SPRINT-8 Phase 6 — admin.last1.enterprises Prod Cutover Report¶
Date: 2026-08-31
Status: COMPLETE — prod DNS on R940; Railway retained as rollback net.
Prior: SPRINT8_T1_EXECUTION_PLAN.md
1. DNS backup (rollback)¶
| Field | Value |
|---|---|
| Zone | last1.enterprises (f13b99308eef77318acf5a9c4b79a69d) |
| Record ID | 203e2fee88c4501b17716e224e30b7ee |
| Rollback CNAME | b3rep7ek.up.railway.app |
| Proxied | true |
Artifacts: docs/architecture/backups/admin-dns-cutover-2026-08-31T191500Z/ (ROLLBACK.md, admin.last1.enterprises.json)
Rollback: PUT CNAME back to b3rep7ek.up.railway.app (Railway still running).
2. DNS cutover applied¶
| Hostname | New target |
|---|---|
admin.last1.enterprises |
4c8550f2-2156-4284-b9f7-60cdc0fdc109.cfargotunnel.com (proxied) |
Tunnel origin: http://192.168.1.97:5000 (VM 115 last1admin-app).
3. Prod smoke (https://admin.last1.enterprises)¶
| Check | Result |
|---|---|
| Health | 200 |
x-railway-edge |
Absent (serving from R940 / Cloudflare tunnel) |
| Login / role | ryan@last1.enterprises → super_admin (GET /api/auth/user 200) |
| fetchWithAuth same-origin | Bundle index-D9yxaFqy.js: 0 refs to last1.app/api/admin |
| RadioCheck | GET /api/radiocheck/units 200 |
| RealOutcomes | POST /api/proxy/realoutcomes → /api/admin/stats 200 JSON |
| last1.id ops | POST /api/proxy/last1id → /api/admin/stats 200 |
| LastVet | GET /api/lastvet/stats 200 |
| Angel | GET /api/angel/stats 200 |
| Onset metrics | GET /api/admin/onset/protocol-downloads 200 (total 1384) |
| Marketing (Onset) | GET /api/admin/marketing/onset/stats 200 |
| last1.app | POST /api/proxy/last1 → /api/admin/stats returns 200 (SPA HTML; sovereign last1.app has no JSON admin stats route at that path — UI reads last1.app via last1Request / dashboard routes; browser E2E PASS on staging + prod per Ryan) |
Post-cutover hotfix (gateway split)¶
Render was mapping LAST1ADMIN_APP_PROD_ADMIN_GATEWAY_SECRET (64-char, last1.app monolith) into runtime ADMIN_GATEWAY_SECRET, breaking RealOutcomes HMAC (expects 44-char shared secret).
Fix: render-last1admin-env-app.sh now writes:
- ADMIN_GATEWAY_SECRET → legacy 44-char (RealOutcomes + last1.id)
- LAST1_ADMIN_GATEWAY_SECRET → 64-char (last1.app monolith)
Re-rendered .env, container recreated (3fdf3b04…). RealOutcomes proxy re-smoke: 200.
4. Code fix committed¶
Repo: Last-1-Enterprises/last1-admin
Commit: 7445e0c — fetchWithAuth stays same-origin (no VITE_LAST1_API_BASE prefix on admin BFF routes).
Repo: lastvet-gates (local)
Change: scripts/last1-admin/render-last1admin-env-app.sh gateway split (not yet committed).
5. Not done (by design)¶
| Item | Status |
|---|---|
| Phase 7 Railway teardown | Deferred — b3rep7ek.up.railway.app rollback net |
| Prod soak | Ryan discretion (24–48h) before Phase 7 auth |
6. Next step¶
Ryan authorizes Phase 7 separately after soak: remove Railway disciplined-beauty last1-admin service.