Setup instructions

# Setup guide

Secrets stay in the secret manager. Do not paste key values into chat.

Canonical host: https://vfx.assemblybay.com (Vercel project auto-vfx). Clerk production Frontend API: clerk.vfx.assemblybay.com. Preview/dev keys stay pk_test_. Optional CLERK_ORG_ID is an allowlist, not a tenant id.

Database: DATABASE_URL (Neon role auto_vfx_app after RLS), DIRECT_DATABASE_URL (migrator). prisma migrate deploy. Never db push in production. Empty installs: pnpm db:migrate:empty against a disposable database.

R2: R2_ACCOUNT_ID, R2_ENDPOINT, R2_BUCKET, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY. Bucket-scoped Object R/W on auto-vfx-media / auto-vfx-media-dev. Same values on the worker host. CORS: PUT/HEAD/GET from https://vfx.assemblybay.com, http://127.0.0.1:3120, http://localhost:3000.

Workers: WORKER_CREDENTIALS_JSON on Vercel and the worker. Production ignores WORKER_TOKEN_SECRET as a dual cpu/gpu fallback. CPU_WORKER_WAKE_URL + CRON_SECRET for wake. WORKER_SCRATCH jail on the worker host. Do not copy generation keys onto the CPU image.

Media: MEDIA_SIGNING_SECRET. Playback is GET /api/media/[assetVersionId] authorized bytes (Range 200/206/416) or POST short-lived grant.

Planner: ALLOW_PAID_PROVIDER_CALLS must be the string true before execute_operation enqueue. Keep at most one planner key.

Native probes: AE_HOST_PROBE_URL, MOCHA_HOST_PROBE_URL, BLENDER_BIN on the execution host. Probes are https + configured host only.

Owner actions: dedicated Auto-VFX Clerk production at vfx.assemblybay.com (not clerk.assemblybay.com / Evuhl); MFA for org admins; optional Collective on the development instance for local pk_test_; mint R2 token; grant GitHub App to thefatedworld/auto-vfx; run workers/cpu/job_loop.py with AUTO_VFX_API_URL=https://vfx.assemblybay.com; supply rights-cleared plate+insert. Deploy with ./scripts/deploy-prod.sh. Do not change Assembly Bay nameservers. Do not claim the first live loop until a worker heartbeat and candidate exist.