`verification/tk11114/FIX-PASTE.md`

29 lines
# ⛔ SUPERSEDED / DO NOT RUN — 2026-09-02
# This webhook-token paste chased a theory functional tests DISPROVED (live webhook token
# already matches …e9c9; same wrong diagnosis that neutralized refresh-webhook.sh).
# The correct pending action is verification/tk11114-remediation/BLOCK-A-PASTE.md

# TK-11114 — the ONE fix paste (Steve runs; gated prod change)

**What it does (durable):** on Kamatera, aligns the service's `WEBHOOK_URL_TOKEN` to the
registered webhook's token (`…e9c9`, pulled from secrets-manager — confirmed byte-identical,
sha `8ab7a3a16ad4`), keeps `DRY_RUN:'0'`, backs up the ecosystem for rollback, restarts
`--update-env`, and self-verifies (healthz `dry_run:false`; bad token → 401; `e9c9` → 200).
Fixes the token mismatch a concurrent restart introduced (running `00e1` ≠ registered `e9c9`).

```
! ssh root@45.61.58.125 'set -e; cd /root/Projects/dw-signup-fulfillment; WT=$(grep -E "^WEBHOOK_URL_TOKEN=" /root/Projects/secrets-manager/.env | head -1 | cut -d= -f2- | tr -d "\"" ); echo "aligning service token -> last4=${WT: -4} (want e9c9)"; cp ecosystem.config.js ecosystem.config.js.bak.tk11114; sed -i "s/61a971f3660e64e217a692ba7c4e1cfebb87ea9573f100e1/$WT/g" ecosystem.config.js; grep -nE "WEBHOOK_URL_TOKEN|DRY_RUN" ecosystem.config.js; pm2 restart dw-signup-fulfillment --update-env; sleep 2; echo "== healthz =="; curl -s http://127.0.0.1:9862/healthz; echo; curl -s -o /dev/null -w "badtoken http=%{http_code} (want 401)\n" -X POST http://127.0.0.1:9862/webhooks/customers/create/bogus -H "Content-Type: application/json" -d "{}"; curl -s -o /dev/null -w "e9c9 http=%{http_code} (want 200)\n" -X POST "http://127.0.0.1:9862/webhooks/customers/create/$WT" -H "Content-Type: application/json" -d "{}"'
```

**Expected output:** `dry_run:false`, `badtoken http=401`, `e9c9 http=200`.

**Rollback (if anything looks wrong):**
```
! ssh root@45.61.58.125 'cd /root/Projects/dw-signup-fulfillment && cp ecosystem.config.js.bak.tk11114 ecosystem.config.js && pm2 restart dw-signup-fulfillment --update-env && curl -s http://127.0.0.1:9862/healthz'
```

**After it's green:** tell me, and I run the controlled `+dwgolive` test signup (step 3) — the
un-swallow logging (already deployed) will now show George's real response, proving the verify
email actually sends (or revealing the exact next fix). Then verify-click → `verified-sample`
tag → cleanup.