From 7844c262f85a38873a6ccda20baa068f220981a4 Mon Sep 17 00:00:00 2001 From: Moheeb Zara Date: Sun, 17 May 2026 05:12:09 -0700 Subject: [PATCH] =?UTF-8?q?docs:=20HANDOFF=20pass-46=20=E2=80=94=20Phase?= =?UTF-8?q?=202=20deployed=20(run=2025990457904),=20smoke=20clean?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/HANDOFF.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index 3b035d3..ef5f8c2 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -16,8 +16,9 @@ Branch `main`. Owner asked for an extreme audit before deploy. Ran an independen - Audit PASS (no change needed): Phase-1 webhook guarantees intact, multi-tenant isolation, RLS + member self-view, HTML escaping, CRON_SECRET constant-time, migration idempotent + mirror exact, fresh-clone fails safe. ### State -- **Still not deployed.** All P1s fixed and gated; awaiting the deploy decision. Local commits ahead of origin: pass-44 docs (dc76a86), the 5 Phase 2 commits, and this audit-fix + pass-46. -- Post-deploy provisioning (owner, Droplet): set `RESEND_API_KEY`, `EMAIL_FROM` (verified domain + SPF/DKIM), `CRON_SECRET`; add the once-a-minute crontab line (docs/DEPLOYMENT.md). Inert until then. +- **DEPLOYED** (run 25990457904, HEAD f1bae44, success). All 7 local commits (pass-44 docs + 5 Phase 2 + audit-fix) pushed; origin == local. Smoke clean: `/` `/login` 200; gated 307; Stripe webhook 400 (Phase 1 intact, not 307); `/api/cron/notifications` 503 with/without bearer (proxy whitelist works; CRON_SECRET unset = fails safe). +- **Inert until owner provisions (Droplet):** set `RESEND_API_KEY`, `EMAIL_FROM` (Resend-verified domain + SPF/DKIM), `CRON_SECRET`; add the once-a-minute crontab line (docs/DEPLOYMENT.md). Until then the outbox fills but nothing sends. +- Validation after provisioning: Stripe test-mode dues run -> `dues_renewed` enqueued once, dispatcher sends, `/me` shows it; force card failure -> `dues_payment_failed`; let it lapse -> `dues_lapsed`. ---