[thomasluizon]

Closes thomasluizon/orbit-tickets#1417.

Accounts carrying orbit_design=redesign are routed to a separate production Render web service at the same public address. Other requests retain the current origin and public Host. Removing the Worker route restores the current build for both cookie variants.

infra/production.tf adds the image-backed service using the current production plan, region, health path and production env group, and exports its ID and Render hostname for thomasluizon/orbit-tickets#1499. A required production_redesign_web_digest seeds an approved production-configured redesign/main image; subsequent digest changes are ignored so releases remain manual. infra/cloudflare.tf, infra/web-routing.tf and infra/workers/web-routing.mjs proxy only app DNS and add the cookie router. The redesign request uses its Render Host plus X-Forwarded-Host: app.useorbit.org and X-Forwarded-Proto: https; path, query, method, body and other headers pass through. The current request passes through unchanged.

Miniflare tests cover both routes, exact cookie matching, cookie removal, POST bodies and Server Action headers, callback queries, redirect responses and session cookies. The Terraform workflow installs locked test dependencies and runs all infrastructure tests. The web plan guard now protects the redesign service too. infra/README.md documents rollout, permission checks, live verification and rollback.

Test evidence

• dotnet build Orbit.slnx: exit 0, zero errors. Generated src/Orbit.Api/openapi.json is unchanged.
• node --test infra/check-web-plan.test.mjs infra/web-routing.test.mjs: exit 0, 20 passed, including 13 new Worker tests.
• npm ci --prefix infra and npm test --prefix infra: exit 0, 48 passed. Installation audit reports zero vulnerabilities.
• dotnet test tests/Orbit.Domain.Tests --no-build: exit 0, 666 passed.
• dotnet test tests/Orbit.Application.Tests --no-build: exit 0, 5,466 passed.
• dotnet test tests/Orbit.Infrastructure.Tests --no-build: exit 0, 3,342 passed.
• terraform fmt -check -recursive infra and terraform -chdir=infra validate -no-color: exit 0.
• terraform -chdir=infra plan -input=false -no-color: exit 1, Backend initialization required. The S3 backend is not initialized here and Cloudflare/Render credentials are unset. No live plan summary or permission verdict is claimed. No secrets were read and no infrastructure was applied.
• This adds routing infrastructure; there was no existing Worker routing regression test or shipped routing defect to demonstrate with a before/after test run. Live Next.js, OAuth and edge latency verification requires the orchestrator's apply.

Expected plan scope, pending live confirmation: three creates (redesign service, Worker script, Worker route), app DNS proxy update, and the required production web env-group link update. Existing web services must remain unchanged.

CI round (d5182a1c, SonarCloud quality gate):

• sonarcloud.yml now installs infra with npm ci --prefix infra --ignore-scripts and writes coverage/web-routing.lcov from infra/web-routing.test.mjs; the routing cases run in Node and in Miniflare, because Miniflare alone produced an empty Node coverage report (TN: only). Local: SF:infra/workers/web-routing.mjs, LF:18, LH:18.
• terraform.yml:30 runs npm ci --prefix infra --ignore-scripts (S6505).
• npm ci --prefix infra --ignore-scripts exit 0; npm test --prefix infra exit 0, 61 tests including the workerd cases; actionlint on both workflows exit 0. The test file keeps all 22 assertions.

Base merge (25e67509, b44730e2): main took orbit-api#733 (the v2 document) and orbit-api#734 (the typed /api/config response) in parallel, so main's committed openapi_v2.json lacked the AppConfigResponse schema and the Build check's stale-document step failed on this pull request's merge commit. dotnet build src/Orbit.Api (exit 0) regenerates it; openapi.json is unchanged. Merging this pull request clears that red on main.

Interface evidence

The live pinned Cloudflare script schema, route schema, and DNS schema confirm the used resources, bindings and proxy fields. Routes require proxied DNS; the Request contract confirms request cloning and header rewriting. Render image deployments do not automatically redeploy images.

A real terraform providers schema -json invocation with the installed pinned providers in a backend-disabled scratch root confirmed render_web_service.id and .url: each is { "type": "string", "computed": true }, with descriptions identifying the service ID and accessible URL. The complete image attribute-name set is digest, image_url, registry_credential_id, tag; there is no image auto_deploy field. Reproduce using the provider declarations from infra/versions.tf without its S3 backend, then initialize and run the schema command. No new Render HTTP response fields are consumed.

The live Miniflare testing docs confirm the testing API. Installed miniflare/dist/src/index.d.ts and dist/src/index.js confirm outboundService receives a real Request and returns a Response, bindings supplies environment values, and dispatchFetch invokes the module. Tests assert the actual runtime-generated outbound requests rather than inventing external response fixtures.

Assumptions

• Require an explicit production_redesign_web_digest from a published production-configured redesign image, rather than bootstrapping the new service with the current build's digest.
• Use Node's existing infrastructure test runner with Miniflare rather than introducing a separate Vitest runner; pin the Worker compatibility date to one the installed runtime supports.

Manual steps

• Cloudflare > My Profile > API Tokens: verify the token supplying CLOUDFLARE_API_TOKEN has account-level Workers Scripts Write and zone-level Workers Routes Write and DNS Write. The provider also lists Workers Scripts Read, Workers Routes Read and DNS Read for reads. Existing script access does not prove route access. Token inspection is unverified here; report an actual denial with its exact permission name.
• Existing Terraform execution environment > ignored infra/local.tfvars: supply production_redesign_web_digest for the approved production redesign/main image, retain dns_app_target = "orbit-web-3qmv.onrender.com" and web_custom_domains = ["app.useorbit.org"], then review a saved plan and the web plan guard output before applying through the existing infrastructure process. The plan must have only the scope above.
• Render > orbit-web-redesign > Environment and Settings > Deploy: confirm orbit-production-web, NEXT_PUBLIC_SITE_URL=https://app.useorbit.org, the approved image digest, and service health. Read outputs production_redesign_web_service_id and production_redesign_web_host for #1499. That UI ticket owns its repository variable key and production branch/service selection in GitHub Actions > release.yml; this PR does not modify the UI repository.
• Public app after the UI cookie change and #1499 are deployed: compare /api/health with and without orbit_design=redesign to the approved redesign/main and main commits, then remove the cookie and reload. Verify Google and email sign-in, /auth-callback, every configured callback, session renewal, and Server Actions on both routes with the browser staying on app.useorbit.org.
• Cloudflare deployment verification: measure cached immutable-asset and uncached /api/health added latency using interleaved routed and direct-origin requests from the same location, preserving public TLS/Host, confirming cache status and recording sample count and median TTFB deltas. Cached added latency: not measured before apply. Uncached added latency: not measured before apply.
• Rollback check in Cloudflare > Workers & Pages > orbit-web-routing > Settings > Domains & Routes: deleting only app.useorbit.org/* must return both cookie variants to the current health commit. Preserve the DNS target and current service custom domain; remove the route from Terraform before an apply intended to retain rollback.

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the production routing infrastructure, Worker behavior, runtime tests, and paired web changes across both repositories.

• Production origin: Adds a separately pinned redesign Render service, shared production configuration, release outputs, and plan-guard protection.
• Cookie routing: Proxies the app hostname through Cloudflare, routes the exact redesign cookie to its own origin, and preserves request bodies, callbacks, redirects, and session cookies.
• Rollout and rollback: Documents approved-image bootstrap, permissions, live verification, and restoration of the current origin by removing the Worker route. Canonical-host compatibility is addressed by paired orbit-ui-mobile#1832; the initial redesign image depends on that fix. Manual releases are covered by orbit-ui-mobile#1829.
• Verification: Independently ran the infrastructure suite: all 48 tests passed. Terraform was unavailable locally (terraform: command not found); the PR's Terraform validation check passed. Live OAuth, session, and latency verification remain deployment-time checks.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the CI and routing-test changes since dccbf368; production Worker behavior and Terraform resources are unchanged.

• Added Worker coverage: Included web-routing.lcov in SonarCloud and installed the locked infrastructure dependencies before coverage generation.
• Preserved runtime verification: Ran the routing cases in both Node and workerd, allowing Node coverage collection without replacing Cloudflare runtime checks.
• Disabled install scripts: Updated both CI workflows to use npm ci --prefix infra --ignore-scripts.
• Verified the delta: Independently installed dependencies with scripts disabled and passed all 61 infrastructure tests. The generated Worker LCOV report covered all 18 lines and all 6 branches. Live OAuth, session, and latency verification remain deployment-time checks.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the delta since d5182a1: the merge from main and regenerated v2 OpenAPI config documentation; routing behavior and infrastructure are unchanged.

• Regenerated config documentation: Added the existing config response and its three schemas to openapi_v2.json, matching ConfigController and the committed v1 document without changing runtime payloads.
• Verified schema consistency: Independently checked equality of the config response and schemas across v1/v2, resolved all 1,593 local v2 references, and inspected the sibling consumer types. No full build or unit suite was rerun for this generated-document-only delta.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud