SPRINT-7 T2-2 Report — last1.app Monolith + last1app-edge Prep¶

Date: 2026-08-30
Status: T2-2 PASS. STOP — await Ryan review before T2-3 (secret rotation).
VM: 121 last1app-app @ 192.168.1.104 (monolith) + last1app-edge cloudflared (ingress validated, no DNS)

Pre-T2-2 gate (SMS cron safety)¶

Job	`active`	Notes
`sms-checkin-cron`	false	Stays off until T-5 (avoid duplicate Twilio with hosted)
`org-sms-cron`	false	Same
`check-in-proof-events-cron`	true	Internal proof path only; no outbound SMS

Playbook: R940_MIGRATION_PLAYBOOK.md §5c — migration smoke must not fire live Twilio/APNs; duplicate scheduler rule documented.

Executive summary¶

Workstream	Result
Railway → BWS sync	21 `LAST1APP_APP_PROD_*` keys (Supabase URLs/keys skipped; sovereign DB prefix owns those)
Rendered `.env`	45 runtime keys; no `tcthzakppndkykatoefx` refs
Sovereign overrides	`DATABASE_URL` / session store → `192.168.1.103`; `SUPABASE_URL` → `http://192.168.1.103:8000`; `LAST1_ID_API_BASE` → `https://auth.last1.id`
Docker monolith	`last1app-app:prod` listening `192.168.1.104:5000` (container recreated)
Internal HTTP smoke	root 200, `/api/auth/user` 200 (`user: null`), Kong reachability 401 (expected anon)
DB connectivity	PASS — Postgres responds (registry v2 returns app-level 500; see flag below)
`last1app-edge` tunnel	Created `6b0fa8e8-2eef-4550-9811-12e6ad31d10b`; ingress validate OK; systemd active
DNS	Not changed (hosted + Railway remain live)

Scripts: sync-app-bws-from-railway.py, render-last1app-env-app.sh, deploy-last1app-app.sh, t2-2-create-edge-tunnel.sh, install-last1app-edge-cloudflared.sh

1. BWS + env render¶

Railway sync (`ee89d9f1-547e-45cb-9c16-8427be6d8e60`)¶

Synced Twilio, Stripe, SendGrid, session/cron/webhook secrets, OAuth flags, etc. Skipped hosted-owned keys: DATABASE_URL, SUPABASE_*, VITE_SUPABASE_*.

Sovereign DB keys (`LAST1APP_DB_PROD_*`, from T-1 Gate B / `push-db-stack-bws.py`)¶

Runtime var	R940 value
`DATABASE_URL`	`postgresql://postgres.your-tenant-id@192.168.1.103:5432/postgres`
`SUPABASE_DATABASE_URL`	Same (Express session store)
`SUPABASE_URL`	`http://192.168.1.103:8000`
`SUPABASE_ANON_KEY` / `SUPABASE_SERVICE_ROLE_KEY`	R940 JWT keys
`PUBLIC_URL` (internal)	`http://192.168.1.104:5000`
`LAST1_ID_API_BASE`	`https://auth.last1.id` (overrides Railway `https://last1.id`)

Guard: render aborts if tcthzakppndkykatoefx appears in output.

Note: VM 121 does not yet have /etc/bitwarden/access-token; env rendered on agent and copied to /opt/last1app/.env. Run install-vm-bws.sh before T-5 if on-VM render is required.

2. Monolith deploy (VM 121)¶

Step	Result
Source rsync	`/tmp/sprint7-audit/last1.app/` → `/opt/last1app/src`
Docker install	First boot on VM 121
`docker build` + `docker run --force-recreate`	Image `last1app-app:prod`, bind `192.168.1.104:5000`
Container health	Up; logs show Supabase admin + Stripe env loaded

Internal smoke (`192.168.1.104:5000`)¶

Check	HTTP	Notes
`GET /`	200	SPA shell
`GET /api/auth/user`	200	`{"user":null}` without session
`GET /api/public/registry/v2`	500	Postgres reached; SQL column mismatch (flag)
Kong `192.168.1.103:8000/rest/v1/`	401	Expected without API key

3. last1app-edge cloudflared (prep only)¶

Item	Value
Tunnel name	`last1app-edge`
Tunnel UUID	`6b0fa8e8-2eef-4550-9811-12e6ad31d10b`
CNAME target	`6b0fa8e8-2eef-4550-9811-12e6ad31d10b.cfargotunnel.com`
BWS keys	`LAST1APP_APP_EDGE_TUNNEL_ID`, `_TUNNEL_CNAME`, `_CLOUDFLARED_TUNNEL_CREDENTIALS`

Ingress (validated, not routed in DNS)¶

Hostname	Origin
`last1.app`	`http://192.168.1.104:5000`
`www.last1.app`	`http://192.168.1.104:5000`
`api.last1.app`	`http://192.168.1.103:8000` (Kong / Edge / Realtime)

cloudflared tunnel ingress validate → OK. systemctl is-active cloudflared → active.

T-5 Ryan: CNAME last1.app, www, and api.last1.app → tunnel target (proxied).

4. Flags (non-blocking for T2-2)¶

Flag	Detail	T2-3 / T-5
Registry v2 500	Resolved pre-T2-3: pre-existing prod bug, not restore drift. See SPRINT7_REGISTRY_500_FINDINGS.md. Railway also 500s; hosted + R940 `organizations` schemas identical (59 cols); neither has `certification_status`.	Fix `registryService.ts` select/fallback before T-5 cutover (separate from T2-3)
Twilio / Stripe	Still Railway-era secrets (GG 29160801 / 29615733)	T2-3 rotation
VM 121 BWS	No local BWS token yet	`install-vm-bws.sh` before T-5 on-VM ops
`t2-1-smoke-edge.sh`	Can still hit live Twilio on `sms-daily-check`	Harden smoke (stub provider) per playbook §5c

5. Hosted unchanged¶

Railway last1.app still serves production traffic.
Hosted Supabase tcthzakppndkykatoefx + hosted pg_cron SMS jobs still active until T-5 teardown.
R940 SMS crons remain inactive.

STOP¶

T2-2 complete. Do not proceed to T2-3 until Ryan reviews this report.

Next (after approval): T2-3 secret rotation (Twilio GG 29160801, Stripe GG 29615733); webhook URL dashboard updates deferred to T-5 when api.last1.app is live.