Setup instructions

# Setup guide

Secrets stay in the secret manager. Do not paste key values into chat.

Canonical host: https://vfx.assemblybay.com (Vercel project auto-vfx). Clerk production Frontend API: clerk.vfx.assemblybay.com. Preview/dev keys stay pk_test_. Optional CLERK_ORG_ID is an allowlist, not a tenant id.

Database: DATABASE_URL, DIRECT_DATABASE_URL. prisma migrate deploy. Never db push in production. Empty installs: pnpm db:migrate:empty against a disposable database.

R2: R2_ACCOUNT_ID, R2_ENDPOINT, R2_BUCKET, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY. Bucket-scoped Object R/W on auto-vfx-media / auto-vfx-media-dev. Same values on the worker host.

Workers: WORKER_CREDENTIALS_JSON on Vercel and the worker. Production ignores WORKER_TOKEN_SECRET as a dual cpu/gpu fallback. CPU_WORKER_WAKE_URL + CRON_SECRET for wake.

Media: MEDIA_SIGNING_SECRET. Playback is GET /api/media/[id] authorized bytes (Range 200/206/416) or POST short-lived grant.

Native probes: AE_HOST_PROBE_URL, MOCHA_HOST_PROBE_URL, BLENDER_BIN on the execution host.

Owner actions: dedicated Auto-VFX Clerk production at vfx.assemblybay.com (not clerk.assemblybay.com / Evuhl); mint R2 token; grant GitHub App to thefatedworld/auto-vfx; run workers/cpu/job_loop.py with AUTO_VFX_API_URL=https://vfx.assemblybay.com; supply rights-cleared plate+insert. Deploy with ./scripts/deploy-prod.sh. Do not change Assembly Bay nameservers.