`verification/crezana-proposal/APPROVAL.md`

30 lines

# TK-11438 — Crezana socket batch: approval required

Prepared only. No source application, restart, canonical write or email send has occurred. Steve's latest report-in says keep unfinished/gated work open. The previous scoped approvals completed showroom, PatternDesignLab, Ken and Gracie; do not repeat those actions. The earlier broad relay covers already-described pending actions only; this new Crezana rollout is outside that scope.

## Requested approval

Apply the included one-line patch to /Users/macstudio3/Projects/crezana-internal/lib/vendor-requests.js, make a local commit, and restart only the existing PM2 crezana-internal process once. Its startup invokes existing CREATE TABLE IF NOT EXISTS and CREATE INDEX IF NOT EXISTS against dw_unified.vendor_requests. Approval must include these existing startup schema commands. Preserve all email exclusions: no request-creation, preview or sending endpoint and no email wrapper execution.

The sole code change replaces the hardcoded host 127.0.0.1 with process.env.PGHOST || (process.platform === 'darwin' ? '/tmp' : '127.0.0.1'). Explicit host overrides and Linux fallback remain supported. No catalog/database-row update, DNS, remote deployment, public directory edit, credential change or PostgreSQL TCP shutdown is included.

## Current baseline and evidence

- Clean source HEAD 036e705f747943640d521747f41272ee30ae5a83; source SHA256 ce0099389bf08e01e2a7a08f2a1bf442e146cd0ea17500abd583bb93af840702. Prepared SHA256 d87ab5d2e4d44953aea64befe63c033dc0bc8479c3bc11fc5328c7bfb6d8690e; syntax PASS.
- PM2 crezana-internal PID8192, restart count1, online, port10072. Effective and saved PGHOST=/tmp already; no PM2 env/dump edit or global pm2 save is needed.
- Catalog API returns443 products. Six HTTP assertions passed: root missing/invalid401 and valid200; existing open catalog feed missing/valid200; health200. Preserve current auth boundaries and response hash. This task does not change Crezana's existing listener/exposure; Gracie's separate privacy changes remain untouched.
- Independent pg clients with default_transaction_read_only=on verified TCP and socket resolve to dw_admin, dw_unified OID16391, same server start, 19columns/4indexes, and two Crezana requests (max id6). Schema/index hashes match. Missing socket fails ENOENT. No application module imported and no purchasing route invoked.
- Fresh fleet scan: 15 prepared shared-module patches still unapplied, Gracie applied, no source drift. No conclusion that the remaining consumers are all migrated or inactive.

## Execution prerequisites and rollback

On approval, recheck source HEAD/hash, clean worktree, exact PM2 identity/PID and effective/saved host. Refresh read-only HTTP/catalog/schema/request baselines immediately before action. Back up the one source file and capture scoped PM2 metadata under a gitignored private directory (0700, files0600); check byte hash before replacement. Do not back up credentials in tracked files. Any concurrent drift stops execution for review.

Apply only the exact one-line patch and syntax-check. Restart only crezana-internal once. Verify a new PID with restart count incremented once, stable health/auth/catalog hash and443 products, unchanged request rows/schema/indexes, no TCP5432 descriptors for the process, and successful socket startup schema completion before any authenticated request-list GET (that GET itself calls ensureSchema). Email-capable POSTs remain excluded. Record the actual checks and limits; do not call a skipped critical path done.

On failure restore the exact source backup after checking no concurrent edits, and restart only this process to restore its original TCP behavior. Recheck health/auth/catalog; preserve all host/auth configuration. No PM2 global save, fleet restart or canonical data rollback. Restore only owned file changes. No automatic retirement or listener changes.

## Status

BLOCKED on Steve's approval of this concrete next rollout. TK-11438 stays open/incomplete; the session is not closed or compacted. Other remaining consumer and scheduler classification is preserved in verification/session-close/SESSION-HANDOFF.md. No new paid API work in this preparation.