SPRINT-7 T-4 Report — last1.app WEB Production DNS Cutover¶
Date: 2026-08-30
Status: T-4 CLOSED. Automated smoke PASS + Gate T4-R PASS — see SPRINT7_T4-R_REPORT.md.
Scope: last1.app + www.last1.app only. api.last1.app deferred to T-5. Railway kept as rollback net.
Executive summary¶
| Workstream | Result |
|---|---|
| Pre-cutover (VM 121) | Monolith healthy; DB/session at 192.168.1.103; PUBLIC_URL=https://last1.app |
| Registry v2 fix | Still pending in repo (not deployed) — only known-broken endpoint |
| Monolith cron routes | PASS (trust drainer, validation expiry, Stripe reconcile) |
| DNS cutover | last1.app + www → 6b0fa8e8-…cfargotunnel.com (proxied) |
| Prod automated smoke | ALL PASS — R940 via CF; no x-railway-edge |
| Rollback backup | /tmp/last1app-gate-b/t4-dns-backup-20260830T191833Z |
Scripts: t4-dns-cutover-web.sh, t4-prod-smoke.sh · env render: PUBLIC_URL_OVERRIDE=https://last1.app
1. Pre-cutover verification¶
Monolith + DB (VM 121 @ 192.168.1.104)¶
| Check | Result |
|---|---|
| Container | last1app-app Up (force-recreate before cutover) |
DATABASE_URL / SUPABASE_DATABASE_URL |
192.168.1.103:5432 (sovereign) |
SUPABASE_URL |
http://192.168.1.103:8000 |
| Session store | Same Postgres DSN (Express session on sovereign DB) |
PUBLIC_URL |
https://last1.app (post-render override) |
LAST1_ID_API_BASE |
https://auth.last1.id |
LAST1_OAUTH_REDIRECT_URI |
https://last1.app/api/auth/last1/callback |
| Hosted ref guard | No tcthzakppndkykatoefx in rendered env |
Registry v2 bug (Muster last1app-registry-v2-certification-status-bug)¶
| Item | Status |
|---|---|
| Repo fix | Pending — registryService.ts still selects certification_status |
| R940 deployed code | Unchanged — same pre-existing bug as Railway |
| Post-cutover behavior | /api/public/registry/v2 → 500 (confirmed) |
| Regression? | No — identical failure mode pre-cutover |
Acceptable for T-4: dormant public registry API; only known-broken prod endpoint.
In-process / HTTP cron (monolith on VM 121)¶
No setInterval workers; scheduled work is HTTP cron routes (Railway/external caller → https://last1.app/api/internal/cron/…). After DNS flip, same URLs hit R940.
| Endpoint | Probe (LAN, dry_run where supported) |
HTTP |
|---|---|---|
POST /api/internal/cron/drain-last1-trust-events |
Trust event drainer → auth.last1.id |
200 |
POST /api/internal/cron/expire-pending-validations |
IRS/validation expiry path | 200 |
POST /api/internal/cron/stripe-reconcile |
Stripe plan reconciliation | 200 |
CRON_SECRET present in BWS + container env.
2. DNS cutover (WEB only)¶
| Hostname | Before | After |
|---|---|---|
last1.app |
k1v3g8rr.up.railway.app (proxied) |
6b0fa8e8-2eef-4550-9811-12e6ad31d10b.cfargotunnel.com (proxied) |
www.last1.app |
ympsfowb.up.railway.app (proxied) |
same tunnel CNAME (proxied) |
Zone: last1.app (2226b6f7fd3e3a5bbde757d361f8308d)
Not changed:
| Hostname | Status |
|---|---|
api.last1.app |
NXDOMAIN (T-5) |
Hosted tcthzakppndkykatoefx |
Untouched |
Staging last1app-*.last1.enterprises |
Unchanged |
Railway: Service still running (rollback net). Revert = restore CNAMEs from backup JSON in t4-dns-backup-…/.
3. Webhooks (hostname unchanged → now R940)¶
Stripe webhook registered at https://last1.app/api/stripe/webhook (T2-3). Hostname unchanged; DNS now resolves to R940 monolith via tunnel. Unsigned probe → 400 (handler live, signature gate OK). No URL change required.
Twilio callbacks targeting last1.app paths behave the same (hostname-stable cutover).
4. Production automated smoke (https://last1.app)¶
Log: /tmp/last1app-gate-b/t4-prod-smoke-20260830T191849Z.txt
| Check | HTTP | CF proxy | Railway? |
|---|---|---|---|
GET / |
200 | cf-ray ✓ |
absent ✓ |
GET /api/auth/user |
200 | ✓ | absent — {"user":null} |
GET /api/public/registry/v2 |
500 | ✓ | absent (known bug) |
POST /api/stripe/webhook (no sig) |
400 | ✓ | absent |
GET https://auth.last1.id/.well-known/openid-configuration |
200 | ✓ | N/A |
5. Constraints held¶
| Constraint | Status |
|---|---|
| WEB only | ✓ last1.app + www only |
api.last1.app / RadioCheck iOS |
✓ Not exposed (T-5) |
| Railway rollback net | ✓ Still running |
| Hosted Supabase | ✓ Untouched |
| R940 SMS crons | ✓ sms-* inactive; check-in-proof-events-cron active |
| Realtime | ✓ Preserved on sovereign stack |
| Container recreate | ✓ Pre-cutover redeploy used --force-recreate |
6. Gate T4-R — Ryan browser E2E¶
PASS (2026-08-30). Full write-up: SPRINT7_T4-R_REPORT.md.
- Last1 ID OAuth + Google OAuth on sovereign GoTrue
- Warriors In Need org dashboard + data load from R940 confirmed
- GoTrue provider sweep documented (Phone OTP + Apple SIWA = T-5 pre-flight)
Rollback (if needed)¶
Restore DNS from backup:
# Records in /tmp/last1app-gate-b/t4-dns-backup-20260830T191833Z/
# last1.app → k1v3g8rr.up.railway.app
# www.last1.app → ympsfowb.up.railway.app
Railway service remains available immediately on CNAME revert.
STOP¶
T-4 closed. T-5 planning may proceed; complete GoTrue Phone + Apple migration before RadioCheck iOS cutover (see T4-R §4).