`verification/tk11114-remediation/E2E-PROOF.md`

39 lines
# TK-11114 remediation — R4 E2E proof

Status: **PASS** · 2026-09-02 · finalizer `/root`

## Root cause and repair

- The existing `customers/create` webhook was valid; no webhook was created or deleted.
- PM2 injected a stale `GEORGE_BASIC_AUTH` override (`sha8 bd3d134d`) instead of George's authoritative on-host credential (`sha8 29398480`).
- Production `lib/email.js` also lagged local HEAD and omitted `message_class: transactional`.
- Deployed current `lib/email.js` and `lib/verify.js`, including credential/customer-safe status logging.
- Restarted only `dw-signup-fulfillment`. Removed the stale George override and restored the existing Shopify-registered webhook token after `--update-env` initially selected the stale secrets-master value.

No secret values are recorded in this evidence.

## Boundary assertions

| Boundary | Evidence | Verdict |
|---|---|---|
| Build identity | Production hashes equal local HEAD `9e5aa29` for `lib/email.js` and `lib/verify.js` | PASS |
| Service health | `dw-signup-fulfillment` online after bounded restart | PASS |
| Credential resolution | Stale PM2 Basic-auth override absent; authoritative George file fallback active | PASS |
| Webhook auth negative | Invalid URL token returned HTTP 401 | PASS |
| Controlled customer | One Steve-owned `+dwgolive` customer created, id `8412255387699` | PASS |
| Handler correlation | Production log: `customers/create id=8412255387699` | PASS |
| Automatic delivery | Production log: `source=retail-verify status=200`; George mailbox contains exactly one matching message | PASS |
| UTF-8 content | Subject preserved the gift emoji and typographic dash | PASS |
| Verify click | Bearer URL handled without disclosure; URL hash `dc408a21`; HTTP 200 with success body | PASS |
| Persisted entitlement | `verified-sample` tag, `custom.sample_verified=true`, and `custom.sample_verify_sent=true` | PASS |
| Replay idempotency | Second controlled delivery returned `skipped: already_sent`; mailbox verify-message count remained 1 | PASS |
| Cleanup | Customer DELETE 200, subsequent GET 404 | PASS |

## Scope and residuals

- No backfill/list send, DNS, spend, remote push, webhook creation/deletion, or other Shopify/dw_unified write occurred.
- No other PM2 service was intentionally restarted.
- Native Shopify delivery was not observed for the Admin-API-created test customer during the wait window, so the existing registered webhook was deterministically replayed with that exact customer ID. This proves the production webhook handler → George → verify → tag journey, while keeping the native-emission distinction explicit.
- Unrelated untracked helper files were not modified or committed.