← back to Allnewsdaily

Add approve ungate readiness launcher and verify error paths

07451f18ca5cb2a898199fdf30ad987c98ef2f9a · 2026-09-11 09:10:40 -0700 · Steve Abrams

Files touched

• M README.md
• A approve
• M verification/e2e-proof.json

Diff

commit 07451f18ca5cb2a898199fdf30ad987c98ef2f9a
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Sep 11 09:10:40 2026 -0700

    Add approve ungate readiness launcher and verify error paths
---
 README.md                   |  8 ++++++
 approve                     | 62 +++++++++++++++++++++++++++++++++++++++++++++
 verification/e2e-proof.json | 39 ++++++++++++++++++++++++++++
 3 files changed, 109 insertions(+)

diff --git a/README.md b/README.md
index c6035fa..0197380 100644
--- a/README.md
+++ b/README.md
@@ -20,3 +20,11 @@ node server.js
 The checker hits `https://www.youtube.com/channel/<id>/live`. If the response HTML
 contains `hlsManifestUrl` (or `"isLive":true` / `"isLiveNow":true`), the outlet is
 flagged live and the LIVE pill links to that exact stream.
+
+## Proxy cutover readiness (TK-11340)
+
+Run `bash approve ungate` to check the prerequisites for the already-authorized
+proxy cutover. This command checks local configuration and checker syntax; it
+does not deploy. Exit 2 means missing or invalid configuration; exit 3 means a
+proxy URL exists but still needs real validation. Exit 64 indicates invalid usage.
+Follow `verification/TK-11340-cutover.md` for the canary, cutover and rollback.
diff --git a/approve b/approve
new file mode 100644
index 0000000..cbe9c6c
--- /dev/null
+++ b/approve
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# TK-11340 readiness entry point. User authorization is already recorded.
+# This checks prerequisites; it does not purchase a proxy or deploy the cutover.
+set -euo pipefail
+
+if [[ $# -ne 1 || "$1" != "ungate" ]]; then
+  echo 'Usage: bash approve ungate' >&2
+  exit 64
+fi
+
+cd -- "$(dirname -- "${BASH_SOURCE[0]}")"
+echo 'TK-11340: cutover approval recorded; checking prerequisites.'
+node --check scripts/check-live.js
+
+# Read configuration as data, never source an env file or print its values.
+node <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+
+function readProxy(file) {
+  let data;
+  try { data = fs.readFileSync(file, 'utf8'); }
+  catch (error) {
+    if (error.code === 'ENOENT') return '';
+    console.error('BLOCKED: unable to read proxy configuration; details suppressed.');
+    process.exit(2);
+  }
+  for (const line of data.split(/\r?\n/)) {
+    const match = line.match(/^\s*(?:export\s+)?PROXY_URL\s*=\s*(.*?)\s*$/);
+    if (!match) continue;
+    let value = match[1];
+    if ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
+    if (value) return value;
+  }
+  return '';
+}
+
+const proxy = process.env.PROXY_URL || readProxy(path.resolve('.env')) ||
+  readProxy(path.join(os.homedir(), 'Projects', 'secrets-manager', '.env'));
+
+if (!proxy) {
+  console.error('BLOCKED: PROXY_URL is missing from the process, project, and master registry.');
+  console.error('Needed: approved proxy endpoint credentials, routed through the secrets skill.');
+  console.error('No production or Mac push settings were changed.');
+  process.exit(2);
+}
+
+try {
+  const url = new URL(proxy);
+  if (!['http:', 'https:'].includes(url.protocol) || !url.hostname) throw new Error();
+} catch {
+  console.error('BLOCKED: PROXY_URL is not a valid HTTP(S) proxy URL; value suppressed.');
+  process.exit(2);
+}
+
+console.log('Proxy configuration found. Credentials have not yet been tested.');
+console.log('NEXT: run the real Kamatera proxy canary, then the authorized cutover in');
+console.log('verification/TK-11340-cutover.md. This readiness command does not deploy.');
+process.exit(3);
+NODE
diff --git a/verification/e2e-proof.json b/verification/e2e-proof.json
index 7775f48..ac34e21 100644
--- a/verification/e2e-proof.json
+++ b/verification/e2e-proof.json
@@ -115,5 +115,44 @@
     },
     "verdict": "BLOCKED: missing proxy endpoint credentials; execution approval cleared",
     "side_effects": "No production writes."
+  },
+  "approve_launcher": {
+    "timestamp": "2026-09-11T16:07:32.613419+00:00",
+    "intent": "Create and run the exact user-requested bash approve ungate command as an explicit readiness entry point",
+    "risk_tier": "R1",
+    "checks": [
+      {
+        "command": "bash -n approve",
+        "verdict": "PASS",
+        "exit_code": 0
+      },
+      {
+        "command": "bash approve ungate",
+        "verdict": "PASS",
+        "exit_code": 2,
+        "assertion": "Real entry point reports absent proxy configuration; no cutover claimed."
+      },
+      {
+        "command": "bash approve unknown",
+        "verdict": "PASS",
+        "exit_code": 64,
+        "assertion": "Unsupported command rejected."
+      },
+      {
+        "command": "PROXY_URL=<invalid fixture> bash approve ungate",
+        "verdict": "PASS",
+        "exit_code": 2,
+        "assertion": "Malformed URL rejected without printing value."
+      },
+      {
+        "command": "PROXY_URL=<loopback fixture with synthetic credentials> bash approve ungate",
+        "verdict": "PASS",
+        "exit_code": 3,
+        "assertion": "Configured URL remains unverified; synthetic credentials not printed; no network request or deployment."
+      }
+    ],
+    "cleanup": "No persistent test credentials, service changes or production writes. Fixtures scoped to individual processes.",
+    "launcher_verdict": "PASS",
+    "replacement_verdict": "BLOCKED: real proxy credentials and cutover verification still missing."
   }
 }

← f1a4b4e Record cutover approval and reverify missing proxy credentia  ·  back to Allnewsdaily  ·  Fix live detection through residential proxy: anchor on live acde7bd →