[Programcode]

Staging now follows main by itself. Within about 5 minutes of each commit on main, a timer on the VPS applies migrations and deploys changed Edge Functions to staging, reseeds invented but realistic data, and reports the result on the commit. docs/staging.md is the one place that says how to get in.

Plan and audit: plans/2026-10-03-staging-loop.md

Split with other PRs

• ci: three-minute PR check and two previews per PR #95 (merged) owns previews pinned to staging: the VITE_SUPABASE_ENV pin, the debatelab-staging Vercel project, preview CORS and the Auth allowlists. I had my own version of this and dropped it.
• fix(e2e): start a Current Debate in the staging spec #100 (merged) owns the staging spec fix, which starts a Current Debate before adding a source. The stale spec is why Protected staging E2E had failed since 2026-09-23. Backend drift did not cause those failures.

What changes

• scripts/staging-sync.mjs refuses to run unless the Supabase CLI sees brifeyypjauyusmkptkx named debate-trainer-staging, and it refuses when SUPABASE_PROJECT_ID points anywhere else. It passes --project-ref to every CLI call. It applies pending migrations only after db push --dry-run lists exactly those files, then deploys missing, stale or wrong-JWT functions (never workspace-invites) and rechecks. It stops if staging's migration history diverges from the commit. With --report it sets a staging-sync commit status and opens, comments on or closes the issue "Staging is out of sync with main".
• ops/staging-sync/ holds a user systemd timer that fires every 5 minutes, run.sh, which keeps a dedicated clone of main and never runs npm install, and install.sh. A synced commit is rechecked hourly, so hand deploys show up as drift.
• scripts/staging/seed.mjs and fixtures.mjs create seed-admin, seed-pro, seed-trial and seed-expired, and make Adam's Google address a Pro admin. The seed-pro demo code is kept in ~/.config/debatelab/staging-access.env on the VPS. Each account gets copies of three invented debates with sources and saved results. Rows have fixed ids and are upserted, so a rerun is safe. The seed refuses to write unless the fetched keys carry staging's JWT ref. --session <account> signs agents in as any seeded account (a demo code would make it Pro), and --owner-tier moves Adam's account to trial or expired until the next seed.
• Protected staging E2E has a gate job that waits up to 20 minutes for staging-sync success on its commit and skips commits main has moved past. The browser job rechecks this on every attempt and times out after 30 minutes. run.sh holds a sync while a browser run is testing. The workflow gains statuses: read.
• staging-preview-note.yml posts one comment on any PR that touches supabase/migrations or supabase/functions. The comment says the PR's staging preview runs main's backend until merge.
• docs/staging.md is new. operations.md drops the manual sync procedure, because needing approval for every run is why staging drifted. AGENTS.md, testing.md, the docs index and the plans index now point to docs/staging.md.

Credential and blast radius

Adam chose to have the timer use the Supabase CLI token already on the VPS. That is a classic token, and it can reach production. The ref checks keep the sync on staging, but they are not a security boundary. Whoever merges to main controls the script the timer runs, and it runs within 5 minutes. The follow-up is a Supabase token scoped to staging only.

Outside the repo (done)

• Installed debatelab-staging-sync.timer on the VPS. Linger is on, and node, supabase and gh all resolve under the unit's PATH. The first run on main exited cleanly, because main doesn't have the script yet.
• Created a Vercel Protection Bypass for Automation on debatelab-staging. It is stored as VERCEL_STAGING_BYPASS in the GitHub staging environment and in the VPS access file. Without it a preview returns 302; with it the preview returns 200.
• Seeded staging twice. Both runs left 8 seeded debates and 19 seeded sources.

Verification

All checks ran locally. GitHub Actions jobs fail in 2 to 3 seconds with zero steps because the account is out of minutes, so there is no CI pass. Copilot is out of quota, so Codex (gpt-6.1-sol, high) did the reviews: five rounds, each finding checked against the code and fixed (see the commits).

On the branch, after merging main (#95, #100, #101):

• docs:check, lint, typecheck, unit tests (278), test:edge (344) and build pass at c6a90c5. At de705f8, before ci: three-minute PR check and two previews per PR #95 cut the unit suite, the full unit suite with coverage (1232), collaboration (30), edge, build and test:sw also passed. Desktop and mobile browser E2E passed at 34d2ec0 (250 passed, 6 skipped).
• The protected staging suite passes locally at 097aeb3 against synced staging (2 passed, 28.4 s, including one real AI request). It ran on port 18080 with the seeded Pro code, because the local copy of the CI code has expired.
• A real staging-sync.mjs --report run outside an agent environment deployed 13 functions to staging, rechecked, and set staging-sync to success. The code was byte-identical to main, which the ci: three-minute PR check and two previews per PR #95 thread had already deployed. This branch's merge commit dated the functions as changed.
• The PR's debatelab-staging Vercel preview works on a phone viewport. Every request went to staging, the seeded Pro sign-in worked, and the seeded debate showed (screenshots and video in the comments).
• A real run with SUPABASE_PROJECT_ID set to production is refused with exit code 2, and with --report the refusal sets a failed status and opens the drift issue.
• Drift-reporting drills on PR commits opened and closed the issue. The duplicates Staging is out of sync with main #102 and Staging is out of sync with main #103 came from GitHub's search lag. The script now lists issues instead of searching. Staging is out of sync with main #104 and Staging is out of sync with main #106 were drills.
• The timer is installed. Linger is on, and its GitHub queries work under systemd.
• Staging Auth has Google enabled, the staging hosts are allowlisted, and Adam's seeded account is email-confirmed.

Not yet proven:

• That a merge to main syncs staging with nobody touching it. This PR's merge is the first test (status plus reseed). The next merge that changes Edge Functions proves the deploy step.
• Adam's own Google sign-in on staging. Only Adam can test it.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Oct 3, 2026 7:37am UTC
debatelab-staging	Ready	Preview	Oct 3, 2026 7:37am UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Next included review available in 24 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Free
• Run ID: 9db93e42-4eb8-4b9a-8dfd-a55fafab841a

📥 Commits

Reviewing files that changed from the base of the PR and between f511b29 and e8282df.

📒 Files selected for processing (17)

• .github/workflows/staging-e2e.yml
• .github/workflows/staging-preview-note.yml
• AGENTS.md
• docs/README.md
• docs/operations.md
• docs/staging.md
• docs/testing.md
• ops/staging-sync/debatelab-staging-sync.service
• ops/staging-sync/debatelab-staging-sync.timer
• ops/staging-sync/install.sh
• ops/staging-sync/run.sh
• plans/2026-10-03-staging-loop.md
• plans/README.md
• scripts/staging-sync.mjs
• scripts/staging/fixtures.mjs
• scripts/staging/seed.mjs
• src/test/scripts/staging-sync.test.ts

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[Programcode]

Seeded staging, driven through a local build pinned to staging (VITE_STAGING_PREVIEW). I signed in on the real login page with the seeded Pro demo code. Recording started after sign-in, so the code doesn't appear. The debatelab-staging Vercel preview gets the same pin once #95 merges.

Trial and expired accounts, signed in with seed.mjs --session, keep their plans.

seeded-desktop.webm

seeded-mobile.webm

[Programcode]

The real PR preview works on a phone viewport (Pixel 7). This is debatelab-staging-zzo5t7b05, the debatelab-staging Vercel preview of this branch at c6a90c5, which includes #95's pin. Playwright opened it through the VERCEL_STAGING_BYPASS header and signed in on the login page with the seeded Pro demo code; nothing was recorded during sign-in. Every Supabase request went to brifeyypjauyusmkptkx (staging), and the page shows the Staging backend strip, the seeded Current Debate, and the Pro plan.

Also on this head, a real scripts/staging-sync.mjs --report run, outside an agent environment, deployed 13 functions to staging, rechecked, and set staging-sync to success (097aeb3). The code was byte-identical to main. My branch's merge-of-main commit dated them as changed, so this was the first real run of the deploy path. Afterwards, preview hosts pass CORS, a lookalike host is refused, and demo-code sign-in returns a handoff.

phone-preview.webm