Gate 0 E2E run log — R940 production (2026-09-15)¶

Gate 0.5 A1 scripted leg + A2 harness proof on R940. Human leg: E2E_RUN_LOG_2026-09-15_R940_HUMAN.md (Gate 0 EARNED on R940).

Field	Value
Date (UTC)	2026-09-15T16:13:52Z – ~16:14:25Z
Operator	Cursor agent (scripted harness)
Environment	R940 production — `api.last.vet` → lastvet-edge (`.89`) → lastvet-api VM 107 (`.90`) → lastvet-db VM 108 (`.91`)
API base	`https://api.last.vet/api`
Veteran `va_patient_id`	`2000163`
Internal veteran ID	`7eba7aa3-db3b-4124-bf65-f300f1898139`
Recipient email (OTP)	`e2e-harness@last1.enterprises` (SendGrid → Gmail IMAP)
Harness	`scripts/e2e-roi-gate0-full.sh` + `scripts/e2e-roi-gate0.sh`
OTP source	Inbox IMAP only (`LAST1_TEST_LASTVET_E2E_IMAP_` → harness env); no CloudWatch*
Secrets	Bitwarden: `LASTVET_R940_PROD_VETERAN_SESSION_EXCHANGE_SECRET`, `LAST1_TEST_LASTVET_E2E_IMAP_*`, `LASTVET_IOS_SHARED_VA_OPEN_DATA_API_KEY`
`DATABASE_URL`	Unset (demo veteran pre-exists on R940; local DB URL causes SSL failure from dev machine)

Steps¶

Step	Result	Notes
1. Find MH facility (San Diego)	✅ PASS	`verify-facilities-sd.js` — 11 facilities, 0 missing anchors
2. Generate ROI (10-5345)	✅ PASS	`seed-roi-demo.sh` prefill `form: 10-5345`
3. Sign + Part 2 scope	✅ PASS	Synthetic PDF sign; demo seed path
4. Create secure link	✅ PASS	`linkId: 4d423dde-751e-482f-a67a-ecf0a4b35d90`
5. Provider OTP verify	✅ PASS	Inbox IMAP (`uid>13` baseline); app password rotated in BWS (16-char)
6. PDF download	✅ PASS	HTTP 200, 322 bytes, `%PDF` header
7. Revoke link	✅ PASS	`DELETE /veteran/me/secure-links/{id}` Bearer JWT
8. Post-revoke blocked	✅ PASS	`{"error":"revoked"}`

Scripted harness output¶

API_BASE=https://api.last.vet/api ./scripts/e2e-roi-gate0-full.sh

Facilities: ok=true, resolvedCount=11, missingAnchors=[]

Seed:
  grant: 7d0800a0-1cac-45d1-b24e-bcd1d8f74880
  loop:  59760df0-9b00-4cb3-b8c5-77ff7fcf0349
  doc:   551bc98f-09a0-4a2e-9788-669254ae6b16
  linkId: 4d423dde-751e-482f-a67a-ecf0a4b35d90
  url: https://provider.last.vet/r/2Xgbef1_MgXIvSy3iDeYKC5GzUA_KSDO3hFKUUvv4vY

E2E:
  open → challengeId e4921c20-14e0-4834-9ebd-250d3e694747
  inbox OTP (uid>13) → verify-otp → viewSessionToken [redacted]
  artifact → HTTP 200, 322 bytes, valid PDF
  revoke → {"message":"Secure link revoked."}
  post-revoke open → {"error":"revoked"}

✅ Gate 0 API E2E complete
✅ Scripted ROI path complete.

Infra notes¶

Prior run (same session) failed on stale IMAP login password (19-char in BWS); fixed by Google Workspace app password rotation to 16-char.
Harness fix: Linux mktemp template in e2e-roi-gate0.sh (lastvet-artifact.XXXXXX).
July 2026 AWS E2E logs do not satisfy this earn line — origin was ECS/RDS, not R940 VMs.

Human iOS walk notes¶

Recorded in E2E_RUN_LOG_2026-09-15_R940_HUMAN.md (TestFlight, same veteran, R940 prod).

Sign-off¶

[x] Scripted pass on Bearer JWT harness against R940 prod
[x] Human pass on device (TestFlight) — E2E_RUN_LOG_2026-09-15_R940_HUMAN.md
[x] Run log committed to repo

Closes: Gate 0.5 A2 (harness repeatable on R940); scripted half of A1.
With human log: full Gate 0 EARNED on R940.