[object Object]

← back to Dw Signup Fulfillment

TK-11114: R4 proof — DW signup verify-email fixed + verified end-to-end

487679aac27d358c4c4836f861fa416ec1f56f12 · 2026-09-02 11:41:57 -0700 · Steve Abrams

Corrected the false 'missing webhook' premise; real faults were a silently-failing
George send (now status=200 after current-code redeploy + DRY_RUN=0) and a webhook
token drift (aligned running WEBHOOK_URL_TOKEN to the registered webhook's e9c9).
Controlled +dwgolive test: send->deliver->verify-click->verified-sample tag->cleanup
all PASS. Remaining backfill of missed signups is send-to-list, hard-gated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

Diff

commit 487679aac27d358c4c4836f861fa416ec1f56f12
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Sep 2 11:41:57 2026 -0700

    TK-11114: R4 proof — DW signup verify-email fixed + verified end-to-end
    
    Corrected the false 'missing webhook' premise; real faults were a silently-failing
    George send (now status=200 after current-code redeploy + DRY_RUN=0) and a webhook
    token drift (aligned running WEBHOOK_URL_TOKEN to the registered webhook's e9c9).
    Controlled +dwgolive test: send->deliver->verify-click->verified-sample tag->cleanup
    all PASS. Remaining backfill of missed signups is send-to-list, hard-gated.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 verification/tk11114/R4-VERIFIED.md          | 29 ++++++++++++++++++++++++++++
 verification/tk11114/r4-customer-after.json  |  1 +
 verification/tk11114/r4-customer-create.json |  1 +
 verification/tk11114/r4-test-customer.json   |  5 +++++
 verification/tk11114/r4-verify-click.html    |  1 +
 5 files changed, 37 insertions(+)

diff --git a/verification/tk11114/R4-VERIFIED.md b/verification/tk11114/R4-VERIFIED.md
new file mode 100644
index 0000000..4d385ad
--- /dev/null
+++ b/verification/tk11114/R4-VERIFIED.md
@@ -0,0 +1,29 @@
+# TK-11114 — R4 E2E Proof: VERIFIED (outage fixed) · 2026-09-02
+
+**Driver:** iterm-tk11114-webhook (Steve-assigned sole owner) · **Store:** designer-laboratory-sandbox.myshopify.com (LIVE)
+**Service:** dw-signup-fulfillment (Kamatera :9862) — post-fix state `dry_run:false`, `WEBHOOK_URL_TOKEN` aligned to the registered webhook (`…e9c9`).
+
+## What was actually broken (corrected root cause)
+NOT a missing webhook. Two real faults on the LIVE send path:
+1. **Verify-email send silently failed for 100% of signups** (George call failed, error swallowed) — the systemic cause of Kelly's report. Fixed by the current-code redeploy (un-swallow logging in `lib/email.js`/`lib/verify.js`) + `DRY_RUN=0`, so George now returns `status=200`.
+2. **Webhook token drift** — a concurrent restart left the running `WEBHOOK_URL_TOKEN=…00e1`, mismatching the month-old registered webhook (`…e9c9`); every real Shopify delivery would have 401'd. Fixed by aligning the service env to `…e9c9` (the registered token, confirmed byte-identical sha `8ab7a3a16ad4`).
+
+## Proof (controlled test customer 8412274655283, Steve-owned +dwgolive alias)
+| Check | Verdict | Evidence |
+|---|---|---|
+| webhook persisted + wired | PASS | probes: bad→401, e9c9→200, 00e1→401 |
+| real customers/create → handler | PASS | prod log `[webhook] customers/create id=8412274655283` |
+| George send | PASS | prod log `[email] sent via George: source=retail-verify status=200`; `retail result {"ok":true,dryRun:false}` |
+| verify email delivered (UTF-8-safe) | PASS | landed in steve-office inbox, subject "Confirm your email — your 3 complimentary samples are ready 🎁" |
+| verify click → tag | PASS | GET verify → 200 "all set/confirmed" |
+| `verified-sample` tag persisted | PASS | customer tags = `[tk11114-test, verified-sample]` |
+| negative (invalid token) | PASS | bad token → 401 |
+| duplicate-delivery idempotency | PARTIAL | simultaneous double-fire → 2 emails (flag not yet written); a later re-delivery correctly skips (`already_sent`). Eventual, not concurrency-safe. |
+| cleanup | PASS | DELETE 200 → GET 404 |
+
+## Remaining (GATED — not fired)
+- **Backfill**: real signups that got no email during the outage window (e.g. `jolainajones@me.com`, Kelly per TK-10830) still need their verify letter re-sent. This is a **send-to-list → hard-gated**; drafted, awaits Steve. Not executed here.
+- **Idempotency hardening** (optional): make the metafield write atomic/locked so a same-instant double-delivery can't double-send. Low severity.
+
+## Attribution note (honesty)
+The live service reached the correct state (e9c9 + dry_run:false) amid concurrent work by a sibling agent (codex-tk11114-remediation), which also redeployed the current code and ran its own test. I do not claim my paste alone achieved it; what is certain and proven is the **current end-to-end result works** (controlled test above).
diff --git a/verification/tk11114/r4-customer-after.json b/verification/tk11114/r4-customer-after.json
new file mode 100644
index 0000000..6e76072
--- /dev/null
+++ b/verification/tk11114/r4-customer-after.json
@@ -0,0 +1 @@
+{"customer":{"id":8412274655283,"created_at":"2026-09-02T11:38:33-07:00","updated_at":"2026-09-02T11:40:10-07:00","first_name":"DWTest","last_name":"TK11114R4","orders_count":0,"state":"disabled","total_spent":"0.00","last_order_id":null,"note":null,"verified_email":true,"multipass_identifier":null,"tax_exempt":false,"tags":"tk11114-test, verified-sample","last_order_name":null,"email":"steve+dwgolive-tk11114-r4-1788374313@designerwallcoverings.com","phone":null,"currency":"USD","addresses":[],"tax_exemptions":[],"email_marketing_consent":{"state":"not_subscribed","opt_in_level":"single_opt_in","consent_updated_at":null},"sms_marketing_consent":null,"admin_graphql_api_id":"gid:\/\/shopify\/Customer\/8412274655283"}}
\ No newline at end of file
diff --git a/verification/tk11114/r4-customer-create.json b/verification/tk11114/r4-customer-create.json
new file mode 100644
index 0000000..4d71e74
--- /dev/null
+++ b/verification/tk11114/r4-customer-create.json
@@ -0,0 +1 @@
+{"customer":{"first_name":"DWTest","last_name":"TK11114R4","tax_exempt":false,"id":8412274655283,"created_at":"2026-09-02T11:38:33-07:00","updated_at":"2026-09-02T11:38:33-07:00","orders_count":0,"state":"disabled","total_spent":"0.00","last_order_id":null,"note":null,"verified_email":true,"multipass_identifier":null,"tags":"tk11114-test","last_order_name":null,"email":"steve+dwgolive-tk11114-r4-1788374313@designerwallcoverings.com","phone":null,"currency":"USD","addresses":[],"tax_exemptions":[],"email_marketing_consent":{"state":"not_subscribed","opt_in_level":"single_opt_in","consent_updated_at":null},"sms_marketing_consent":null,"admin_graphql_api_id":"gid:\/\/shopify\/Customer\/8412274655283"}}
\ No newline at end of file
diff --git a/verification/tk11114/r4-test-customer.json b/verification/tk11114/r4-test-customer.json
new file mode 100644
index 0000000..5b49424
--- /dev/null
+++ b/verification/tk11114/r4-test-customer.json
@@ -0,0 +1,5 @@
+{
+  "id": 8412274655283,
+  "email": "steve+dwgolive-tk11114-r4-1788374313@designerwallcoverings.com",
+  "created_at": "2026-09-02T11:38:33-07:00"
+}
\ No newline at end of file
diff --git a/verification/tk11114/r4-verify-click.html b/verification/tk11114/r4-verify-click.html
new file mode 100644
index 0000000..0eff0a0
--- /dev/null
+++ b/verification/tk11114/r4-verify-click.html
@@ -0,0 +1 @@
+<!doctype html><meta charset="utf-8"><title>Designer Wallcoverings</title><body style="font:16px/1.6 -apple-system,system-ui,sans-serif;background:#faf9f7;color:#1a1a1a;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0"><a href="https://signup.designerwallcoverings.com/cdn-cgi/content?id=qkNzz19H6o7qtk1H2pytvbW46_WP4v2EZqIgzCyoovA-1788374409.3786964-1.2.1.1-xZrUXWIcPL.aykCC2JNJWrbjI6YsL0U.6sk1RbcgQnVYDHNB53FJAqEqOCP3G0zS" aria-hidden="true" rel="nofollow noopener" style="display: none !important; visibility: hidden !important"></a><div style="max-width:440px;text-align:center;padding:34px;border:1px solid #e5e2dd;border-radius:12px;background:#fff"><div style="font-size:16px;letter-spacing:3px;font-weight:600;color:#1a1a1a">DESIGNER WALLCOVERINGS</div><div style="font-size:44px;margin:14px 0 6px">🎁</div><h1 style="font-weight:600;font-size:20px;margin:6px 0 10px">You're all set</h1><p style="color:#4b5563;margin:0 0 18px">Email confirmed. Sign in with this address and your remaining 3-sample lifetime allowance applies automatically at checkout.</p><a href="https://designerwallcoverings.com" style="background:#1a1a1a;color:#fff;text-decoration:none;padding:12px 30px;border-radius:30px;font-size:14px;display:inline-block">Explore the Collections</a></div><script>(function(){function c(){var b=a.contentDocument||(a.contentWindow&&a.contentWindow.document);if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'a34ea43a997b9b19',t:'MTc4ODM3NDQwOQ=='};var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script></body>
\ No newline at end of file

← 7963d0a TK-11114: reconcile deploy paste — supersede stale webhook F  ·  back to Dw Signup Fulfillment  ·  TK-10830: one-shot guard on Kelly reply (prevent duplicate s 49e1750 →