Profile Route Live Smoke

Scope

This opt-in live smoke proves selected current-user profile compatibility routes through api-gateway with the non-default profile route table. It does not promote deploy/gateway/routes.json, does not prove browser behavior, and does not replace populated-target cutover validation.

Browser-originated proof for the same base and teacher profile update routes is tracked separately in Profile Route Browser Smoke.

The smoke seeds a disposable profile snapshot directly in profile-service as owner-service setup, then performs user-facing compatibility updates through api-gateway only:

• PATCH /api/auth/me/profile
• PATCH /api/auth/me/teacher-profile

It also verifies GET /api/auth/me remains on the broad legacy auth sibling route in the profile route table.

Required Runtime

Start these processes before live mode:

• profile-service, default PROFILE_SERVICE_BASE_URL=http://localhost:8082
• api-gateway, default GATEWAY_BASE_URL=http://localhost:8085
• gateway route table: GATEWAY_ROUTE_TABLE=deploy/gateway/routes.profile-native-localhost-example.json

Use the same AUTH_JWT_SECRET for the gateway and the smoke when the smoke mints its local HS256 bearer token.

Run

Static self-test:

cd go-platform
PROFILE_ROUTE_LIVE_SELF_TEST=1 make test-profile-routes-live

Confirmed live run:

cd go-platform
PROFILE_ROUTE_LIVE_CONFIRM=profile-native \
PROFILE_ROUTE_LIVE_SEED_CONFIRM=seed-profile \
GATEWAY_BASE_URL=http://localhost:8085 \
PROFILE_SERVICE_BASE_URL=http://localhost:8082 \
AUTH_JWT_SECRET=local-hoctapaz-development-secret-change-before-deploy \
make test-profile-routes-live

Useful optional variables:

• PROFILE_ROUTE_LIVE_AUTHORIZATION='Bearer <token>' to provide an existing gateway-valid teacher token instead of minting a local HS256 token.
• PROFILE_ROUTE_LIVE_USER_ID=<account-id> to choose the disposable profile id.
• PROFILE_ROUTE_LIVE_ARTIFACT_DIR=output/qa/<name> to control artifact output.
• PROFILE_ROUTE_LIVE_SKIP_LEGACY_GUARD=1 only when the isolated smoke environment cannot reach the broad legacy sibling route.

Latest Local Proof

On 2026-07-10, live mode passed against local profile-service and api-gateway:

HTTP_ADDR=:8082 ENV=local GOTOOLCHAIN=go1.25.11 \
go run ./services/profile-service/cmd/server

HTTP_ADDR=:18088 \
LEGACY_API_BASE_URL=http://127.0.0.1:9 \
GATEWAY_ROUTE_TABLE=deploy/gateway/routes.profile-native-localhost-example.json \
AUTH_JWT_SECRET=local-hoctapaz-development-secret-change-before-deploy \
GOTOOLCHAIN=go1.25.11 \
go run ./services/api-gateway/cmd/server

Then:

PROFILE_ROUTE_LIVE_CONFIRM=profile-native \
PROFILE_ROUTE_LIVE_SEED_CONFIRM=seed-profile \
PROFILE_ROUTE_LIVE_ARTIFACT_DIR=output/qa/profile-route-live-20260710-1543 \
GATEWAY_BASE_URL=http://localhost:18088 \
PROFILE_SERVICE_BASE_URL=http://localhost:8082 \
AUTH_JWT_SECRET=local-hoctapaz-development-secret-change-before-deploy \
make test-profile-routes-live

Artifacts were written under:

output/qa/profile-route-live-20260710-1543/

Observed route evidence:

• /api/auth/me/profile: status 200, route profile-base-update, state native_write, request id profile-route-live-base.
• /api/auth/me/teacher-profile: status 200, route profile-teacher-update, state native_write, request id profile-route-live-teacher.
• /api/auth/me?source=profile-route-live-smoke: status 502, route auth, state legacy_proxy. The 502 is expected because the legacy target was a deliberate dummy endpoint.

Both local processes were stopped after the run.

The earlier local baseline remains under output/qa/profile-route-live-20260709-121055/. These runs seed only a disposable local owner profile and do not prove production-like data or default route promotion.

Rollback

Switch GATEWAY_ROUTE_TABLE back to deploy/gateway/routes.json; the default table still keeps the profile compatibility routes on the broad legacy auth route. This smoke writes only to the disposable local profile-service runtime used for the proof.