Admin operations

Live stack readiness

Static launch-control view for the current Supabase and Cloudflare buildout. Values are sourced from the live-platform runbook and secret inventory, with no browser-side secret or platform fetches.

Readiness model2026-05-10 snapshotNext refresh: after Wrangler secret list, DNS attach, and gateway smoke.
Gateway dataModelive reads
cnapp RLSClean
Worker secrets10 set
Custom domainsNot attached
Match rows38 live-read
Shared DBException
Backfilled cnapp rows1,215
Missing runtime inputs10
Custom hostnames attached0 / 3
Non-cnapp RLS findingsShared DB warning

Live-read gate

API gateway

Watch

Public read paths are configured to use the Supabase publishable key against RLS-protected cnapp tables. Match reads return live dataMode with the current public row set.

Staging URL
cnapp-api-gateway.facilit8.workers.dev
HTTP smoke
matches 38 live-read rows
dataMode
live for seeded matches, games, tickets
News fallback
mock response; 0 public article rows
Live read tables
matches, innings, balls, quizzes, news, tickets
NextSmoke Workers.dev and final domains after each deploy; add Turnstile before protected browser-write flows ship.

Shared project status

Supabase cnapp

Watch

cnapp schema objects are applied and RLS coverage is clean inside the app-owned namespace.

Project
Cricket Namibia shared Supabase project
Region
Central Europe (Zurich)
cnapp tables
64
RLS disabled on cnapp tables
0
cnapp tables without policies
0
NextKeep tracking the approved CN-DEC-004 production-isolation exception until a dedicated project or new decision exists.

Resources and DNS

Cloudflare edge

Blocked

KV, R2, queues, Workers, and Pages staging surfaces exist; DNS and custom hostnames are still not cut over.

Pages
cnapp-marketing, cnapp-app, cnapp-admin
Workers
api-gateway, cricclubs-sync, ticketing-bridge, push-fanout
Custom domains
None attached
DNS record read
Blocked by token permissions
NextGrant DNS read/edit permission, attach api/app/admin hostnames, then rerun public smoke tests on final domains.

Probe active

Source sync

Watch

Read models have live public rows and the scheduled Worker now warms a larger full-scope match window for busy Cricket Namibia club days.

Matches
38
Balls
1,035
Players
92
News articles
0
Recurring sync
50-match warm window; runtime flag still must be verified
NextVerify the scheduled write flag and cron logs after deploy, then compare same-day CricClubs counts against gateway rows.

Supabase cnapp row counts

Backfilled read models

Manual
cnapp_matches38
cnapp_match_innings16
cnapp_match_balls1,035
cnapp_players92
cnapp_teams7
cnapp_tournaments1
cnapp_venues11
cnapp_quizzes2
cnapp_ticket_listings13
cnapp_news_articles0

Backfill status

Source freshness

Migrations 0001-0004Applied
Read-model backfillApplied 2026-05-10
Worker scheduled sync50-match warm window in code; runtime flag needs smoke
Source credential confirmationCricClubs ready
News read model0 rows

Worker runtime gaps

Names only, no values

Blocked

cnapp-api-gateway

Public reads live; signing/service role installed

  • TURNSTILE_SECRET_KEY

cnapp-cricclubs-sync

ready_for_live_writes; scheduled write coverage widened

  • Runtime cron log verification on final schedule

cnapp-ticketing-bridge

Display-only pending

  • TICKETING_CHECKOUT_BASE_URL
  • TICKETING_BRIDGE_SECRET
  • TICKETING_API_BASE_URL

cnapp-push-fanout

Provider routing pending

  • APNS_KEY_ID
  • APNS_TEAM_ID
  • APNS_BUNDLE_ID
  • APNS_PRIVATE_KEY
  • FCM_SERVICE_ACCOUNT_JSON

DNS and custom domains

Cutover blockers

api.cricket.com.naNo custom domain attached
app.cricket.com.naNo custom domain attached
admin.cricket.com.naNo custom domain attached
DNS API accessRead was blocked by token permissions
Pages stagingcnapp-admin.pages.dev is deployed

Launch blockers

Before public readiness

Final-domain gateway smoke missingBlocks public hostname launch
Worker runtime inputs are partialBlocks sync writes, push providers, protected writes, ticket bridge
DNS/custom-domain cutover missingBlocks public hostname smoke
Scheduled source writes need smokeCron logs must prove busy days sync fully
Shared DB has non-cnapp RLS findingsOwning systems must remediate outside this app repo

Operating boundaries

What this dashboard must not hide