Infrastructure Validation Report

Anthropic claude-sonnet-4-6

• ANTHROPIC_API_KEY set in Vercel (production + preview) and Railway
• ANTHROPIC_MODEL set to claude-sonnet-4-6
• No direct key validation endpoint — keys confirmed by env var presence only

Resend Email

• RESEND_API_KEY set in Vercel (production + preview)
• RESEND_FROM_EMAIL set in Vercel (production + preview)
• Used for admin notifications when interviews complete

Voyage AI Embeddings Low Embeddings

• VOYAGE_API_KEY set in both environments. Model: voyage-3
• Only 1 document chunk has embeddings out of the entire document_chunks table
• 45 documents in storage but embeddings are not populated — may need reprocessing

Help System Status

• /api/help/status returns: 24 documents, 277 chunks, database connected, indexing complete
• Direct DB query: 43 help_documents, 238 help_chunks
• /api/help/stats correctly returns 403 (requires admin auth)
• Reindex endpoints available: POST /api/help/index-docs (admin), POST /api/help/index-docs-webhook (API key)
• HELP_REINDEX_API_KEY set in Vercel env vars

Note: API reports 24 docs / 277 chunks vs DB shows 43 docs / 238 chunks. API may filter active documents or use caching.

Backend Health

• /health returns: status “healthy”, database “connected”, version “1.0.0”
• Swagger UI loads at /docs — 116 API endpoints registered
• OpenAPI spec accessible at /openapi.json

CORS Configuration

• Allows superassistant-mvp.vercel.app — confirmed via response headers
• Blocks unauthorized origins — evil-site.com gets no access-control-allow-origin header
• Vercel preview regex: superassistant-.*-charlie-fullers-projects\.vercel\.app
• Preflight OPTIONS returns 200

Security Headers & Auth

• X-Frame-Options: DENY
• X-Content-Type-Options: nosniff
• Strict-Transport-Security: max-age=31536000; includeSubDomains
• access-control-allow-credentials: true
• JWT: ES256 via JWKS, audience authenticated, HS256 fallback

Schedulers (Railway Logs)

• Google Drive Sync Scheduler: RUNNING — check interval 5 minutes Started at 2026-03-08 16:14:55 UTC
• Database Backup Scheduler: RUNNING — daily at 02:00 UTC Started at 2026-03-08 16:14:55 UTC
• slowapi: No logs mentioning slowapi errors. Rate limiting configured in code but no runtime issues detected.

Authentication

• Project: ycyrirjplwpjezlerzig.supabase.co
• Auth provider: email (11 users, all emails confirmed)
• JWT: ES256 with JWKS auto-detection, HS256 fallback via SUPABASE_JWT_SECRET
• Audience: authenticated
• NEXT_PUBLIC_SUPABASE_URL + NEXT_PUBLIC_SUPABASE_ANON_KEY set for all Vercel targets

OAuth & Redirect URLs

• Google Drive: /api/google-drive/oauth-callback
• Notion: /api/notion/oauth-callback
• Site URL and email templates should be verified manually in Supabase dashboard

Storage Buckets

• avatars: 2 objects
• backups: 29 objects
• documents: 45 objects
• system-instructions: 2 objects
• Total: 78 objects across 4 buckets

Embeddings & Data Action Needed

• Only 1 document chunk has a non-null embedding vector
• 45 documents uploaded but embeddings not populated — Voyage AI processing may need to be re-triggered
• 52 public tables present — all expected tables confirmed
• System instructions: 2 files in storage bucket

Build Configuration

• Framework: nextjs
• Root directory: frontend
• Node version: 22.x
• Build command: npm run build
• Install command: npm install
• Output directory: .next

Environment & Integrations

• Auto expose system envs: enabled
• Region: iad1 (US East)
• 71 environment variables configured
• Sentry integration: active (source maps + React component annotation)
• Crons: enabled (no active definitions)
• Preview deploys: active (Vercel preview regex configured)
• No vercel.json — all config via Vercel dashboard (framework auto-detected)