Raxx · internal docs

internal · gated

Wake-up brief — 2026-05-22 UTC

T-1 day to 2026-05-23 (operator-testing-ready per [[project_launch_posture_personal_use]], not public launch). Prod healthy: raxx-api-prod web.1 up 14h, raxx-console-prod up 18h.

Section 1 — PRs since 2026-05-21 06:00 UTC

Merged: 30. Highlights — webauthn validator P0 fix #2683, api-URL build conditional fix #2701, passkey flag flip #2673, deploy-antlers self-trigger #2675, dead-link + INSIGHT_STUB cleanup #2676 #2677, CE token sweep on inner pages #2674, options forward-looking copy #2671, vendor-name + error-code QA blockers #2670, Procfile release-phase alembic #2660, Lightsail vault snapshot + restore SOP #2661 #2662, agent vault retry helper #2665, BCP v1 #2651, 12-PR docs research bundle #2609-#2651.

Open: 1 — #2694 docs.raxx.app organization pass. BLR review applied as follow-up commit; held on operator follow-up for the 5 TBD pricing.md features (Decision 3). Docs surface stays CF-Access-gated through personal-use window so noindex defers Hinch Newman gate.

Section 2 — Operator-action queue (22 open) + needs-decision (20 open)

Today's launch-relevant operator items: - #2688 remove CF Access from tickets.raxx.app — held; revisit when customers exist - #1645 remove CF Access from getraxx.com — held per personal-use posture - #1025 pre-launch-blocker remove CF Access from raxx.app + api.raxx.app — api.raxx.app done yesterday (CF dashboard bypass), raxx.app stays gated - #1022 pre-launch-blocker wire auth routes — shipped yesterday (#2673 flags + #2683 validator fix + #2701 API URL); close after operator confirms signup works - #1632 pre-launch-blocker Stripe Price ID backfill on Founders subs

Decision queue highlights: #2299 console flag-UX hardening epic · #2076 FreeScout 5-state workflow path A/B/C · #1384 ORATS enterprise license · 6 stale bandit HIGHs awaiting triage (#2473-#2477, #2362).

Section 3 — Wave performance

Section 4 — SEV alerts

No SEV-1 / SEV-2 open. CI overnight failures (non-customer-impacting): - Nightly Security Scan (10:56 UTC) — recurring scanner-output gap, tracked - Terraform — email-delivery-stack (09:40 UTC) — TF_ROLE_ARN secret unset per #1898 - Billing retention cron (06:50 UTC), Trace integrity cron (05:54 UTC) — both Queue-cutover-pending

Section 5 — T-1 launch readiness

Yesterday's actual ship: signup flow end-to-end on raxx.app. Five-link chain that all had to align: 1. api.raxx.app CF Access bypass (operator dashboard click) 2. FLAG_WEBAUTHN_REGISTRATION + FLAG_AUTH_WEBAUTHN_LOGIN flipped on raxx-api-prod 3. BOOTSTRAP_TOKEN_SIGNING_KEY minted + set on raxx-api-prod (still needs vault-write per #2699) 4. Validator regression fix shipped (PR #2683, RCA docs/incidents/2026-05-21-prod-webauthn-boot-fail.md) 5. Frontend API URL pinned to prod in deploy-antlers.yml (PR #2701) — last link, otherwise raxx.app was XHRing api-staging

Outstanding to ship before any external attention: - Operator confirms signup completes end-to-end (Touch ID enrollment landed) - SignupPage / LoginPage / PublicLanding CE port (cards #2691 #2692 #2693 ready-for-dev — currently light-theme Bootstrap, mismatched with rest of app) - Pricing.md Decision 3 (5 TBD features) — operator follow-up to unblock docs PR #2694 - BOOTSTRAP_TOKEN_SIGNING_KEY vault write (#2699)

Schedule risk: none new. Yesterday's prod outage RCA'd + permanent fix shipped. CF Access perimeter posture locked at [[project_cf_access_perimeter_2026_05_21]].

Recommendation today: confirm signup, dispatch SignupPage / LoginPage / PublicLanding CE-port wave (3 parallel ux-polisher agents), close the four launch-gating cards above. T-1 stays viable.