GO/NO-GO Decision: Frontend Pipeline Cutover

Date: 2026-03-19 Decision: GO

Validation Results

#	Test	Result	Notes
1	deploy.yaml triggers Amplify build	PASS	Run 23321972310 succeeded via push trigger on demo branch
2	Demo site loads after deployment	PASS	demo.alpha001.app.arda.cards returns 200; Items page renders correctly
3	User can sign in	PASS	miguel@arda.cards signs in via Cognito USER_PASSWORD_AUTH on demo pool us-east-1_zLN2pEodA
4	Page navigation works (Items, Order Queue, Receiving)	PASS	All three pages load with 0 console errors after ARDA_API_KEY fix
5	No NEXT_PUBLIC_* configuration errors	PASS	No JavaScript errors in browser console; env vars correctly resolved from CloudFormation
6	redeploy with specific SHA	PASS	Amplify job 6 deployed commit 34a27571432f (older commit); Amplify Console confirmed correct SHA
7	Amplify Console shows correct commit	PASS	Verified via aws amplify get-job — commitId: 34a27571432f
8	Latest version restored after redeploy test	PASS	Amplify job 7 restored commit 1881b5d1cd6e (HEAD)
9	Existing partitions unaffected	PASS	Dev last build: 2026-03-18 (job 93), Stage: 2026-03-18 (job 170), Prod: 2026-03-12 (job 97) — no new builds

Method Notes

• Tasks 3.1, 3.2: Deploy triggered via push event on demo branch (workflow_dispatch not available from non-default branch)
• Tasks 3.3, 3.4: Redeploy tested via direct AWS CLI aws amplify start-job --commit-id (same API the workflow calls). redeploy.yaml cannot be dispatched from demo branch — will be testable via workflow_dispatch after PR2 merges to main
• Functional verification: Playwright MCP used for automated spot checks; manual sign-in confirmed by operator
• Comparison with dev and prod: Demo behavior validated against both existing environments using Playwright

Issues Found During Validation

Resolved: ARDA_API_KEY mismatch (blocking, fixed)

The ARDA_API_KEY_DEMO GitHub org secret had a stale value that didn’t match the demo backend’s expected API key. All API calls returned 401, which triggered the auth error handler to redirect to sign-in (flashing loop).

Fixed by: Updating the Secrets Manager secret, Amplify app env var, and GitHub org secret with the correct value from 1Password (op://Arda-DemoOAM/ARDA-API-KEY). See drift-warnings.md item 4.

Noted: Auth error handling (non-blocking, ticketed)

The authErrorHandler.ts does not distinguish between user-token failures (JWT expired) and backend-auth failures (API key rejected). Both trigger a sign-in redirect. The dev environment suppresses this via mock mode (NEXT_PUBLIC_DEPLOY_ENV=DEV), hiding the same underlying 401 errors.

Ticket: arda-frontend-app#701

Noted: Dev environment has persistent 401 errors (pre-existing)

The dev environment (dev.alpha002.app.arda.cards) has the same 401 backend API errors as demo had before the fix. These are suppressed by [MOCK AUTH] Suppressing auth error redirect in mock mode. The dev ARDA_API_KEY in Secrets Manager may also be out of sync with what the backend expects. Not blocking for this project.

Conditions for GO

All 9 tests pass. The ARDA_API_KEY issue was found and fixed during validation. The auth error handling improvement is ticketed but not blocking — it’s a UX/observability issue, not a pipeline issue.

Preconditions for Cutover (Run 4)

#	Precondition	Status	Date
1	infrastructure#428 merged (OIDC environment subjects)	✓ Done	2026-03-19
2	AMPLIFY_GITHUB_ACCESSTOKEN GitHub secret updated with regenerated PAT	✓ Done	2026-03-19
3	ARDA_API_KEY_DEMO GitHub org secret updated to match 1Password	✓ Done	2026-03-19
4	Team notified via Slack #dev-team with cutover plan summary	✓ Done	2026-03-19

Approver

jmpicnic — 2026-03-19