L1 Entry Closeout — 2026-09-02¶
Milestone: LastVet veteran login via Last1 ID + verification gate (L1 entry only).
Status: CLOSED — Ryan E2E sign-off on curryrg@gmail.com (2026-09-02).
Next: Coordination loop build — awaiting Ryan approval of LOOP1_COORDINATION_LOOP_BUILD_PLAN.md. No loop code until approved.
What was proven¶
| Criterion | Evidence |
|---|---|
| Veteran signs in via Last1 ID (not VA front door) | last.vet-ios Last1IDAuthManager → auth.last1.id/oauth/authorize (client_id=lastvet) |
| Google OAuth branding | Dedicated Last1 ID GCP client on GoTrue (322031692113-…); consent shows Last1 ID |
| Verification gate enforced | isVeteranVerified from last1.id / LastVet API; unverified users blocked from main tabs |
| Verified veteran path | curryrg@gmail.com — DD-214 Pathway 2, platform-admin confirm → Verified veteran on Step 3 |
| VA auto-popup removed | last.vet-ios 48c22e4 — no Service History OAuth on onboarding complete / App Lock setup |
| Home card copy | last.vet-ios 7dcbf8b — no WIN-only messaging; status reflects Last1 ID verification |
| LastVet API session mint | POST /api/auth/last1/veteran/callback deployed prod (201bb3c) |
Cross-repo release pins (reference, not tags)¶
| Repo | Branch | Commit | Notes |
|---|---|---|---|
| last.vet-ios | main |
7dcbf8b |
L1 entry UI + VA gate + home card |
| last.vet-api | main |
201bb3c |
Last1 ID veteran callback + DD-214 proxy |
| last1.id | (prod VM) | — | VCA + DD-214 dual method; GoTrue Google OAuth rotated |
| last.vet-web | (deployed) | — | /auth/last1/callback bridge (no code change this increment) |
Suggested git tag on lastvet-gates after this closeout doc merges: l1-entry-2026-09-02.
Auth VM config — drift discipline¶
See AUTH_VM_L1_ENTRY_CONFIG.md (same directory). Summary:
| Setting | Committed in repo? | Live VM state (2026-09-02) |
|---|---|---|
GOOGLE_OAUTH_* in /opt/auth-last1id/.env |
Values in BWS only; keys documented in scripts | Ryan updated manually + GoTrue restart |
GOTRUE_URI_ALLOW_LIST in docker-compose.yml |
setup-auth-stack.sh + apply-gotrue-google-week4.sh (patched this closeout) |
Ryan applied via manual sed + restart — re-run apply script or redeploy from template to reconcile |
Stale RealOutcomes client 584962111101-… |
N/A (retired) | Replaced with 322031692113-… |
RealOutcomes-500 lesson: BWS holds secrets; compose/env on VM must match checked-in templates. After any manual VM edit, run apply-gotrue-google-week4.sh from a workstation with BWS access, or diff VM docker-compose.yml against scripts/last1-id/setup-auth-stack.sh.
Explicitly not in L1 entry (unchanged)¶
coordination_*tables / Λ state machine- Loop card in LastVet hub (beyond verification status card)
- RecruitCRM, Path B HM, public anchor, seven-stage timeline UI
- Coordination notes / Gate 0 ROI loop extensions beyond existing Gate 0 code
Sign-off¶
| Role | Name | Date | Notes |
|---|---|---|---|
| Product / ED | Ryan Curry | 2026-09-02 | E2E complete on simulator; Last1 ID Google auth + verified gate |
L1 entry closed. Coordination loop: plan only until Ryan approves build.