provisioning scripts.
• Audit tenants, refresh platform health, sync subscriptions, capture usage, and repair migration state.
• Repair one tenant from the UI without inventing a second implementation path.
• Review clinic lifecycle events, invite states, and buyer-proof evidence or smoke status from one central screen.
• Issue or revoke scoped private API tokens for platform demos, internal tools, or clinic-scoped integrations.
• Reset a demo clinic back to a deterministic buyer-ready story without disturbing the rest of the platform shell.

Platform and clinic operators no longer have to infer readiness from configuration files alone. The product surfaces key provider and access states directly in the UI.

• Platform operations shows Google and Microsoft enabled state, missing credentials, callback alignment, domain policy summary, and recent identity linking activity.
• Clinic communications surfaces show Twilio driver health, callback posture, replay activity, failed delivery reasons, and patient opt-out pressure by channel.
• Platform access policy shows the effective IP allowlist, maximum session age, and TOTP-by-role posture so operators can audit launch controls without reading storage directly.

Platform admin completion is now visible as first-class UI instead of a mix of hidden service actions and partial screens.

• Staff Ops Center handles invite, resend, revoke, suspend, reactivate, remove access, default clinic, and membership history flows.
• Clinic Lifecycle console keeps active, provisioning, failed, suspended, archived, restored, and reset-demo actions in one place.
• Onboarding status and demo readiness summaries stay attached to each clinic so repair and buyer proof share one platform mental model.
• Lifecycle and repair actions remain command-backed, so there is no second admin-only implementation path to maintain.

The operator contract is now explicit: audit, repair, refresh, then rerun the buyer path and docs evidence.

• Operix:audit-tenants stays dry-run by default and highlights migration, membership, and bootstrap gaps.
• Operix:repair-tenant heals tenant schema, AI/comms bootstrap, permissions, memberships, and stale provisioning state.
• Operix:repair-migration-state baselines missing migration rows when schema already exists, which is critical for partial installs.
• Audit Export Center can package platform activity, memberships, lifecycle, commercial, clinic AI, clinic communications, and clinic overview data into queued JSON or CSV bundles.
• Platform access policy now enforces IP allowlists, maximum session age, and TOTP-by-role from the same operator surface.
• npm run release:gate ties platform smoke, self-serve smoke, docs evidence, docs coverage, and targeted Laravel suites into one repo-local release gate.
• Platform clinic summaries surface the latest evidence and smoke timestamps so buyer-facing readiness is obvious before anyone starts a demo.