Problem
No .replit/replit.nix or docs/deployment/replit.md exists yet. DEPLOY-001 resolves single-origin serving; this issue documents and smoke-tests the actual Replit deployment path on top of it without ever deploying or touching a real Replit database from this engineering loop.
Repository evidence
No Replit config files found anywhere in the repo.
Risk
P1 -- required before any real deployment attempt, but explicitly non-destructive: this issue produces documentation and a repeatable command sequence, not a live deployment.
Scope
.replit/replit.nix only if actually required and justified (document why, if added); docs/deployment/replit.md; repeatable production build command; repeatable production start command; first-deploy migration procedure; rollback procedure; custom-domain smoke-test checklist. Verify (via local reasoning/testing, not a live Replit deploy): static asset caching, HTML no-cache, SPA fallback, API route precedence, WS upgrade routing, health/readiness endpoints, graceful shutdown, DB connection cleanup, market-feed cleanup, env-var validation, secure production cookies, CORS/origin restrictions, custom-domain compatibility.
Non-goals
No actual deployment to Replit; no modification of any real Replit database; GitHub remains canonical -- Replit must never become the dev source of truth (explicit mission constraint).
Dependencies
DEPLOY-001 (single-origin serving must exist first).
Proposed implementation
Config files (if justified) plus a markdown runbook mirroring the rigor of the existing docs/operations/runbook.md (from OBS-016) but specific to first-deploy/rollback/custom-domain steps.
Acceptance criteria
Following the documented build+start commands locally (in production mode) reproduces a working single-origin server exactly as DEPLOY-001 verified; rollback procedure is concretely actionable (not vague); custom-domain checklist covers DNS, TLS, and same-origin cookie implications.
Definition of done
Commands in the doc are verified to actually work by running them locally; reviewer PASS; no deployment was performed.
Test plan
Manual: execute every documented command locally and confirm output matches the doc's stated expectations.
Security review
Confirm the doc doesn't instruct committing secrets into .replit/replit.nix; env vars documented as Replit-secrets-configured, not hardcoded.
Accessibility review
N/A.
Observability requirements
Doc should reference the existing /api/health//api/ready endpoints as the deployment health-check mechanism.
Performance considerations
N/A beyond what DEPLOY-001/PERF-001 already cover.
Rollback plan
This issue's own deliverable includes the rollback procedure; the issue itself is trivially revertable (docs/config only).
Documentation requirements
docs/deployment/replit.md.
Completion evidence
(added on merge)
Reviewer verdict
(pending)
Problem
No
.replit/replit.nixordocs/deployment/replit.mdexists yet.DEPLOY-001resolves single-origin serving; this issue documents and smoke-tests the actual Replit deployment path on top of it without ever deploying or touching a real Replit database from this engineering loop.Repository evidence
No Replit config files found anywhere in the repo.
Risk
P1 -- required before any real deployment attempt, but explicitly non-destructive: this issue produces documentation and a repeatable command sequence, not a live deployment.
Scope
.replit/replit.nixonly if actually required and justified (document why, if added);docs/deployment/replit.md; repeatable production build command; repeatable production start command; first-deploy migration procedure; rollback procedure; custom-domain smoke-test checklist. Verify (via local reasoning/testing, not a live Replit deploy): static asset caching, HTML no-cache, SPA fallback, API route precedence, WS upgrade routing, health/readiness endpoints, graceful shutdown, DB connection cleanup, market-feed cleanup, env-var validation, secure production cookies, CORS/origin restrictions, custom-domain compatibility.Non-goals
No actual deployment to Replit; no modification of any real Replit database; GitHub remains canonical -- Replit must never become the dev source of truth (explicit mission constraint).
Dependencies
DEPLOY-001(single-origin serving must exist first).Proposed implementation
Config files (if justified) plus a markdown runbook mirroring the rigor of the existing
docs/operations/runbook.md(from OBS-016) but specific to first-deploy/rollback/custom-domain steps.Acceptance criteria
Following the documented build+start commands locally (in production mode) reproduces a working single-origin server exactly as
DEPLOY-001verified; rollback procedure is concretely actionable (not vague); custom-domain checklist covers DNS, TLS, and same-origin cookie implications.Definition of done
Commands in the doc are verified to actually work by running them locally; reviewer PASS; no deployment was performed.
Test plan
Manual: execute every documented command locally and confirm output matches the doc's stated expectations.
Security review
Confirm the doc doesn't instruct committing secrets into
.replit/replit.nix; env vars documented as Replit-secrets-configured, not hardcoded.Accessibility review
N/A.
Observability requirements
Doc should reference the existing
/api/health//api/readyendpoints as the deployment health-check mechanism.Performance considerations
N/A beyond what
DEPLOY-001/PERF-001already cover.Rollback plan
This issue's own deliverable includes the rollback procedure; the issue itself is trivially revertable (docs/config only).
Documentation requirements
docs/deployment/replit.md.Completion evidence
(added on merge)
Reviewer verdict
(pending)