`verification/TK-11340-cutover.md`

75 lines
# TK-11340: proxy cutover readiness

Status: **BLOCKED — proxy credentials unavailable**, rechecked September 11, 2026.

The existing ticket records Steve's provider/spend approval. Do not ask him to
choose a provider again. No purchase, deployment, service restart, credential
mutation, or pusher retirement was performed in this run.

## Verified current state

- Production has proxy-capable checker code, but the running `allnewsdaily` PM2
  service has no `PROXY_URL`. Production project env has no proxy assignment.
- Local project env, master secrets env, and registry route key names yielded no
  proxy/Webshare credentials. Prior owner asked for a later handoff in M-02941.
- Production `data/live-static.flag` exists. Mac live-push job is loaded and its
  last exit status is zero.
- Production health returned 20 outlets, 15 live, and status-file timestamp
  `2026-09-11T00:56:57.132Z`. This proves the existing path, not proxy independence.
- Local checker passes syntax validation. Local `https-proxy-agent` installation
  is absent; install from the existing lockfile before local proxy testing.

## Pending gated execution

Prerequisite: Steve provides the approved account's proxy endpoint credentials.
Route and verify them with the secrets skill; never paste them into tickets or
command output. Do not infer that an ISP address works with YouTube until tested.
Steve explicitly authorized the documented cutover with "ungate abnd run" and
"go" on September 11, 2026. Execution approval is cleared; proxy credentials
and successful canary verification remain technical prerequisites.

1. Install locked dependencies in an isolated canary checkout. Configure the
   approved proxy through the secrets workflow, and prove CONNECT authentication,
   compressed response handling and actual YouTube live detection from Kamatera.
   Write canary results outside the production status path. Compare known live
   channels and video IDs, and exercise rejected credentials/failure recovery.
2. Snapshot current app version, service settings, static flag, status file and
   launchd job. Keep secrets out of evidence. Rehearse rollback before cutover.
3. Load the proxy into the running service's environment using the approved
   deployment process. Merely writing `.env` does not update the already-running
   Node process; checker children inherit the parent's environment. Retain static
   mode while preparing and checking the process environment.
4. Stop the Mac live-push job and wait for any in-flight checker/rsync/SSH to
   finish. Only then clear the production static flag. The pusher recreates that
   flag on every run, so clearing it first races the next push.
5. Verify production generates fresh status for at least three complete polling
   cycles with the Mac pusher disabled. Correlate checker logs, per-outlet
   timestamps, `/api/health`, `/api/outlets` and rendered LIVE links. A fresh file
   timestamp alone does not establish successful proxy fetches.
6. Independently verify the result, monitor errors and freshness, and only then
   mark the ticket done. The existing workaround review date is October 9, 2026.

Rollback: first restore static mode to prevent more production checker runs,
drain any active checker, restore the saved service/status state as necessary,
then bootstrap the Mac pusher and verify a successful push and fresh health.

## Diagnostic incident

The first PM2 metadata query exceeded Node's default subprocess output buffer.
The thrown exception included raw environment output containing credentials.
The retry used a larger buffer and suppressed exception details. No values are
copied into this report. A security owner should assess exposure and stage any
required rotation for Steve; no credentials were changed during this task.

Evidence: `verification/e2e-proof.json`. Critical proxy and cutover journeys are
explicitly skipped, so this is a readiness handoff, not completed replacement.

## September 11 resume

Read-only production recheck: service online, proxyConfigured=false, no proxy
assignment in project env, static flag still present. Health: 20 outlets, 17
live; status timestamp `2026-09-11T15:16:28.326Z`. Local project/master env and
registry/routes contain no proxy/Webshare keys. No production mutation occurred.
The ungate dry-run classified this memo as reversible remote (Tier B); explicit
user execution authorization supersedes its generic approval requirement.