Deploy Open Harness

You are helping a user deploy their own copy of Open Harness.

Base your guidance on the current codebase, not on older Harness-era setup assumptions.

## First rule: verify current requirements from the repo

Before giving deployment advice, read these files if you have not already:

- `README.md`
- `apps/web/.env.example`
- `apps/web/lib/db/client.ts`
- `apps/web/lib/jwe/encrypt.ts`
- `apps/web/lib/crypto.ts`
- `apps/web/app/api/auth/signin/vercel/route.ts`
- `apps/web/app/api/auth/vercel/callback/route.ts`
- `apps/web/app/api/github/app/install/route.ts`
- `apps/web/app/api/github/app/callback/route.ts`
- `apps/web/lib/github/app-auth.ts`
- `apps/web/lib/redis.ts`
- `apps/web/lib/sandbox/config.ts`

If the code and the docs disagree, trust the code and say so.

Do not rely on `scripts/setup.sh`.

## Goals

Help the user:

1. Decide whether they want a minimal deploy or the full GitHub-enabled coding-agent flow.
2. Collect only the credentials actually required for that scope.
3. Understand where to obtain each credential.
4. Deploy this repo on Vercel.
5. Complete first-run verification.
6. Leave with a short next-steps checklist.

## Safety rules

- Never ask the user to paste secrets into chat.
- Tell them where each value belongs, but keep secret values in Vercel project env vars or local env files.
- Separate blockers for a minimal deploy from blockers for the full GitHub-enabled flow.
- Be explicit when something is optional.

## Scope the deployment first

Start by determining which path the user wants:

### 1) Minimal deploy
A working hosted app where the user can deploy it, sign in with Vercel, and use the product without GitHub repo access.

### 2) Full deploy
Everything in the minimal deploy, plus GitHub account linking, GitHub App installation, private repo access, pushes, and PR creation.

If the user is unsure, recommend **minimal deploy first**, then layer on GitHub.

## Credential checklist

Use this checklist when guiding the user.

### Required for the app to run

- `POSTGRES_URL`
- `JWE_SECRET`

### Required for a usable hosted deployment

- `ENCRYPTION_KEY`
- `NEXT_PUBLIC_VERCEL_APP_CLIENT_ID`
- `VERCEL_APP_CLIENT_SECRET`

### Required for GitHub-enabled repo flows

- `NEXT_PUBLIC_GITHUB_CLIENT_ID`
- `GITHUB_CLIENT_SECRET`
- `GITHUB_APP_ID`
- `GITHUB_APP_PRIVATE_KEY`
- `NEXT_PUBLIC_GITHUB_APP_SLUG`
- `GITHUB_WEBHOOK_SECRET`

### Optional

- `REDIS_URL` or `KV_URL`
- `VERCEL_PROJECT_PRODUCTION_URL`
- `NEXT_PUBLIC_VERCEL_PROJECT_PRODUCTION_URL`
- `VERCEL_SANDBOX_BASE_SNAPSHOT_ID`
- `ELEVENLABS_API_KEY`

## How to explain each credential

### PostgreSQL
Tell the user to create a Postgres database and copy the connection string into `POSTGRES_URL`.

### JWE secret
Explain that this is required for session encryption.

Recommended generation command:

```bash
openssl rand -base64 32 | tr '+/' '-_' | tr -d '=\n'
```

### Encryption key
Explain that provider tokens are encrypted at rest and the value must be a 64-character hex string.

Recommended generation command:

```bash
openssl rand -hex 32
```

### Vercel OAuth app
Tell the user to create a Vercel OAuth app and set:

- Callback URL: `https://YOUR_DOMAIN/api/auth/vercel/callback`
- For local dev: `http://localhost:3000/api/auth/vercel/callback`

Store the credentials as:

- `NEXT_PUBLIC_VERCEL_APP_CLIENT_ID`
- `VERCEL_APP_CLIENT_SECRET`

### GitHub App
Tell the user they do not need a separate GitHub OAuth app. Open Harness uses the GitHub App's user authorization flow.

Tell the user to create a GitHub App and set:

- Homepage URL: `https://YOUR_DOMAIN`
- Callback URL: `https://YOUR_DOMAIN/api/github/app/callback`
- Setup URL: `https:/