SPRINT-3 S3-6 Report — PF verification (production cutover)¶
Date: 2026-08-28
Hostname: https://realoutcomes.app (+ www)
Origin: VM 116 (realoutcomes-app) via realoutcomes-edge tunnel
Script: scripts/realoutcomes/verify-pf-headers-production.sh
DNS¶
| Check | Result |
|---|---|
Apex CNAME → 643ea255-19c7-4cef-a154-7a2fd6154275.cfargotunnel.com |
PASS (proxied) |
| WWW CNAME → same target | PASS (proxied) |
| Public resolver (1.1.1.1) | Cloudflare anycast A (104.21.44.126, 172.67.199.249) |
Stack fingerprint (no Railway)¶
| URL | HTTP | x-railway-edge |
|---|---|---|
https://realoutcomes.app/ |
200 | absent |
https://www.realoutcomes.app/ |
200 | absent |
Response: x-powered-by: Express, last-modified: Fri, 28 Aug 2026 22:19:29 GMT (R940 deploy).
API smoke¶
| Test | Result |
|---|---|
GET /api/auth/user (no session) |
401 |
GET /api/directory?limit=1 |
200; total 1,987,840 |
GET /login |
200 |
GET /api/health |
200 |
GET https://auth.last1.id/.well-known/openid-configuration |
200 |
POST /api/auth/last1/start |
200; authorizeUrl → auth.last1.id with redirect_uri=https://realoutcomes.app/auth/callback and client_id=realoutcomes |
Auth E2E (browser login → callback → session): deferred to S3-7 (Ryan). Automated pre-checks above PASS.
Stripe webhook¶
| Test | Result | Notes |
|---|---|---|
POST /api/stripe/webhook (no signature) |
400 | Endpoint reachable on prod |
POST /api/stripe/webhook (bad signature) |
400 | Rejects invalid sig |
POST http://192.168.1.99:5000/api/stripe/webhook (valid HMAC, new BWS secret) |
200 {"received":true} |
Signing secret validates on R940 |
POST https://realoutcomes.app/api/stripe/webhook (valid HMAC from Cursor runner) |
403 CF 1010 |
Cloudflare bot/WAF blocks synthetic signed POST from this IP; not an app failure |
Ryan S3-7 action: In Stripe Dashboard → Webhooks → we_1U9Y7mJBZ5q5XOPp4iRBYUfp → send test event or inspect recent delivery log. Expect 2xx once Stripe delivers from Stripe IP ranges.
VM 116 / VM 117¶
| Check | Result |
|---|---|
VM 116 cloudflared |
active |
VM 116 realoutcomes-app |
Up; local :5000 200 |
| VM 117 GoTrue container | absent (Gate E) |
VM 117 GET /storage/v1/status (LAN) |
200 |
VM 117 POST /functions/v1/process-score-runs (service role) |
200 {"success":true,...} |
VM 117 realoutcomes-* timers |
5 listed (active) |
S3-6 verdict¶
PASS — production DNS and PF checks confirm R940 via tunnel. Stripe secret validates on origin; prod webhook path needs Stripe Dashboard delivery confirmation (CF 1010 on synthetic external signed test only).
Next: Ryan executes S3-7 browser E2E on https://realoutcomes.app using SPRINT-3_S3-7_TEST_PLAN.md.
STOP after S3-7 sign-off before S3-8 (Railway + hosted Supabase teardown).
END S3-6 report