spec(phase-8): add deployment tasks

[Nether403]

Summary

Adds the tasks.md companion to the approved Phase 8 deployment spec (requirements + design merged in PR #6). Breaks the work into 44 dependency-ordered tasks across 9 batches so the spec-task-execution sub-agent can pick them up one at a time.

Batch structure

Batch	Theme	Count
A	Rate limiter module (memory backend default, Upstash behind flag)	6
B	Sentry wiring behind SENTRY_DSN (no-op when unset)	5
C	Auth fail-closed tightening + app-level PBT suite	2
D	Railway manifests + runbook scripts (migrate.ts, smoke.ts, rollback.md)	5
E	.env.example + README production section [docs]	2
F	External provisioning: Railway / Neon / Upstash / Sentry / GitHub / DNS [external]	8
G	Staging cutover	6
H	Production cutover	7
I	Post-deploy cleanup [docs]	3

Total: 44 tasks.

Task format

Each task carries:

• Acceptance criteria referenced by R-ID from requirements.md
• Files touched per design.md § 2
• Verification — the exact command or reviewer check that closes the task
• Dependencies — an explicit prior-task list so batches A/B/C/D can run in parallel once phase-gated

Ambiguities resolved in this draft

• App-level property-based tests for CORS, admin-key gating, and auth fail-closed (design § 8 Properties 3–5) land in a new apps/api/src/app.pbt.test.ts file in C2 rather than alongside the rate-limit PBT.
• The RATE_LIMIT_BACKEND=upstash flip in production is sequenced after the first prod smoke (H5 → H6 → H7) so the cutover has a clean rollback point if the Upstash path misbehaves.
• Both F8 (DNS provisioning) and H4 (DNS verification in cutover) are kept — F8 can run ahead of H2 or at cutover, and H4 is the confirmation gate either way.
• I3's CHANGELOG step is marked "edit if present, otherwise create" since the repo does not yet have a root CHANGELOG.md.

What's next

Once this PR merges, Batch A can start immediately. A1–A6 are all code-only tasks that run in apps/api/ and have no external preconditions.

Closes the tasks phase of the Phase 8 deployment spec. Ties back to:

• ADR 003 — Deployment architecture
• Phase 8 requirements
• Phase 8 design

---

---

Summary by cubic

Adds tasks.md for Phase 8 deployment, breaking the approved spec into 44 dependency-ordered tasks across 9 batches so spec-task-execution can run them one by one. Each task includes acceptance criteria, files, verification, and dependencies.

• New Features
  • Groups 44 tasks into 9 batches: rate limiter, Sentry, auth fail-closed, Railway manifests/scripts, docs, external provisioning, staging, production, post-deploy.
  • Each task names R-ID acceptance criteria, touched files, exact verification steps, and dependencies for safe parallelization.
  • Notes PBT placement and sequencing, and schedules the production RATE_LIMIT_BACKEND=upstash flip after the first smoke for clean rollback.

^{Written for commit aa5baed. Summary will update on new commits.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".kiro/specs/phase-8-deployment/tasks.md">

<violation number="1" location=".kiro/specs/phase-8-deployment/tasks.md:311">
P2: H4’s dependency gating contradicts its own execution instructions: it says DNS may be flipped during H4, but requires F8 to be completed first. This makes the fallback path impossible in the task runner.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: H4’s dependency gating contradicts its own execution instructions: it says DNS may be flipped during H4, but requires F8 to be completed first. This makes the fallback path impossible in the task runner.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .kiro/specs/phase-8-deployment/tasks.md, line 311:

<comment>H4’s dependency gating contradicts its own execution instructions: it says DNS may be flipped during H4, but requires F8 to be completed first. This makes the fallback path impossible in the task runner.</comment>

<file context>
@@ -0,0 +1,357 @@
+  - Preconditions: F8, H2.
+  - Acceptance criteria: R9.1, R9.2, R9.3, R9.4, R9.5.
+  - Verification: `dig api.stackfast.app +short` matches the Railway edge; `curl -I https://stackfast.app` returns 200; `curl -I http://stackfast.app` returns 301/308 to `https://stackfast.app`.
+  - Dependencies: F8, H2.
+
+- [ ] **H5** Run production smoke and record `/health` evidence `[external]`
</file context>