SPRINT-2 Gate E Report — VM 117 GoTrue Retirement (S2-E)¶

Status: COMPLETE — Gate F pass 2026-08-28
Date: 2026-08-28
Prerequisite: Gate D pass (ryan@last1.enterprises + ryan@last1.org login verified)

Summary¶

GoTrue (supabase-auth) retired on VM 117 (192.168.1.98). Postgres, Envoy API gateway, PostgREST, Storage, Edge Functions, Supavisor, Studio, imgproxy, and meta remain running. Auth routes removed from Envoy (lds.template.yaml, cds.yaml) and Kong template (kong.yml). RealOutcomes on VM 116 continues to authenticate via auth.last1.id (Last1 ID OIDC); app DATABASE_URL remains hosted Supabase (Gate D scope).

1. Rollback artifacts (captured before retirement)¶

Item	Value
Directory	`/var/backups/realoutcomes/gate-e-pre-gotrue-retire-20260828T213736Z` (VM 117)
Compose backup	`docker-compose.yml.bak-pre-sprint2-gotrue-20260828T213736Z`
Kong backup	`kong.yml.bak-pre-sprint2-gotrue-20260828T213736Z`
Envoy LDS backup	`lds.template.yaml.bak-pre-sprint2-gotrue-20260828T213736Z`
Envoy CDS backup	`cds.yaml.bak-pre-sprint2-gotrue-20260828T213736Z`
Rollback instructions	`ROLLBACK.md` in same directory

Rollback (if auth breaks post-retirement):

cd /opt/supabase/docker
BACKUP=/var/backups/realoutcomes/gate-e-pre-gotrue-retire-20260828T213736Z
cp "$BACKUP/docker-compose.yml.bak-pre-sprint2-gotrue-20260828T213736Z" docker-compose.yml
cp "$BACKUP/kong.yml.bak-pre-sprint2-gotrue-20260828T213736Z" volumes/api/kong.yml
cp "$BACKUP/lds.template.yaml.bak-pre-sprint2-gotrue-20260828T213736Z" volumes/api/envoy/lds.template.yaml
cp "$BACKUP/cds.yaml.bak-pre-sprint2-gotrue-20260828T213736Z" volumes/api/envoy/cds.yaml
docker compose up -d auth api-gw

2. Changes executed¶

Step	Action	Result
1	Stop + remove `supabase-auth` container	PASS — container absent
2	Remove `auth:` service from `docker-compose.yml`	PASS — no auth service definition
3	Remove 8 Envoy routes with `cluster: auth` from `lds.template.yaml`	PASS — 0 `cluster: auth` remaining
4	Remove `auth` cluster from `cds.yaml`	PASS
5	Remove 7 `auth-v1*` services from `kong.yml`	PASS (template; live gateway is Envoy)
6	Recreate `api-gw` (`supabase-envoy`)	PASS — healthy

Note: Initial route-removal script corrupted lds.template.yaml; immediately restored from backup and re-applied with a route-scoped patch. Final config verified (881 lines, healthy Envoy).

3. VM 117 stack after retirement¶

Container	Status
`supabase-db`	Up (healthy)
`supabase-envoy` (api-gw)	Up (healthy)
`supabase-rest`	Up (healthy)
`supabase-storage`	Up (healthy)
`supabase-edge-functions`	Up (healthy)
`supabase-pooler` (supavisor)	Up (healthy)
`supabase-meta`	Up (healthy)
`supabase-studio`	Up (healthy)
`supabase-imgproxy`	Up (healthy)
`supabase-auth`	Removed

4. Automated verification¶

VM 117 (Supabase stack)¶

Test	Result
`GET /auth/v1/health`	401 (auth route removed; fails closed via gateway basic auth)
`POST /functions/v1/process-score-runs` (service role bearer)	200
`GET /storage/v1/status` (anon bearer)	200
`GET /rest/v1/` (service role bearer)	200
Edge cron timers (`realoutcomes-process-score-runs.timer`, etc.)	active
Recent cron log entries	200 (`process-score-runs`, `process-status-changes`)

VM 116 (RealOutcomes app)¶

Test	Result
`GET /`	200
`GET /api/auth/user` (no bearer)	401 (expected)
`GET /api/auth/user` (invalid bearer)	401 (JWT validation rejects garbage token)
`GET /api/directory?limit=1`	200
`GET https://auth.last1.id/.well-known/openid-configuration`	200

Bearer note: Automated smoke validates unauthenticated and invalid-bearer rejection plus Last1 ID OIDC discovery. A live user access token (post Google OAuth) requires Ryan browser verification in §5.

5. Manual verification (Ryan required before Gate F)¶

#	Test	Expected
E-1	`ryan@last1.enterprises` — sign out → full OAuth loop	Lands in portal; admin badge; Veterans watchlist
E-2	`ryan@last1.org` — sign out → full OAuth loop	Lands in portal; id unchanged (`536a1797…`)
E-3	Portfolio / directory / watchlists	Data loads (no regression from GoTrue retirement)
E-4	Confirm no app traffic hits `192.168.1.98:8000/auth/v1/*` during login	Browser network tab shows only `auth.last1.id`

Reply when all pass: Gate E pass
If login breaks: run rollback in §1; do not proceed to Gate F.

6. DB scope note¶

System	Database
RealOutcomes app (VM 116)	Hosted Supabase (`DATABASE_URL` on `realoutcomes-app`)
VM 117 Postgres	Local stack DB (2 legacy users; IRS replica from Gate B rehearsal)

GoTrue retirement does not migrate app data to VM 117. T3 cutover remains a separate gate.

7. Blocked until Gate E Ryan sign-off¶

Gate	Work
F	SPRINT-2 closeout → SPRINT-3 (`realoutcomes-edge`)

END Gate E report