SPRINT-7 Pre-Teardown Checklist (T-5 / T-6 Gate)
Product: last1.app + RadioCheck shared Supabase (tcthzakppndkykatoefx)
Hard deadline: Complete before T-6 hosted Supabase + Railway teardown.
Created: 2026-08-30 (T-2 closeout)
Use this checklist at T-5 prep and again as a T-6 blocker — nothing on this list may remain open when Ryan authorizes hosted teardown.
A. GitGuardian / D-live secrets (from T2-3 partial)
| ☐ |
Action |
GG |
Verify |
GG close? |
| ☐ |
Stripe secret key: Dashboard roll → STRIPE_NEW_SECRET_KEY=sk_live_… python3 scripts/last1app/t2-3-rotate-secrets.py → t2-3-redeploy.sh |
29615733 |
GET /v1/balance with new key only (no charge) |
Close after roll + BWS/Railway updated |
| ☐ |
SendGrid: No rotation — key already dead |
29615727 |
GET /v3/scopes → 401 (confirmed 2026-08-30) |
CLOSE now — invalid credential; removal at SendGrid→Resend migration |
| ☐ |
Anthropic: Revoke old leaked key in Console; push new key via ANTHROPIC_NEW_API_KEY=… + rotate script + redeploy |
29615732 |
Old key: GET /v1/models → 401; new key: 200 on same probe |
Close only after revoke confirmed in Console + BWS synced |
Already done (T2-3): Twilio GG 29160801, Stripe webhook GG 29615730.
B. App / infra (before T-5 cutover)
| ☐ |
Action |
Notes |
| ☐ |
Fix registry v2 (registryService.ts → certification_state) |
Muster: last1app-registry-v2-certification-status-bug |
| ☐ |
Per-function JWT hardening on Edge (T2-1 auth table) |
Before api.last1.app public |
| ☐ |
install-vm-bws.sh on VM 121 if on-VM render required |
Optional until T-5 |
| ☐ |
Update last1.id webhook_url → api.last1.app |
With Twilio/Stripe URL cutover at T-5 |
C. T-5 cutover (Ryan authorization only)
| ☐ |
Action |
| ☐ |
DNS: last1.app, www, api.last1.app → last1app-edge tunnel |
| ☐ |
Twilio + Stripe webhook URLs → sovereign public hostnames |
| ☑ |
Activate R940 sms-checkin-cron + org-sms-cron; retire hosted SMS crons (done 2026-09-16; hosted unreachable) |
| ☐ |
Rewrite pg_cron URLs: 192.168.1.103:8000 → https://api.last1.app |
D. T-6 teardown (after T-5 stable + checklist A complete)
| ☐ |
Action |
| ☐ |
Delete hosted Supabase project tcthzakppndkykatoefx |
| ☐ |
Tear down Railway last1.app prod service (rollback net) |
| ☐ |
Close remaining GG D-live incidents for last1.app |
| ☐ |
Confirm no runtime refs to hosted ref in BWS / iOS / Edge |
References