← back to Allnewsdaily
Document verified proxy cutover blocker and corrected handoff
db75327923c869c9176d96abdbf41504f9cc16b3 · 2026-09-10 17:59:19 -0700 · Steve Abrams
Files touched
A verification/TK-11340-cutover.mdA verification/e2e-proof.json
Diff
commit db75327923c869c9176d96abdbf41504f9cc16b3
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Thu Sep 10 17:59:19 2026 -0700
Document verified proxy cutover blocker and corrected handoff
---
verification/TK-11340-cutover.md | 63 +++++++++++++++++++++++++
verification/e2e-proof.json | 99 ++++++++++++++++++++++++++++++++++++++++
2 files changed, 162 insertions(+)
diff --git a/verification/TK-11340-cutover.md b/verification/TK-11340-cutover.md
new file mode 100644
index 0000000..f51b56e
--- /dev/null
+++ b/verification/TK-11340-cutover.md
@@ -0,0 +1,63 @@
+# TK-11340: proxy cutover readiness
+
+Status: **BLOCKED — proxy credentials unavailable**, checked September 10, 2026.
+
+The existing ticket records Steve's provider/spend approval. Do not ask him to
+choose a provider again. No purchase, deployment, service restart, credential
+mutation, or pusher retirement was performed in this run.
+
+## Verified current state
+
+- Production has proxy-capable checker code, but the running `allnewsdaily` PM2
+ service has no `PROXY_URL`. Production project env has no proxy assignment.
+- Local project env, master secrets env, and registry route key names yielded no
+ proxy/Webshare credentials. Prior owner asked for a later handoff in M-02941.
+- Production `data/live-static.flag` exists. Mac live-push job is loaded and its
+ last exit status is zero.
+- Production health returned 20 outlets, 15 live, and status-file timestamp
+ `2026-09-11T00:56:57.132Z`. This proves the existing path, not proxy independence.
+- Local checker passes syntax validation. Local `https-proxy-agent` installation
+ is absent; install from the existing lockfile before local proxy testing.
+
+## Pending gated execution
+
+Prerequisite: Steve provides the approved account's proxy endpoint credentials.
+Route and verify them with the secrets skill; never paste them into tickets or
+command output. Do not infer that an ISP address works with YouTube until tested.
+Current user instruction requires production changes to remain held for approval.
+
+1. Install locked dependencies in an isolated canary checkout. Configure the
+ approved proxy through the secrets workflow, and prove CONNECT authentication,
+ compressed response handling and actual YouTube live detection from Kamatera.
+ Write canary results outside the production status path. Compare known live
+ channels and video IDs, and exercise rejected credentials/failure recovery.
+2. Snapshot current app version, service settings, static flag, status file and
+ launchd job. Keep secrets out of evidence. Rehearse rollback before cutover.
+3. Load the proxy into the running service's environment using the approved
+ deployment process. Merely writing `.env` does not update the already-running
+ Node process; checker children inherit the parent's environment. Retain static
+ mode while preparing and checking the process environment.
+4. Stop the Mac live-push job and wait for any in-flight checker/rsync/SSH to
+ finish. Only then clear the production static flag. The pusher recreates that
+ flag on every run, so clearing it first races the next push.
+5. Verify production generates fresh status for at least three complete polling
+ cycles with the Mac pusher disabled. Correlate checker logs, per-outlet
+ timestamps, `/api/health`, `/api/outlets` and rendered LIVE links. A fresh file
+ timestamp alone does not establish successful proxy fetches.
+6. Independently verify the result, monitor errors and freshness, and only then
+ mark the ticket done. The existing workaround review date is October 9, 2026.
+
+Rollback: first restore static mode to prevent more production checker runs,
+drain any active checker, restore the saved service/status state as necessary,
+then bootstrap the Mac pusher and verify a successful push and fresh health.
+
+## Diagnostic incident
+
+The first PM2 metadata query exceeded Node's default subprocess output buffer.
+The thrown exception included raw environment output containing credentials.
+The retry used a larger buffer and suppressed exception details. No values are
+copied into this report. A security owner should assess exposure and stage any
+required rotation for Steve; no credentials were changed during this task.
+
+Evidence: `verification/e2e-proof.json`. Critical proxy and cutover journeys are
+explicitly skipped, so this is a readiness handoff, not completed replacement.
diff --git a/verification/e2e-proof.json b/verification/e2e-proof.json
new file mode 100644
index 0000000..f5d0b4f
--- /dev/null
+++ b/verification/e2e-proof.json
@@ -0,0 +1,99 @@
+{
+ "ticket": "TK-11340-replace-allnewsdaily-residential-mac-liv",
+ "intent": "Replace Mac residential live-status push with production-owned proxy polling",
+ "risk_tier": "R3 integration readiness; R4 cutover held",
+ "environment": "Mac local repository and read-only Kamatera production",
+ "build_commit": "bf0d0443b2595b3017ba89873b47cf896d36f2b3",
+ "timestamp": "2026-09-11T00:58:54.359911+00:00",
+ "baseline": "Clean worktree; proxy support already committed and deployed; prior spend approval recorded in ticket and archived memo.",
+ "commands_executed": [
+ "tk inbox; tk show; tk take; tk log; tk comment; tk dm",
+ "git status --short; git log; git rev-parse HEAD",
+ "Read scripts/check-live.js, scripts/push-live-status.sh, server.js, package.json and archived approval",
+ "Credential-key presence checks only in local project env and master registry",
+ "SSH read-only static flag, checker source and project env metadata checks",
+ "SSH sanitized PM2 metadata check and curl http://127.0.0.1:9962/api/health",
+ "launchctl list com.steve.allnewsdaily-live-push",
+ "pmset -g; pgrep -fl caffeinate; screensaver idleTime read",
+ "node --check scripts/check-live.js",
+ "npm ls https-proxy-agent --depth=0"
+ ],
+ "checks": [
+ {
+ "boundary": "source",
+ "verdict": "PASS",
+ "evidence": "Proxy support exists locally and on production; checker syntax valid."
+ },
+ {
+ "boundary": "credentials",
+ "verdict": "FAIL",
+ "evidence": "No PROXY_URL/Webshare assignments found in inspected local project/master env, routes key names or production project env; running PM2 service proxyConfigured=false."
+ },
+ {
+ "boundary": "service",
+ "verdict": "PASS",
+ "evidence": {
+ "name": "allnewsdaily",
+ "status": "online",
+ "staticFlag": true,
+ "LIVE_STATIC_env": false,
+ "proxyConfigured": false
+ }
+ },
+ {
+ "boundary": "api",
+ "verdict": "PASS",
+ "scope": "Existing Mac-fed service only",
+ "evidence": {
+ "ok": true,
+ "outlets": 20,
+ "liveOutlets": 15,
+ "lastStatusFile": "2026-09-11T00:56:57.132Z"
+ }
+ },
+ {
+ "boundary": "producer",
+ "verdict": "PASS",
+ "evidence": "Mac launchd live-push job loaded; LastExitStatus=0. Push script recreates static flag after each transfer."
+ },
+ {
+ "boundary": "local_dependencies",
+ "verdict": "FAIL",
+ "evidence": "npm ls https-proxy-agent --depth=0 returns empty; install locked dependencies before local proxy tests."
+ },
+ {
+ "boundary": "power",
+ "verdict": "PASS",
+ "evidence": "sleep=0, displaysleep=0, disksleep=0, screensaver idleTime=0 and persistent caffeinate -dimsu present."
+ },
+ {
+ "boundary": "real_proxy_happy_path",
+ "verdict": "SKIP",
+ "critical": true,
+ "reason": "No proxy credentials available."
+ },
+ {
+ "boundary": "proxy_auth_failure_and_recovery",
+ "verdict": "SKIP",
+ "critical": true,
+ "reason": "No proxy credentials available; production changes gated."
+ },
+ {
+ "boundary": "Mac_independence_over_three_cycles",
+ "verdict": "SKIP",
+ "critical": true,
+ "reason": "Cutover not performed."
+ },
+ {
+ "boundary": "rollback_rehearsal",
+ "verdict": "SKIP",
+ "critical": true,
+ "reason": "Production changes gated."
+ }
+ ],
+ "negative_checks": "Proxy credentials missing. Initial PM2 execFileSync exceeded default output buffer; its exception exposed environment data. Retry used 64 MiB buffer and suppressed exception output. No secret values retained in these artifacts.",
+ "cleanup_rollback": "No production writes, process restarts, purchases or launchd changes. Existing pusher retained. No credentials rotated.",
+ "handoff": "M-02941 asked prior owner for later credential handoff location only.",
+ "verdict": "BLOCKED",
+ "next_action": "Steve supplies approved proxy account endpoint credentials; then validate through secrets workflow and obtain execution authorization for production cutover per current gate."
+}
← bf0d044 front page: Drudge-style photos — big splash photo + a lead
·
back to Allnewsdaily
·
auto-data-snapshot: 2026-09-10T20:45:30 (1 data files) — ver c46e8cf →