Drive on Start + Void

​

Worker profiles

​

Build and artifact

​

Cutover packet

​

Switch

1. Record the source SHA, the sealed artifact name and the Vercel deployment ID.
2. Provision the four secrets on tuturuuu-drive, then deploy the sealed output.
3. Verify on the Worker before attaching the route: smoke below with the Worker’s own address.
4. Attach drive.tuturuuu.com to the Worker (a proxied route in front of the still-valid Vercel origin where possible).

​

Smoke

# Anonymous protected route redirects to /login; no 5xx
curl -sI https://drive.tuturuuu.com/00000000-0000-4000-8000-000000000001 | head -5
# Login page renders
curl -s -o /dev/null -w '%{http_code}\n' https://drive.tuturuuu.com/login
# Build identity matches the accepted SHA
curl -s https://drive.tuturuuu.com/api/build-info
# Foreign host is refused
curl -s -o /dev/null -w '%{http_code}\n' -H 'Host: untrusted.invalid' https://drive.tuturuuu.com/login

​

Rollback

• Triggers: a 5xx rate above 1% or an authentication failure loop for 5 minutes, any cross-host response, or any storage permission regression.
• Action: remove the Worker route (or repoint the mapping) so drive.tuturuuu.com resolves to the recorded Vercel deployment again. Never rebuild on the rollback path.
• Data: a route rollback changes no stored files or metadata.
• Stability: keep the Vercel project and domain for 14 consecutive stable days before decommissioning, which is a separate approval.