# ReviewRouter hosted beta Blueprint.
# Customer code review still runs inside customer GitHub Actions. These services
# are the control plane only: dashboard, webhooks, config/OIDC, health, jobs.
# Native builds attempt Prisma network isolation, then use a minimal child
# environment if unsupported. CI and self-hosted builds require isolation;
# the owner-approved native Render fallback still permits network access.

services:
  - type: web
    name: reviewrouter-release-control
    runtime: node
    plan: starter
    region: frankfurt
    branch: main
    buildCommand: npm install --prefix .render-tooling --no-package-lock --ignore-scripts --no-audit --no-fund pnpm@10.33.0 && export PATH="$PWD/.render-tooling/node_modules/.bin:$PATH" && test "$(pnpm --version)" = 10.33.0 && NODE_ENV=development node scripts/install-private-dependencies.mjs --frozen-lockfile && env -u SUBSCRIPTION_RUNTIME_DEPLOY_KEY_B64 -u GIT_SSH_COMMAND -u GIT_SSH_VARIANT node scripts/generate-prisma-offline.mjs && pnpm build
    startCommand: PATH="$PWD/.render-tooling/node_modules/.bin:$PATH" env -u SUBSCRIPTION_RUNTIME_DEPLOY_KEY_B64 HOST=0.0.0.0 pnpm release-control:start
    healthCheckPath: /health
    autoDeployTrigger: off
    envVars:
      - key: NODE_VERSION
        value: 26.11.1
      - key: PORT
        value: 10000
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_CONTROL_DATABASE_URL
        sync: false
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_PROVIDER_DATABASE_URL
        sync: false
      - key: REVIEW_ROUTER_RELEASE_CONTROL_TOKEN_SHA256
        sync: false
      - key: REVIEW_ROUTER_PROVIDER_AUTHORITY_TOKEN_SHA256
        sync: false
      - key: REVIEW_ROUTER_RELEASE_COMMIT_SHA
        sync: false
      - key: REVIEW_ROUTER_RELEASE_IMAGE_DIGEST
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_PERMIT_INSTALLER_DATABASE_URL
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_RECEIPT_READER_DATABASE_URL
        sync: false
      # Independent database-generation and routine-body trust roots. These
      # values come from the signed rollout evidence, never from either URL.
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_SYSTEM_IDENTIFIER
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_TARGET_SYSTEM_IDENTIFIER
        sync: false
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_DATABASE_OID
        sync: false
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_DATABASE_NAME
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_TARGET_DATABASE_OID
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_TARGET_DATABASE_NAME
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_MIGRATION_MANIFEST_SHA256
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_NAMESPACE_FINGERPRINT
        sync: false
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_OWNER_ROLE
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_GUARD_ROLE
        value: reviewrouter_activation_receipt_guard
      - key: REVIEW_ROUTER_ACTIVATION_INSTALLER_BODY_SHA256
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_READER_BODY_SHA256
        sync: false
      # Compact deployment authorization for the checked-in canonical artifact.
      - key: REVIEW_ROUTER_TARGET_PREACTIVATION_CATALOG_POLICY_SHA256
        sync: false
      - key: REVIEW_ROUTER_TARGET_ACTIVATED_CATALOG_POLICY_SHA256
        sync: false

  - type: web
    name: reviewrouter-release-witness
    runtime: node
    plan: starter
    region: frankfurt
    branch: main
    buildCommand: npm install --prefix .render-tooling --no-package-lock --ignore-scripts --no-audit --no-fund pnpm@10.33.0 && export PATH="$PWD/.render-tooling/node_modules/.bin:$PATH" && test "$(pnpm --version)" = 10.33.0 && NODE_ENV=development node scripts/install-private-dependencies.mjs --frozen-lockfile && env -u SUBSCRIPTION_RUNTIME_DEPLOY_KEY_B64 -u GIT_SSH_COMMAND -u GIT_SSH_VARIANT node scripts/generate-prisma-offline.mjs && pnpm build
    startCommand: PATH="$PWD/.render-tooling/node_modules/.bin:$PATH" env -u SUBSCRIPTION_RUNTIME_DEPLOY_KEY_B64 HOST=0.0.0.0 pnpm release-witness:start
    healthCheckPath: /health
    autoDeployTrigger: off
    envVars:
      - key: NODE_VERSION
        value: 26.11.1
      - key: PORT
        value: 10000
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_WITNESS_DATABASE_URL
        sync: false
      - key: REVIEW_ROUTER_RELEASE_WITNESS_TOKEN_SHA256
        sync: false
      - key: REVIEW_ROUTER_RELEASE_WITNESS_RENDER_READ_TOKEN
        sync: false
      - key: REVIEW_ROUTER_RELEASE_COMMIT_SHA
        sync: false
      - key: REVIEW_ROUTER_RELEASE_IMAGE_DIGEST
        sync: false
      - key: REVIEW_ROUTER_TARGET_PREACTIVATION_CATALOG_POLICY_SHA256
        sync: false
      - key: REVIEW_ROUTER_TARGET_ACTIVATED_CATALOG_POLICY_SHA256
        sync: false
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_SYSTEM_IDENTIFIER
        sync: false
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_DATABASE_OID
        sync: false
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_DATABASE_NAME
        sync: false
      - key: REVIEW_ROUTER_SOURCE_RELEASE_WITNESS_DATABASE_URL
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_RECEIPT_READER_DATABASE_URL
        sync: false
      - key: REVIEW_ROUTER_RELEASE_WITNESS_GITHUB_READ_TOKEN
        sync: false
      - key: REVIEW_ROUTER_RELEASE_WITNESS_SIGNING_KEY_ID
        sync: false
      - key: REVIEW_ROUTER_RELEASE_WITNESS_SIGNING_PRIVATE_KEY_PEM
        sync: false
      - key: REVIEW_ROUTER_RELEASE_CONTROL_REPOSITORY
        sync: false
      - key: REVIEW_ROUTER_RELEASE_CONTROL_WORKFLOW_PATH
        value: .github/workflows/private-network-pg17-rollout.yml
      - key: REVIEW_ROUTER_SOURCE_RENDER_DATABASE_ID
        sync: false
      - key: REVIEW_ROUTER_SOURCE_DATABASE_SYSTEM_IDENTIFIER
        sync: false
      - key: REVIEW_ROUTER_SOURCE_DATABASE_OID
        sync: false
      - key: REVIEW_ROUTER_SOURCE_DATABASE_NAME
        sync: false
      - key: REVIEW_ROUTER_SOURCE_RECOVERY_WITNESS_SHA256
        sync: false
      - key: REVIEW_ROUTER_TARGET_RENDER_DATABASE_ID
        sync: false
      - key: REVIEW_ROUTER_TARGET_RECOVERY_WITNESS_SHA256
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_TARGET_SYSTEM_IDENTIFIER
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_TARGET_DATABASE_OID
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_TARGET_DATABASE_NAME
        sync: false
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_CATALOG_FINGERPRINT
        sync: false
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_CATALOG_VERIFIER
        sync: false
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_MIGRATION_MANIFEST_IDENTITY
        sync: false
      - key: REVIEW_ROUTER_RELEASE_AUTHORITY_OWNER_ROLE
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_GUARD_ROLE
        value: reviewrouter_activation_receipt_guard
      - key: REVIEW_ROUTER_ACTIVATION_MIGRATION_MANIFEST_SHA256
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_NAMESPACE_FINGERPRINT
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_INSTALLER_BODY_SHA256
        sync: false
      - key: REVIEW_ROUTER_ACTIVATION_READER_BODY_SHA256
        sync: false

  - type: web
    name: reviewrouter-web
    runtime: image
    plan: starter
    region: frankfurt
    image:
      # Release tooling replaces this example with an exact @sha256 digest.
      # Mutable tags are forbidden for production runtime deployment.
      url: ghcr.io/777genius/review-router-saas-runtime@sha256:0000000000000000000000000000000000000000000000000000000000000000
    healthCheckPath: /
    # Runtime deploys are explicit and follow the exclusive migration evidence gate.
    autoDeployTrigger: off
    maxShutdownDelaySeconds: 60
    envVars:
      - fromGroup: reviewrouter-hosted-beta
      - key: NODE_VERSION
        value: 26.11.1
      - key: PORT
        value: 10000
      - key: REVIEW_ROUTER_RUNTIME_ROLE
        value: web
      - key: DATABASE_URL
        # Provision reviewrouter_web as a non-owner runtime role, then enter
        # its private URL during Blueprint sync. Never use the database owner.
        sync: false
      - key: REVIEW_ROUTER_CODEX_EFFECT_AUTHORITY_DATABASE_URL
        # Isolated signer login; it has EXECUTE only on the authority signer.
        sync: false

  - type: web
    name: reviewrouter-api
    runtime: image
    plan: starter
    region: frankfurt
    image:
      url: ghcr.io/777genius/review-router-saas-runtime@sha256:0000000000000000000000000000000000000000000000000000000000000000
    healthCheckPath: /ready
    # Runtime deploys are explicit and follow the exclusive migration evidence gate.
    autoDeployTrigger: off
    maxShutdownDelaySeconds: 60
    envVars:
      - fromGroup: reviewrouter-hosted-beta
      - key: NODE_VERSION
        value: 26.11.1
      - key: PORT
        value: 10000
      - key: REVIEW_ROUTER_RUNTIME_ROLE
        value: api
      - key: DATABASE_URL
        # Provision reviewrouter_api as a non-owner runtime role.
        sync: false
      - key: REVIEW_ROUTER_CODEX_EFFECT_AUTHORITY_DATABASE_URL
        # Isolated signer login; it has no direct rotating-table privileges.
        sync: false
      # GitLab integration is API-only. Runtime/model credentials still stay in
      # the user's GitLab CI/CD variables.
      - key: REVIEW_ROUTER_GITLAB_API_TOKEN
        sync: false
      - key: REVIEW_ROUTER_GITLAB_API_BASE_URL
        sync: false
      - key: REVIEW_ROUTER_GITLAB_INSTALLER_TOKEN
        sync: false
      - key: REVIEW_ROUTER_GITLAB_INSTALLER_ADMIN_TOKEN
        sync: false
      - key: REVIEW_ROUTER_GITLAB_STATIC_REPOSITORIES_JSON
        sync: false
      - key: REVIEW_ROUTER_GITLAB_OIDC_ISSUER
        sync: false
      - key: REVIEW_ROUTER_GITLAB_OIDC_JWKS_URL
        sync: false
      - key: REVIEW_ROUTER_GITLAB_OIDC_AUDIENCE
        value: reviewrouter
      - key: REVIEW_ROUTER_GITLAB_RUNTIME_IMAGE
        value: ghcr.io/777genius/review-router-gitlab-runtime:v1

  - type: worker
    name: reviewrouter-worker
    runtime: image
    plan: starter
    region: frankfurt
    image:
      url: ghcr.io/777genius/review-router-saas-runtime@sha256:0000000000000000000000000000000000000000000000000000000000000000
    # Runtime deploys are explicit and follow the exclusive migration evidence gate.
    autoDeployTrigger: off
    maxShutdownDelaySeconds: 120
    envVars:
      - fromGroup: reviewrouter-hosted-beta
      - key: REVIEW_ROUTER_RUNTIME_ROLE
        value: worker
      - key: NODE_VERSION
        value: 26.11.1
      - key: DATABASE_URL
        # Provision reviewrouter_worker as a non-owner runtime role.
        sync: false

databases:
  - name: reviewrouter-db
    postgresMajorVersion: "17"
    databaseName: review_router
    # This CREATEROLE owner credential is used only to converge cluster roles.
    # Migrations connect separately as the NOCREATEROLE release role.
    user: reviewrouter_role_bootstrap
    region: frankfurt
    plan: basic-256mb
    ipAllowList: []

envVarGroups:
  - name: reviewrouter-hosted-beta
    envVars:
      - key: NODE_ENV
        value: production
      - key: AUTH_TRUST_HOST
        value: "true"
      - key: AUTH_SECRET
        generateValue: true
      - key: REVIEW_ROUTER_ACTION_SESSION_SECRET
        generateValue: true
      - key: REVIEW_ROUTER_ENABLE_DASHBOARD_MUTATIONS
        value: "1"
      - key: REVIEW_ROUTER_ENABLE_WORKFLOW_PROVISIONING
        value: "1"
      - key: REVIEW_ROUTER_DISABLE_WORKFLOW_PROVISIONING
        value: "0"
      - key: REVIEW_ROUTER_DISABLE_ACTION_CONTROL_PLANE
        value: "0"
      - key: REVIEW_ROUTER_ACTION_REF
        sync: false
      # Rotating workflows are durably attested to an immutable Action release.
      # Keep the primary and bounded A -> B overlap separate from the mutable
      # general workflow channel above.
      - key: REVIEW_ROUTER_CODEX_ROTATING_ACTION_REF
        sync: false
      - key: REVIEW_ROUTER_CODEX_ROTATING_ALLOWED_ACTION_REFS
        sync: false
      # Copy this exact, inseparable tuple from the digest-verified installer
      # descriptor attached to the immutable release. Never use a branch URL.
      - key: REVIEW_ROUTER_CODEX_ROTATING_INSTALLER_URL
        sync: false
      - key: REVIEW_ROUTER_CODEX_ROTATING_INSTALLER_VERSION
        sync: false
      - key: REVIEW_ROUTER_CODEX_ROTATING_INSTALLER_SHA256
        sync: false
      # Stable secret-manager value; Blueprint sync must never rotate it.
      - key: REVIEW_ROUTER_TOKEN_ENCRYPTION_KEY
        sync: false
      # One operator-managed value is shared by every database writer. It is
      # fingerprinted at runtime and must never be emitted to logs.
      - key: REVIEW_ROUTER_DATABASE_RECOVERY_WITNESS
        sync: false
      # Staged together with the witness during a generation cutover. Every
      # runtime role verifies this fingerprint and records a DB-bound proof
      # before its process starts. Neither value may be logged.
      - key: REVIEW_ROUTER_EXPECTED_RECOVERY_WITNESS_SHA256
        sync: false
      - key: REVIEW_ROUTER_RUNTIME_ROLLOUT_ID
        sync: false
      - key: REVIEW_ROUTER_RUNTIME_RELEASE_COMMIT_SHA
        sync: false
      - key: REVIEW_ROUTER_RUNTIME_ROLLOUT_STARTED_AT
        sync: false
      - key: REVIEW_ROUTER_LIVE_CANARY_TOKEN_SHA256
        sync: false
      - key: REVIEW_ROUTER_ACTION_OIDC_AUDIENCE
        value: reviewrouter
      - key: REVIEW_ROUTER_ENABLE_CODEX_ROTATING_OAUTH
        value: "0"
      - key: REVIEW_ROUTER_CODEX_ROTATING_NEW_WORK_ADMISSION_ENABLED
        value: "0"
      - key: REVIEW_ROUTER_CODEX_ROTATING_SETUP_ISSUANCE_ENABLED
        value: "0"
      # Revision-aware review v2 deploys additively. Writer capabilities are
      # enabled only after release attestation and an explicit cohort cutover.
      - key: REVIEW_ROUTER_REVIEW_V2_RUN_CONTROL_ENABLED
        value: "0"
      - key: REVIEW_ROUTER_REVIEW_V2_WORKER_ENABLED
        value: "0"
      - key: REVIEW_ROUTER_PROGRESS_PROJECTION_CAPTURE
        value: "0"
      - key: REVIEW_ROUTER_PROGRESS_FILE_COVERAGE
        value: "0"
      - key: REVIEW_ROUTER_HOSTED_PROGRESS_COMMENT_WRITES
        value: "0"
      - key: REVIEW_ROUTER_PROGRESS_REPOSITORIES
        value: ""
      - key: REVIEW_ROUTER_REVIEW_V2_CAPABILITY_ACTIVE_KEY_ID
        sync: false
      - key: REVIEW_ROUTER_REVIEW_V2_CAPABILITY_KEYS_JSON
        sync: false
      - key: REVIEW_ROUTER_REVIEW_RUN_AUTHORIZATION_ACTIVE_KEY_ID
        sync: false
      - key: REVIEW_ROUTER_REVIEW_RUN_AUTHORIZATION_KEYS_JSON
        sync: false
      - key: REVIEW_ROUTER_REVIEW_V2_PRODUCER_RELEASE_ATTESTATIONS_JSON
        sync: false
      - key: REVIEW_ROUTER_REVIEW_V2_PROVIDER_VOTE_LANES_JSON
        sync: false
      - key: REVIEW_ROUTER_REVIEW_V2_PROJECTION_POLICY_VERSION
        value: "review-projection-policy.v5-t0"
      # Cross-revision context reuse is fail-closed. Session and replay keys are
      # API-only; gateway identity is bound to each immutable producer release.
      - key: REVIEW_ROUTER_REVIEW_V2_CONTEXT_SESSION_SECRET_BASE64
        sync: false
      - key: REVIEW_ROUTER_REVIEW_V2_CONTEXT_REPLAY_ACTIVE_KEY_ID
        sync: false
      - key: REVIEW_ROUTER_REVIEW_V2_CONTEXT_REPLAY_KEYS_JSON
        sync: false
      - key: REVIEW_ROUTER_REVIEW_V2_OPERATOR_CREDENTIAL_SHA256
        sync: false
      - key: REVIEW_ROUTER_REVIEW_CONFIG_OPERATOR_CREDENTIAL_SHA256
        sync: false
      - key: REVIEW_ROUTER_DEFAULT_MODEL
        value: gpt-5.6-sol
      - key: REVIEW_ROUTER_DEFAULT_EFFORT
        value: xhigh
      - key: REVIEW_ROUTER_OUTBOX_BATCH_SIZE
        value: "25"
      - key: REVIEW_ROUTER_OUTBOX_PROCESSING_STALE_MS
        value: "900000"
      - key: REVIEW_ROUTER_WORKER_IDLE_MS
        value: "5000"
      - key: REVIEW_ROUTER_WORKER_BUSY_MS
        value: "250"
      - key: REVIEW_ROUTER_WORKER_ERROR_MS
        value: "5000"
      - key: REVIEW_ROUTER_MAX_REPOSITORIES_PER_SYNC
        value: "250"
      - key: REVIEW_ROUTER_WEB_URL
        value: https://reviewrouter.org
      - key: REVIEW_ROUTER_API_URL
        value: https://api.reviewrouter.org
      - key: REVIEW_ROUTER_PUBLIC_API_URL
        value: https://api.reviewrouter.org
      - key: REVIEW_ROUTER_PUBLIC_WEB_URL
        value: https://reviewrouter.org
      - key: REVIEW_ROUTER_HOSTED_WEB_URL
        value: https://reviewrouter.org
      - key: REVIEW_ROUTER_HOSTED_API_URL
        value: https://api.reviewrouter.org
      - key: NEXTAUTH_URL
        value: https://reviewrouter.org
      # GitHub App OAuth/client/webhook credentials. Do not commit real values.
      - key: GITHUB_APP_ID
        sync: false
      - key: GITHUB_APP_CLIENT_ID
        sync: false
      - key: GITHUB_APP_CLIENT_SECRET
        sync: false
      - key: GITHUB_APP_SLUG
        sync: false
      - key: GITHUB_APP_PRIVATE_KEY
        sync: false
      - key: GITHUB_WEBHOOK_SECRET
        sync: false
      # Compatibility aliases kept for hosted readiness checks and future split
      # GitHub OAuth support.
      - key: GITHUB_CLIENT_ID
        sync: false
      - key: GITHUB_CLIENT_SECRET
        sync: false