You are working on StratoFusion. Complete the remaining OVH VM rehearsal, local VM rehearsal, and production cutover preparation without changing live apex production until explicit cutover approval is given.
Required Context
Before acting, read:
AGENTS.md
README.md
public/docs/developer/AI_OPERATING_PROTOCOL.md
docs/ai-skills/01-architecture.md
docs/ai-skills/03-rclone-data-plane.md
docs/ai-skills/08-testing.md
docs/ai-skills/09-authentication-oauth.md
docs/ai-skills/11-deployment.md
docs/phase-b-checklist.md
docs/local-vm-rehearsal.md
public/docs/DEPLOYMENT.md
public/docs/RCLONE_SERVICE.md
Use PowerShell and PNPM on Windows. Do not use WSL. Use explicit Git Bash only for .sh scripts that require POSIX shell behavior.
Current Known State
Branch: migrate/vm-consolidation.
Pushed commits:
5feb92d7 - supports OVH vm-* and local .test rehearsal hostnames.
39388f8b - allows VM deploy job to log into GHCR before pulling images.
GitHub VM Deploy rerun for 39388f8b passed.
OVH VM at 15.204.243.136 has healthy internal app and rclone services.
OVH Caddy now serves only:
vm-staging.stratofusion.io
vm-rclone.stratofusion.io
vm-grafana.stratofusion.io
vm-glitchtip.stratofusion.io
OVH VM runtime env has been updated to vm-staging / vm-rclone URLs.
OAuth redirect env vars on the OVH VM have been updated to:
https://vm-staging.stratofusion.io/api/google
https://vm-staging.stratofusion.io/api/onedrive
https://vm-staging.stratofusion.io/api/dropbox
CRON_REPLICAS must remain 0 and AUTH_ACCESS_PAUSED should remain true except during a controlled auth verification window.
Remaining OVH Blocker
Public DNS for the vm-* hostnames still resolves to Vercel edge IPs, not the OVH VM. Create or update these DNS A records:
Host
Type
Value
vm-staging.stratofusion.io
A
15.204.243.136
vm-rclone.stratofusion.io
A
15.204.243.136
vm-grafana.stratofusion.io
A
15.204.243.136
vm-glitchtip.stratofusion.io
A
15.204.243.136
Do not change apex, www, rclone, grafana, or glitchtip production records until Phase C cutover is explicitly approved.
After DNS changes propagate, verify:
$names = @("vm-staging.stratofusion.io","vm-rclone.stratofusion.io","vm-grafana.stratofusion.io","vm-glitchtip.stratofusion.io")foreach($name in $names){Resolve-DnsName$name-Type A |Select-Object @{Name="Name";Expression={$name}},IPAddress
}
Trust Caddy's local root certificate on Windows as described in docs/local-vm-rehearsal.md.
Build or deploy an image whose public build-time URLs match the local .test origin if testing browser flows locally. Do not promote local .test images to OVH or production.
Safety Rules
Keep cron disabled during all rehearsals unless doing a short, explicit, user-approved cron test window.
If a Neon production dump is restored to any VM, park all jobs except the operator's test jobs before enabling cron.
Never run destructive rclone commands without explicit approval.
Manual rclone commands must default to --dry-run.
Do not print secrets, OAuth tokens, provider client secrets, webhook secrets, or complete .env contents.
Do not change production apex DNS until the user explicitly approves Phase C cutover.
Completion Criteria
OVH rehearsal is complete when:
All four vm-* DNS records resolve to 15.204.243.136.
Caddy obtains valid public certificates for all four vm-* hosts.
https://vm-staging.stratofusion.io/api/health returns healthy over real TLS.
https://vm-rclone.stratofusion.io/health returns healthy over real TLS.
Clerk sign-in, provider OAuth callbacks, upload/download, Grafana, GlitchTip, backup, and drain-gate checks from docs/phase-b-checklist.md are evidenced.
CRON_REPLICAS is restored to 0 after any test window.
Local VM rehearsal is complete when:
Windows hosts entries resolve all four .test names to the local VM.
Browser TLS trusts the local Caddy root certificate.
App and rclone health checks pass through the .test hostnames.
Upload/download and optional restore/cron/drain rehearsals pass without affecting production jobs.
Final Report
Report:
DNS records changed and observed resolution.
VM services and health check outputs.
Caddy certificate status.
Third-party dashboard items completed or still pending.