SPRINT-7 T-2 Closeout — last1.app Sovereign Stack (Mechanics Complete)¶

Date: 2026-08-30
Status: T-2 CLOSED (Ryan accepted T2-3 partial). STOP — do not start T-3/T-4/T-5 until Ryan authorizes next session.

What T-2 delivered¶

Phase	Result
T2-0	Storage + pg_cron restored; SMS crons staged off on R940
T2-1	22 Edge Functions deployed + verified; auth model documented
T2-2	Monolith on VM 121; BWS env; `last1app-edge` tunnel prep (no DNS)
T2-3	Twilio + Stripe webhook rotated; partial on Stripe SK / SendGrid / Anthropic

Constraints held: webhook URLs unchanged; no live SMS/payments in smoke; playbook §5c respected.

Reports: T2-0 · T2-1 · T2-2 · T2-3

See SPRINT7_PRE_TEARDOWN_CHECKLIST.md — must complete before hosted tcthzakppndkykatoefx teardown.

#	Item	GG	Status (2026-08-30)
1	Stripe `sk_live_` Dashboard roll → `t2-3-rotate-secrets.py` + redeploy	29615733	Open — old key still live in Stripe
2	SendGrid — close GG (key already dead)	29615727	Close in GG — `GET /v3/scopes` → 401; no rotation needed
3	Anthropic — revoke leaked key + push new key to BWS	29615732	Open — see below

Check	Result
BWS `LAST1APP_APP_PROD_ANTHROPIC_API_KEY`	Still pre-rotation material (`sk-ant-api03…69e-`, len 40)
API auth probe (`GET /v1/models`, not inference)	401 — credential not usable
New key in BWS	Not yet — Ryan issued new Console key; run `ANTHROPIC_NEW_API_KEY=… t2-3-rotate-secrets.py` + redeploy
Console revocation of leaked key	Ryan verify — API 401 on old material is necessary but not sufficient; confirm leaked key shows Revoked/Deleted in Anthropic Console (not merely superseded while still listed active)

GG 29615732: Keep TRIGGERED until BWS/Railway carry the new key and Console shows old key revoked.

Track	Owner	Deadline
Registry v2 500 (`certification_status`)	last1.app repo + Muster `last1app-registry-v2-certification-status-bug`	Before T-5
SendGrid → Resend migration	Post-migration (parked)	After T-6

T-2 migration mechanics are banked. Ryan decides next session: continue cutover arc (T-3+) or pause here.