LAST1.ID W7-1 Pre-Teardown Audit¶
Date: 2026-08-26
Status: Complete — STOP for Ryan approval before W7-2 (archival)
Ryan approved Week 7 kickoff. This audit covers dependency checks only. No teardown executed.
Executive summary¶
| Check | Result |
|---|---|
Prod services → Railway last1.id compute |
CLEAR — no active prod dependency |
Prod services → hosted Supabase nztgswcpnwggymncrnyx |
CLEAR — sovereign uses R940 Postgres |
| Hardcoded Railway/Supabase URLs in LastVet runtime | CLEAR — none in prod paths |
| iOS issuer | Expected gap — still https://last1.id (deferred) |
| Recommendation | Proceed to W7-2 with flagged non-prod/staging items below |
Rollback note: last1.id DNS already points at Cloudflare Pages, not Railway. Railway service last1.id still exists (SUCCESS) but is off the public auth path. Full rollback to Railway would require DNS + env restore until W7-4 deletes the service.
1. Railway last1.id service — active connections¶
Production (verified live)¶
| Service | last1.id / Railway target | Value |
|---|---|---|
lastvet-api-prod (R940) |
LAST1_ID_API_BASE |
https://auth.last1.id |
Sovereign last1id-app |
SITE_URL, PUBLIC_BASE_URL, LAST1_ID_ISSUER_URL, SUPABASE_URL |
all https://auth.last1.id |
provider.last.vet (CF Pages prod) |
OIDC issuer in bundle | auth.last1.id |
Public https://last1.id |
DNS | Cloudflare (Pages marketing), not Railway |
Public https://auth.last1.id |
Auth + OIDC | R940 tunnel → sovereign stack |
Railway service state (GraphQL, 2026-08-26)¶
| Field | Value |
|---|---|
| Project | disciplined-beauty (0cb8d8fa-5216-479a-b1f5-00d2dfa7c88b) |
| Service | last1.id (b84596ac-82b1-40b2-96ab-f4e4ec03a186) |
| Latest deployment | SUCCESS |
| Public traffic | No — last1.id resolves to Cloudflare Pages; JWKS at https://last1.id/.well-known/jwks.json returns HTTP 500 (legacy path, not prod auth) |
Conclusion: Railway compute is a dormant fallback, not serving production auth/OIDC traffic.
2. Hosted Supabase nztgswcpnwggymncrnyx — active connections¶
| Consumer | Uses hosted Supabase? | Notes |
|---|---|---|
| Sovereign R940 stack | No | Postgres on sovereign-db-last1id (192.168.1.95) |
| LastVet API (prod) | No | Talks to auth.last1.id only |
| Provider portal (prod) | No | OIDC client only |
last1.id marketing Pages |
No project ref in JS bundle | CSP allows *.supabase.co; /assets/index-*.js grep found no nztgswcpnwggymncrnyx |
Railway last1.id service |
Yes (legacy) | Still deployed; historical DB/auth backend |
| LastVet repos (runtime code) | No | nztgswcpnwggymncrnyx appears only in gate-b-dump.sh + docs |
Hosted project liveness: https://nztgswcpnwggymncrnyx.supabase.co responds (401 without valid key — project online).
Conclusion: Safe to archive/delete Supabase after W7-2 pg_dump, once Ryan chooses disposition in W7-3. No prod LastVet path depends on it.
3. Repo grep — Railway / Supabase URL remnants¶
Production runtime (action needed later, not W7-1 blockers)¶
| Location | Finding | W7 impact |
|---|---|---|
last.vet-ios/Configuration.swift |
last1OAuthIssuer: https://last1.id |
Deferred — iOS rebuild post-soak; already misaligned with Pages apex (not auth) |
last.vet-provider/scripts/cf-build-staging.sh |
NEXT_PUBLIC_LAST1_ID_ISSUER=https://last1.id |
Staging debt — update when staging cutover desired |
last.vet-provider/src/lib/last1Auth.ts |
Default fallback https://last1.id |
Overridden in prod build |
last.vet-api/src/config/environment.ts |
Default LAST1_ID_API_BASE fallback https://last1.id |
Prod env overrides on R940 |
Non-runtime / scripts / docs only¶
| Location | Finding |
|---|---|
lastvet-gates/scripts/last1-id/week5-jwks.sh, week4-smoke.sh |
Optional RAILWAY_JWKS_URL=https://last1.id/... (audit scripts) |
lastvet-gates/scripts/last1-id/gate-b-dump.sh |
SUPABASE_PROJECT_REF=nztgswcpnwggymncrnyx |
lastvet-gates/scripts/last1-id/copy-railway-secrets-week3.sh |
Railway IDs + historical BWS copy helpers |
last.vet-api tests / docs |
test.last1.id, https://last1.id in comments and defaults |
last.vet-api staging smoke scripts |
*.up.railway.app for LastVet API staging, not last1.id |
No *.up.railway.app hostname for last1.id found in application code.
4. iOS status (expected)¶
89:89:last.vet-ios/LastVet/App/Configuration.swift
static var last1OAuthIssuer: URL { URL(string: "https://last1.id")! }
| Item | Status |
|---|---|
| Issuer | https://last1.id (not auth.last1.id) |
| Feature flag | last1OAuthEnabled: true |
| Redirect URI | https://last.vet/auth/last1/callback (unchanged) |
| Prod API client_id | lastvet (matches sovereign) |
Assessment: Expected deferred gap. iOS Last1 sign-in does not use Railway or hosted Supabase directly; it uses the issuer URL for /oauth/authorize. With last1.id on marketing Pages, iOS OAuth is already misaligned — Railway teardown does not introduce a new prod regression.
Not in W7 scope per Ryan constraint.
5. Flagged items (informational, not W7-1 blockers)¶
- Provider staging issuer still
last1.idincf-build-staging.sh— fix when staging auth cutover is scheduled. - GCP legacy client
645620802422-4ce8…still tied to hosted Supabase GoTrue Google OAuth — decide in W7-5 after Supabase disposition (W7-3). - Railway service still running (
SUCCESS) — costing compute until W7-4; no prod traffic. maintenance.cleanup_failedon sovereign app (2026-08-26) — non-P1; unrelated to teardown.
6. W7-1 verdict¶
| Gate | Decision |
|---|---|
| Dependency risk blocking W7-2? | No |
| Proceed to W7-2 archival? | Yes, pending Ryan approval |
| Abort teardown? | No |
Ryan approvals needed next¶
| Gate | Decision |
|---|---|
| W7-2 | Approve archival run (Railway env export + Supabase pg_dump) |
| W7-3 (later) | Supabase: delete / free-tier archive / keep paid |
| W7-5 (later) | GCP old client: delete / keep for audit |
| W7-6 (later) | BWS keys to remove (Cursor will list) |
STOP — awaiting Ryan "approve W7-2" before any archival or teardown.