Mind on Start + Void

apps/mind has native TanStack Start + Vite+ + Void source beside its Next build, generated by the start-bridge codemod. The Next build and vercel.json are untouched, so the current deployment keeps serving until the route is flipped. vercel-production-mind.yaml still deploys the Next app.

Worker

Staging candidate: the staging Worker name (workers_dev off, TUTURUUU_NOINDEX=1). A production Worker (tuturuuu-mind, workers_dev and preview_urls off, TUTURUUU_NOINDEX=0) is created by the cutover PR; nothing here attaches a route.
Entry: apps/mind/cloudflare/worker.ts; Wrangler config is emitted by void into dist.
Host: mind.tuturuuu.com. Root-only: mountHosts is empty and unknownHost is reject, so tuturuuu.com/mind and any other host answer 404 before app code runs.
Binding: ASSETS (static output, run_worker_first).
Variables (names): TUTURUUU_NOINDEX, optional INTERNAL_WEB_API_ORIGIN (default https://tuturuuu.com).
Secrets (names, set in the Worker, never in the repo): NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY, SUPABASE_SECRET_KEY, and TUTURUUU_APP_COORDINATION_SECRET. Configure service binding ABUSE_GUARD to tuturuuu-abuse-guard, secret ABUSE_GUARD_KEY_PEPPER, and text variable ABUSE_GUARD_FAMILIES=proxy; ABUSE_GUARD_TIMEOUT_MS is optional. Upstash is not required. Compare the remaining Worker secrets with the Vercel project environment list before the flip.
Optional variables read by the source: MIND_APP_URL, WEB_APP_URL.

Build and qualification

bun install --frozen-lockfile --ignore-scripts
bun turbo:local run build --filter=@tuturuuu/mind^... --concurrency=2
bun scripts/ci/generate-build-metadata.ts
bun run --cwd apps/mind routes:check
bun run --cwd apps/mind type-check:cloudflare
bun run --cwd apps/mind build:cloudflare
CI=true CI_SOURCE_SHA=$(git rev-parse HEAD) bun run --cwd apps/mind test:runtime

mind-cloudflare.yaml runs the same steps in CI. test:runtime starts the emitted Worker in workerd with synthetic secrets and no network egress: build identity, root host, apex rejection, unknown paths, and the signed-out redirect through the app-owned cloudflare/auth-redirect.runtime.mjs fixture (8 checks). The app proxy admits anonymous GET/HEAD /api/build-info without an app-session refresh, so deployment verification gets 200 instead of 401.

Smoke checks after the route is attached

curl -sI https://mind.tuturuuu.com/api/build-info   # 200, JSON, no-store
curl -sI https://mind.tuturuuu.com/                 # 307 to /login for a signed-out client
curl -sI https://mind.tuturuuu.com/login            # renders, no 5xx
curl -sI https://tuturuuu.com/mind        # 404 (root-only app)

Every page redirects signed-out users to login, so a signed-in check needs a test session and belongs to the release owner. No smoke request may return 5xx.

Rollback

Before the flip, record the current production Vercel deployment id for the app (the repo does not store it) and the DNS records and TTLs for mind.tuturuuu.com in the release record.
Roll back by detaching the Worker route or restoring the captured DNS records to the recorded deployment. vercel-production-mind.yaml still deploys the Next app.
Rerun the smoke checks against the previous origin.

Rolling back touches no database rows and no migrations. Route, DNS and deployment changes belong to the release owner.

Build

Platform

Components

Worker

Build and qualification

Smoke checks after the route is attached

Rollback

​Worker

​Build and qualification

​Smoke checks after the route is attached

​Rollback

Worker

Build and qualification

Smoke checks after the route is attached

Rollback