LAST1.ID Week 5 Report — Full Test Matrix¶

Date: 2026-08-25
Scope: Sovereign stack on auth-last1id (VM 114, 192.168.1.96 / Tailscale 100.85.114.46). Private LAN only. Railway + hosted Supabase unchanged. No DNS cutover.
Status: Week 5 complete with two Ryan review items — STOP before Week 6 approval.

Executive summary¶

Week 5 executed the full test matrix against the R940 sovereign last1.id stack. Email/password, Google OAuth (Ryan browser), JWKS, light load, and core partner OIDC all pass. Session cascade (GoTrue session survives partner token exchange + refresh) passes. Two items need Ryan investigation before Week 6 DNS cutover: (1) partner OIDC id_token.sub is a distinct subject UUID (not auth.users.id) — likely by design, test assertion was wrong; (2) Postgres failure-mode probe via host iptables did not block Dockerized GoTrue DB traffic — failure-mode test needs a Docker-aware approach.

Test report card¶

#	Test	Method	Result	Notes
1	Email signup	`week5-email-e2e.sh` on VM 114	PASS	`@last1.enterprises.test` only; `GOTRUE_MAILER_AUTOCONFIRM=true` (no outbound email)
2	Email signin	same	PASS	Password grant returns `access_token`
3	Session refresh	same	PASS	Refresh token → new access token; `/user` valid
4	Google OAuth init	`week5-google-oauth-e2e.sh`	PASS	Client `889079898378-…`; redirect_uri `https://auth.last1.id/auth/v1/callback`
5	Google OAuth browser	Ryan manual (Firefox/Tailscale hosts)	PASS	`ryan@last1.enterprises` login `2026-08-25T18:01:16Z`; callback → health JSON
6	Google OAuth Cursor browser	Cursor IDE browser automation	SKIP	Health URL reachable; full Google consent requires human account — not automatable without test Google creds
7	Partner OIDC round-trip	`week4-oidc-e2e.sh` (baseline)	PASS	Signup → PKCE approve → token → JWKS verify → userinfo
8	Partner OIDC session cascade	manual + `week5-oidc-e2e.sh` partial	PASS	GoTrue session valid pre/post OIDC; refresh post-OIDC yes
9	Partner OIDC `id_token.sub`	`week5-oidc-e2e.sh` assertion	FINDING	`id_token.sub` ≠ `auth.users.id`; matches `userinfo.sub` (pairwise subject). Ryan confirm intended.
10	Sovereign JWKS HTTP 200	`week5-jwks.sh`	PASS	`kid=last1-rs256-staging-v1`, RS256
11	Railway JWKS baseline	`week5-jwks.sh`	INFO	`https://last1.id/.well-known/jwks.json` → HTTP 500 (unchanged since Week 3)
12	Kong restart recovery	`week5-failure-modes.sh`	PASS	Health + signup recover within ~5s
13	MinIO down (auth path)	same	PASS	Auth health + signup unaffected (profile photos deferred)
14	Postgres unreachable	same	FINDING	Host `iptables` block did not stop Docker GoTrue signups (HTTP 200). Probe inconclusive — needs Docker-network-aware test. Ryan review.
15	Light load 10 concurrent signups	`week5-load.sh`	PASS	10/10 success; avg 494ms, max 523ms

1. Email + password E2E — PASS¶

Script: scripts/last1-id/week5-email-e2e.sh

Step	Result
POST `/auth/v1/signup`	`access_token` + `refresh_token`
POST `/auth/v1/token?grant_type=password`	Signin OK
GET `/auth/v1/user`	Email matches synthetic address
POST `/auth/v1/token?grant_type=refresh_token`	New tokens; `/user` valid

No emails sent (AUTOCONFIRM; .test domain only).

2. Google OAuth — PASS¶

Automated init — PASS¶

Check	Result
`external.google` enabled	true
Authorize → 302 → `accounts.google.com`	OK
Client ID	`889079898378-p9dffvhr7tqdh1e71j2rlq45epnuq844.apps.googleusercontent.com`
`redirect_uri`	`https://auth.last1.id/auth/v1/callback`

Script: scripts/last1-id/week5-google-oauth-e2e.sh

Browser E2E — PASS (Ryan manual)¶

Ryan completed full flow after Week 4 correction:

/etc/hosts: 100.85.114.46 auth.last1.id (Tailscale; off-LAN)
Authorize URL → Google consent → callback
Landed on GoTrue health JSON (redirect_to=/auth/v1/health)

Server audit: GoTrue log login / provider=google for ryan@last1.enterprises at 2026-08-25T18:01:16Z.

Cursor browser automation — SKIP¶

Cursor browser can reach https://auth.last1.id/auth/v1/health in some environments, but Google consent requires a human Google account. No dedicated test Google credential in BWS. Ryan manual test is the authoritative browser E2E for Week 5.

Old GCP client (645620802422-…): not disabled (parallel run constraint held).

3. Partner OIDC E2E — PASS (with Ryan review item)¶

Core round-trip — PASS¶

week4-oidc-e2e.sh on VM 114: ALL PASS (signup → PKCE approve → token exchange → JWKS RS256 verify → userinfo).

Session cascade — PASS¶

Verified manually after partner token exchange:

Check	Result
GoTrue `/user` before OIDC approve	Valid session
GoTrue `/user` after partner token exchange	Same user (`post_oidc_user_match=yes`)
GoTrue refresh token after OIDC	Works (`refresh_post_oidc=yes`)

FINDING: `id_token.sub` semantics¶

week5-oidc-e2e.sh added assertion id_token.sub == auth.users.id — fails by design:

Field	Example value
`auth.users.id`	`ef5e1ac7-db58-40c0-934b-ad636d9471d7`
`id_token.sub`	`e4941280-d281-4dca-9d8c-c6afecb5aefe`
`userinfo.sub`	Same as `id_token.sub`

Partner OIDC issues a partner-scoped subject distinct from the internal GoTrue user UUID. JWKS signature, aud=lastvet, nonce, and userinfo round-trip all pass (Week 4 contract).

Ryan action: Confirm this matches LastVet integration expectations before Week 6. Not a stack regression — Week 5 test assertion was overly strict.

Script: scripts/last1-id/week5-oidc-sub-debug.sh (diagnostic)

4. JWKS endpoint health — PASS¶

Endpoint	HTTP	kid	Notes
Sovereign `http://192.168.1.96:5000/.well-known/jwks.json`	200	`last1-rs256-staging-v1`	RS256; cutover-ready
Railway `https://last1.id/.well-known/jwks.json`	500	n/a	Known prod bug; must not inherit at Week 6

Script: scripts/last1-id/week5-jwks.sh

5. Failure mode testing — PARTIAL (Ryan review item)¶

Script: scripts/last1-id/week5-failure-modes.sh

Scenario	Expected	Observed	Result
Kong restart	Brief outage → recovery	Health + signup OK after ~5s	PASS
MinIO stopped	Auth unaffected	Health + signup OK	PASS
Postgres blocked (host iptables → `192.168.1.95:5432`)	Signup fails	Signup still HTTP 200	FINDING

Postgres probe note: GoTrue runs in Docker; host OUTPUT iptables does not block container egress on the Docker bridge. /health may also respond from pooled connections. Week 6 prep: design failure test via docker compose pause auth, DB VM stop, or network policy on sovereign-db-last1id — not host iptables alone.

All services restored after tests.

6. Light load test — PASS¶

Script: scripts/last1-id/week5-load.sh

Metric	Value
Concurrent signups	10
Success rate	10/10
Avg latency	494ms
Max latency	523ms

No obvious bottleneck at this scale. Not production load testing.

Constraints held¶

Constraint	Held
No DNS cutover	Yes — `auth.last1.id` still Railway publicly
Old GCP client active	Yes
Railway/Supabase untouched	Yes
No email to non-test addresses	Yes — `.test` domain + autoconfirm

Ryan review items (STOP before Week 6)¶

Partner OIDC sub claim: Confirm partner-scoped id_token.sub (≠ auth.users.id) is intended LastVet contract.
Postgres failure-mode probe: Accept inconclusive iptables test; approve Docker-aware probe for Week 6 prep (optional).

Scripts added¶

Script	Purpose
`week5-email-e2e.sh`	Email signup/signin/refresh
`week5-google-oauth-e2e.sh`	Google init + DB audit
`week5-oidc-e2e.sh`	Partner OIDC + session cascade
`week5-jwks.sh`	Sovereign vs Railway JWKS
`week5-failure-modes.sh`	Kong / MinIO / Postgres probes
`week5-load.sh`	10 concurrent signups
`week5-run-all.sh`	Master runner
`week5-oidc-sub-debug.sh`	`sub` claim diagnostic

Run on VM 114: bash week5-run-all.sh

Week 6 entry (blocked until Ryan approval)¶

Ryan sign-off on Week 5 report + two review items above
DNS: auth.last1.id → R940 tunnel; last1.id → Cloudflare Pages
Deploy LastVet LAST1_ID_API_BASE=https://auth.last1.id
24–48h soak — Railway + Supabase remain fallback
Verify public JWKS 200 on https://auth.last1.id/.well-known/jwks.json

Ryan approval required before Week 6 execution.