Release v0.34.31 - "Exodus"

Release Date: August 15, 2026

Summary

This release completes the migration of the Ballistics API from Google Cloud to AWS Lambda, and hardens what the move exposed.

api.ballistics.7.62x51mm.sh now resolves to API Gateway rather than the GCP load balancer, and the whole /v1 surface is served by Lambda. The GCP load balancer, the Cloud Run service, the Cloud DNS zone and the proof-of-concept stack have all been retired. The Amazon price tracker and the weekly activity report were ported from Cloud Functions to Lambda with EventBridge schedules. Firestore stays on GCP deliberately: the iOS app reads it directly, so moving it would force an app update.

Several fixes here came from production alarms firing during the cutover rather than from planned work: a missing warmer behind a recurring 5xx, an internal route whose burst limit was low enough that a normal refresh run throttled against itself, Firestore reads that turned a transient gRPC blip into a user-facing 503, and an entitlement lookup that could deny a paying customer on the same class of blip without raising any alarm at all.

Features

• detect unparseable access-log lines; correct the injection claim
• log the client user agent in access logs
• rebuild the weekly report on real data and move it to Lambda
• move the Amazon price tracker off Cloud Run onto Lambda
• cut api.ballistics over to AWS — GCP is out of the request path
• keep the infrastructure routes reachable after the DNS repoint
• API Gateway custom domain for api.ballistics, mapped to the prod stack
• stack-owned SNS alarm topic with a tinymachines.io display name
• create the ballistics-api-prod stack
• build the S3 + CloudFront + ACM stack for releases, cutover blocked
• pre-stage the 62x51mm.sh zone in Route53 for a seamless nameserver switch
• production naming steps 2-3 — ECR repos populated, GCP identity provisioned
• migrate the last two routes — /api/v1/* — route migration complete
• route the entire /v1 surface to Lambda — migration complete
• slice 13 — long-tail closure live in production, 20 paths
• stage the long-tail function in CloudFormation, unrouted
• add the long-tail Lambda closure running the complete Flask app
• let the Flask entitlement gate carry auth that API Gateway cannot
• bound the routes that became publicly reachable on Lambda
• resolve secrets and the fleet DB URL lazily, without breaking Cloud Run
• add the Lambda migration infrastructure that already serves production

Bug Fixes

• point the probe at the prod API and stop calling the public host "GCP"
• bound and retry Firestore reads so a blip cannot deny a paying user
• retry the whole streamed read; harden the malformed-log alarm
• retry transient Firestore gRPC failures instead of returning 503
• three-way client split -- unattributed traffic was hiding real users
• stop the refresh phase throttling against itself
• record app_version again, and stop losing rows on Lambda
• add the missing long-tail warmer — root cause of the recurring 5xx alarm
• serialize Firestore timestamps, and close the X-Firebase-Uid trust gap
• admit the long-tail role to GCP workload identity, and bound Firestore reads
• repair the SQLite logging wrapper that broke three production endpoints
• remove an empty database that shadowed the real one, and ship newrelic.ini
• track the model registry index so a clone can actually load models

Performance

• defer heavy imports so Lambda cold starts stay inside the gateway budget

Documentation

• state the userAgent log-injection risk accurately
• correct the price-tracker redeploy failure -- I caused it, and retire 5 dead Cloud Run units
• record the post-migration fixes and their production verification
• the sqlite bug needs no Cloud Run deploy — AWS already serves it correctly
• the monitoring hang is a missed Phase 2 step, not an app defect
• record the Phase 2 deploy, and correct an over-optimistic estimate
• plan the remaining 197 routes, and correct a wrong assumption
• define the route authorization policy blocking DNS cutover
• correct a phantom directory and a BC5D command that cannot work
• repoint the IP inventory at the consolidated patents directory
• track the CDM PINN reproduction study and its script
• release notes for v0.34.30 "Tripwire"

Chores

• update the internal-route throttle assertion to the fixed value
• tear down the GCP load balancer, Cloud Run and Cloud DNS zone
• verify /v1/calculate and the batch contract on the prod stack
• parameterize every physical resource name for a production stack
• Phase 3 parity results — 85% exact, one blocker, one hypothesis corrected
• add the Phase 3 parity harness for the long-tail closure
• add per-workload canaries and handler contract tests for the Lambda slices
• file 89 scripts into buckets, leaving the path-fragile ones in place
• fix the cross-repo wiring so a fresh clone is usable
• stop shipping 2.8GB of redundant model artifacts to every clone
• file stray root reports and consolidate the whitepaper directories
• purge dead config and generated artifacts from the tree
• move patent material out to ~/projects/patents

Other

• build(aws): template outgrew CloudFormation's inline limit; stage it in S3
• build(gcp): scale Cloud Run to zero with request-based CPU allocation
• build: stop uploading non-shipping trees to Cloud Build

← All Releases