Tier 4 Onset T4-4 Report — DNS cutover (STOP for Gate T4-R)¶
Status: STOP — automated smoke PASS; Ryan browser E2E (Gate T4-R) pending
Date: 2026-08-30 (Sun cutover window)
Authorization: Ryan T4-4 go
Zone: theonset.app (7607d8b8d46f14a6c903558e97eb555b)
Actions applied¶
1. Vault (onset-db VM 119)¶
| Secret | Value |
|---|---|
clinic_portal_base_url |
https://clinic.theonset.app |
clinic_cron_secret |
unchanged (matches ONSET_APP_PROD_CRON_SECRET) |
Script: t4-0-vault-align.py with CLINIC_BASE_URL=https://clinic.theonset.app
2. DNS (Cloudflare API)¶
| Record | Type | Name | Target | Proxied |
|---|---|---|---|---|
| Clinic | CNAME | clinic.theonset.app |
fe2fa2de-d776-485f-85ed-84415f0c3493.cfargotunnel.com |
Yes |
Previous target (Railway, removed): fdvwr7c8.up.railway.app
SendGrid, MX, apex/www Pages, and other theonset.app records were not modified.
Automated smoke (prod hostname)¶
| Check | Expected | Result |
|---|---|---|
GET https://clinic.theonset.app/ |
200, no x-railway-edge |
PASS |
GET https://clinic.theonset.app/login |
200 | PASS |
GET https://auth.last1.id/.well-known/openid-configuration |
200 | PASS |
Cron /api/cron/protocol-deliveries |
200 + bearer | PASS |
Cron /api/cron/fullscript-sync |
200 + bearer | PASS |
Cron /api/cron/weekly-summary |
200 + bearer | PASS |
Vault trigger_clinic_protocol_deliveries() → prod URL |
fires without error | PASS |
Fullscript webhook GET /api/webhooks/fullscript |
200 ack | PASS |
Stripe webhook POST /api/stripe/webhook (no sig) |
400 (endpoint live) | PASS |
Storage template (R940) templates/posts/1.png |
200 | PASS |
VM 118 cloudflared |
active | PASS |
onset-edge connector |
1 active | PASS |
Last1 login → dashboard: not automatable (client-side PKCE in browser). Ryan Gate T4-R.
Rollback net (unchanged)¶
| System | Status |
|---|---|
| Railway clinic origin | Live (DNS no longer points to it) |
| Hosted Supabase prod | Live (iOS rollback net until T-5) |
| Hosted Supabase staging | Live |
| iOS Release xcconfig | Hosted (until T-5) |
Rollback procedure¶
- Revert
clinic.theonset.appCNAME →fdvwr7c8.up.railway.app(proxied) - Revert vault
clinic_portal_base_url→ Railway or LAN URL as needed - Optional:
sudo systemctl stop cloudflaredon VM 118
Gate T4-R — Ryan manual (browser)¶
| # | Test | Expected |
|---|---|---|
| T4-R-1 | Clinic login curryrg@gmail.com on prod DNS |
Dashboard loads |
| T4-R-2 | /patients/new authenticated |
Practitioner context loads |
| T4-R-3 | Optional: wait for hourly cron or re-trigger from DB | No errors |
| T4-R-4 | iOS App Store build still on hosted | No regression |
| T4-R-5 | VM 119 supabase-auth healthy |
docker ps OK |
Reply T-4 pass or share failure detail.
END T4-4 report (STOP for Ryan E2E)