Related bounty or source issue
Bounty #932 (accepted proposed-work requests, round 3)
Related scripts: scripts/check_deploy_ready.py, docs/admin-runbook.md
Problem
Deploy readiness already validates that MERGEWORK_PUBLIC_BASE_URL is present and looks like an HTTP(S) URL, but operators can still pass whitespace-padded or slash-only variants that later break absolute link construction in admin/public pages (for example a value that strips to empty after normalization, or "/" / "https://" incomplete hosts).
This is distinct from treasury-executor env validation (#814) and OAuth callback registration (#1146/#1185).
Evidence
Checked against current origin/main patterns used by scripts/check_deploy_ready.py and public URL helpers. Related proposed-work already covers treasury executor (#814) and staging dry-run identity (#813); public base URL canonicalization/edge forms are not covered by those issues.
Proposed work
Extend scripts/check_deploy_ready.py to reject blank-after-strip, scheme-only, and host-missing MERGEWORK_PUBLIC_BASE_URL values with a clear CLI error before other readiness checks continue. Add a focused unit/smoke test for the rejection cases.
Expected value
Prevents green deploy-readiness while the app would later emit broken absolute links; reduces production foot-guns for operators.
Reference tier
25-100 MRWK: small docs, typo, reproduction, triage
Acceptance or test notes
MERGEWORK_PUBLIC_BASE_URL=' ' fails readiness with a clear messageMERGEWORK_PUBLIC_BASE_URL='https://' fails readiness- A normal
https://example.com value still passes
Duplicate search
Searched open proposed-work for public-base-url / deploy readiness overlaps; #814 covers treasury executor envs, #813 staging dry-run identity, #815 report API host args. No open issue specifically for public base URL edge forms.
Out of scope
Changing runtime URL builders, migrating existing env files, or altering OAuth callback path registration.
Related bounty or source issue
Bounty #932 (accepted proposed-work requests, round 3)
Related scripts:
scripts/check_deploy_ready.py,docs/admin-runbook.mdProblem
Deploy readiness already validates that
MERGEWORK_PUBLIC_BASE_URLis present and looks like an HTTP(S) URL, but operators can still pass whitespace-padded or slash-only variants that later break absolute link construction in admin/public pages (for example a value that strips to empty after normalization, or"/"/"https://"incomplete hosts).This is distinct from treasury-executor env validation (#814) and OAuth callback registration (#1146/#1185).
Evidence
Checked against current
origin/mainpatterns used byscripts/check_deploy_ready.pyand public URL helpers. Related proposed-work already covers treasury executor (#814) and staging dry-run identity (#813); public base URL canonicalization/edge forms are not covered by those issues.Proposed work
Extend
scripts/check_deploy_ready.pyto reject blank-after-strip, scheme-only, and host-missingMERGEWORK_PUBLIC_BASE_URLvalues with a clear CLI error before other readiness checks continue. Add a focused unit/smoke test for the rejection cases.Expected value
Prevents green deploy-readiness while the app would later emit broken absolute links; reduces production foot-guns for operators.
Reference tier
25-100 MRWK: small docs, typo, reproduction, triage
Acceptance or test notes
MERGEWORK_PUBLIC_BASE_URL=' 'fails readiness with a clear messageMERGEWORK_PUBLIC_BASE_URL='https://'fails readinesshttps://example.comvalue still passesDuplicate search
Searched open proposed-work for public-base-url / deploy readiness overlaps; #814 covers treasury executor envs, #813 staging dry-run identity, #815 report API host args. No open issue specifically for public base URL edge forms.
Out of scope
Changing runtime URL builders, migrating existing env files, or altering OAuth callback path registration.