Preserve wedding guest sessions across deploys

[kvz]

Why

The real wedding-demo user test found broken private images in an existing guest session while fresh CI guests passed. Ordinary backend deploys generated a new JWT signing key and replaced JWKS. Two unexpired browser tokens no longer verified against the current public keys; private-media authorization returned HTTP 500.

Changes

• Preserve a validated existing signing-key/JWKS pair in production and previews. Ordinary deployment is no longer key rotation.
• Initialize only when both variables are absent, in one supported Convex CLI stdin batch without --force. Refuse incomplete/malformed/mismatched keys and an implicit seed-key rotation.
• Keep secret values in memory/stdin; capture and sanitize failed CLI output. An ambiguous write is not blindly retried.
• Accept the single-line PKCS8 PEM produced by Convex Auth's official setup without rewriting its stored representation; retain the previous empty-seed behavior.
• Document the partial-deployment boundary and correct the README's obsolete upload-action uploadCode argument: invitation codes belong to sign-in.

Validation

• yarn check: 285 tests pass, no type errors. Tests use real RSA signatures with a local mocked CLI; existing sessions remain verifiable across redeployment, malformed/partial/mismatched inputs refuse, secret output is suppressed, and batch initialization/ambiguous outcomes are covered.
• Council review identified single-line PEM, interrupted initialization and empty-seed regressions. Each new regression failed before the fix; all pass now. Final council output was partial because its Codex transport failed; the independent final Opus 5.5 review passed and confirmed the installed CLI's batch/serialization behavior. No review result is being claimed for that failed reviewer.
• Reconciled nonblocking follow-ups: keep the existing deploy-before-configuration order (deployment names, including new previews, come from the deploy result), explicitly document partial effects, and fail/re-read rather than adding an automatic auth-write retry loop. More detailed safe diagnostics can follow if operational evidence warrants them; stdout/stderr and invalid key values remain suppressed. Existing source comments and CONTRIBUTING state these boundaries.
• Independent Opus 5.5 defensive review found no auth-policy bypass/secret exposure blocker in this narrow deploy-script change. No production security probes, permission widening, session-lifetime extension or API2 production change.
• Merged as dea765aad6038400b5d9bdf8fa32f90de97fd554. Main CI / production deployment 38801367700 passed, including real private-Storage upload, Range, seek, original fidelity and denial. The production backend logged “Deployment auth keys preserved.” at 20:24:19Z; the preview also exercised first initialization and a later preserve path.
• Actual same-guest deployment acceptance passed at 20:28:45Z: the guest established at 20:07 remained signed in and loaded private gallery/viewer images; public JWKS SHA stayed unchanged and the original unexpired JWT remained valid. The browser normally refreshed its token, so a separate no-JavaScript API context additionally sent the original pre-deploy cookie: authorized redirect 307, CDN 200, 217,589 image bytes, and no JWT refresh. This is not a claim of byte-identical cookies. An initial overstrict cookie-equality assertion is retained as a test-harness negative, not a production failure.
• Final loaded-state Chromium interactions at 20:35 passed direct video seek and image → keyboard navigation → settled close → video seek, mobile image viewing, upload-modal focus, Dutch localization and the native icon (200), with no console/page errors. Media aborts during seek/close were recorded. A preceding rapid-sequence run hit a five-second video poll timeout; its gallery/no-viewer screenshot and negative are retained, cause unproved, rather than calling the entire exploratory pass error-free. Latest three-sample lab medians: desktop cold 0.852 s / warm 0.840 s, simulated mobile 5.348 s, CLS 0, cold JavaScript about 333 kB; not field p75/INP.
• Opus 5.5's final read-only reconciliation of the post-deploy browser artifacts: READY, no observed release blocker; original broken-image/key-rotation and icon findings closed for the tested scenario. The rapid video interaction remains inconclusive, and mobile loading / copyable-starter DX remain follow-up work, not silently marked fixed.

Already-invalid tokens are not repaired by preserving the current key; affected guests may need to re-enter. The fix prevents ordinary future deploys from invalidating working sessions. Mobile performance and starter simplification findings remain separate proposals in the single DAM living plan.

_{🤖 Claimed by kvz on studio1/convex since 2026-10-15 · resume: codex resume 019fa2ee-f994-79d0-9d50-071bf2cb7ad6}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
convex	Ready	Preview	Oct 15, 2026 8:18pm UTC