amadan
woodstar runbook: rehearsal catch — #77 dropped atproto-did from apbridge; cutover sha -> e7406bb
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+14
−1
docs/superpowers/plans/2026-08-16-woodstar-cutover-runbook.md+14 −1
diff --git a/docs/superpowers/plans/2026-08-16-woodstar-cutover-runbook.md b/docs/superpowers/plans/2026-08-16-woodstar-cutover-runbook.md| index d7d80f69f..4b40aa7d1 100644 |
| --- a/docs/superpowers/plans/2026-08-16-woodstar-cutover-runbook.md |
| +++ b/docs/superpowers/plans/2026-08-16-woodstar-cutover-runbook.md |
| @@ -22,7 +22,7 @@ per spec `docs/superpowers/specs/2026-08-12-woodstar-carloku-migration-design.md |
| | Delegation zone | `acme.oncarlos.com` (oncarlos.com zone `Z04313755ASMHAWD536L`, Route53, keymail account — edge publishes TXT here via `CARLOS_DNS_PROVIDER=route53` suffix-walk) | |
| | Delegation CNAME | `_acme-challenge.woodstar.app` → `_acme-challenge.woodstar.app.acme.oncarlos.com` — **DONE 2026-08-16** (stale Caddy TXT leftovers deleted in the same change batch) | |
| | Old-box cert headroom | apex + wildcard both expire **2026-10-21**; old-box renewal is blocked by the delegation CNAME from its ~Sept 21 renewal window — cutover must land before then, rollback keeps existing certs | |
| -| W0 build sha | woodstar `origin/main` `1aa534e` — **BUILT + SHIPPED + PROMOTED 2026-08-17** (all six binaries + status, one sha, `GOOS=linux GOARCH=arm64`, clean worktree; channel `canary/woodstar`). A later re-ship repeats D2.3 verbatim at the newer sha | |
| +| W0 build sha | **`e7406bb` — the last pre-#77 main commit** (SHIPPED + PROMOTED + ADOPTED 2026-08-17, superseding the first `1aa534e` ship). REHEARSAL CATCH: #77 moved the `/.well-known/atproto-did` handler out of apbridge into atbridge, so `1aa534e`'s six-service topology 404s every Bluesky handle verification — `e7406bb` keeps #66 (fan-out) + #76 and matches live prod behavior exactly. The PDS rollout (D5) re-ships newer main WITH atbridge | |
| | Account | `woodstar` = sqid **`bdm`** on console.carloku.com (Paul owner) — settled 2026-08-17 | |
| | Channel | `canary/woodstar` (the canary/keymail pattern; all seven apps ride it) | |
| | Old-box SSH | `ssh -i ~/.ssh/woodstar-canary.pem ec2-user@52.30.232.124` (key per woodstar `scripts/status-publish.sh`) | |
| @@ -243,6 +243,19 @@ Original checklist (for a re-run; all over |
| ## D3 — Rehearsal (copies only, tear down after) |
| +**FIRST RUN 2026-08-17 (at `1aa534e`):** restore 11 s + integrity `ok` |
| +× 3 + relay serving in 1 s = **freeze-to-serving 12 s**. Loopback |
| +probes: feed/`info`/AASA/real-media-file/search all 200; webfinger + |
| +`/users/paul` 200 `application/activity+json`; `/subscribe` WS **101**; |
| +`/img/x` 404 `text/plain` (unfurl service answering — NOT the SPA-HTML |
| +failure shape); `/stream/` 401 (notify alive, auth-gated); |
| +`/unfurl?url=…` curl-timeout — the loopback egress lock refusing the |
| +external fetch, by design. Host behaviors: www → 301 apex ✓, paul → |
| +302 `/paul` ✓, **atproto-did → 404 ✗ — THE RUN'S CATCH** (see the W0 |
| +build sha row: #77 removed the handler from apbridge; sha moved to |
| +`e7406bb`, re-shipped + re-adopted). Rehearsal MUST re-run at |
| +`e7406bb` and show atproto-did 200 before D4. |
| + |
| - [ ] **D3.1** server-side CopyObject of the old bucket's backups into |
| `s3://carlos-data-ie-271376211898/woodstar-rehearsal/`. |
| - [ ] **D3.2** on the flagship: `litestream restore` the three DBs from |