docs(deploy): capture the service-cutover ordering traps as a checklist - #84
Merged
Merged
Conversation
The August 2026 cutover to the GitHub-connected Railway service hit two ordering traps that nothing documented: - REGENGINE_CORS_ORIGINS came across as a Railway reference variable, so it carried the OLD service's URL. Because the same allowlist also gates state-changing requests (auth_middleware), this broke both CORS headers and every write — and kept the nightly smokes red for three days after the cutover PR merged, initially attributed to the wrong cause. - The dashboard reaches the demo through a Next.js proxy route hosted on Vercel, so INFLOW_LAB_SERVICE_URL is a Vercel env var, not a Railway one — and Vercel bakes env at build, so setting it does nothing until production is redeployed. Nothing recorded this venue. Write the four-step checklist (CORS = change-not-copy, secrets = make concrete, consumers = retarget incl. the Vercel var, then retire) into the Railway Shared Demo section, each step with its verification probe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014ykFQkKR1XmCtSkDRCT4sT
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a "Moving the demo to a new service (cutover checklist)" subsection to the Railway Shared Demo docs, written from what the August 2026 cutover actually hit rather than from theory. Four ordered steps, each with its verification probe:
REGENGINE_CORS_ORIGINS= change, never copy/reference. The value names the host, so a Railway reference variable carries the old URL — which breaks both CORS headers and every state-changing request, sinceapp/auth_middleware.pygates writes on the same list. This single stale value kept both nightly smokes red for three days after chore: cut the shared demo over to the GitHub-connected Railway service #82 merged (Remote Smoke is failing against the shared demo #80, Remote Browser Smoke is failing against the shared demo #81), initially attributed to the wrong cause.INFLOW_LAB_SERVICE_URLis a Vercel env var (inert until a production redeploy) — a venue nothing previously documented.Why now
#82's decommissioning note covered the auth/HMAC copy but omitted the CORS change and the Vercel venue — the two things that actually bit. This closes that documentation gap while the incident details are fresh; the resolution evidence lives in #80/#81.
Test Plan
commit_source) and are transcribed from the working commands.🤖 Generated with Claude Code
https://claude.ai/code/session_014ykFQkKR1XmCtSkDRCT4sT
Generated by Claude Code