[mthines]

Why

Deploy run 39121682238 (the #700 merge) showed two problems:

• e2e-web-staged skipped. It waited for VERCEL_AUTOMATION_BYPASS_SECRET. Deployment Protection is now off for the web project, so the staged URL is public and the secret is gone.
• smoke-preview failed on the new CLI lane. Preview's LOREKIT_SMOKE_TOKEN is service-role, and protect/pin/unpin/policy/groom refuse a credential with no owner. Production was not promoted.

What changed

• deploy.yml: removes the bypass gate step and the per-step secret env from e2e-web-staged, so the job now always runs.
• packages/web-e2e: removes the bypass header route, originHeaders() and VERCEL_BYPASS_SECRET. Traces stay off for any production-target run, staged build included.
• packages/cli/test/smoke/cases.mjs: the owner-keyed cases skip on a service-role token, the same way purge and the hosted MCP smoke already do.
• docs/smoke-tests.md: drops the secret row.

How to verify

• Ran playwright test --project=public against the live staged build lorekit-mmha4hvcx…vercel.app with no bypass header: 34 passed, 1 skipped.
• Ran pnpm nx typecheck web-e2e, pnpm nx test web-e2e, pnpm nx lint web-e2e and node --test packages/cli/test/cli-smoke.test.mjs (42/42). All pass.
• actionlint: no new findings. The two SC2129 style notes are already on main.

User-facing docs/llms.txt: none applied, because this changes CI wiring and tests only.

[dash0-dev]

Darkplane Automerge did not approve this pull request. It scored 68.02 of 100, and 75 was required.

• 🟡 Evidence quality scored 66.
  Relevant checks pass, including Typecheck, Test & Lint (affected), Web — Playwright e2e (local build + local Supabase), Storybook, and CI Summary. The PR body reports a manual Playwright run against the staged build (34 passed, 1 skipped) and CLI smoke tests (42/42). No human review exists, and the deploy.yml change and the skipped owner-keyed CLI smokes can't be exercised before a real deploy run. Many other checks show neutral, so they add no signal.

The other 2 criteria

• 🟢 Blast radius scored 70.
  The change touches only CI and test code, with no runtime product code. It is easy to revert, and originHeaders and VERCEL_BYPASS_SECRET have no remaining references in the code I searched. The main risk is in .github/workflows/deploy.yml: e2e-web-staged no longer skips without the bypass secret, so it now gates promote-web-production on every deploy. If the staged URL is still protected, production promotion would be blocked until it is fixed or reverted. The CLI smoke skips are limited to the service-role tier.
• 🟢 Change footprint scored 68.
  The change is small (about 120 lines across 7 files) and mostly deletes the Vercel bypass-secret plumbing from deploy.yml, env.ts, fixtures.ts, playwright.config.ts and api-docs.e2e.ts. It also adds a repeated early-return skip for service-role credentials to five smokes in cases.mjs. The deploy.yml edit is the one non-trivial part. e2e-web-staged now always runs instead of skipping, and promote-web-production depends on it, so a failure there blocks production promotion. The diff output was truncated near the end of fixtures.ts, so I did not see that last part.

_{An AI evaluator produced these scores from the diff, the repository history, and the pull request text. The pull request text is author-controlled, so treat the scores as signals rather than proof. Reviewed for commit 053efa7.}