From 7c812526d061fae77175da5a2810faf7d337a1e4 Mon Sep 17 00:00:00 2001 From: SimpleTest Date: Wed, 12 Aug 2026 16:40:36 +0300 Subject: [PATCH] Record transactional email launch proof --- docs/public-launch-checklist.md | 8 +++++++ docs/verification.md | 41 ++++++++++++++++++++++++++++++++- 2 files changed, 48 insertions(+), 1 deletion(-) diff --git a/docs/public-launch-checklist.md b/docs/public-launch-checklist.md index 59e632b..9239008 100644 --- a/docs/public-launch-checklist.md +++ b/docs/public-launch-checklist.md @@ -43,6 +43,14 @@ final image scans after updating Phoenix LiveView from advisory-affected `1.2.8` to patched `1.2.9`. Exact unit, timing, memory, cleanup, and dependency evidence are recorded in `docs/verification.md`. +The current 2026-08-12 launch-boundary rerun passed 462 ExUnit tests, fourteen +browser map-asset tests, the migration-registry completeness check, all +configured quality/security and production-release drills, and the final image +scans with zero detected vulnerabilities. The isolated unit completed in +4 minutes 47.572 seconds with a measured 222.3 MiB memory peak and left no +run-scoped container or temporary image. Exact email-flow and migration evidence +is recorded in `docs/verification.md`. + ## 2. Verify production configuration without exposing secrets Run both checks against the single ignored production `.env`. The first reports diff --git a/docs/verification.md b/docs/verification.md index ef70130..1506f72 100644 --- a/docs/verification.md +++ b/docs/verification.md @@ -1,8 +1,47 @@ # Who Need Help — implementation verification -Observed through 2026-08-10 in the local workspace. This report separates observed +Observed through 2026-08-12 in the local workspace. This report separates observed results from product limits and unknown production properties. +## Current launch-boundary and transactional-email proof on 2026-08-12 + +- The complete isolated `scripts/quality.sh` pipeline passed in user-systemd + unit + `codex-heavy-wnh-quality-launch-boundary-20260812-163255-3402967.service`. + It completed successfully in 4 minutes 47.572 seconds with a measured + 222.3 MiB memory peak. ExUnit reported 462 passing tests with seed `616444`, + and the browser map-asset suite reported fourteen passes. +- The run passed the repository policy, ShellCheck, Hadolint at the configured + threshold, actionlint, Compose, Helm, observability, format, compiler, xref, + Credo, Sobelow, Dialyzer, dependency audits, migration and rollback drills, + and the production-release orchestration drills. The final Debian 13.6 + application image and all pinned infrastructure images reported zero detected + vulnerabilities. +- The migration compatibility registry is now checked against every migration + at or after the first reviewed version. The pending + `20260812120611_allow_inbox_only_nearby_subscriptions.exs` migration is + explicitly classified `application_safe`; the isolated policy drill proved + that missing registry entries are rejected while reviewed safe and + forward-only entries are accepted by their respective release paths. +- Immediate per-request nearby email is retired. Nearby matches use the private + in-app inbox and optional push; the settings UI states that an email digest is + not enabled. Support contact verification enqueues one operator alert only + after the address is verified. Requester email is limited to the first staff + response or a later public-status change, while authenticated requesters also + receive an in-app support update. Ordinary requester and staff conversation + messages do not each generate email. +- Optional support email runs through the dedicated Oban `mail` queue, whose + default concurrency is one per worker. Fixed-purpose delivery telemetry + records only the allow-listed purpose and outcome, without email addresses or + message content. Authentication and content-removal confirmations remain + transactional email paths by design. +- Exact-name inspection after completion found no container or temporary image + belonging to quality scope `20260812133255-3403320` / + `wnh_quality_202608121332553403320`. +- This was local verification only. It did not deploy production, modify the + frozen hackathon-test checkout, change shared Caddy, save Google Play Console + fields, or push the public Git remote. + ## Current local quality and dependency-security proof on 2026-08-10 - The complete isolated `scripts/quality.sh` pipeline passed in user-systemd