From d81f94edb9d15aee2e98ff53eb3aa15a22958a3c Mon Sep 17 00:00:00 2001 From: Odinaka Robert Nnamani Date: Mon, 26 Oct 2026 09:08:08 +0100 Subject: [PATCH 1/2] Record deployed auth backend and pending controlled Sprout pilot --- AGENTS.md | 22 +++++++- CLAUDE.md | 22 +++++++- docs/COLLAB.md | 9 ++++ docs/deploy-runbook.md | 26 +++++++++- docs/sprout-pilot-validation-2026-10-25.md | 58 ++++++++++++++++++++-- 5 files changed, 131 insertions(+), 6 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 024e05c..6727de8 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -62,7 +62,27 @@ the industry's founding lie, in our own product. --- -## Current production checkpoint (October 16, 2026) +## Current production checkpoint (October 26, 2026) + +API and worker run `effd2bdbe3fe5f52b2f960c3a6075817c7e2cc4a` (PR #59), +released through exact-main CI/image publishing and the guarded canary path. +Two labelled owner-inbox canaries have provider delivery evidence. Dashboard +remains `328f5ad`, admin `cd3d3ff`, marketing/developers `1829289`; all are healthy. +Previous `328f5ad` API/worker images are retained for rollback. + +The authentication path is admitted only for the isolated QA workspace. The +separate bounded non-persistent vault and restricted TLS replay ledger pass +isolation checks; the signed hook listener is healthy and rejects unsigned or +outside-pilot recipients. The Supabase hook has **not** been saved/enabled and +no native Sprout sign-in is verified. Activation approval and Mac unlock are +pending. The temporary pilot key is protected server-side and must be revoked +when the pilot ends. Two of eight approved test sends are used. +See `docs/sprout-pilot-validation-2026-10-25.md` for exact scope and evidence. +SES sandbox limits remain; no unrestricted sending or public auth rollout is +claimed. The application host, managed database and managed queue sizes are +unchanged; the pilot uses existing host capacity. + +## Previous production checkpoint (October 16, 2026) All six services run `182928943604ddb3eb4ba79ec48fc0ae3a6fb7a1` (PR #43), deployed 15 October at 22:58–22:59 WAT through the guarded canary/release path. diff --git a/CLAUDE.md b/CLAUDE.md index bf73333..affcc35 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,6 +1,26 @@ # CLAUDE.md — working notes for rootmail -## Current production checkpoint (October 16, 2026) +## Current production checkpoint (October 26, 2026) + +API and worker run `effd2bdbe3fe5f52b2f960c3a6075817c7e2cc4a` (PR #59), +released through exact-main CI/image publishing and the guarded canary path. +Two labelled owner-inbox canaries have provider delivery evidence. Dashboard +remains `328f5ad`, admin `cd3d3ff`, marketing/developers `1829289`; all are healthy. +Previous `328f5ad` API/worker images are retained for rollback. + +The authentication path is admitted only for the isolated QA workspace. The +separate bounded non-persistent vault and restricted TLS replay ledger pass +isolation checks; the signed hook listener is healthy and rejects unsigned or +outside-pilot recipients. The Supabase hook has **not** been saved/enabled and +no native Sprout sign-in is verified. Activation approval and Mac unlock are +pending. The temporary pilot key is protected server-side and must be revoked +when the pilot ends. Two of eight approved test sends are used. +See `docs/sprout-pilot-validation-2026-10-25.md` for exact scope and evidence. +SES sandbox limits remain; no unrestricted sending or public auth rollout is +claimed. The application host, managed database and managed queue sizes are +unchanged; the pilot uses existing host capacity. + +## Previous production checkpoint (October 16, 2026) All six services run `182928943604ddb3eb4ba79ec48fc0ae3a6fb7a1` (PR #43), deployed 15 October at 22:58–22:59 WAT through the guarded canary/release path. diff --git a/docs/COLLAB.md b/docs/COLLAB.md index 400e4a2..aae0e8b 100644 --- a/docs/COLLAB.md +++ b/docs/COLLAB.md @@ -366,3 +366,12 @@ pairs. Native consumers can select code-only email without browser redirects; default link mode preserves its exact callback checks. The local test command pins mock mail/DNS and preserves fixture environment settings. These controls are tested implementation, not evidence that Sprout sign-in is live. + +## 26 October 2026 — auth backend released, Sprout session still pending + +PR #59 is deployed to API/worker at effd2bd after exact-main CI/images and two +confirmed ordinary canary deliveries. The optional isolated hook/vault and TLS +ledger passed operational checks; auth is limited to the disposable QA scope. +Supabase hook activation and the native Sprout session are not yet verified. +Do not market this as a completed customer integration or unrestricted auth mail. +See docs/sprout-pilot-validation-2026-10-25.md for the exact remaining gates. diff --git a/docs/deploy-runbook.md b/docs/deploy-runbook.md index a8bc002..b917af9 100644 --- a/docs/deploy-runbook.md +++ b/docs/deploy-runbook.md @@ -1,6 +1,30 @@ # Deploy runbook -## Current production (October 16, 2026) +## Current production (October 26, 2026) + +API and worker: `effd2bdbe3fe5f52b2f960c3a6075817c7e2cc4a` (PR #59). +Dashboard: `328f5ade6bcb9f916cba758360e07e9b7961420b`; admin: +`cd3d3ff90454d045167d0a750a70fbdc25942e6c`; public marketing/developers: +`182928943604ddb3eb4ba79ec48fc0ae3a6fb7a1`. All are healthy. Exact-main CI and +image publishing passed. Migrations 0083/0084 applied before guarded API canary; +both labelled owner-inbox API/worker canaries delivered. Previous API/worker +`328f5ad` images remain held for rollback. + +The host-local overlay now includes opt-in `auth-pilot` services and the internal +`auth-content` network on API/worker. Preserve it and the separate environment +files. The dedicated hook uses `.env.sprout-hook.prod`, not the broad API env. +Caddy runs on the host network: its exact hook route proxies to loopback 4011, +with no access logging or proxy retries. Other API routes still use port 4000. +No new paid instance/database/cache was provisioned. + +The pilot is not complete: Supabase hook activation and native session remain +pending. Only the isolated QA scope is admitted. Before rolling back to older +code, disable the hook/admission and drain or expire auth jobs; preserve replay +metadata. Host config/environment backups are in `.pilot-backup-20261026` +(root-only). Never print those files. Detailed controls and current evidence: +[Sprout validation report](sprout-pilot-validation-2026-10-25.md). + +## Previous production (October 16, 2026) Production web traffic now uses the consolidated ARM host `i-0b7b3474488dc906b` (`t4g.medium`). The existing web IP `32.195.196.221` diff --git a/docs/sprout-pilot-validation-2026-10-25.md b/docs/sprout-pilot-validation-2026-10-25.md index 03b9dba..d19426c 100644 --- a/docs/sprout-pilot-validation-2026-10-25.md +++ b/docs/sprout-pilot-validation-2026-10-25.md @@ -1,8 +1,8 @@ # Sprout auth pilot: configuration validation -Observed 25 October 2026. **Not activated; no Sprout sign-in or live auth email -has been tested.** This records read-only production checks and the remaining -activation steps, not a deployment or successful pilot. +Latest checkpoint: 26 October 2026. **Rootmail backend deployed; Supabase hook +not activated and no native Sprout sign-in or live auth email verified.** The +historical read-only observations below are followed by the release evidence. ## Rootmail production @@ -119,3 +119,55 @@ root test command passed as well. No test success here proves live delivery. References: [Supabase Send Email Hook](https://supabase.com/docs/guides/auth/auth-hooks/send-email-hook), [AWS SES IAM action/resource scope](https://docs.aws.amazon.com/service-authorization/latest/reference/list_sesv2.html). + +## Release and isolated runtime — 26 October 2026 + +PR #59 merged as `effd2bdbe3fe5f52b2f960c3a6075817c7e2cc4a`. +[Exact-main CI](https://github.com/Robertpaschal/rootmail/actions/runs/40288446479) +and [image publishing](https://github.com/Robertpaschal/rootmail/actions/runs/40288693690) +passed. API and worker deployed through the guarded canary path, with migrations +0083/0084 applied while auth was disabled. The earlier production-image list is +superseded for API/worker only. All six application services remain healthy. + +Two of the eight approved owner-inbox sends were used: +- API canary `msg_hpctfpeh81d23fvuehi5otek`: provider ID and delivery event observed. +- Worker canary `msg_lmbt50hzgw3jvv5yngli7p4y`: provider ID and delivery event observed. + +These are ordinary transactional canaries, not proof of auth delivery or a native +session. Release SSM command: `3dd3023f-64e2-4d35-93f1-fa64e43cef4c`. + +The approved runtime SES read policy remains exact-scoped. A separate +`rootmail_sprout_hook` database role has ledger SELECT/INSERT/UPDATE and no read +access to customer messages. Its TLS connection verifies the RDS CA and host. +The ledger retains only replay metadata, not codes or recipient addresses. + +The private vault has 64 MiB maximum data memory, 96 MiB container memory/swap +limit, no RDB/AOF, no replicas, no published port, read-only filesystem and tmpfs. +Its default user is disabled. The restricted auth user passed one-time GETDEL +and was denied other key namespaces, CONFIG SET and MONITOR. The host has no swap. +Its ACL file is under root-only `/etc/rootmail`; no memory snapshots are configured. +Isolation check: `6356a0c5-e1c3-4fc3-b691-f3fcef93288a`. + +API and worker now share the exact QA allowlist and private vault configuration. +The separate hook container is bounded to 192 MiB, no swap/core dumps, read-only, +with no extra capabilities. Health passes and restarts are zero. Its environment +contains only the hook settings, temporary QA key and limited ledger URL. +Caddy's existing host-network setup routes only the exact hook path to loopback +4011. No access logger or request-body recording was added. + +Public HTTPS checks: ordinary API dependencies healthy; unsigned hook rejected +with 401; a validly signed synthetic outside-pilot recipient rejected with 403 +before sending; exact QA capability returns the expected SES/workspace contract. +Evidence: `465d792f-0ec5-4cb3-a111-2c246f43107c`, +`b7a94b2d-4e51-4546-a38d-f7b45baa5b72`, `41d59f52-6c88-4920-8db9-72449f04d2f9`. + +The current native Sprout Mac build passes using the existing local configuration; +its unrelated working-tree changes were not edited or committed. Native UI control +reports the Mac locked; an unlock request is pending. The Supabase HTTPS hook form +is prepared but unsaved, awaiting the required action-time approval. No live auth +code has been requested. Do not mark the integration or HT-005 complete. + +After the pilot, disable its Supabase hook/admission, revoke the temporary key +and verify 401, stop the optional hook/vault containers, remove temporary secret +material and preserve ledger tombstones. Do not leave the hook enabled with a +revoked key: sign-in emails would fail. Default Supabase delivery remains untested. From 6b1abbe6645f4183be709aa37fc5a883f37c50a9 Mon Sep 17 00:00:00 2001 From: Odinaka Robert Nnamani Date: Tue, 27 Oct 2026 03:55:08 +0100 Subject: [PATCH 2/2] docs: record successful Sprout pilot and verified cleanup --- AGENTS.md | 14 ++-- CLAUDE.md | 14 ++-- docs/COLLAB.md | 16 +++++ docs/deploy-runbook.md | 27 ++++---- docs/sprout-pilot-validation-2026-10-25.md | 75 ++++++++++++++++++++-- 5 files changed, 112 insertions(+), 34 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 6727de8..e8a44e3 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -70,13 +70,13 @@ Two labelled owner-inbox canaries have provider delivery evidence. Dashboard remains `328f5ad`, admin `cd3d3ff`, marketing/developers `1829289`; all are healthy. Previous `328f5ad` API/worker images are retained for rollback. -The authentication path is admitted only for the isolated QA workspace. The -separate bounded non-persistent vault and restricted TLS replay ledger pass -isolation checks; the signed hook listener is healthy and rejects unsigned or -outside-pilot recipients. The Supabase hook has **not** been saved/enabled and -no native Sprout sign-in is verified. Activation approval and Mac unlock are -pending. The temporary pilot key is protected server-side and must be revoked -when the pilot ends. Two of eight approved test sends are used. +The controlled Sprout pilot passed code delivery, native Mac sign-in and session +restoration after restart. Five of eight approved emails were used. The Supabase +hook is now Disabled, the temporary QA key is revoked (HTTP 401 verified), auth +admission is disabled, and the optional hook/vault runtime and temporary secrets +are removed. The limited ledger login is disabled; replay tombstones remain. +No ongoing Rootmail auth sending is enabled. Supabase default fallback delivery, +actual two-device sync and an independent customer installation remain unverified. See `docs/sprout-pilot-validation-2026-10-25.md` for exact scope and evidence. SES sandbox limits remain; no unrestricted sending or public auth rollout is claimed. The application host, managed database and managed queue sizes are diff --git a/CLAUDE.md b/CLAUDE.md index affcc35..eb3d3b8 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -8,13 +8,13 @@ Two labelled owner-inbox canaries have provider delivery evidence. Dashboard remains `328f5ad`, admin `cd3d3ff`, marketing/developers `1829289`; all are healthy. Previous `328f5ad` API/worker images are retained for rollback. -The authentication path is admitted only for the isolated QA workspace. The -separate bounded non-persistent vault and restricted TLS replay ledger pass -isolation checks; the signed hook listener is healthy and rejects unsigned or -outside-pilot recipients. The Supabase hook has **not** been saved/enabled and -no native Sprout sign-in is verified. Activation approval and Mac unlock are -pending. The temporary pilot key is protected server-side and must be revoked -when the pilot ends. Two of eight approved test sends are used. +The controlled Sprout pilot passed code delivery, native Mac sign-in and session +restoration after restart. Five of eight approved emails were used. The Supabase +hook is now Disabled, the temporary QA key is revoked (HTTP 401 verified), auth +admission is disabled, and the optional hook/vault runtime and temporary secrets +are removed. The limited ledger login is disabled; replay tombstones remain. +No ongoing Rootmail auth sending is enabled. Supabase default fallback delivery, +actual two-device sync and an independent customer installation remain unverified. See `docs/sprout-pilot-validation-2026-10-25.md` for exact scope and evidence. SES sandbox limits remain; no unrestricted sending or public auth rollout is claimed. The application host, managed database and managed queue sizes are diff --git a/docs/COLLAB.md b/docs/COLLAB.md index aae0e8b..630a487 100644 --- a/docs/COLLAB.md +++ b/docs/COLLAB.md @@ -375,3 +375,19 @@ ledger passed operational checks; auth is limited to the disposable QA scope. Supabase hook activation and the native Sprout session are not yet verified. Do not market this as a completed customer integration or unrestricted auth mail. See docs/sprout-pilot-validation-2026-10-25.md for the exact remaining gates. + + +## 26 October 2026 — controlled Sprout native sign-in observed + +Rootmail delivered three live authentication emails to the approved owner inbox. +A fresh code authenticated the native Mac app; the session survived quit/reopen. +Wrong code and a five-hour-old code were rejected. This establishes the controlled +sign-in path, not a public integration rollout, exact expiry boundary, immediate +resend invalidation or real two-device habit sync. API/worker remain on effd2bd. + +The pilot is closed: Supabase hook disabled, temporary key revoked/401 verified, +auth admission and optional runtime removed, secrets removed, restricted ledger +login disabled and replay metadata preserved. No extra paid AWS resource was +added. Rootmail auth sending is not left enabled; default Supabase fallback is +untested. An independent customer setup and broader live acceptance remain gates. +See docs/sprout-pilot-validation-2026-10-25.md for evidence and local native build fix. diff --git a/docs/deploy-runbook.md b/docs/deploy-runbook.md index b917af9..b3572cb 100644 --- a/docs/deploy-runbook.md +++ b/docs/deploy-runbook.md @@ -10,19 +10,20 @@ image publishing passed. Migrations 0083/0084 applied before guarded API canary; both labelled owner-inbox API/worker canaries delivered. Previous API/worker `328f5ad` images remain held for rollback. -The host-local overlay now includes opt-in `auth-pilot` services and the internal -`auth-content` network on API/worker. Preserve it and the separate environment -files. The dedicated hook uses `.env.sprout-hook.prod`, not the broad API env. -Caddy runs on the host network: its exact hook route proxies to loopback 4011, -with no access logging or proxy retries. Other API routes still use port 4000. -No new paid instance/database/cache was provisioned. - -The pilot is not complete: Supabase hook activation and native session remain -pending. Only the isolated QA scope is admitted. Before rolling back to older -code, disable the hook/admission and drain or expire auth jobs; preserve replay -metadata. Host config/environment backups are in `.pilot-backup-20261026` -(root-only). Never print those files. Detailed controls and current evidence: -[Sprout validation report](sprout-pilot-validation-2026-10-25.md). +The controlled Sprout pilot passed native Mac sign-in and session restoration, +using five of eight approved test emails. It is now closed: Supabase hook Disabled, +QA key revoked and rejected with HTTP 401, auth admission removed from API/worker, +optional hook/vault containers removed, and temporary secrets deleted. The +restricted ledger role is NOLOGIN; replay tombstones remain. The original host +composition and Caddy route to port 4000 are restored. No new paid AWS service +was provisioned. Sprout's default Supabase delivery remains untested. + +Do not re-enable the saved Supabase hook against the retired runtime/key. A future +pilot needs fresh scoped credentials/configuration and the preflight in the +[Sprout validation report](sprout-pilot-validation-2026-10-25.md). Before rolling +back to older code, keep auth admission disabled and preserve replay metadata. +Pre-pilot host configuration backups remain root-only in `.pilot-backup-20261026`; +never print their contents. ## Previous production (October 16, 2026) diff --git a/docs/sprout-pilot-validation-2026-10-25.md b/docs/sprout-pilot-validation-2026-10-25.md index d19426c..655a9c6 100644 --- a/docs/sprout-pilot-validation-2026-10-25.md +++ b/docs/sprout-pilot-validation-2026-10-25.md @@ -1,10 +1,11 @@ # Sprout auth pilot: configuration validation -Latest checkpoint: 26 October 2026. **Rootmail backend deployed; Supabase hook -not activated and no native Sprout sign-in or live auth email verified.** The -historical read-only observations below are followed by the release evidence. +Latest checkpoint: 26 October 2026. **Controlled Sprout sign-in and session +restoration passed. Pilot closed; production API/worker remain deployed.** +Five of eight approved emails were used. Earlier sections are historical +observations; the final acceptance/cleanup section records the current state. -## Rootmail production +## Historical pre-release Rootmail production - AWS account `130299713609`, region `us-east-1`; deployment identity `claude-depoy`. SSM reports the consolidated ARM host online. @@ -38,7 +39,7 @@ SSM evidence IDs (outputs contain no credentials or message content): `9bc1944f-7af6-44c8-ae13-ceffb719a728` (runtime SES read denial). The successful post-permission check is `a3f6fc13-eab2-40e1-a342-529de0e07c18`. -## Sprout hosted settings +## Historical pre-pilot Sprout hosted settings The existing in-app GitHub sign-in refreshed successfully after Supabase reported an expired session. No new login permission or project was created. @@ -91,7 +92,7 @@ workspace test tasks pass (258 API tests), typecheck and all six builds pass, and the design audit reports zero blockers. Production runtime-image CI must still verify the newly added entrypoint/dependency packaging before release. -## Remaining activation and acceptance +## Original activation and acceptance plan 1. Runtime SES read permission is applied and verified. Preserve its exact scope. 2. Finish the reviewed hook-host deployment and durable ledger configuration. @@ -120,7 +121,7 @@ root test command passed as well. No test success here proves live delivery. References: [Supabase Send Email Hook](https://supabase.com/docs/guides/auth/auth-hooks/send-email-hook), [AWS SES IAM action/resource scope](https://docs.aws.amazon.com/service-authorization/latest/reference/list_sesv2.html). -## Release and isolated runtime — 26 October 2026 +## Release and isolated runtime — 26 October 2026, before activation PR #59 merged as `effd2bdbe3fe5f52b2f960c3a6075817c7e2cc4a`. [Exact-main CI](https://github.com/Robertpaschal/rootmail/actions/runs/40288446479) @@ -171,3 +172,63 @@ After the pilot, disable its Supabase hook/admission, revoke the temporary key and verify 401, stop the optional hook/vault containers, remove temporary secret material and preserve ledger tombstones. Do not leave the hook enabled with a revoked key: sign-in emails would fail. Default Supabase delivery remains untested. + + +## Controlled native acceptance and cleanup — 26 October 2026 + +After explicit approval, Supabase's Send Email Hook was enabled for the exact +Sprout endpoint and only the owner inbox. Three auth emails, plus the two ordinary +canaries above, used **five of eight** approved sends. All three auth messages +have provider acceptance and delivery evidence; retained HTML/text/content hash +are NULL. This is bounded observed evidence, not a general delivery guarantee. + +| Auth message | Created (UTC) | Observed outcome | +|---|---|---| +| `msg_fxb60m2947c04p7up2hnxgnk` | 13:23:43.523 | SES delivery at 13:23:44.684; inbox arrived | +| `msg_8ss9x4njdcq89fcbzi19nld3` | 13:26:21.671 | Resend; SES delivery at 13:26:22.580; inbox arrived | +| `msg_ckuuj7fpa9f3e1h4j3nb4nh1` | 18:43:55.494 | Fresh email arrived; native sign-in succeeded | + +The native Mac app displayed **Your account**, the owner address and **Up to date**. +Quitting and reopening the current Sprout app preserved that signed-in session. +A synthetic wrong code was rejected. A code attempted more than five hours later +was rejected, beyond the configured 60-minute lifetime; this is not a controlled +expiry-boundary test. Resend produced a fresh email, but immediate invalidation +of the preceding code was not tested. No codes or private links are retained here. + +Initial native builds omitted the Supabase custom keys from their generated +Info.plist. A targeted local Sprout fix adds `apple/Config/AppInfo.plist` and uses +`INFOPLIST_FILE` in `apple/project.yml` and `apple/Sprout.xcodeproj/project.pbxproj`. +It references build variables, with no embedded credentials. Both Mac and arm64 +iOS simulator builds passed and their built property lists contain the expected +configuration. The initial generic iOS asset-catalog build failed; a bounded +`-jobs 2 ARCHS=arm64 ONLY_ACTIVE_ARCH=YES` retry passed. No iOS runtime sign-in was +tested. These three local fixes are uncommitted in the separate Sprout working +tree, which already contains unrelated work; that work was preserved. + +Cleanup: the Supabase hook is Disabled, the QA key is revoked and HTTP 401 was +verified, and no auth sends remained queued/sending. API/worker admission and +vault environment were removed, original host overlay/Caddy routing restored, +and both application services restarted on the same released image. Optional +hook/vault containers were stopped and removed. The limited ledger role is +NOLOGIN with its password removed; temporary key, hook settings, generated +secrets and vault ACL were removed. Replay tombstones are preserved. Core +production health passed after cleanup: all six services healthy with zero +restarts; API/public sites returned 200, and authenticated sites reached their +login pages successfully. No new paid AWS resource was created. +Disabling the hook returns Sprout to Supabase's default delivery configuration, +which has **not** been tested as a fallback. This pilot does not leave ongoing +Rootmail auth sending enabled. + +Evidence: release `3dd3023f-64e2-4d35-93f1-fa64e43cef4c`; auth audit +`795a13c6-8d52-4165-b4c4-b103ff8a9cb4`; all three records +`0017c7c0-b757-452f-921a-2852a0064e26`; revoked key/401 +`2b93570f-e147-48bd-a42c-bd101069fc0b`; runtime cleanup +`6eb65f3f-40de-4227-b997-a225ebe36126`; final cleanup/health/retention +`b5ebecdb-1023-4ec5-a9e1-44faf5ac23b0` (3 ledger entries, 3 auth messages, +zero retained-body/hash violations). Cleanup evidence reviewed 27 October. + +Remaining gates: independent customer setup, broader action/multi-recipient live +acceptance, controlled expiry/resend invalidation boundaries, real two-device +habit sync/offline conflicts, and SES production access for unrestricted sending. +An empty account showing Up to date does not establish cross-device sync. Rootmail +integration and Sprout HT-005 remain In progress for those broader requirements.