[karlwaldman]

Reconcile the isolated MCP production app with the reviewed remote plugin 0.1.2 image from protected-main source d11cd0315987e9831381a7fe74f5b67d0cb943f8, digest sha256:003efbb235c11502c037ab0e1034a045e4498c4403bd13f8cc2fb28c46d74137. Preserve the live custom domain, allowed origins, ingress and instance size; bind the dedicated mcp_oauth database and its verified CA. The encryption key is injected at deployment from its read-back-verified Mac login Keychain backup and is never committed.

The database and restricted role are provisioned. The exact non-root amd64 image passed local remote initialization, nine-tool inventory, OAuth metadata and premium sign-in challenge with an isolated PostgreSQL 15 store. All runtime changes passed protected-main live API CI. The runbook records key recovery, first-migration reconnect behavior, restart verification and rollback without dropping storage.

This updates the old October 3 deployment record to today's concrete rollout. Production activation and refresh-across-restart verification follow this PR; they are not yet claimed here.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 74121f57-0bca-45c6-b5e7-5eaea723866a

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[karlwaldman]

Reviewed the spec against the live app: preserves custom domain, allowed origins, ingress, one 1GB instance and all unrelated settings. Only the immutable image and dedicated OAuth database binding/URL/CA are added. The backed-up 32-byte key is injected in process as SECRET and is absent from the file. Database owner/grants are verified; the exact amd64 image digest passed non-root/provenance checks and isolated PostgreSQL remote-container smoke. Runtime source d11cd03 is protected main with green live API tests. Current PR CI is green. Rollback retains database/key, and production verification will include the bound CA and refresh after a real same-image deployment.