SPRINT-8 T-0 Audit — last1-admin Reconnect + Railway Teardown¶
Date: 2026-08-31 (UTC)
Status: Read-only audit. STOP — await Ryan review before reconnect execution.
Scope: last1-admin (admin.last1.enterprises) — last product migration in the sovereignty arc.
Context change: Hosted Supabase tcthzakppndkykatoefx account is deleted (DNS NXDOMAIN as of 2026-08-31). SPRINT-8 is first sovereign connect, not repointing a live hosted upstream.
v1.2 lens (strategic, not build authority)¶
| Question | Answer |
|---|---|
| Keystone / Track B? | No. This finishes hosted-era teardown and cost cut for the internal ops BFF. |
| Critical path? | No. Coordination keystone work is elsewhere; admin reconnect does not advance a measured coordination loop. |
| Legitimate now? | Yes — last upstream-dependent product; completing sovereignty migration + Railway exit is intentional cleanup. |
| Build authority | gates/, AGENTS.md, PARKED.md only. This doc is reconnaissance, not a task backlog. |
Executive summary¶
last1-admin is a multi-product internal BFF with no sovereign DB VM. It was paused at Tier 3 T3-3 (compute on VM 115, prod still Railway) while upstream products migrated. Hosted bundle Supabase is gone. Both production (Railway) and parallel R940 stacks still have env/BWS pointing at https://tcthzakppndkykatoefx.supabase.co, which no longer resolves.
Gate B (SPRINT-7) restored bundle relational data to last1app-db (VM 103 @ 192.168.1.103), public API https://api.last1.app. Admin must connect there for auth + shared bundle reads — not to auth.last1.id for operator shell login (that host remains the upstream for last1.id ops proxy routes only).
Verdict: Admin is non-functional for login and any Supabase-backed module until BWS + container env are repointed to sovereign JWTs/URLs, GoTrue redirect allow-list is updated, and schema/code paths are verified. Railway admin service is still running but serves a broken auth plane.
1. Admin current state¶
1.1 VM 115 (admin-app, 192.168.1.97)¶
| Check | Result (2026-08-31 live) |
|---|---|
| Host reachable | Yes — ssh ryan@192.168.1.97, hostname admin-app |
| Provisioned / warm | Yes — uptime ~4 days; migration execution paused, VM not powered down |
Docker last1admin-app |
Up (~3 days), bound 192.168.1.97:5000 (not localhost) |
| Health | GET http://192.168.1.97:5000/health → 200 (from agent + VM) |
| Soak cron | Still documented */30 probe on VM 115 (TIER_3_ADMIN_PAUSED_STATUS.md) |
| Tunnel | Ingress rule staged on lastvet-r940 → .97:5000; prod DNS still Railway (TIER_3_ADMIN_T3-3_REPORT.md) |
Paused vs warm: Tier 3 cutover/E2E/Railway teardown is paused. VM 115 stack was intentionally kept warm for a later reconnect — that state holds.
1.2 BWS (last1-admin project 719957e4-e73e-41f1-9b75-b480012d7d96)¶
Live BWS read (agent-01, 2026-08-31) — URL keys only:
| Key | Current value | Stale? |
|---|---|---|
LAST1ADMIN_APP_PROD_SUPABASE_URL |
https://tcthzakppndkykatoefx.supabase.co |
Yes — deleted project |
LAST1ADMIN_APP_PROD_VITE_SUPABASE_URL |
same | Yes |
LAST1ADMIN_APP_PROD_RADIOCHECK_SUPABASE_URL |
same | Yes |
RADIOCHECK_SUPABASE_URL (legacy unprefixed) |
same | Yes |
VITE_SUPABASE_URL (legacy) |
same | Yes |
LAST1ADMIN_APP_PROD_ONSET_SUPABASE_URL |
https://emxrmjysvxeboavhatry.supabase.co |
Likely stale — DNS NXDOMAIN from agent (Onset sovereign path exists separately) |
LAST1ADMIN_APP_PROD_VITE_API_BASE |
https://last1.app |
OK — sovereign R940 web (SPRINT7_T4_REPORT.md) |
LAST1ADMIN_APP_PROD_REALOUTCOMES_API_BASE |
https://realoutcomes.app |
OK — sovereign R940 (SPRINT-3_CLOSEOUT.md) |
LAST1ADMIN_APP_PROD_LAST1_ID_API_BASE |
https://auth.last1.id |
OK |
LAST1ADMIN_APP_PROD_LASTVET_API_BASE |
https://api.last.vet |
OK |
LAST1ADMIN_APP_PROD_ANGEL_API_BASE |
https://api.angel.report |
OK |
JWT secrets in BWS (VITE_SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY, RADIOCHECK_SERVICE_ROLE_KEY, etc.) are almost certainly hosted-project JWTs. Repointing URL alone is insufficient — keys must come from LAST1APP_DB_PROD_* (last1-radiocheck BWS) after sovereign JWT generation.
Prior doc ADMIN_BWS_DB_VALIDATION.md (2026-08-29) marked hosted URLs intentional until Tier 6. That assumption is obsolete now that hosted is deleted.
1.3 VM 115 rendered .env (live, redacted)¶
Matches BWS stale refs:
SUPABASE_URL=https://tcthzakppndkykatoefx.supabase.co
VITE_SUPABASE_URL=https://tcthzakppndkykatoefx.supabase.co
RADIOCHECK_SUPABASE_URL=https://tcthzakppndkykatoefx.supabase.co
LAST1_API_BASE=https://last1.app
LAST1_ID_API_BASE=https://auth.last1.id
ONSET_SUPABASE_URL=https://emxrmjysvxeboavhatry.supabase.co
REALOUTCOMES_API_BASE=https://realoutcomes.app
Recent container logs show LastVet ops digest failures: Legacy API keys are disabled — consistent with calling a dead or wrong Supabase API with hosted-era keys.
1.4 Railway production¶
| Check | Result |
|---|---|
| Public URL | https://admin.last1.enterprises |
| Service | Railway project disciplined-beauty, service 7c02cdf9-0ecc-4a6c-bb5c-e4c940b37dcf (TIER_3_ADMIN_T3-1_REPORT.md) |
| State | Running — GET / → 200, header x-railway-edge: lax1 |
| Paused? | No — Railway has no pause; service still takes traffic |
| Functional? | Shell may load; auth and Supabase modules broken (upstream deleted) |
Prod DNS has not cut over to VM 115 (TIER_3_ADMIN_T3-3_REPORT.md).
1.5 Hosted Supabase deletion (context change)¶
| Probe | Result |
|---|---|
tcthzakppndkykatoefx.supabase.co DNS |
NXDOMAIN (2026-08-31) |
| Prior SPRINT-7 assumption | Admin could stay on hosted until SPRINT-8 "flip" |
| Current reality | Hosted is gone; admin never received sovereign URLs in BWS |
2. Dependencies — what admin connects to¶
Admin is a terminal BFF (no {product}-db VM). It holds service-role keys and HMAC gateway secrets. Source: TIER_3_ADMIN_MIGRATION_AUDIT.md §1–2, updated for post-SPRINT-7 upstreams.
2.1 Three-way shared DB coupling (historical → target)¶
SPRINT-7 documented admin as the third consumer of bundle Supabase alongside last1.app and RadioCheck (SPRINT7_T0_AUDIT.md). Post–Gate B, that data lives on last1app-db.
| Admin surface | Was (hosted) | Must be (sovereign) |
|---|---|---|
| Operator login (GoTrue) | tcthzakppndkykatoefx |
https://api.last1.app (sovereign GoTrue on VM 103) |
| SPA Supabase client | same | same + LAST1APP_DB_PROD_* anon JWT |
| RadioCheck dashboards (direct SRK reads) | same project | https://api.last1.app + sovereign service role |
| last1.app admin proxy | https://last1.app |
https://last1.app (already R940) |
Admin does not need a separate DB migration — it needs HTTP URL + JWT repoint to the stack SPRINT-7 already restored.
2.2 Full upstream matrix (post–SPRINT-7 world)¶
| Upstream | Mechanism | Sovereign status | Admin BWS today |
|---|---|---|---|
| Bundle Supabase (auth + RC + shared tables) | SUPABASE_*, VITE_SUPABASE_*, RADIOCHECK_SUPABASE_* |
Ready — VM 103, public api.last1.app |
Broken — deleted ref |
| last1.app | LAST1_API_BASE + gateway HMAC |
R940 (T-4 web cutover) | OK |
| last1.id ops | LAST1_ID_API_BASE + LAST1ID_ADMIN_GATEWAY_SECRET |
auth.last1.id |
OK on VM; Railway may still default last1.id if env stale |
| RealOutcomes | REALOUTCOMES_API_BASE + HMAC |
R940 (SPRINT-3 closed) | OK |
| Onset | ONSET_SUPABASE_* service role |
Sovereign stack exists (Tier 4); public URL TBD | Stale hosted URL |
| LastVet | LASTVET_API_BASE + internal secret |
api.last.vet |
OK |
| Angel | ANGEL_API_BASE + internal secret |
Cloudflare Worker | OK |
| SendGrid | ops digest / marketing | External | BWS key present |
Not admin's DB: LastVet clinical Postgres, RealOutcomes Postgres, Onset clinical Postgres, last1.id identity Postgres — all accessed via HTTP proxy or separate Supabase URL env vars.
2.3 Data on last1app-db — Gate B vs admin needs¶
Gate B parity (SPRINT7_T1_GATE_B_REPORT.md) verified bundle tables including:
| Data | Sovereign (live query 2026-08-31) |
|---|---|
auth.users |
43 rows |
user_profiles |
6 rows; is_system_admin = true for ryan@last1.org, ryan@last1.enterprises |
organizations, check_ins, last1_* bundle tables |
Parity PASS per Gate B |
| RadioCheck core tables | Restored with bundle |
Tables T3-0 claimed on shared Supabase but absent on sovereign last1app-db:
| Table | On VM 103 public schema? | Impact |
|---|---|---|
system_admin_memberships |
No | May break RBAC if code queries this table (see §3) |
org_admin_memberships |
No | Org-scoped admin roles |
admin_telemetry_events |
No | Admin telemetry writes |
marketing_* |
No | Marketing admin module |
client_telemetry_events |
Yes | Different table name |
org_admin_requests |
Yes | Onset/org workflow |
Note: system_admin_memberships / admin_telemetry_events appear in last1.id schema inventory (LAST1_ID_GATE_A_REPORT.md), not Gate B bundle parity. T3-0 may have conflated last1.id tables with bundle tables. Code review required before reconnect: confirm whether admin login RBAC uses user_profiles.is_system_admin + @last1.enterprises domain rule vs system_admin_memberships on the bundle project.
3. Admin auth path¶
3.1 Operator shell login (primary)¶
| Layer | Behavior |
|---|---|
| Browser | @supabase/supabase-js against VITE_SUPABASE_URL + anon key → GoTrue OAuth/password |
| Server | Validates JWT via SUPABASE_URL + service role; resolves admin role |
| Correct sovereign target | https://api.last1.app/auth/v1/* (last1app-db GoTrue) |
| Not this | auth.last1.id for shell login — that is the last1.id product module upstream (POST /api/proxy/last1id) |
Documented login entry for company admins (auth.last1.id/login?entry=admin) is a separate last1.id surface, not the admin portal's Supabase session (TIER_3_ADMIN_MIGRATION_AUDIT.md §1.5).
3.2 Auth migration decision (for Ryan, not decided in T-0)¶
| Option | Description | Effort |
|---|---|---|
| A — Bundle GoTrue (recommended first reconnect) | Point admin at sovereign api.last1.app with restored auth.users (43) |
Low — matches current code shape |
B — @last1id/sdk / auth.last1.id only |
Align with R940_PRODUCT_ISOLATION_PRINCIPLES_v1.md §2 steady-state IdP | High — admin codebase still built around Supabase Auth client |
T-0 recommendation: Option A for SPRINT-8 functional reconnect; Option B is a separate product/auth refactor, not required to exit Railway.
3.3 GoTrue redirect / site URL prerequisites¶
Before browser login works on sovereign:
- Add
https://admin.last1.enterprises/auth/callback(and staging hostname if used) to sovereign GoTrue redirect allow-list on last1app-db. - Ensure
SITE_URL/ public URL env on GoTrue matches cutover hostname policy. - Rebuild admin SPA if
VITE_SUPABASE_*are compile-time inlined (same pattern as RadioCheck T5-D).
4. Gap analysis — what breaks / what's needed¶
4.1 Broken today (if admin is used)¶
| Symptom | Cause |
|---|---|
| Login / session refresh fails | GoTrue host NXDOMAIN |
| RadioCheck admin pages (direct SRK) fail | Same |
| LastVet ops digest errors | Supabase API rejects legacy JWT (Legacy API keys are disabled in VM logs) |
| Marketing admin (if used) | marketing_* tables not on sovereign bundle DB |
| Onset admin direct Supabase reads | BWS still points at dead Onset hosted ref |
| R940 parallel stack | Same stale env — soak probe only checks HTTP 200/401, not auth upstream health |
Railway prod and VM 115 are equally broken for real operator work.
4.2 Minimum reconnect checklist (execution — not authorized in T-0)¶
- BWS: Replace all
tcthzakppndkykatoefxURLs withhttps://api.last1.app(or approved public Kong hostname). - BWS: Replace anon + service-role JWTs with
LAST1APP_DB_PROD_SUPABASE_ANON_KEYand sovereign service role from last1-radiocheck / platform BWS (same keys last1.app monolith uses post-T5). - BWS: Update
LAST1ADMIN_APP_PROD_ONSET_SUPABASE_URLto sovereign Onset public API (when Ryan confirms hostname). - Render:
scripts/last1-admin/render-last1admin-env-app.sh→ recreatelast1admin-appon VM 115. - GoTrue: Redirect allow-list + verify
auth.userspassword/OAuth providers (SPRINT7_T5-A_REPORT.md). - Code/schema verify: RBAC tables vs
user_profiles.is_system_admin; marketing module scope. - E2E: TIER_3_ADMIN_T3-4_TEST_PLAN.md against staging hostname or post-cutover prod.
- DNS: Cut
admin.last1.enterprisesto VM 115 via dedicatedadmin-edgetunnel (R940_PRODUCT_ISOLATION_PRINCIPLES_v1.md §1). - Railway teardown: After soak + Ryan sign-off (last Railway product in migration arc).
4.3 Data that may NOT be in Gate B restore¶
| Data class | Risk | Mitigation |
|---|---|---|
marketing_* on bundle |
Missing on VM 103 | Confirm whether marketing lived on hosted bundle or only Onset/last1.id; migrate or disable module |
admin_telemetry_events |
Missing | Low row count historically on last1.id; may be acceptable loss or needs migration script |
system_admin_memberships |
Missing on bundle | Verify code path; may rely on user_profiles.is_system_admin (2 rows present) |
| Auth provider linkage | 43 users restored | OAuth users must re-auth if provider secrets differ; password users should work if credentials restored |
| Onset admin data | Separate project | Repoint URL + keys to Onset sovereign stack |
4.4 Railway teardown scope (SPRINT-8 tail)¶
| Item | Notes |
|---|---|
Railway service disciplined-beauty / last1-admin |
Last product compute still on Railway per consolidation plan |
admin.last1.app |
Distinct Railway build of last1.app (VITE_ADMIN_ONLY) — not last1-admin (SPRINT7_T0_AUDIT.md §2) — do not conflate teardown |
| Rollback net | After DNS cutover to VM 115, Railway admin becomes rollback only; delete after soak |
5. Sequencing vs upstream products (readiness)¶
| Upstream | Ready for admin reconnect? |
|---|---|
last1.id (auth.last1.id) |
Yes |
| RealOutcomes | Yes (SPRINT-3 closed) |
| last1.app web | Yes (T-4) |
| last1.app + RadioCheck bundle DB/GoTrue | Yes (Gate B + T5-A; public api.last1.app per T5-B plan) |
| Onset | Partial — admin BWS still hosted; confirm sovereign public URL |
| LastVet / Angel | Yes (already external sovereign APIs) |
Admin was correctly sequenced last (TIER_RESEQUENCING_2026-08-28.md). Upstream bundle sovereignty is far enough that reconnect is unblocked in principle — pending Ryan authorization and schema/code verification above.
6. Open questions for Ryan (before T-1 execution)¶
- Auth path: Bundle GoTrue (
api.last1.app) first reconnect vs full@last1id/sdkrefactor now? - RBAC: Does last1-admin query
system_admin_membershipson the bundle project, or onlyuser_profiles.is_system_admin+ domain rule? - Marketing module: Required for reconnect, or disable until marketing tables migrated?
- Onset admin URL: Confirm sovereign public Supabase/Kong hostname for
ONSET_SUPABASE_URL. - DNS cutover: Staging E2E on
admin-app.last1.enterprises(naming v2) vs direct prod flip? - Hosted deletion timing: Confirm
tcthzakppndkykatoefxdeletion is intentional and complete (no rollback net) before Railway admin delete.
7. References¶
| Doc | Role |
|---|---|
| SPRINT7_T0_AUDIT.md | Three-way coupling map |
| SPRINT7_T1_GATE_B_REPORT.md | Bundle restore parity |
| ADMIN_BWS_DB_VALIDATION.md | Pre-deletion BWS intent (superseded) |
| TIER_3_ADMIN_PAUSED_STATUS.md | Warm VM 115 state |
| TIER_3_ADMIN_MIGRATION_AUDIT.md | BFF proxy inventory |
| TIER_3_ADMIN_T3-4_TEST_PLAN.md | Post-reconnect E2E |
| R940_PRODUCT_ISOLATION_PRINCIPLES_v1.md | SPRINT-8 slot + admin-edge |
| POST_MIGRATION_ROADMAP.md | Admin after SPRINT-7 |
STOP¶
No BWS changes. No container recreate. No DNS cutover. No Railway delete.
Deliverable complete for Ryan review. Next gate: Ryan authorizes SPRINT-8 T-1 reconnect plan.