# MotorSignal Operations Actions — Production Installation Guide

> **CAUTION: OPERATOR EXECUTION GUIDE ONLY**  
> Do not apply these commands automatically. Execute manually during an authorized maintenance window.

---

## 1. Helper Script Installation
```bash
# 1. Install helper script to canonical location
sudo install -m 0750 -o root -g root \
  /opt/motorsignal/current/backend/scripts/ops-action-helper.sh \
  /opt/motorsignal/current/backend/scripts/ops-action-helper.sh

# 2. Verify helper permissions
ls -la /opt/motorsignal/current/backend/scripts/ops-action-helper.sh
# Expected: -rwxr-x--- 1 root root
```

## 2. Sudoers Configuration
```bash
# 1. Copy sudoers fragment
sudo install -m 0440 -o root -g root \
  /opt/motorsignal/current/backend/docs/ops-actions/sudoers-fragment \
  /etc/sudoers.d/motorsignal-ops-actions

# 2. Validate sudoers syntax (MANDATORY)
sudo visudo -c -f /etc/sudoers.d/motorsignal-ops-actions
# Expected: /etc/sudoers.d/motorsignal-ops-actions: parsed OK
```

## 3. Environment Configuration
In `/etc/motorsignal/production.env`, ensure:
```bash
OPS_ACTION_HELPER_PATH=/opt/motorsignal/current/backend/scripts/ops-action-helper.sh
```

## 4. Emergency Killswitch (Disable all mutation controls)
To rapidly disable all mutations without stopping the API or website:
```bash
sudo chmod 0000 /opt/motorsignal/current/backend/scripts/ops-action-helper.sh
```
When chmod is set to 0000, `is_helper_configured()` will return false, and all mutation requests will fail closed with HTTP 503.