Step 1: Foundation and confined tracer

Prove the Vercel production boundary with one read-only tracer

Goal

Prove the Vercel production boundary for one configured, non-critical database. Prove Static IP egress, Workflow, deployed temporary storage, package bundling, and Connect. Keep no candidate and create no Git reference.

Scope

Add:

The administrator page and navigation entry.
Server actions and the authorized operation-status route.
Workflow integration and one tracer workflow.
The application-database tables and migrations.
The audit events and lease helpers.
Production environment validation.
Focused Node, Workflow, and Playwright tests.

Reuse the Step 0 package logic. Do not create a second MySQL discovery or Drizzle integration.

Update proxy.ts so /.well-known/workflow/ bypasses application authentication. Keep all other application routes under the current proxy rules.

Add RACKSPACE_TRACER_DATABASE as a production-only, non-secret environment value. The browser cannot supply the tracer name.

Implementation

Install the current stable Workflow packages from the official Next.js guide.
Install @workflow/vitest for Workflow integration tests.
Add the direct application dependencies for Workflow and Vercel Connect.
Configure Next.js with the Workflow integration.
Add the Workflow proxy exclusion and a matcher test.
Add the shared operation, lease, result, and error contracts and audit contracts.
Add the Turso migration and migration tests.
Add the production-only environment fields.
Show a disabled state outside Production or with incomplete configuration.
Require requireSystemAdmin() in every action and route.
Start the tracer through the safe start protocol.
Put MySQL, file, Drizzle Kit, Connect, and GitHub work in step functions.
Put only operation IDs and safe identifiers in Workflow values.
Update step state and lease heartbeat at each boundary.

The tracer step does this work in order:

Create a unique directory under /tmp.
Connect with the snapshot account and normal TLS validation.
Make sure that the configured database remains visible.
Record the server version, active TLS cipher, and effective egress result.
Call the Step 0 programmatic Drizzle method once to prove the deployed bundle.
Record output names, sizes, hashes, duration, and peak temporary storage.
Discard all generated output.
Connect with the runtime account and normal TLS validation.
Require the configured result from SELECT DATABASE().
Run one zero-row query against a visible table or view.
Record required and prohibited grant checks as booleans.
Request a Connect token restricted to conveyal/concourse and contents:write.
Read the immutable repository ID.
Create one unreferenced Git blob with fixed, non-sensitive text.
Record its hash without creating a Git reference.
Close both connections.
Remove the temporary directory in a finally block.

The tracer does not repeat Step 0 object discovery or persistent evidence collection. It does not return raw DDL, grants, hostnames, account names, database names, or generated files.

Tests

The proxy bypasses Workflow routes and protects application routes.
A forged tracer name cannot reach the workflow.
The safe start protocol calls start() once per operation.
A lost start response does not cause another start.
The first workflow step can bind the run ID.
A retry reads the step record before an external write.
The lease blocks refresh and verification overlap.
Manual clear rejects a live or different lease.
Audit errors fail closed at state-changing boundaries.
The tracer removes its temporary directory after every result.
The tracer result contains only allowlisted fields.
The GitHub probe creates no ref, commit, or pull request.
A normal or impersonated user cannot start the tracer.
The page polls only through the authorized no-store route.

Use @workflow/vitest to prove retry and serialization behavior. Use the Node runner for ordinary module tests.

Production gate

Deploy through the normal release process. Run the tracer once for the recorded database.

Record the operation, Workflow run, egress and TLS results, file manifest, resource use, Connect repository scope, and Git blob hash. Record no DDL or raw grant text.

Step 1 is complete only when the tracer passes and pnpm verify passes.

Stop conditions

Stop if any boundary needs a preview or local production credential. Also stop for TLS, permission, repository-scope, bundle, Workflow, or temporary-storage errors.

Step 1: Foundation and confined tracer

Prove the Vercel production boundary with one read-only tracer

Goal

Scope

Add:

The administrator page and navigation entry.
Server actions and the authorized operation-status route.
Workflow integration and one tracer workflow.
The application-database tables and migrations.
The audit events and lease helpers.
Production environment validation.
Focused Node, Workflow, and Playwright tests.

Reuse the Step 0 package logic. Do not create a second MySQL discovery or Drizzle integration.

Update proxy.ts so /.well-known/workflow/ bypasses application authentication. Keep all other application routes under the current proxy rules.

Add RACKSPACE_TRACER_DATABASE as a production-only, non-secret environment value. The browser cannot supply the tracer name.

Implementation

Install the current stable Workflow packages from the official Next.js guide.
Install @workflow/vitest for Workflow integration tests.
Add the direct application dependencies for Workflow and Vercel Connect.
Configure Next.js with the Workflow integration.
Add the Workflow proxy exclusion and a matcher test.
Add the shared operation, lease, result, and error contracts and audit contracts.
Add the Turso migration and migration tests.
Add the production-only environment fields.
Show a disabled state outside Production or with incomplete configuration.
Require requireSystemAdmin() in every action and route.
Start the tracer through the safe start protocol.
Put MySQL, file, Drizzle Kit, Connect, and GitHub work in step functions.
Put only operation IDs and safe identifiers in Workflow values.
Update step state and lease heartbeat at each boundary.

The tracer step does this work in order:

Create a unique directory under /tmp.
Connect with the snapshot account and normal TLS validation.
Make sure that the configured database remains visible.
Record the server version, active TLS cipher, and effective egress result.
Call the Step 0 programmatic Drizzle method once to prove the deployed bundle.
Record output names, sizes, hashes, duration, and peak temporary storage.
Discard all generated output.
Connect with the runtime account and normal TLS validation.
Require the configured result from SELECT DATABASE().
Run one zero-row query against a visible table or view.
Record required and prohibited grant checks as booleans.
Request a Connect token restricted to conveyal/concourse and contents:write.
Read the immutable repository ID.
Create one unreferenced Git blob with fixed, non-sensitive text.
Record its hash without creating a Git reference.
Close both connections.
Remove the temporary directory in a finally block.

The tracer does not repeat Step 0 object discovery or persistent evidence collection. It does not return raw DDL, grants, hostnames, account names, database names, or generated files.

Tests

The proxy bypasses Workflow routes and protects application routes.
A forged tracer name cannot reach the workflow.
The safe start protocol calls start() once per operation.
A lost start response does not cause another start.
The first workflow step can bind the run ID.
A retry reads the step record before an external write.
The lease blocks refresh and verification overlap.
Manual clear rejects a live or different lease.
Audit errors fail closed at state-changing boundaries.
The tracer removes its temporary directory after every result.
The tracer result contains only allowlisted fields.
The GitHub probe creates no ref, commit, or pull request.
A normal or impersonated user cannot start the tracer.
The page polls only through the authorized no-store route.

Use @workflow/vitest to prove retry and serialization behavior. Use the Node runner for ordinary module tests.

Production gate

Deploy through the normal release process. Run the tracer once for the recorded database.

Record the operation, Workflow run, egress and TLS results, file manifest, resource use, Connect repository scope, and Git blob hash. Record no DDL or raw grant text.

Step 1 is complete only when the tracer passes and pnpm verify passes.

Stop conditions

Stop if any boundary needs a preview or local production credential. Also stop for TLS, permission, repository-scope, bundle, Workflow, or temporary-storage errors.

Step 1: Foundation and confined tracer

Prove the Vercel production boundary with one read-only tracer

Goal

Scope

Add:

The administrator page and navigation entry.
Server actions and the authorized operation-status route.
Workflow integration and one tracer workflow.
The application-database tables and migrations.
The audit events and lease helpers.
Production environment validation.
Focused Node, Workflow, and Playwright tests.

Reuse the Step 0 package logic. Do not create a second MySQL discovery or Drizzle integration.

Update proxy.ts so /.well-known/workflow/ bypasses application authentication. Keep all other application routes under the current proxy rules.

Add RACKSPACE_TRACER_DATABASE as a production-only, non-secret environment value. The browser cannot supply the tracer name.

Implementation

Install the current stable Workflow packages from the official Next.js guide.
Install @workflow/vitest for Workflow integration tests.
Add the direct application dependencies for Workflow and Vercel Connect.
Configure Next.js with the Workflow integration.
Add the Workflow proxy exclusion and a matcher test.
Add the shared operation, lease, result, and error contracts and audit contracts.
Add the Turso migration and migration tests.
Add the production-only environment fields.
Show a disabled state outside Production or with incomplete configuration.
Require requireSystemAdmin() in every action and route.
Start the tracer through the safe start protocol.
Put MySQL, file, Drizzle Kit, Connect, and GitHub work in step functions.
Put only operation IDs and safe identifiers in Workflow values.
Update step state and lease heartbeat at each boundary.

The tracer step does this work in order:

Create a unique directory under /tmp.
Connect with the snapshot account and normal TLS validation.
Make sure that the configured database remains visible.
Record the server version, active TLS cipher, and effective egress result.
Call the Step 0 programmatic Drizzle method once to prove the deployed bundle.
Record output names, sizes, hashes, duration, and peak temporary storage.
Discard all generated output.
Connect with the runtime account and normal TLS validation.
Require the configured result from SELECT DATABASE().
Run one zero-row query against a visible table or view.
Record required and prohibited grant checks as booleans.
Request a Connect token restricted to conveyal/concourse and contents:write.
Read the immutable repository ID.
Create one unreferenced Git blob with fixed, non-sensitive text.
Record its hash without creating a Git reference.
Close both connections.
Remove the temporary directory in a finally block.

The tracer does not repeat Step 0 object discovery or persistent evidence collection. It does not return raw DDL, grants, hostnames, account names, database names, or generated files.

Tests

The proxy bypasses Workflow routes and protects application routes.
A forged tracer name cannot reach the workflow.
The safe start protocol calls start() once per operation.
A lost start response does not cause another start.
The first workflow step can bind the run ID.
A retry reads the step record before an external write.
The lease blocks refresh and verification overlap.
Manual clear rejects a live or different lease.
Audit errors fail closed at state-changing boundaries.
The tracer removes its temporary directory after every result.
The tracer result contains only allowlisted fields.
The GitHub probe creates no ref, commit, or pull request.
A normal or impersonated user cannot start the tracer.
The page polls only through the authorized no-store route.

Use @workflow/vitest to prove retry and serialization behavior. Use the Node runner for ordinary module tests.

Production gate

Deploy through the normal release process. Run the tracer once for the recorded database.

Record the operation, Workflow run, egress and TLS results, file manifest, resource use, Connect repository scope, and Git blob hash. Record no DDL or raw grant text.

Step 1 is complete only when the tracer passes and pnpm verify passes.

Stop conditions

Stop if any boundary needs a preview or local production credential. Also stop for TLS, permission, repository-scope, bundle, Workflow, or temporary-storage errors.

Search documentation

Search documentation

Search documentation

Goal

Scope

Implementation

Tests

Production gate

Stop conditions

Search documentation

Goal

Scope

Implementation

Tests

Production gate

Stop conditions

Search documentation

Search documentation

Goal

Scope

Implementation

Tests

Production gate

Stop conditions

Search documentation

Goal

Scope

Implementation

Tests

Production gate

Stop conditions