Deploy and operations

Deploy contract

npm run api:migrate && tsx server/index.ts

Every production boot applies pending SQL migrations in server/migrations/ before the API starts. Migration file reads are constrained to the resolved migrations directory.

Smoke check

npm run smoke:prod

The smoke checks API health, DB health, readiness, root HTML, dashboard fallback, auth protection for provider/queue endpoints, and CORS allow/block behavior.

Readiness endpoints

• GET /api/health: cheap process health.
• GET /api/db/health: Postgres connectivity.
• GET /api/ready: Postgres and media-storage readiness.

Worker loop

The in-process worker handles queued SMS/iMessage provider jobs, email, calls, webhook deliveries, and workflow runs. Rows are claimed with FOR UPDATE SKIP LOCKED and retried with backoff.

Queue triage

Workspace owners can inspect provider readiness and outbound queues, fix missing provider config, then retry individual items or trigger an owner-only worker pass.

Security scans

Use Rafter for GitHub-backed security scans after hardening changes and local secret scans before commits. Treat a Rafter finding as a source-to-sink question first: fix real issues, document false positives only after tracing the path.

rafter run --repo InventorySheets/homeforce-test1 --branch main --format md --mode fast
rafter secrets .

BlueGate messaging triage

1. Confirm the provider has the HomeForce endpoint secret, integration credentials, and BlueGate Partner V3 token where existing group chat actions need Partner V3.
2. Confirm the configured BlueGate send URL is an authenticated provider/integration endpoint, not the public HomeForce webhook, unless a signing layer is adding BlueGate timestamped HMAC headers.
3. For direct threads, verify a provider thread like any;-;+15555555555.
4. For new group starts, confirm the selected contacts have phone handles and BlueGate returns/stores a real group chat GUID after handoff.
5. For existing group follow-ups, verify the provider thread is the observed group chat GUID.
6. Confirm inbound group payloads include isGroup, chatGuid, and participants.

Request tracing

Every response includes X-Request-Id. Pair the request ID with the approximate time when searching Railway logs.