Flip mint.tacc.utexas.edu to ui-react

Question

Point the primary SUBSIDE host at ui-react in place of mint-ui-lit, once #76 has proven the
app works against TACC's real data on a Vercel preview.

Settled by #69 — these were open questions on this ticket and no longer are:

The legacy ui component stays deployed but unrouted. Not a second path, not a second
URL: the route moves to ui-react and the Lit deployment is simply left running. It is
removed after client sign-off (Remove the legacy ui Helm component from TACC's deployment #81), not here.
Rollback is therefore re-pointing the route back at the still-running Lit deployment.
Nobody needs telling before the URL changes — there are no users on Lit at TACC.

What this ticket still has to do:

Deploy ui-react to TACC's cluster and move mint.tacc.utexas.edu onto it.
Confirm the OAuth2 round-trip at the real origin. This is the one thing Smoke-test ui-react on a Vercel preview against TACC's real Hasura and CKAN #76 structurally
cannot prove, because Vercel previews use a dedicated OAuth path for preview origins
(ADR-0002). Check whether the OAuth2 redirect URI for mint.tacc.utexas.edu is already registered #73 settles the redirect URI; this is where it is exercised for real.
Re-check anything from Smoke-test ui-react on a Vercel preview against TACC's real Hasura and CKAN #76's checklist whose behaviour depends on the origin or on the
container's runtime config rather than on the app itself — in particular login-gated reads and,
if Proxy CKAN through the container nginx (only if T3 says CORS is broken) #74 landed an nginx CKAN proxy, /datasets/* through it.

This is the only genuinely one-way step on the map. Everything before it is reversible.

Sharpened by Check whether the OAuth2 redirect URI for mint.tacc.utexas.edu is already registered:
the redirect URI is already registered — https://mint.tacc.utexas.edu/oauth2/callback is the
exact callback_url of Tapis client mint, the one Lit uses today, and ui-react reuses that
client rather than getting its own. Three constraints follow, and they bind this ticket:

The ingress host must be exactly https://mint.tacc.utexas.edu. Tapis matches
redirect_uri on scheme, host and path; a plain-http:// route is rejected by the IdP
(verified). TLS is not cosmetic here, it is the login contract.
Lit must be unrouted, never re-hosted. Its callback URL is hardcoded to
${window.location.origin}/oauth2/callback with no override, and client mint is pinned to
the one origin — so Lit parked at a second hostname cannot log in, and the rollback would
be a rollback to a broken app. Set components.ui.ingress.enabled: false and leave the
deployment running; that is exactly the state Confirm SUBSIDE can live without the un-ported Lit screens #69 asked for and the chart expresses it.
Rollback = re-enable that ingress and take the host off ui_react. No IdP change either
way — whichever app holds the route is the one client mint serves.
No staging host for ui-react before the flip. A temporary hostname would need its own
Tapis client — and the Vercel preview-forwarding trick cannot substitute, because it forwards
through the fixed origin, which would still be serving Lit, and Lit does not forward.

The OAuth round-trip this ticket must confirm is therefore a real check of the deployment
(TLS terminating on the right host, nginx SPA fallback serving /oauth2/callback, the
entrypoint writing AUTH_CLIENT_ID: mint), not of the registration — the registration is
proven. The container side already checks out: docker/nginx.conf falls back
try_files $uri /index.html, so the callback route loads the app rather than 404ing.

Sharpened by Settle the window.MINT_CONFIG values for the TACC deployment:
the config half of the flip is decided. Add exactly this to TACC's values:

components:
  ui_react:
    enabled: true
    config:
      client_id: "mint"
      data_catalog_api: "https://ckan.tacc.utexas.edu"

Ten of the twelve __MINT_CONFIG__ keys need no statement. They derive from the component
ingresses or inherit shared chart values that TACC already overrides. #75 has the full table and
the evidence for each.

data_catalog_api looks redundant and is not. The ui_react template derives CKAN from
components.data_catalog, which TACC does not use; TACC uses external_services.ckan.url.
Without the override the key is omitted and the app falls back to a compiled default that
happens to be correct. State it.

Two chart cleanups to do while you are in there, neither blocking:

ui-react-config.yaml still emits MODEL_CATALOG_API. Commit .env.example and local-setup notes so ui-react runs for someone who is not Max #72 deleted that key from the app.
The generator ignores unknown variables, so it is harmless — remove it for hygiene.
values.yaml and the fail in ui-react-config.yaml claim the React client must differ
from Lit's. Check whether the OAuth2 redirect URI for mint.tacc.utexas.edu is already registered #73 settled that this is wrong for this rollout. Correct the text. The fail
itself triggers only on an empty client_id, so it does not block "mint".

Also make ui-react-config.yaml read external_services.ckan.url, as ui-config.yaml does.
The override above makes this optional.

New chart change, from #88 — a prerequisite, not a cleanup.

ui-react-config.yaml must emit EXECUTION_ENGINE. Derive it from .Values.components.ensemble_manager.config.execution_engine.type. This is how ui-config.yaml:52 already feeds window.REACT_APP_EXECUTION_ENGINE to Lit. TACC overrides that value to tapis, so TACC needs no new value.

Why it is required. The app default is localex, matching the chart default. Without the key, ui-react at TACC posts run submissions to /executionsLocal instead of /executionEngines/tapis.

It does not block the flip. The SOW criterion is the single-form model input config, not run execution.

The chart cleanup list is now four items: the dead MODEL_CATALOG_API key, the wrong "must be a distinct client" text, external_services.ckan.url, and this.

Known gap from #92, and it does not block this ticket.

ui-react cannot find datasets by standard variable. The thread wizard's Datasets step returns
the right datasets for only 3 of TACC's 40 annotated variables. 28 return zero, and some return
only false positives. Cause and evidence: #94.

Why it does not block the flip. The SOW §8 criterion is the single-form model input config,
which passes (#76). This fault is on the thread-execution path, the same side of the app as #85
and #88, neither of which blocked this ticket either.

Why it still matters at the flip. Anyone at TACC who opens a thread and reaches Datasets sees
an empty list with no error. It reads as an empty deployment, the same trap as the California
region default. Expect the question if TACC walks the modeling path before #94 lands.

No chart change follows from this. It is client-only.

Constraint from #116 — re-confirm the delete at the real origin after the flip.

#116 proved the delete round trip through TACC's production Hasura under a real Tapis token, but at localhost:3000, not at mint.tacc.utexas.edu. The literal test could not be run: this host still serves Lit, and Lit's delete is broken for its own reason, so it would have failed without saying anything about the migration.

Origin is not part of that round trip — same endpoint, same database, same user role. So nothing about the delete is left open. What is left open is what this ticket already owns: the deployment. Add the delete to the post-flip re-check list, next to the OAuth2 round trip:

create a throwaway problem statement, delete it, reload, confirm it is gone
confirm as anonymous, not just in the app — an orphan is invisible to its owner and visible to anonymous, which is how Deleting a problem statement, task or thread leaves the row behind and reports success #99 hid for so long

One thing this ticket must not assume. The migration alone does not fix delete. The client fix (#115) is required, and Lit is still broken. Lit stays deployed-but-unrouted at the flip, so that is fine — but if the route is ever rolled back to Lit, delete goes back to silently orphaning rows.

Two orphans from the #116 verification are still in TACC's database, cleanup in #120. Not a blocker here.

Sharpened by Chart never sets EXECUTION_ENGINE for ui_react:
the three chart cleanups #75 listed here are done, and one of them was not a cleanup.

MODEL_CATALOG_API is no longer emitted, and its override key is gone from values.yaml.
The client_id text no longer claims the React UI needs a client distinct from the legacy UI's.
ui-react-config.yaml now reads external_services.ckan.url. This one mattered. Without it
the key was omitted, not wrong, so the app fell back to a compiled-in default that was correct
by coincidence — the same class of gap as Chart never sets EXECUTION_ENGINE for ui_react, so a deployed React UI submits runs to the wrong engine #150 itself.

So the values to add to TACC's deployment are now one line, not two:

components:
  ui_react:
    enabled: true
    config:
      client_id: "mint"

data_catalog_api is no longer needed — TACC sets external_services.ckan.url, and the template
now reads it. Stating it explicitly is still harmless and still wins.

One new constraint: 9.0.0-beta.6 is not installable from the chart repo. beta.4 and
beta.5 were Chart.yaml version bumps that were never packaged, so releases/ and index.yaml
stop at 9.0.0-beta.3. This flip therefore needs either a packaged release commit
(make release in helm-charts) or a deploy from a git checkout. The dev cluster rehearsal used a
local chart path.

And one worry that turns out not to apply. #123
(a config-map-only change does not roll pods) does not bite ui_react: its deployment carries a
checksum/config pod-template annotation, so changing components.ui_react.config at the flip does
restart the pod and the new env-config.js reaches the browser. Verified on the dev cluster.
mint-ui and mint-ensemble-manager carry no such annotation, so #123 still applies to them.

Correction to the constraint above: 9.0.0-beta.6 is now installable. It is packaged, tagged
and published — helm repo add mint https://mintproject.github.io/mint/ then
--version 9.0.0-beta.6. Rendering straight from the published repo against the dev cluster's
values gives EXECUTION_ENGINE: "tapis" and DATA_CATALOG_API: "https://ckan.tacc.utexas.edu".

So this ticket does not need to package a release or deploy from a checkout. Two things remain
on the chart side:

beta.4 and beta.5 never existed as artifacts. They were Chart.yaml bumps that were never
packaged. The chart repo goes 9.0.0-beta.3 → 9.0.0-beta.6; there is no gap to explain, only a
numbering jump.
The monorepo's helm-charts submodule pointer still needs bumping to the release commit
(7130169), the way #70 bumped it for
beta.3. Not done here — the working branch had an unrelated pointer bump in flight.

Three constraints from #207, measured
by rendering dynamo/shared with ui_react.enabled=true.

1. The TACC values block is four lines, not one. #150 recorded "one line,
client_id: mint". That is wrong. With enabled: true alone the render gives:

AUTH_CLIENT_ID: "mint-local" — the chart default. TACC needs "mint"
(#73).
The ui_react ingress on host mint.local, with no TLS, while mint-ui keeps
mint.tacc.utexas.edu and the minttacc secret.

So this ticket sets enabled: true, config.client_id: "mint", the ingress host and the
minttacc TLS block, and moves Lit's ingress aside in the same edit. branding: tacc is
already there from #207; do not remove it.

2. BRANDING is carried, but never read at TACC. #207 proved the key on the dev cluster,
in the pod's own env-config.js. It could not prove it at TACC, because there is no
ui_react pod until this ticket runs. Take #207's acceptance check here: after the flip,
kubectl exec into the ui_react pod and read env-config.js. It must show
BRANDING: "tacc", AUTH_CLIENT_ID: "mint" and EXECUTION_ENGINE: "tapis". A green
helm upgrade is not proof.

3. The chart pin needs no bump. dynamo already pins 9.0.0-beta.11, which carries
BRANDING. 9.0.0-beta.12 is on the chart's main but is unpublished, and nothing here
needs it.

The TACC deploy checkout is current. This ticket needs a values edit and nothing else.

Read on the login node at ~/tacc-values/shared on 2026-09-12, after a helm upgrade that
reached revision 185:

git log → 85149e7, level with dynamo origin/main. That is the Carry BRANDING from the MINT chart to the pod at TACC #207 commit.
Chart.lock and charts/ → MINT-9.0.0-beta.11.tgz, the version that carries BRANDING.
values.yaml:112-119 → branding: tacc under components.ui_react.config.
values.yaml:111 → enabled: false, so the upgrade deployed no ui_react pod. Confirmed:
deployments.apps "mint-ui-react" not found.

So no git pull and no helm dependency update are needed here. helm upgrade . reads the
vendored charts/ directory rather than the repository, so a pull alone would not move the chart
— but the chart is already right.

Note helm list prints mint-isi-0.3.0, the umbrella chart. It never shows the MINT dependency
version. Read Chart.lock for that.

TACC deployment, read from outside on 2026-09-12

The finding: the pinned image has no branding

dynamo sets global.imageTag: '0.1.0'. That tag is v0.1.0 = main head = 971622c,
cut 2026-08-30. It does not carry #206:

ui-react/src/lib/branding.ts — absent.
BRANDING in scripts/generate-env-config.mjs — absent.
ui-react/public/images/ — absent, so neither logo is in the image.
PR #209 is not an ancestor of the tag.

So a flip on today's pin drops the TACC and UT Austin logos — the exact regression #206 was
opened to prevent, and which #207 just
carried through the chart and dynamo. The chart would send BRANDING: "tacc" to an image that
does not read the key.

develop is 95 commits ahead of v0.1.0. There is no newer release tag and no open
release-please PR. So this ticket must also choose the image: cut a release from develop, or
pin global.imageTag to a develop SHA. All four services have an image at the develop
head 9d58ec77a08151ffa6eacc6aa50648a9128718a0 — mint-ui-react, ensemble-manager,
model-catalog-api and graphql-engine all return a manifest — so a single global pin is
available. Note the package is ensemble-manager, not mint-ensemble-manager.

A trap in the acceptance check

curl https://mint.tacc.utexas.edu/env-config.js returns 200 today, before any flip. nginx
serves index.html for an unknown path, so the body is Lit's page. A status code proves nothing
here, in either direction. Read the body for window.__MINT_CONFIG__, or read the file
inside the pod.

State confirmed

Check	Result
`mint.tacc.utexas.edu`	Lit (`<title>DYNAMO</title>`, `config.js` with `REACT_APP_*`)
`ui_react` pod	none — `enabled: false`
Lit's live `AUTH_CLIENT_ID`	`mint` — confirms this ticket's `client_id: "mint"`
Lit's live `EXECUTION_ENGINE`	`tapis`
Hasura from the production origin	POST works, `Access-Control-Allow-Origin: *`
Ensemble Manager `/v1/executionEngines/tapis`	405 on GET — the route exists, POST only
CKAN `package_list`	200, `Access-Control-Allow-Origin: https://mint.tacc.utexas.edu`
`thread { response_variable { label } }`	`validation-failed` — #136 not applied
`thread { response_variable { name } }`	works — the legacy schema is live

One thing to file separately

Lit's config.js is served publicly and contains REACT_APP_DATA_CATALOG_KEY, a CKAN JWT. It
is readable by anyone who loads the page, so it is already exposed rather than newly exposed.
ui-react needs no CKAN key (#75 — every
read is an anonymous GET), so the flip stops publishing it. Rotate it when
#81 retires Lit.

Flipped 2026-09-12. Verified from outside; two checks still need a login.

mint.tacc.utexas.edu serves ui-react. Values in
dynamo#18, merged and deployed.

Proven

Check	Result
Host	React — `<title>MINT Model Catalog</title>`
`env-config.js`	the generated file, not the SPA fallback
`AUTH_CLIENT_ID`	`mint`
`EXECUTION_ENGINE`	`tapis`
`BRANDING`	`tacc`
Both logo files	200
`/oauth2/callback`	200 — nginx serves the app
Lit `/config.js`	now the SPA fallback
Hasura from this origin	200, `Access-Control-Allow-Origin: *`
CKAN from this origin	200, echoes the host
`thread { response_variable { label } }`	works — #136 is live

The served env-config.js replaces #207's kubectl exec check. It is stronger: it is the file
the browser gets.

The render matched the deploy

helm template with chart 9.0.0-beta.13 and TACC's own values changed exactly this: it removed
Ingress/mint-ui and added ConfigMap, Deployment, Service and Ingress for
mint-ui-react. Deployment/mint-ui stays, so the rollback of #73 is in place.

Two md5 guards proved the file. shared/values.yaml at dynamo main was byte-identical to the
file I rendered against, and the patched file was byte-identical to the one whose render I read.

Still open on this ticket

The OAuth2 round trip at the real origin. This is the one thing Smoke-test ui-react on a Vercel preview against TACC's real Hasura and CKAN #76 could not prove.
The delete round trip, from the Apply the modeling provenance cascade migration to TACC's Hasura #116 constraint: create a throwaway problem statement, delete
it, reload, and confirm as anonymous.

Both need a signed-in browser.

One thing to file

Lit's config.js published REACT_APP_DATA_CATALOG_KEY, a CKAN JWT, to every visitor. The flip
stops publishing it. ui-react needs no CKAN key (#75). Rotate the key when
#81 retires Lit.

Done. `mint.tacc.utexas.edu` serves `ui-react`, signed in, at the real origin.

Both open checks pass. Values in
dynamo#18.

1. The OAuth2 round trip — the thing #76 could not prove

Proven from the network log, not from the screen.

GET https://portals.tapis.io/v3/oauth2/authorize
      ?client_id=mint
      &response_type=token
      &redirect_uri=https%3A%2F%2Fmint.tacc.utexas.edu%2Foauth2%2Fcallback   -> 302
GET https://mint.tacc.utexas.edu/oauth2/callback?access_token=...            -> 200

Tapis validates redirect_uri before it draws the login form, so the 302 is the match on
scheme, host and path. The callback 200 is nginx's SPA fallback serving the app. The app took
the token and the header reads mosorio. #73's decision to reuse client mint holds.

2. The delete round trip — the #116 constraint

Created, deleted, reloaded, and confirmed as anonymous, which is how #99 hid.

Step	Anonymous count
Baseline	39
After create (`wb6crthxmtyr8yip`)	40
After delete	39

The child task row is gone with it, so the CASCADE is verified from the app at the real
origin. The row is gone from the list after a reload.

Also confirmed

The TACC and UT Austin strip renders, both logos served from this host, links to
tacc.utexas.edu and utexas.edu.
Counts are TACC's own: 55 models, 213 datasets, 5,998 regions, 668 variables.
Anonymous browsing is not bounced. The page loads with a Sign In button and the counts
render with no login.
env-config.js reads AUTH_CLIENT_ID: "mint", EXECUTION_ENGINE: "tapis",
BRANDING: "tacc".

Three things outlive this ticket

The served env-config.js beats Carry BRANDING from the MINT chart to the pod at TACC #207's kubectl exec check. It is the file the browser
gets. Read it at the host.
A stale token in a browser profile reads as a forced-login regression. My first load went
straight to Tapis. An isolated context proved the app does not bounce anonymous visitors.
Check in a clean context before filing that bug.
The region filter still defaults to California, where TACC has nothing. Signed in, the
problem statement list showed 1 item. This is the first screen
#80 hands the client. Say "switch to
Texas" in the handover, or it reads as an empty deployment.

One thing to file

Lit's config.js published REACT_APP_DATA_CATALOG_KEY, a CKAN JWT, to every visitor. The flip
stops publishing it. Rotate the key when
#81 retires Lit.

Navigation Menu

Repository navigation

Flip mint.tacc.utexas.edu to ui-react #77

Question

8 remaining items

TACC deployment, read from outside on 2026-09-12

The finding: the pinned image has no branding

A trap in the acceptance check

State confirmed

One thing to file separately

Flipped 2026-09-12. Verified from outside; two checks still need a login.

Proven

The render matched the deploy

Still open on this ticket

One thing to file

Done. `mint.tacc.utexas.edu` serves `ui-react`, signed in, at the real origin.

1. The OAuth2 round trip — the thing #76 could not prove

2. The delete round trip — the #116 constraint

Also confirmed

Three things outlive this ticket

One thing to file

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Flip mint.tacc.utexas.edu to ui-react #77

Description

Question

Activity

mosoriob commented on Aug 8, 2026

mosoriob commented on Aug 9, 2026

8 remaining items

mosoriob commented on Aug 11, 2026

mosoriob commented on Aug 30, 2026

mosoriob commented on Aug 30, 2026

mosoriob commented on Sep 12, 2026

mosoriob commented on Sep 12, 2026

mosoriob commented on Sep 12, 2026

TACC deployment, read from outside on 2026-09-12

The finding: the pinned image has no branding

A trap in the acceptance check

State confirmed

One thing to file separately

mosoriob commented on Sep 12, 2026

Flipped 2026-09-12. Verified from outside; two checks still need a login.

Proven

The render matched the deploy

Still open on this ticket

One thing to file

mosoriob commented on Sep 12, 2026

Done. mint.tacc.utexas.edu serves ui-react, signed in, at the real origin.

1. The OAuth2 round trip — the thing #76 could not prove

2. The delete round trip — the #116 constraint

Also confirmed

Three things outlive this ticket

One thing to file

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Done. `mint.tacc.utexas.edu` serves `ui-react`, signed in, at the real origin.