last1.id Mode 2A — Week 2 Gate C Report (W2C)¶
Date: 2026-08-25
Gate: C — Cutover readiness (sovereign READ-READY for Week 3)
Status: COMPLETE — STOP for Ryan Week 3 approval
Constraints honored: No Railway, Supabase, GCP OAuth, or DNS changes.
Executive summary¶
sovereign-db-last1id is READ-READY for Week 3 last1.id app deployment. GoTrue on VM 114 (192.168.1.96:8000) passes end-to-end auth smoke tests against migrated data. BWS LAST1_ID_R940_PROD_* connection strings (Week 1) remain the app/GoTrue DB target.
Gate C fix applied: GoTrue upgraded v2.170.0 → v2.196.0 on auth-last1id. Migrated Supabase auth.* schema (through 20260625000000) requires a matching GoTrue build; v2.170 failed session refresh with missing destination name oauth_client_id.
GoTrue API smoke tests (VM 114 via Kong :8000)¶
All tests run against http://192.168.1.96:8000/auth/v1/ (LAN; same path tunnel will expose at cutover).
| Test | HTTP | Result |
|---|---|---|
Signup (POST /signup) |
200 | New user + access/refresh tokens returned |
Signin (POST /token?grant_type=password) |
200 | Password grant OK |
Session refresh (POST /token?grant_type=refresh_token) |
200 | New access + refresh tokens (after GoTrue v2.196.0) |
Admin user list (GET /admin/users) |
200 | Returns migrated + smoke users; ryan@last1.enterprises present |
GoTrue image on VM 114: supabase/gotrue:v2.196.0 (repo setup-auth-stack.sh updated to match).
Sovereign-db READ-READY declaration¶
| Layer | Host | Status |
|---|---|---|
| Postgres 17.11 | 192.168.1.95 / last1id_prod |
Migrated data; FK clean; RLS 35 policies |
| GoTrue + Kong | 192.168.1.96:8000 |
Healthy; auth API green |
MinIO profile-photos |
192.168.1.96:9000 |
3 objects; checksums verified (Gate B) |
| BWS secrets | LAST1_ID_R940_PROD_DATABASE_*, GOTRUE_*, MINIO_* |
Week 1; LAN URLs |
Week 3 may: deploy last1.id Node app on auth-last1id; point app env at self-hosted Kong/Postgres/MinIO. Week 3 must not (yet): public DNS, GCP OAuth callback changes, Railway cutover, Supabase teardown.
Week 2 migration totals (Gates A–C)¶
| Metric | Count |
|---|---|
auth.users |
12 (+ smoke-test users created in Gate C) |
public.* rows |
543 |
storage.objects |
3 |
| RLS policies (public) | 35 |
| Repo migrations | 71 files; live supabase_migrations.schema_migrations = 70 |
| MinIO files migrated | 3 / 3 |
Gotchas (Week 2 → documented)¶
| # | Gotcha | Where documented |
|---|---|---|
| 1 | IPv6 direct DB blocked from R940; use Supavisor pooler | LAST1_INFRASTRUCTURE_CONSOLIDATION_PLAN.md Tier 2 lessons |
| 2 | pg_dump client version ≥ source PG major |
Same |
| 3 | Post-restore auth.* → last1id_app ownership |
Same + gate-b-restore.sh |
| 4 | GoTrue version must match migrated auth.schema_migrations |
This report; setup-auth-stack.sh → v2.196.0 |
Week 3 readiness¶
| Prerequisite | Ready? |
|---|---|
| Sovereign Postgres populated | Yes |
| GoTrue serving auth | Yes |
| MinIO profile photos | Yes |
| BWS connection strings | Yes (LAN IP) |
| Observability scrape | Yes (Week 1) |
| Deferred to Week 3–4 | last1.id app deploy, OAUTH_JWT_* from Railway, Google OAuth staging, SMTP |
| Deferred to Week 6 | DNS auth.last1.id, public cutover, soak |
| Deferred to Week 7 | Supabase/Railway teardown |
Recommended Week 3 first steps:
- Deploy last1.id app container on auth-last1id (still private LAN/tunnel only).
- Copy
OAUTH_JWT_*+ partner OIDC env from Railway → BWS. - Point app
SUPABASE_URL/DATABASE_URLat self-hosted stack (Kong + Postgres). - Smoke partner OIDC with synthetic accounts (Week 5 matrix starts early if time).
Ryan Gate C checklist¶
- [ ] Accept GoTrue smoke test results (signup / signin / refresh / admin list)
- [ ] Accept READ-READY declaration for Week 3 app deploy
- [ ] Approve Week 3 kickoff (app + OAuth staging; constraints above unchanged)
STOP — Awaiting Ryan Week 3 approval.