Operate the BuildVouch pilot

This guide is for the authorised operator maintaining the BuildVouch environment.

Keep the project boundary

Use cyclotron-tech/buildvouch and the existing Lovable project. Retain its backend and connected repository. Make changes through reviewable GitHub commits and pull requests.

Configure the server

Required application settings are SUPABASE_URL and SUPABASE_PUBLISHABLE_KEY. Client builds use their VITE_ publishable equivalents. Integrations additionally require SUPABASE_SERVICE_ROLE_KEY, BUILDVOUCH_GITHUB_BINDINGS and the per-binding GitHub token variables.

Never place a service-role or private GitHub credential in a VITE_ variable. Consult the deployment runbook for the complete configuration checklist.

Apply migrations

Reconcile the migration ledger with the repository. Run the new migrations in order inside a transaction on a dedicated preview or test database. Run the deterministic database suite before applying approved production changes. Do not edit already-applied migrations.

Provision operators

Pilot owners and CMS operators use different allowlists. Add only verified identities through the authorised backend procedure. No operator is seeded automatically.

Verify before release

Run type checking, lint, domain tests, dependency/secret checks, the production build, database authorization tests and the authenticated desktop/mobile journey. Configure upstream authentication throttling and exact OAuth redirects. Demonstrate backup restoration in the intended environment.

Monitor

Review denied requests, token creation/revocation, source-sync failures, finding transitions, active incidents, expiring exceptions and approvals. Use request IDs for support; do not log bearer tokens or raw request bodies.

Recover

Revoke affected integration tokens, suspend compromised access and preserve audit evidence. Restore in a separate environment first. Forward repair schema changes; do not delete evidence to make a release appear clean.