VA production readiness — scripted E2E run log (2026-07-16)¶

Parallel track — NOT Gate 0.5 A1. A1 remains closed on its 2026-07-15 log. This run proves the scripted leg on hardened API code (P0.1–7 + Phase B API shipped 2026-07-16). The human leg on hardened iOS (P0.1–7 + Phase B client) is still outstanding — that code is local and not on TestFlight. Parallel-track exit requires both.

Field	Value
Date (UTC)	2026-07-16T01:56:23Z – 01:56:41Z (post-`SECURE_LINK_E2E_LOG_OTP` teardown)
Operator	Cursor agent (scripted harness)
Track	VA production readiness (parallel)
Environment	AWS production — ECS `lastvet-prod-api:7`, RDS `lastvet-prod-postgres`, `api.last.vet`
API image digest	`sha256:f1ae5caff5634ffebf169dab0ed31643c50ac1b6a7acbd71925546b21934137c`
API base	`https://api.last.vet/api`
Veteran `va_patient_id`	`2000163`
Internal veteran ID	`7eba7aa3-db3b-4124-bf65-f300f1898139`
Recipient email (OTP)	`e2e-harness@last1.enterprises` (SendGrid → Gmail IMAP inbox)
Harness	`scripts/e2e-roi-gate0-full.sh` (OTP from `scripts/lib/fetch-e2e-otp-inbox.mjs` only)
OTP logging invariant	`SECURE_LINK_E2E_LOG_OTP` removed — not in SM `lastvet-prod/app`, not in task def `:7`, logging branch deleted from API

Steps¶

Step	Result	Notes
1. Find MH facility (San Diego)	✅ PASS	`node scripts/verify-facilities-sd.js` — 11 facilities, 0 missing anchors
2. Generate ROI (10-5345)	✅ PASS	`seed-roi-demo.sh` prefill `form: 10-5345`
3. Sign + Part 2 scope	✅ PASS	Synthetic PDF sign; demo seed path
4. Create secure link	✅ PASS	`linkId: 4961b7a9-814c-46ae-94b8-8f138799ffa2`
5. Provider OTP verify	✅ PASS	Inbox IMAP only (`uid>10` baseline); no CloudWatch fallback
6. PDF download	✅ PASS	HTTP 200, 322 bytes, `%PDF` header
7. Revoke link	✅ PASS	`DELETE /veteran/me/secure-links/{id}` Bearer JWT
8. Post-revoke blocked	✅ PASS	`{"error":"revoked"}`

Scripted harness output¶

scripts/e2e-roi-gate0-full.sh (AWS production, post OTP-log teardown)

Facilities: ok=true, resolvedCount=11, missingAnchors=[]

Seed:
  internalVeteranId: 7eba7aa3-db3b-4124-bf65-f300f1898139
  grant: 5ce88394-80d9-46e2-858b-7bc71f9bee01
  loop:  1f455d5c-e623-46b5-a0a1-bc56591a01cb
  doc:   a408345c-bd18-439f-b8bc-edfd3be148f2
  linkId: 4961b7a9-814c-46ae-94b8-8f138799ffa2
  url: https://provider.last.vet/r/McAFDo1dagzGZ1NHuXJ27CA1BbGu-7j7xRTRk6u6fck

E2E:
  open → challengeId e76eec6b-73fd-4da3-b332-68b19f3e4c1e
  inbox OTP (uid>10) → verify-otp → viewSessionToken [redacted]
  artifact → HTTP 200, 322 bytes, valid PDF
  revoke → {"message":"Secure link revoked."}
  post-revoke open → {"error":"revoked"}

Infra notes¶

Prior inbox proof (2026-07-16 ~01:40 UTC) fixed Gmail IMAP parsing + stale-UID guard; committed 5b1eaaf.
Teardown executed same session: SM key deleted, Terraform task def :7, API redeployed without OTP logging code.
Invariant satisfied: prod no longer logs OTPs (same class as Railway teardown).

Human iOS leg¶

[x] Human pass on hardened iOS build (P0.1–7 + Phase B) via TestFlight on api.last.vet — see E2E_RUN_LOG_2026-07-21_VA_PARALLEL_TRACK_HUMAN.md
[x] Scripted pass on hardened API (this log)
[x] Inbox OTP harness proven without SECURE_LINK_E2E_LOG_OTP
[x] Run log committed to repo

Sign-off¶

Scripted parallel-track leg passed on AWS production with inbox-only OTP and OTP logging removed. Human TestFlight leg recorded 2026-07-21. Parallel track exit criterion met (both legs).