`verification/tk11114-remediation/before-george-cred-digests.txt`

32 lines
TK-11114 remediation — George credential digests (last4 + sha256[:8] ONLY; no secrets)
Captured read-only 2026-09-02 by iterm-tk11114-george-repair.

KAMATERA (prod — where the customers/create webhook lands):
  /root/Projects/george-gmail/.env ............ FILE-MISSING  (cred-precedence disproven)
  /root/DW-Agents/gmail-agent/.env (authoritative):
      GEORGE_BASIC_AUTH ........... len=38 last4=DKJO sha8=29398480   <-- CORRECT (direct /api/send => 200)
      GEORGE_EXTERNAL_SEND_TOKEN .. len=48 last4=3e9e sha8=40da76b8   <-- CORRECT
  /root/Projects/secrets-manager/.env ......... George keys ABSENT
  /root/Projects/dw-signup-fulfillment/.env ... George keys ABSENT

KAMATERA RUNTIME (running pm2 process /proc/<pid>/environ) — THE FAULT:
  GEORGE_BASIC_AUTH (process.env OVERRIDE) .... len=36 last4=eB6P sha8=bd3d134d  <-- STALE/WRONG, != file DKJO
  GEORGE_EXTERNAL_SEND_TOKEN (process.env) .... len=48 last4=3e9e sha8=40da76b8  <-- matches file (fine)
  GEORGE_URL/ACCOUNT/FROM ..................... unset (fall to config defaults)
  DRY_RUN=0  PORT=9862  NODE_ENV=production  PUBLIC_URL=https://signup.designerwallcoverings.com

MAC (dev mirror, non-customer-facing):
  ~/Projects/george-gmail/.env: GEORGE_EXTERNAL_SEND_TOKEN len=48 last4=53d0 sha8=e324d6e2 ; BASIC_AUTH ABSENT
  ~/DW-Agents/gmail-agent/.env: FILE-MISSING
  ~/Projects/secrets-manager/.env: GEORGE_AUTH len=38 last4=DKJO sha8=29398480

ROOT CAUSE (confirmed, digests only):
  config.js#firstEnv prefers process.env over the on-host file. The running prod process
  carries a STALE GEORGE_BASIC_AUTH override (eB6P/bd3d134d) that mismatches George's
  current Basic-auth (DKJO/29398480). Every service->George /api/send authenticates with
  the wrong Basic-auth => 401 => 100% send failure. The error is SWALLOWED
  (email.js#georgePost logs nothing on non-2xx; verify.js#startVerification returns bare
  ok:false). A direct shell /api/send uses the correct DKJO file cred => 200, which is why
  "direct works, organic fails." The deployed email.js message_class omission is a real but
  SECONDARY drift (a direct call omitting message_class still => 200).