auto-data-snapshot: 2026-09-02T11:28:31 (2 data files) — arm-webhook.sh.DISABLED-duplicate-webhook-2026-09-02 verification/tk11114-remediation/RUNBOOK.md

e8c174a0c446a8bebecf61ae41b4b29235642581 · 2026-09-02 11:28:33 -0700 · auto-commit-fleet
Files touched

A arm-webhook.sh.DISABLED-duplicate-webhook-2026-09-02
A verification/tk11114-remediation/RUNBOOK.md
Diff

commit e8c174a0c446a8bebecf61ae41b4b29235642581
Author: auto-commit-fleet <steve@designerwallcoverings.com>
Date:   Wed Sep 2 11:28:33 2026 -0700

    auto-data-snapshot: 2026-09-02T11:28:31 (2 data files) — arm-webhook.sh.DISABLED-duplicate-webhook-2026-09-02 verification/tk11114-remediation/RUNBOOK.md
---
 ...ebhook.sh.DISABLED-duplicate-webhook-2026-09-02 | 24 +++++++++++++++++
 verification/tk11114-remediation/RUNBOOK.md        | 31 ++++++++++++++++++++++
 2 files changed, 55 insertions(+)

diff --git a/arm-webhook.sh.DISABLED-duplicate-webhook-2026-09-02 b/arm-webhook.sh.DISABLED-duplicate-webhook-2026-09-02
new file mode 100644
index 0000000..38ce542
--- /dev/null
+++ b/arm-webhook.sh.DISABLED-duplicate-webhook-2026-09-02
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# TK-11114 Part C — register the customers/create webhook so every DW signup triggers
+# the verify letter. Idempotent: skips if one is already registered. Run as Steve:
+#   ! bash ~/Projects/dw-signup-fulfillment/arm-webhook.sh
+# PREREQ (Part B): the LIVE service must already have WEBHOOK_URL_TOKEN (matching secrets)
+# + VERIFY_SECRET + VERIFIED_TAG=verified-sample + PUBLIC_URL, or the webhook fires but the
+# verify letter 503s. And Part A (the Regios verified-sample rule) must exist first.
+set -euo pipefail
+SHOP="designer-laboratory-sandbox.myshopify.com"
+BASE="https://$SHOP/admin/api/2024-10"
+PUBLIC_URL="https://signup.designerwallcoverings.com"
+FT="$(grep -E '^SHOPIFY_FULFILLMENT_TOKEN=' "$HOME/Projects/secrets-manager/.env" | cut -d= -f2-)"
+WT="$(grep -E '^WEBHOOK_URL_TOKEN=' "$HOME/Projects/secrets-manager/.env" | cut -d= -f2-)"
+[ -z "$WT" ] && { echo "ABORT: WEBHOOK_URL_TOKEN not in secrets-manager/.env"; exit 1; }
+
+existing="$(curl -s "$BASE/webhooks.json?topic=customers/create" -H "X-Shopify-Access-Token: $FT" \
+  | python3 -c "import sys,json;print(len(json.load(sys.stdin).get('webhooks',[])))")"
+if [ "$existing" != "0" ]; then echo "Already registered ($existing customers/create webhook). Nothing to do."; exit 0; fi
+
+printf '{"webhook":{"topic":"customers/create","address":"%s/webhooks/customers/create/%s","format":"json"}}' "$PUBLIC_URL" "$WT" > /tmp/dw-webhook.json
+resp="$(curl -s -X POST "$BASE/webhooks.json" -H "X-Shopify-Access-Token: $FT" -H "Content-Type: application/json" --data @/tmp/dw-webhook.json)"
+echo "$resp" | python3 -c "import sys,json
+w=json.load(sys.stdin).get('webhook')
+print('REGISTERED webhook id =',w['id'],'-> rollback: DELETE /webhooks/'+str(w['id'])+'.json') if w else print('FAIL:',sys.stdin.read()[:400])"
diff --git a/verification/tk11114-remediation/RUNBOOK.md b/verification/tk11114-remediation/RUNBOOK.md
new file mode 100644
index 0000000..529ca70
--- /dev/null
+++ b/verification/tk11114-remediation/RUNBOOK.md
@@ -0,0 +1,31 @@
+# TK-11114 — Execution Runbook (finalizer: /root, blocked from autonomous prod SSH)
+
+Mac2 is classifier-blocked from prod SSH (read AND write), confirmed 2026-09-02.
+The remaining repair is entirely gated prod/Shopify/send actions → Steve pastes via `!`.
+Remediation is identical under both root-cause theories (message_class drift vs stale
+GEORGE_BASIC_AUTH override): deploy the 2 files + restart with a clean env covers both.
+
+## Deploy scope (exactly 2 files — config.js UNCHANGED)
+- lib/email.js  sha256 e442f36f8e676096d29bc85cd20ddce6f0b59dc8e24606ede00bd4ef86a62c12  (git blob d215204913a0)
+- lib/verify.js sha256 14498fdd4a50207e727059cce65b1ed414922550c5d05986669db2ea837011e4  (git blob 356cdcdc93a9)
+Both carry the credential-safe un-swallow logging; email.js also restores `message_class:'transactional'`.
+
+## Prod facts
+host root@45.61.58.125 · dir /root/Projects/dw-signup-fulfillment · pm2 `dw-signup-fulfillment` · PORT 9862 · health :9862/healthz · DRY_RUN=0
+
+## BLOCK A — read-only diagnosis + reversible deploy + restart (Steve pastes on Mac2)
+Guarded with && so it aborts before harm; timestamped .bak backups taken before overwrite.
+(see the inline paste handed in chat)
+
+## BLOCK B — R4 (run only after BLOCK A reports healthz ok)
+1. Create ONE controlled customer (r4.js create) → LIVE customers/create webhook fires organically.
+2. /root drives (non-gated): George inbox search for the verify email, extract + click verify link.
+3. r4.js get <id> → prove verified-sample tag + custom.sample_verify_sent + custom.sample_verified persist.
+4. Replay same webhook → prove idempotency (no duplicate send).
+5. Negative: bad token → 401.
+6. r4.js delete <id> → confirm 404 (cleanup).
+
+## Rollback (per mutation) — see ROLLBACK-MAP.md
+- files: `cp lib/email.js.tk11114.bak.<ts> lib/email.js` (+ verify.js) then `pm2 restart dw-signup-fulfillment`
+- restart: `pm2 restart dw-signup-fulfillment`
+- test customer: `node r4.js delete <TEST_ID>`
← 9e5aa29 prevent customer data in George failure logs · back to Dw Signup Fulfillment · prove TK-11114 signup email remediation end to end e393474 →