`verification/tk11114-remediation/RUNBOOK.md`

32 lines
# TK-11114 — Execution Runbook (finalizer: /root, blocked from autonomous prod SSH)

Mac2 is classifier-blocked from prod SSH (read AND write), confirmed 2026-09-02.
The remaining repair is entirely gated prod/Shopify/send actions → Steve pastes via `!`.
Remediation is identical under both root-cause theories (message_class drift vs stale
GEORGE_BASIC_AUTH override): deploy the 2 files + restart with a clean env covers both.

## Deploy scope (exactly 2 files — config.js UNCHANGED)
- lib/email.js  sha256 e442f36f8e676096d29bc85cd20ddce6f0b59dc8e24606ede00bd4ef86a62c12  (git blob d215204913a0)
- lib/verify.js sha256 14498fdd4a50207e727059cce65b1ed414922550c5d05986669db2ea837011e4  (git blob 356cdcdc93a9)
Both carry the credential-safe un-swallow logging; email.js also restores `message_class:'transactional'`.

## Prod facts
host root@45.61.58.125 · dir /root/Projects/dw-signup-fulfillment · pm2 `dw-signup-fulfillment` · PORT 9862 · health :9862/healthz · DRY_RUN=0

## BLOCK A — read-only diagnosis + reversible deploy + restart (Steve pastes on Mac2)
Guarded with && so it aborts before harm; timestamped .bak backups taken before overwrite.
(see the inline paste handed in chat)

## BLOCK B — R4 (run only after BLOCK A reports healthz ok)
1. Create ONE controlled customer (r4.js create) → LIVE customers/create webhook fires organically.
2. /root drives (non-gated): George inbox search for the verify email, extract + click verify link.
3. r4.js get <id> → prove verified-sample tag + custom.sample_verify_sent + custom.sample_verified persist.
4. Replay same webhook → prove idempotency (no duplicate send).
5. Negative: bad token → 401.
6. r4.js delete <id> → confirm 404 (cleanup).

## Rollback (per mutation) — see ROLLBACK-MAP.md
- files: `cp lib/email.js.tk11114.bak.<ts> lib/email.js` (+ verify.js) then `pm2 restart dw-signup-fulfillment`
- restart: `pm2 restart dw-signup-fulfillment`
- test customer: `node r4.js delete <TEST_ID>`