Repository navigation
Carry main fixes into redesign main (#746) - #756
Merged
Merged
Conversation
(cherry picked from commit 61b0090)
(cherry picked from commit bcfd81e)
* Bring the API redesign tree onto main for #1413 * Preserve calendar connection detection for shipped clients * Prove API and migrated schema compatibility with shipped clients * Trim whitespace in the archived main schema proof * Require the production health response to report the released commit * Bind initial approval previews to stored pending operations * fix: return the bulk skip refresh outcome and split the undo skip query SonarCloud failed the quality gate on two reliability findings in code this pull request brings to main: the bulk skip conflict check read a flag only a lambda wrote (S2583), and the undo skip check loaded Tags and Goals in one query (S8733). The transaction now returns whether every habit refreshed, and the undo skip check splits its query. A new case covers the concurrent change conflict; it failed with the refresh outcome forced to true and passes with the fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 5526c9b)
* feat: resolve feature flags per account * feat: administer account feature flags through MCP and REST * test: exclude feature flag targets from rate limit fixture * fix: reconcile account flag tests and migration metadata with redesign (cherry picked from commit 1b886bd)
* Add header API versioning with v1 compatibility * Verify versioned OpenAPI and browser header compatibility * Preserve skip undo path contract with optional version header (cherry picked from commit ac8b34a)
(cherry picked from commit a9d8dd5)
* Add cookie-based routing for the production redesign web service * Document web routing rollout, permissions, and rollback checks * Fix web routing coverage and disable infra install scripts * chore: regenerate the v2 OpenAPI document on main orbit-api#733 added openapi_v2.json and orbit-api#734 typed the /api/config response in parallel, so main carries a v2 document without the typed config schema and the Build check's stale-document step fails on every merge with main. dotnet build src/Orbit.Api regenerates it; openapi.json is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 9c64770)
* fix: validate habit updates with the resulting time range * fix: preserve end dates when creating root habits * fix: gate slip alert activation and preserve unchanged reminders * fix: compare effective reminder rules across stored formats (cherry picked from commit 7472203)
* Select mutation shards from changed projects * Consolidate guards and filter artifact generation * Skip project documentation in mutation selection * Validate mutation base refs and restrict Git PATH * Read mutation shard changes from standard input (cherry picked from commit b802f9e)
(cherry picked from commit 0e32628)
(cherry picked from commit da2f53a)
(cherry picked from commit 1149606)
(cherry picked from commit 98faf4e)
* fix: erase accountability pairs during account deletion and reset * test: preserve migration compatibility checks after accountability cleanup (cherry picked from commit a9e5fb9)
* fix: compare streak sync dates in the user timezone * fix: show actual days remaining in goal deadline reminders * test: configure timezone for streak scheduler fixtures (cherry picked from commit 0e63842)
(cherry picked from commit abdd738)
Web Push subscriptions accept only HTTPS endpoints on the FCM, Mozilla, Apple and WNS push hosts, and the push HTTP client follows no redirects. Replaces orbit-api#748 as one commit so no commit carries the high-entropy sample fixture. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit d9f847a)
* fix: erase uploaded objects before completing account deletion * fix: refuse upload reads after permanent account deletion * fix: grant uploads bucket deletion permissions and verify provider wiring * test: align storage startup checks with erasure requirements * fix: retire deleted Supabase upload storage * test: configure upload erasure providers in deletion fixtures Share the existing object-store fake across account deletion and scheduler fixtures after merging main. Preserve accountability assertions and production provider requirements for thomasluizon/orbit-tickets#1507. (cherry picked from commit fa33a94)
* fix(auth): limit access tokens to fifteen minutes * fix(auth): align managed JWT lifetime and prove logout rejection (cherry picked from commit ade7016)
* test(auth): expose registration dependent sign-in work * fix(auth): perform uniform registration work before sign-in responses * test(auth): cover expired codes and tracked upsert conflicts * fix(auth): isolate signup retries and restore provisioning guards * fix(auth): recover signup work after dispatch failures * fix(auth): roll back failed signup referrals before retry (cherry picked from commit 1bd0d26)
Apply the carried version declarations to the Notion and proactive controllers and regenerate the v2 contract. Refs thomasluizon/orbit-tickets#746.
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
The carried account-targeting model leaves the newer proactive engine outside effective flag enforcement. A targeted proactive kill switch still permits item generation and notifications.
Reviewed changes Reviewed the complete carry from main onto redesign/main, including the conflict resolutions and final controller-versioning follow-up.
- API compatibility: Adds header-selected v1/v2, preserves omitted-header v1 behavior, types the config response, and regenerates both OpenAPI documents.
- Account feature flags: Adds targeting persistence, shared account/plan resolution, admin REST/MCP controls, and resolver integration into config, agent policy and streak-freeze eligibility.
- Astra safeguards: Persists initial preview fingerprints and enforces chat API-key scope before context dispatch while retaining the newer ask-block, ordered-response and Notion behavior.
- Habit and goal fixes: Corrects edit gates, end dates, reminder invalidation, bulk-skip refresh outcomes, localized streak-sync dates and deadline reminder counts.
- Authentication: Carries OAuth Turnstile protection, composite email/IP rate limits, authenticated BFF forwarding support, shorter access tokens and checkpointed signup jobs.
- Erasure and delivery: Adds S3 upload erasure and owner checks, accountability cleanup, and provider-restricted Web Push delivery.
- Infrastructure and CI: Carries Cloudflare redesign routing, Render/SSM/IAM configuration, staging landing settings, mutation shards, consolidated guards and compatibility coverage.
Verification: the build passed with zero errors; all 10,129 unit tests and 69 Node tests passed. The targeted-flag defect below was reproduced separately using the existing SQLite proactive harness. Sibling client changes and the paired BFF PR were inspected; no live deployment or Play-track verification was performed. The optional cross-model check was unavailable because codex was not installed.
⚠️ Per-account proactive kill switch is ignored
High: Enabling astra_proactive_engine_disabled for an individual account does not stop its proactive engine, even though the new resolver reports the switch as enabled for that account. The preserved ProactiveEngineService.LoadAsync still reads only globally enabled rows, so targeted accounts continue receiving generated items and notifications.
Technical details
# Integrate account targeting into the preserved proactive engine
## Affected sites
- `src/Orbit.Infrastructure/Services/FeatureFlagService.cs:41-46,78-82`: the new shared resolver supports batch account eligibility and global-or-account targeting.
- `src/Orbit.Infrastructure/Services/ProactiveEngineService.cs:52-54`: `Where(f => f.Enabled)` excludes account-only assignments before checking `AstraProactiveEngineDisabled`.
- `src/Orbit.Infrastructure/Services/ProactiveEngineService.cs:253-255`: `CalendarAllowed` consumes the same global-only list, also ignoring account-targeted calendar enablement.
- `src/Orbit.Infrastructure/Services/ProactiveEngineService.cs:31-39,320-350`: scheduled evaluation, current-item retrieval and actionability checks share this loader.
## Reproduction
Using the existing `ProactiveEngineServiceTests.Harness` at the evening-checkin window with a paid account and a due habit:
1. Add `AppFeatureFlag.Create(FeatureFlagKeys.AstraProactiveEngineDisabled, false)` and an `AppFeatureFlagAccount` assignment for that account.
2. Run the real engine and query the real `FeatureFlagService`.
3. Compare with a globally enabled kill switch.
Actual output:
```text
global=False; effectiveDisabled=True; items=1; notifications=1
global=True; effectiveDisabled=True; items=0; notifications=0
```
## Required outcome
- Proactive delivery and current/status reads honor each account's effective kill-switch state.
- Calendar eligibility uses the same effective account flags rather than raw global rows.
- Preserve the existing volume-invariant batch-read behavior.
- Add unit coverage with targeted and untargeted eligible accounts, including suppression of generated items and notifications for the targeted account.
## Suggested approach
Use the existing batch resolver to resolve enabled keys for loaded users, then apply those keys to proactive eligibility and calendar checks. This missing consumer integration is specific to combining account targeting with the newer redesign engine; no change to the resolver's global-or-account semantics is needed.gpt-6.1-sol ｜ 𝕏
|
There was a problem hiding this comment.
No new Critical or High issues found. The proactive account-targeting concern from the prior review is addressed.
Reviewed changes Reviewed b34d0100 against the previously reviewed 5d22617a, using the prior complete carry review as the baseline for unchanged code rather than repeating it.
- Integrated effective account flags into the proactive engine's batch loader, suppressing generation, notifications, current items and active-status reads for targeted-disabled accounts.
- Aligned calendar eligibility with the same per-user resolved flags instead of globally enabled rows.
- Expanded regression coverage for global and account targeting, existing-item visibility/status, calendar fetch suppression and invariant query counts at 10 and 1,000 accounts.
Verification: solution build passed with zero errors; all 10,135 unit tests passed with no failures or skips. The focused proactive/resolver/migration suite also passed all 89 tests, and the worktree remained clean. No live deployment was exercised.
gpt-6.1-sol ｜ 𝕏
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Carry the 21 requested main commits after
8356d4deonto redesign/main at5d9ff03e, in order withgit cherry-pick -x. Preserve the newer Notion, proactive, ordered-response, and ask-block work. The follow-up commit applies the carried API version declarations to the two newer controllers and regenerates the v2 document.Refs thomasluizon/orbit-tickets#746. This remains the standing sync ticket.
Carried commits
61b0090bf(#728)52af0cafbcfd81eaf(#729)7b60cc845526c9bc6(#723)71e975f21b886bdfe(#724)4cfe1ca4ac8b34a20(#733)7cebaf245d22617aversions the newer Notion and proactive controllers.a9d8dd595(#734)1e432b5c9c6477087(#735)0992cb337472203c7(#736)20384f74b802f9e4d(#737)c481e0e80e3262836(#739)ad60dc7eda2f53a54(#740)fffcd22d114960615(#741)4e32a4ce98faf4e62(#743)5f6fa7d8a9e5fb9d7(#745)7ec374620e63842e5(#747)7229647aabdd738e2(#742)2e5439b1d9f847a81(#751)d7edd2c7fa33a94a2(#750)cf8489dbde0f42fe6(#749)cd6931a0ade7016c3(#738)a1207aa01bd0d2650(#744)e2dd228bEvery source SHA has its own original-source trailer. The two older commits checked below already exist by content.
Already present by content
b8abb7628(test: make achievement count fixture independent of the clock #695):tests/Orbit.Application.Tests/Gamification/AchievementProgressServiceTests.cs:118-119sets the old log's creation timestamp to its logged date at noon, exactly as the source change does.41d806406(fix: send the staging pinger with manual redirects #678):infra/workers/staging-pinger.mjs:29uses manual redirects;infra/staging-pinger.test.mjs:106checks rejection of a 301;infra/README.md:69documents the behavior.git show --format= <source> | git apply --reverse --check, exit 0. Neither needed a cherry-pick.Promotion conflicts by redesign commit
Comparing
0a32fab3with5526c9bc6isolates the promotion's additions from its copy of the older redesign tree. Each group below names the latest redesign commit touching its conflicted paths. Later redesign behavior and tests remain; the compatibility additions are applied on top.a2f5469 Clean timeless text on redesign branch for #715 (#577)
src/Orbit.Api/Middleware/LocalizedErrorResultFilter.cstests/Orbit.Infrastructure.Tests/Extensions/McpConfirmationGateTests.cstests/Orbit.Infrastructure.Tests/Middleware/LocalizedErrorResultFilterTests.cs5d9ff03 feat: connect Notion tasks to Astra (#732)
src/Orbit.Api/openapi.jsonsrc/Orbit.Application/Chat/ChatToolGroups.cssrc/Orbit.Application/Common/FeatureFlagKeys.cssrc/Orbit.Application/Profile/Models/UserDataExport.cssrc/Orbit.Application/Profile/Queries/ExportUserDataQuery.cssrc/Orbit.Domain/Models/AgentContracts.cssrc/Orbit.Infrastructure/Migrations/OrbitDbContextModelSnapshot.cstests/Orbit.Application.Tests/Queries/Profile/ExportUserDataQueryHandlerTests.csc8877ee feat: return ordered Astra response parts (#727)
src/Orbit.Application/Chat/AccountRowsCard.cssrc/Orbit.Application/Chat/FollowUpDirective.cssrc/Orbit.Application/Chat/PeriodInsightCard.cssrc/Orbit.Application/Chat/RecordListCard.cssrc/Orbit.Application/Chat/StatusCards.cstests/Orbit.Application.Tests/Chat/FollowUpDirectiveTests.csd80442d feat: add Astra choice and pick list ask blocks (#731)
src/Orbit.Application/Chat/Commands/ProcessUserChatCommand.Accumulator.cssrc/Orbit.Application/Chat/Commands/ProcessUserChatCommand.Ai.cssrc/Orbit.Application/Chat/Commands/ProcessUserChatCommand.Tools.cssrc/Orbit.Application/Chat/Commands/ProcessUserChatCommand.cssrc/Orbit.Application/Chat/Validators/ProcessUserChatCommandValidator.cssrc/Orbit.Application/Common/ErrorCopy.cssrc/Orbit.Infrastructure/Services/AgentOperationExecutor.cstests/Orbit.Application.Tests/Commands/Chat/ChatWriteHoldHandlerTests.cstests/Orbit.Application.Tests/Commands/Chat/ProcessUserChatCommandHandlerTests.cstests/Orbit.Infrastructure.Tests/Services/AgentChatWriteHoldTests.csa644692 Add record list pages and complete Astra card data for #706 (#571)
src/Orbit.Application/Chat/Queries/GetRecordListPageQuery.csc10a291 feat: add proactive Astra item engine (#725)
src/Orbit.Application/Common/ErrorMessages.cssrc/Orbit.Infrastructure/Services/AiProactiveCheckinMessageService.cssrc/Orbit.Infrastructure/Services/ProactiveCheckinSchedulerService.cstests/Orbit.Infrastructure.Tests/Services/AiProactiveCheckinMessageServiceGenerationTests.cstests/Orbit.Infrastructure.Tests/Services/AiProactiveCheckinMessageServiceTests.cstests/Orbit.Infrastructure.Tests/Services/NotificationVoiceTests.cs52c8db9 Add guarded undo for single habit skips (#681)
src/Orbit.Application/Habits/Commands/BulkSkipHabitsCommand.cssrc/Orbit.Application/Habits/Commands/UndoSkipHabitCommand.cs97c39fb feat(chat): enrich day and calendar cards for in-place actions (#726)
tests/Orbit.Application.Tests/Chat/StatusCardBuilderTests.cs40efecf Add optional imported events to calendar API (#659)
tests/Orbit.Application.Tests/Queries/Calendar/CalendarEventItemSerializationTests.cs36fff55 Add proactive item lifecycle status read (#730)
tests/Orbit.Infrastructure.Tests/Services/AgentCatalogServiceTests.cs3f82b8d Fix confirmed bulk habit creation and preserve approval on failure (#702) (#704)
tests/Orbit.Infrastructure.Tests/Services/AgentExecutionAndSanitizerTests.cstests/Orbit.Infrastructure.Tests/Services/BulkCreateAgentOperationTests.csOther conflict resolutions
c3c7a92f, #556).github/workflows/mutation.yml: keptgithub.base_reffor fetch and since; added shard arguments and concurrency. The later #737 matrix change preserves this.d80442d3, #731)src/Orbit.Api/Extensions/ResultActionResultExtensions.cs: combined all Astra and feature-flag status mappings.src/Orbit.Application/Chat/Tools/IAiTool.cs: kept IChatOnlyAiTool and added IMcpOnlyAiTool.5d9ff03e, #732)src/Orbit.Infrastructure/Services/FeatureFlagService.cs: account targeting uses the new shared snapshot; forceRefresh still bypasses its cache for the Notion access gate.d80442d3, #731)src/Orbit.Api/Controllers/ChatController.cs: combined block parsing and 404/409/410 responses with 403 and the early scope guard. Generated OpenAPI replaces the conflicting document.tests/Orbit.Infrastructure.Tests/Persistence/FeatureFlagAccountsMigrationTests.cs: retained historical flag/signup model proofs, exact accountability FK assertions, all eight migration IDs in order, and the current snapshot guard. The historical-to-current FK comparison selects FK operations because the newer redesign also adds tables and seeds.c10a291e, #725)tests/Orbit.Infrastructure.Tests/BackgroundJobs/ScheduledJobRegistryTests.cs: retained ProactiveEngineSchedulerService and added the erasure-capable AccountDeletionScopeFactory.d80442d3, #731)src/Orbit.Api/RateLimiting/DistributedRateLimitAttribute.cs: retained the optional block-answer gate and added BFF settings plus both anonymous partitions. Updated the corresponding existing block-answer fixture for its added dependency.5d9ff03e, #732)tests/Orbit.Infrastructure.Tests/Persistence/SqliteOrbitDbContextFactory.cs: retained encryption-aware model caching and the proactive partial index; added file-backed connections, disabled pooling, and file cleanup for auth concurrency tests.The newer
AstraPickListPreviewTestsfixture also receives the carried executor store and real account flag resolver dependencies. The versioning suite identified the two newer controllers requiring the carried v1/v2 declarations; the final follow-up applies those declarations and generated output together.Migrations and contract
The combined snapshot retains all redesign models and adds
AddFeatureFlagAccounts,CascadeAccountabilityPairsOnUserDeletion, andAddDurableSignupWork. The source migration and Designer files remain byte-for-byte copies of main. Existing redesign migrations are unchanged.Order:
AddHabitSkipUndo,AddFeatureFlagAccounts,ReplaceProactiveCheckinsWithItems,AddIssuedAstraBlocks,AddNotionConnection,TrackNotionOAuthStateConsumption,CascadeAccountabilityPairsOnUserDeletion,AddDurableSignupWork. The flag migration sorts before the newer redesign migrations and depends only on existing Users and AppFeatureFlags. EF applies missing migration IDs; use the normal full migration sequence, including on a database that already applied later redesign IDs. No unresolved ordering question remains.The carried historical schema proof stays pinned to
AddHabitSkipUndo.TargetModel. The current snapshot is checked separately against the full combined model.dotnet ef migrations has-pending-model-changes --project . --startup-project ../Orbit.Api --no-build, run insrc/Orbit.Infrastructurewith unused design-time connection strings, exits 0 and reports no model changes. No database connection or new migration was required.Both OpenAPI documents are generator output. Existing DTO fields and the minimum supported client version remain intact. The two newer controllers expose the same behavior under omitted/v1/v2 headers.
Test evidence
Both locale modes passed:
env -u LANGandLC_ALL=en_US.UTF-8. Each build and test command was judged by its process exit code. Broad verification finished in 76.22 seconds, within the 25-minute budget.dotnet build Orbit.slnxdotnet test tests/Orbit.Domain.Tests --no-build --no-restoredotnet test tests/Orbit.Application.Tests --no-build --no-restoredotnet test tests/Orbit.Infrastructure.Tests --no-build --no-restoredotnet test tests/Orbit.Analyzers.Tests --no-build --no-restoregit diff --exit-code -- src/Orbit.Api/openapi.json src/Orbit.Api/openapi_v2.jsonafter buildTotal: 10,129 tests per locale, no failures or skips. Build warnings remain for existing package-version constraints, deprecated Firebase/subscription members, and an existing captured parameter.
node --test .github/scripts/mutation-matrix.test.mjs tests/Orbit.Infrastructure.Tests/Controllers/OAuthPageScriptTests.mjs infra/check-web-plan.test.mjs infra/staging-pinger.test.mjs infra/google-play-isolation.test.mjs infra/ses-isolation.test.mjs infra/bff-forwarding.test.mjs: exit 0, 69 passed.terraform fmt -check infra, timeless text, dash baseline, root allowlist, and suppression allowlist checks all exit 0. Added bare C# line comments were inspected; the one carried line links its evidence. All commit hooks passed.The unmodified carried
ApiVersioningTestssuite initially exited 1 with 11 passes and two failures:EveryControllerRoute_AcceptsV2AndRejectsUnsupportedVersionrejected the newer Notion route under v2, and the v2 document comparison lacked the newer controller schemas. After adding the same carried version declarations to ConnectionsController and ProactiveAstraController and regenerating, the unchanged suite passed all 13 cases, exit 0. No strengthened test was needed because the existing test already caught this integration defect.Exact before/after command:
env -u LANG dotnet test tests/Orbit.Infrastructure.Tests --no-build --no-restore --filter 'FullyQualifiedName~ApiVersioningTests'.The promotion's unchanged historical schema test initially failed against the newer live model, with 18 other focused cases passing. The next requested source commit (#724) already pins that proof to the promotion snapshot; it is carried as written. Final focused combined runs passed 55 Domain, 87 Application, and 178 Infrastructure cases, each exit 0. Those Infrastructure cases cover the complete combined snapshot, the historical schema proof, Notion refresh, pick-list preview, scope checks, anonymous rate limiting, scheduler wiring, deletion, and auth provisioning races.
No new regression tests were authored in this carry. Source tickets own their original failing-before evidence. No app server, browser, live database, infrastructure apply, or mutation run was started. Miniflare runtime routing checks were not run under the work order's server restriction; the 69 Node unit cases run here exclude that file. CI owns mutation testing and infrastructure rollout verification.
External interface evidence
curl --fail --silent --show-error https://api.useorbit.org/health. Complete response:{"status":"Healthy","commit":"7472203c7450bdd914c68282fefa905d9b432653","checks":[{"name":"background-services","status":"Healthy","description":"All background services running"},{"name":"database","status":"Healthy","description":"Database reachable"}]}. This proves the carried release check'sstatusandcommitfields. Their in-repository producer is WriteHealthCheckResponseAsync.code,title,status, supported-version headers, document grouping and generated filenames. The carried routing suite invokes that actual middleware and passes here.id,url, and image attributes, plus installed Miniflare request and binding contracts. Source PR #742 records the installed Render env_vars schema and complete redacted environment response.S3Objects/Key, null empty listings, deletion XML, DeleteErrors, and DeleteObjectsException on partial failure. It includes exact ilspycmd reproduction commands.Review round 1
Commit
b34d0100answers the Pullfrog finding on5d22617a(the per-account proactive kill switch was ignored). This is a redesign-only integration: the proactive engine exists only onredesign/main, so the fix lives in this carry and nothing changes onmain.ProactiveEngineService.LoadAsyncresolves each loaded user's enabled flags throughIFeatureFlagService.GetEnabledKeysForUsersAsync(one batch read), drops users whose effective flags includeastra_proactive_engine_disabled, andCalendarAllowedreads the same per-user flags instead of the raw global rows.5d22617a(4 failed, 2 passed, exit 1: targeted delivery, active status despite the switch, ignored calendar targeting).ProactiveEngineServiceTests,ProactiveAstraControllerTests,FeatureFlagAndAgentSupportTests,FeatureFlagAccountsMigrationTests) pass, including query-count invariance at 10 and 1,000 eligible accounts.dotnet build Orbit.slnx0 errors; all test projects pass withLANGunset andLC_ALL=en_US.UTF-8(Domain 737, Application 5,692, Infrastructure 3,674, Analyzers 32: 10,135). OpenAPI generation unchanged.Mutation (domain-habit-freeze)was cancelled at its 45-minute limit on5d22617a(414 mutants). No carried Domain test explains it: the slowest changed case isPushSubscriptionTests.Create_Valid_Successat 0.0145 s.Assumptions
0a32fab3tree as its imported redesign baseline and carry its unique additions onto the current branch; rejected restoring that older tree over later Astra work.Manual steps
These are inherited release prerequisites from the carried source PRs; this carry does not perform them.
aws_iam_user_policy.uploads["staging"]. In AWS IAM > Users > orbit-api-uploads-staging > Permissions > uploads-object-access, verifys3:ListBucketonarn:aws:s3:::orbit-uploads-staging-713285551626ands3:DeleteObjecton its objects. Erasure must empty the user's prefix, remove the database row, and return 404 for the stable link. Production's equivalent policy for orbit-api-uploads-production andorbit-uploads-production-713285551626requires the owner's authorization before production release.production_storage_providerandstaging_storage_provider. In Render > Environment Groups > orbit-staging-api / orbit-production-api, retain theStorage__S3__Bucket,Storage__S3__Region,Storage__S3__PublicBaseUrl,Storage__S3__AccessKeyId,Storage__S3__SecretAccessKey,Supabase__Url, andSupabase__AnonKeykeys. RetireStorage__Provider,Supabase__SecretKey, andSupabase__Bucketfrom storage configuration. Startup and erasure verify the result.Jwt__ExpiryMinutes=15andJwt__ExpiryHours=0in Render > orbit-api-staging > Environment, including linked orbit-staging-api and service overrides. Production's equivalent in Render > orbit-api > Environment requires the owner's authorization. Before releasing this shorter token lifetime, verify the Android build carrying thomasluizon/orbit-tickets#1525 (orbit-ui-mobile#1843) is live on the open track, as required by source PR Limit access tokens to fifteen minutes #738./orbit/staging/api/Auth__BffForwardingSecretand/orbit/production/api/Auth__BffForwardingSecretthrough the existing infrastructure process. In AWS Systems Manager > Parameter Store and Render > corresponding API/web environment groups, verify the API'sAuth__BffForwardingSecretand web'sBFF_FORWARDING_SECRETshare their environment's value without printing it. Distinct verified client addresses must consume distinct IP buckets; mismatched headers must retain the direct connection partition.BotProtection__SiteKeyand its pairedBotProtection__SecretKey; activate withBotProtection__Enabled=true. Verify the OAuth widget and valid-token send, and verify missing-token rejection without an email job. The carried checked-in setting remains disabled.production_redesign_web_digest, retaindns_app_target=orbit-web-3qmv.onrender.comandweb_custom_domains=["app.useorbit.org"], then review the saved Terraform plan and web plan guard before applying through the existing process. In Render > orbit-web-redesign > Environment/Settings, verify orbit-production-web,NEXT_PUBLIC_SITE_URL=https://app.useorbit.org, digest, and health. Passproduction_redesign_web_service_idandproduction_redesign_web_hostoutputs to the separate #1499 release work. After its UI release and cookie change, compare app health commits with and withoutorbit_design=redesign, verify callbacks/session renewal/Server Actions, record routed latency, and verify route-removal rollback as detailed in infra/README.md.__EFMigrationsHistory, including all missing redesign IDs and the three carried migrations. This PR does not deploy, merge, or close the standing sync ticket.