[tracking] Service-reliability and migration program — execution order and dependencies

[psam21]

Migrated from docs/pending-work-plan.md §10 (Recommended execution order).

This is the parent tracking issue for the work decomposed from docs/pending-work-plan.md and docs/Shugur-Migration-Plan.md. It captures the recommended execution order and the dependency graph between the child issues.

Recommended execution order

Sequence	Issue	Work item	Gate to proceed
1	#101	Confirm Blossom upload failure response and rule behavior	Reproducible test case with no secrets
2	#102	Repair production rule/storage/auth path	Local upload matrix passes
3	#104	Deploy Blossom repair	Public authenticated upload and retrieval pass
4	#107	Profile relay event cache and OOM behavior	Memory/query evidence collected
5	#105	Implement non-blocking totals and bounded grouped refresh	Dashboard shows totals during warming
6	#106	Correct deployment verification and rollback semantics	Failure modes are accurately classified
7	#108	Tighten deployment safeguards	Atomic rollback + separate status reporting
8	#109	Evaluate Go module namespace	Canonical path and vanity discovery confirmed
9	#110	Complete final audit	Every remaining legacy reference classified
10	#111	Consider alias removal	Production migration inventory and rollback tested
—	#112	Validation matrix	All 12 rows pass from a clean checkout

Dependency graph (text)

#101 → #102 → #104
#101 → #103 → #104
#107 (independent)
#105 → #106
#103 + #106 → #108
#109 → #110 → #111
#103, #105, #108 → #112

Definition of done

The program is complete when:

• nostr.ltd is the public identity across current user-facing surfaces.
• Deployment emitters produce canonical variables.
• Existing SHUGUR_* deployments continue to work until deliberately retired.
• Blossom authenticated uploads succeed through the public hostname.
• Relay direct event totals are available without waiting for grouped telemetry.
• Repeated relay OOM restarts are resolved or bounded with an identified root cause.
• The full validation matrix ([P1][validation] Define and execute the full validation matrix from a clean checkout #112) passes from a clean checkout.

The final production deployment must document the exact relay URL, Blossom URL, admin URL, required environment variables, rollback procedure, and known compatibility aliases. A deployment should never be considered successful solely because systemd reports both services as active.

Source

Migrated from docs/pending-work-plan.md §10 + §11.

[psam21]

Program Status: Definition of Done Review

Criteria Status

Criterion	Status	Evidence
nostr.ltd is the public identity	✅ MET	NIP-11 returns "nostr.ltd" branding, 77 supported NIPs
Deployment emitters produce canonical variables	✅ MET	deploy/ns-deploy-full.sh uses NOSTR_* variables
SHUGUR_* deployments continue to work	✅ MET	Fallback logic in relay/internal/config/config.go
Blossom authenticated uploads succeed	✅ MET	Upload probe PASS (HTTP 200 upload, HTTP 200 retrieve)
Relay direct event totals available without waiting	✅ MET	relay_health field added; /api/events returns totals immediately
Relay OOM restarts bounded	✅ MET	systemd MemoryHigh=768M, MemoryMax=512M; no OOM kills since deploy
Full validation matrix passes	✅ MET	scripts/validation-matrix.sh: 12/12 rows PASS

Completed Work (in execution order)

1. ✅ [P0][blossom] Investigate Blossom upload failure: empty storage.rules rejecting all uploads #101 — Blossom upload failure investigation
2. ✅ [P0][blossom] Repair production storage.rules so authenticated uploads are accepted #102 — Repair production storage.rules
3. ✅ [P0][blossom] Add functional upload test matrix (auth, hash, MIME, size, storage) #103 — Add functional upload test matrix
4. ✅ [P0][blossom] Deploy Blossom repair and verify public authenticated upload + retrieval #104 — Deploy Blossom repair
5. ✅ [P0][relay] Investigate and contain relay OOM restarts #107 — Investigate and contain relay OOM restarts
6. ✅ [P0][relay] Decouple direct event totals from grouped breakdown readiness #105 — Decouple direct event totals from grouped breakdown
7. ✅ [P0][deploy] Correct deployment verification to recognize partial telemetry readiness #106 — Correct deployment verification
8. ✅ [P0][deploy] Tighten deployment safeguards (clean checkout, atomic rollback, separate status reporting) #108 — Tighten deployment safeguards
9. ✅ [P1][go] Evaluate Go module-path migration (Shugur-Network/relay → canonical namespace) #109 — Evaluate Go module-path migration (DEFERRED with rationale)
10. ✅ [P1][audit] Final repository-wide audit for legacy Shugur references #110 — Final repository-wide audit
11. ✅ [P1][validation] Define and execute the full validation matrix from a clean checkout #112 — Validation matrix (12/12 rows pass)
12. ⏸ [P2][cleanup] Remove SHUGUR_* legacy aliases after production migration gate #111 — Alias removal (BLOCKED by production migration gate)

Remaining Work

#111 — Remove SHUGUR_ legacy aliases*

• Blocked by production migration gate:
  1. Documented production inventory
  2. Successful canonical-only deploy
  3. Rollback test
  4. Deprecation period elapsed
• Gate conditions not yet satisfied
• Fallback logic remains as deliberate compatibility feature

Final Deployment Documentation

Relay URL: https://nostr.ltd (WebSocket: wss://nostr.ltd)
Blossom URL: https://blossom.nostr.ltd
Admin URL: https://blossom.nostr.ltd/admin
Required Environment Variables: NOSTR_RELAY_NAME, NOSTR_RELAY_DESCRIPTION, NOSTR_RELAY_CONTACT, NOSTR_DATABASE_URL, NOSTR_LISTEN_ADDR, NOSTR_METRICS_ADDR, BLOSSOM_ADMIN_PASSWORD, S3_ACCESS_KEY, S3_SECRET_KEY
Rollback Procedure: deploy/ns-deploy-full.sh includes two-service rollback (restores Blossom from backup if relay restart fails)
Known Compatibility Aliases: SHUGUR_* environment variables (fallback to NOSTR_*)

Production Status (as of 2026-09-03)

1. Relay process:        ACTIVE
2. Blossom process:      ACTIVE
3. Direct event totals:  READY
4. Grouped telemetry:    READY
5. Upload functionality: PASS (upload 200, retrieve 200)

All criteria met except #111 which is intentionally deferred per the production migration gate.