← back to Allnewsdaily

verification/e2e-proof.json

159 lines

{
  "ticket": "TK-11340-replace-allnewsdaily-residential-mac-liv",
  "intent": "Replace Mac residential live-status push with production-owned proxy polling",
  "risk_tier": "R3 integration readiness; R4 cutover held",
  "environment": "Mac local repository and read-only Kamatera production",
  "build_commit": "bf0d0443b2595b3017ba89873b47cf896d36f2b3",
  "timestamp": "2026-09-11T00:58:54.359911+00:00",
  "baseline": "Clean worktree; proxy support already committed and deployed; prior spend approval recorded in ticket and archived memo.",
  "commands_executed": [
    "tk inbox; tk show; tk take; tk log; tk comment; tk dm",
    "git status --short; git log; git rev-parse HEAD",
    "Read scripts/check-live.js, scripts/push-live-status.sh, server.js, package.json and archived approval",
    "Credential-key presence checks only in local project env and master registry",
    "SSH read-only static flag, checker source and project env metadata checks",
    "SSH sanitized PM2 metadata check and curl http://127.0.0.1:9962/api/health",
    "launchctl list com.steve.allnewsdaily-live-push",
    "pmset -g; pgrep -fl caffeinate; screensaver idleTime read",
    "node --check scripts/check-live.js",
    "npm ls https-proxy-agent --depth=0"
  ],
  "checks": [
    {
      "boundary": "source",
      "verdict": "PASS",
      "evidence": "Proxy support exists locally and on production; checker syntax valid."
    },
    {
      "boundary": "credentials",
      "verdict": "FAIL",
      "evidence": "No PROXY_URL/Webshare assignments found in inspected local project/master env, routes key names or production project env; running PM2 service proxyConfigured=false."
    },
    {
      "boundary": "service",
      "verdict": "PASS",
      "evidence": {
        "name": "allnewsdaily",
        "status": "online",
        "staticFlag": true,
        "LIVE_STATIC_env": false,
        "proxyConfigured": false
      }
    },
    {
      "boundary": "api",
      "verdict": "PASS",
      "scope": "Existing Mac-fed service only",
      "evidence": {
        "ok": true,
        "outlets": 20,
        "liveOutlets": 15,
        "lastStatusFile": "2026-09-11T00:56:57.132Z"
      }
    },
    {
      "boundary": "producer",
      "verdict": "PASS",
      "evidence": "Mac launchd live-push job loaded; LastExitStatus=0. Push script recreates static flag after each transfer."
    },
    {
      "boundary": "local_dependencies",
      "verdict": "FAIL",
      "evidence": "npm ls https-proxy-agent --depth=0 returns empty; install locked dependencies before local proxy tests."
    },
    {
      "boundary": "power",
      "verdict": "PASS",
      "evidence": "sleep=0, displaysleep=0, disksleep=0, screensaver idleTime=0 and persistent caffeinate -dimsu present."
    },
    {
      "boundary": "real_proxy_happy_path",
      "verdict": "SKIP",
      "critical": true,
      "reason": "No proxy credentials available."
    },
    {
      "boundary": "proxy_auth_failure_and_recovery",
      "verdict": "SKIP",
      "critical": true,
      "reason": "No proxy credentials available; production changes gated."
    },
    {
      "boundary": "Mac_independence_over_three_cycles",
      "verdict": "SKIP",
      "critical": true,
      "reason": "Cutover not performed."
    },
    {
      "boundary": "rollback_rehearsal",
      "verdict": "SKIP",
      "critical": true,
      "reason": "Production changes gated."
    }
  ],
  "negative_checks": "Proxy credentials missing. Initial PM2 execFileSync exceeded default output buffer; its exception exposed environment data. Retry used 64 MiB buffer and suppressed exception output. No secret values retained in these artifacts.",
  "cleanup_rollback": "No production writes, process restarts, purchases or launchd changes. Existing pusher retained. No credentials rotated.",
  "handoff": "M-02941 asked prior owner for later credential handoff location only.",
  "verdict": "BLOCKED",
  "next_action": "Supply approved proxy endpoint credentials; validate and route through secrets, then execute already-authorized canary and cutover.",
  "resume": {
    "timestamp": "2026-09-11T15:18:55.321751+00:00",
    "authorization": "User explicitly said ungate abnd run, then go; documented cutover authorized.",
    "commands": [
      "ungate-auditor/audit.mjs --dry-run --only TK-11340-proxy-cutover-credentials",
      "Local key-presence checks; no values printed",
      "Read-only SSH sanitized PM2/project env checks and /api/health"
    ],
    "observed": {
      "status": "online",
      "proxyConfigured": false,
      "envProxyAssignmentPresent": false,
      "staticFlag": true,
      "outlets": 20,
      "liveOutlets": 17,
      "lastStatusFile": "2026-09-11T15:16:28.326Z"
    },
    "verdict": "BLOCKED: missing proxy endpoint credentials; execution approval cleared",
    "side_effects": "No production writes."
  },
  "approve_launcher": {
    "timestamp": "2026-09-11T16:07:32.613419+00:00",
    "intent": "Create and run the exact user-requested bash approve ungate command as an explicit readiness entry point",
    "risk_tier": "R1",
    "checks": [
      {
        "command": "bash -n approve",
        "verdict": "PASS",
        "exit_code": 0
      },
      {
        "command": "bash approve ungate",
        "verdict": "PASS",
        "exit_code": 2,
        "assertion": "Real entry point reports absent proxy configuration; no cutover claimed."
      },
      {
        "command": "bash approve unknown",
        "verdict": "PASS",
        "exit_code": 64,
        "assertion": "Unsupported command rejected."
      },
      {
        "command": "PROXY_URL=<invalid fixture> bash approve ungate",
        "verdict": "PASS",
        "exit_code": 2,
        "assertion": "Malformed URL rejected without printing value."
      },
      {
        "command": "PROXY_URL=<loopback fixture with synthetic credentials> bash approve ungate",
        "verdict": "PASS",
        "exit_code": 3,
        "assertion": "Configured URL remains unverified; synthetic credentials not printed; no network request or deployment."
      }
    ],
    "cleanup": "No persistent test credentials, service changes or production writes. Fixtures scoped to individual processes.",
    "launcher_verdict": "PASS",
    "replacement_verdict": "BLOCKED: real proxy credentials and cutover verification still missing."
  }
}