From 3aeea9aa776442955c80ad640322c371d6625cf4 Mon Sep 17 00:00:00 2001 From: Stephan D Date: Sat, 17 Oct 2026 23:38:10 +0200 Subject: [PATCH] Record healthy SMTP deployment and passing validation (#57) --- docs/signup-facts.md | 48 ++++++++++++++++++++------------------------ 1 file changed, 22 insertions(+), 26 deletions(-) diff --git a/docs/signup-facts.md b/docs/signup-facts.md index 7c41392..cf847bd 100644 --- a/docs/signup-facts.md +++ b/docs/signup-facts.md @@ -114,33 +114,29 @@ Message-ID is correlation only, not a provider idempotency guarantee. Existing failed Resend notifications are not replayed or rewritten. The unverified `sxchnge.com` Resend domain is no longer the selected local delivery path. -Live verified-TLS SMTP authentication and NOOP succeeded with reply 250, without -submitting email. SMTP adapter race tests and backend lint pass. Local tooling -fixtures pass, including password-only Vault validation. Broader validation is -currently blocked by Docker: the service integration test timed out starting its -Testcontainers reaper; both `GOFLAGS=-p=2 make test` and its `-p=1` retry fail in -the existing credential-rotation setup while copying files into a disposable -MongoDB container (90-second context timeout). No checks were disabled. Fresh -stable image pins resolved on retry; two image builds hit a Go proxy TLS -handshake timeout during protobuf generator installation. The generator stage -now shares the existing BuildKit Go module/build caches, preserving its pinned -tool versions and generation command. Cache seeding also stalled during file -extraction; it was canceled after copying the pinned module archives. A normal -build retry remained blocked before starting a compiler process. A fallback -using the same freshly pulled, digest-pinned Go image, canonical Make generation -command and existing module cache stalled during ordinary container startup, -before package installation or compilation produced output. +Live verified-TLS SMTP authentication and NOOP succeeded with reply 250 using +the password from SXCHNGE Vault, without submitting email. SMTP adapter race +tests, `make lint-backend`, `make test-dev-tooling` and `make test-dev-infra` +pass, including canonical Vault layout, service permission isolation, database +credential issuance/renewal/revocation and transactions. The final +`GOFLAGS=-p=2 make test` passes all backend race tests and frontend suites. -Deployment is not complete: the running notifications container still uses the -previous image. The SMTP Vault password and source configuration are prepared, -but its Agent policy/template have not been activated against that old image. -Vault responds over HTTP, while Vault/Mongo Docker health checks time out and -the local Sendico session is unavailable. Restarting Docker Desktop was requested -for recovery because it also interrupts the separate Sendico stack; it has not -been authorized or performed. Rebuild, activate the matching Agent configuration, -restart notifications and verify the live `email_driver: smtp` startup log after -Docker is responsive. Do not treat the successful SMTP login as a deployed -notification delivery check. +Earlier attempts hit Docker archive-copy/reaper timeouts, Go proxy TLS failures +and stalled cache extraction/container startup. The user authorized restarting +Docker Desktop. After recovery, the normal Compose `build --pull notifications` +succeeded with the resolved stable digest pins; no checks were disabled. The +generator stage shares the existing BuildKit Go module/build caches and retains +the pinned tools and canonical Make generation command. A discarded fallback +compiler attempt also failed to access its checksum-state directory; it was not +used for the deployed artifact. + +The matching Vault Agent policy/template were applied, and notifications was +recreated healthy. Its running image matches the rebuilt image +`sha256:d4cbc0cb9005e9cef9381abdf2a13f672104d160536ee6d77ac73a909c0a8638`, +and its startup log confirms `email_driver: smtp`. No customer email was sent or +failed Resend job replayed; SMTP authentication is not a recipient-delivery +check. Sendico's Vault sealed during the Docker restart and was unsealed with +its existing local key, without reinitialization or exposing credentials. With `api.sendico` configured, the product BFF creates the local pending customer