Tier 3 T3-4 Report — Staging URL prep (Phase 4a)¶
Date: 2026-08-28
Status: Phase 4a STOP — await Ryan DNS + GoTrue allow-list, then apply tunnel + PF-1/PF-2. Phase 4b test plan ready.
Parent: TIER_3_REALOUTCOMES_T3-3_REPORT.md
Test plan: TIER_3_REALOUTCOMES_T3-4_TEST_PLAN.md
Phase 4a — Staging URL setup¶
1. Tunnel ingress (Cursor) — dry-run complete ✅¶
| Item | Value |
|---|---|
| Hostname | realoutcomes-app.last1.enterprises |
| Origin | http://192.168.1.99:5000 |
| Tunnel | lastvet-r940 (4c8550f2-2156-4284-b9f7-60cdc0fdc109) |
| Validate | cloudflared tunnel ingress validate → OK |
| Applied? | No (DRY_RUN=1; awaiting Ryan authorization) |
Script: scripts/realoutcomes/configure-tunnel-staging-app.sh
Proposed ingress diff (insert before http_status:404):
2. Supabase Kong staging (auth E2E prerequisite)¶
Browser supabase-js cannot use LAN http://192.168.1.98:8000. Auth tests require a public Supabase API hostname.
| Item | Value |
|---|---|
| Hostname | realoutcomes-db-r940.last1.enterprises |
| Origin | http://192.168.1.98:8000 |
| Script | configure-tunnel-staging-db.sh (dry-run ready) |
| Applied? | No |
After apply: update VM 117 API_EXTERNAL_URL / SUPABASE_PUBLIC_URL, app VITE_SUPABASE_URL, rebuild container.
3. Ryan actions required ⏸ STOP¶
| # | Action |
|---|---|
| R-1 | Cloudflare DNS CNAME (proxied): realoutcomes-app.last1.enterprises → 4c8550f2-2156-4284-b9f7-60cdc0fdc109.cfargotunnel.com |
| R-2 | Cloudflare DNS CNAME (proxied): realoutcomes-db-r940.last1.enterprises → same target (required for auth E2E) |
| R-3 | GoTrue redirect allow-list on VM 117: https://realoutcomes-app.last1.enterprises/auth/callback — run configure-gotrue-staging-redirects.sh with DRY_RUN=0 after DNS |
| R-4 | (If Google OAuth) GCP OAuth client: add authorized redirect URI for staging callback |
| R-5 | Reply "DNS + allow-list ready" so Cursor applies tunnel ingress |
Current DNS check: realoutcomes-app.last1.enterprises → NXDOMAIN (2026-08-28).
4. Cursor apply step (blocked on R-5)¶
When Ryan confirms:
# On lastvet-edge
DRY_RUN=0 bash /path/to/configure-tunnel-staging-app.sh
DRY_RUN=0 bash /path/to/configure-tunnel-staging-db.sh
# Update staging env + rebuild app (PUBLIC_URL + VITE_SUPABASE_URL to HTTPS staging hosts)
# Then:
bash scripts/realoutcomes/verify-pf-headers.sh
5. PF-1 / PF-2 (pending apply)¶
| ID | URL | Expected | Status |
|---|---|---|---|
| PF-1 | https://realoutcomes-app.last1.enterprises/ |
HTTP 200, no x-railway-edge |
Pending |
| PF-2 | https://realoutcomes.app/ |
HTTP 200, has x-railway-edge |
Not run (prod sanity) |
Script: scripts/realoutcomes/verify-pf-headers.sh
Phase 4b — Browser E2E test plan ✅ STOP¶
Deliverable: TIER_3_REALOUTCOMES_T3-4_TEST_PLAN.md
- 42 test cases across navigation, auth, directory, Stripe, SendGrid, Firecrawl, Edge Functions, storage
- Section 10 worksheet for Ryan PASS/FAIL/SKIP
- T3-5 placeholder cleanup reminder documented
Ryan: Review test plan → execute browser tests after PF-1/PF-2 pass → fill Section 10.
Constraints honored¶
| Constraint | Status |
|---|---|
| No prod DNS cutover | OK |
| No hosted Supabase teardown | OK |
| No Railway teardown | OK |
| Admin tier untouched | OK |
| Tunnel not applied without Ryan DNS | OK |
STOP — Next gates¶
| Gate | Status | Action |
|---|---|---|
| Phase 4a dry-run | Done | Ryan: DNS + GoTrue allow-list |
| PF-1/PF-2 | Blocked | Cursor applies tunnel after Ryan confirms |
| Phase 4b test plan | Done | Ryan reviews + executes browser E2E |
| T3-4 complete | Blocked | Ryan Section 10 + Cursor final report |
Do not start browser E2E until PF-1/PF-2 pass.