Proof: Azure ACS Email hosted lifecycle and recipient delivery

[yhay81]

Tracks the hosted proof required before treating the Azure Communication Services Email transport and Azure deployment pack as production-ready.

Source implementation: #151
Portfolio program: #132
Exact accepted transport commit: 0289e2f9343018e92bcc469a9dfc696e5ad23823

Safety gate

• Obtain explicit authorization for an isolated Azure test subscription/account and cost ceiling.
• Do not use a shared production subscription or existing production resources.
• Record subscription class, region, exact image digest, deployed commit, runtime/dependency versions, and resource inventory without publishing secrets or addresses.
• Define rollback and cleanup before provisioning.

Infrastructure proof

• Deploy the reviewed Azure Container Apps pack after it is merged and pin the immutable image digest.
• Use PostgreSQL Flexible Server 18, private Blob Storage, Key Vault, managed identities, and least-privilege RBAC.
• Provision or link ACS Email Communication Services with a custom verified domain; capture Domain, SPF, DKIM, and DKIM2 verification status.
• Record current ACS quota/limit results and any approved custom-domain quota increase.
• Configure Event Grid with an independent secret and exact ACS resource-topic restriction.
• Run migrations before API/worker rollout and verify health/readiness.

Delivery and event proof

• Send a controlled multi-recipient message and observe terminal recipient-level delivery reports correlated to the exact provider message ID.
• Demonstrate duplicate delivery and out-of-order Event Grid events converge without duplicate terminal effects.
• Demonstrate single-recipient engagement attribution and multi-recipient engagement retention as unattributed because ACS engagement events omit recipient identity.
• Exercise bounce/failure/suppression behavior with controlled non-sensitive targets.
• Confirm retry classification does not duplicate sends after an unknown LRO outcome.
• Attach sanitized run IDs, timestamps, digests, status summaries, and CodeQL/CI links; never attach message content, recipient addresses, credentials, or raw secrets.

Teardown

• Execute rollback/cleanup with retention disabled for the proof.
• Verify zero unintended residual Container Apps, jobs, Event Grid subscriptions, databases, storage objects, identities, role assignments, or DNS changes.
• Record final cost and residue audit.

This issue does not authorize billable Azure provisioning. The deployment pack remains experimental until this checklist is completed with evidence.

[yhay81]

Azure pack baseline merged (2026-07-28)

• PR: feat(azure): add Container Apps deployment pack #153
• Exact merged main commit: 717306b34f7e9f81ec020b9ac256038d9721cce1 (GitHub-verified GPG signature)
• Exact-main CI: https://github.com/haya-inc/hayasend/actions/runs/30385497097 — success
• Exact-main CodeQL: https://github.com/haya-inc/hayasend/actions/runs/30385494559 — all three languages returned 0 results
• Open main code-scanning alerts: 0
• All four CodeQL findings discovered on the PR were fixed in code and none were dismissed

This issue remains the authority for the isolated hosted lifecycle and ACS terminal-recipient proof. No Azure resources were created by #153, so every billable provisioning, delivery, receipt, rollback, restore, and cleanup checkbox remains open.

[yhay81]

Immutable hosted-proof input — 2026-07-29

• Released input: HayaSend v0.3.0 from reviewed source 9f420d953c18f6c1f65e46daccd3e025a9bb3933.
• OCI index: sha256:458e9299ddef7a0d398e51cc18ce0daae2557cd444af55dadc67ae3e10bea519.
• Post-pin exact main: e987e38dcaf9cedca567c2a90d98b81c0c2da4bc (GitHub signature verification: valid).
• Exact-main CI: https://github.com/haya-inc/hayasend/actions/runs/30398825664
• Exact-main CodeQL default setup: https://github.com/haya-inc/hayasend/actions/runs/30398824197
• Open code-scanning alerts on main: 0.
• Protected follow-up: chore: pin portable deploys to v0.3.0 image #162.
• azure-container-apps-pack passed on the exact main run, including Terraform tests and Trivy.
• The operator guide now pins the initial deployment to the v0.3.0 OCI index.

The currently authenticated Azure subscription is not an isolated empty proof subscription, so no Azure resource was provisioned. A separately authorized isolated subscription and cost ceiling, ACS custom-domain/Event Grid terminal proof, rollback, cleanup, and residue/cost audit remain required; maturity stays experimental.

[yhay81]

Provider preflight update — 2026-07-29

Azure CLI 2.88.0 is current and authenticated, but the accessible subscription contains an unrelated existing resource group and is not the isolated empty subscription required by this issue. It will not be used. No Azure resource or billing change was made.

[yhay81]

Exact-main safety checkpoint — 2026-07-29

• Exact main: 5b3fa1c57afb125c17266491da21110e19599827 — GitHub verified
• CI: https://github.com/haya-inc/hayasend/actions/runs/30401070775 — azure-container-apps-pack and the complete suite passed
• CodeQL: https://github.com/haya-inc/hayasend/actions/runs/30401070171 — all three languages passed; open alerts on main: 0

PR #163 changed the console-first behavior of the portable PaaS packs and did not alter the Azure ACS deployment contract. No Azure resource or billing change was made. The currently accessible non-isolated subscription will not be used; an isolated subscription, explicit cost ceiling, and ACS custom-domain/Event Grid terminal proof remain required.

[yhay81]

v0.3.1 immutable Azure input refresh — 2026-07-29

The Azure Container Apps deployment pack now points at the verified v0.3.1 image while the ACS Email/Event Grid transport contract remains unchanged:

• Release: v0.3.1, source e6a4cdabe5e699bfd8fc509484e3ed14a00091da.
• Azure pack pin: sha256:73c650a648824005adeb45cf6e5ef1ca8c7d9f321d25c5c58290c070ee6a8979 via chore: pin portable deploys to v0.3.1 #166.
• Exact post-pin main: 99e80c0adeb27bf912570fbac62351893f7b76ae — verified.
• CI: https://github.com/haya-inc/hayasend/actions/runs/30406584349 — azure-container-apps-pack, Terraform tests/Trivy, and the full suite passed.
• CodeQL: https://github.com/haya-inc/hayasend/actions/runs/30406583567 — all languages passed; open main alerts: 0.
• v0.3.1 assets, checksums, SLSA provenance, SBOM attestation, anonymous GHCR access, and non-root image metadata were verified.

No Azure resource, Event Grid subscription, ACS Email domain, DNS record, role assignment, database, storage object, identity, or billing change was made. The accessible subscription remains non-isolated and will not be used. An explicitly isolated subscription and cost ceiling, ACS custom-domain/quota setup, recipient-level terminal correlation, duplicate/out-of-order convergence, controlled receipt, rollback, zero-residue cleanup, and cost audit remain required; maturity stays experimental.

[yhay81]

Harness update: PR #168 merged to protected main as verified commit 4e6e9492bc78f99c08c65eb8f56eb4c9782d36a6. .github/workflows/azure-integration.yml now provides a protected-main, explicit-cost-confirmation Azure Container Apps/ACS Email lifecycle proof, including the controlled two-recipient terminal-delivery/convergence runner, rollback/cleanup boundaries, and privacy-safe evidence handling. The Azure pack passed exact-main CI run 30416007981 and scoped HIGH/CRITICAL Trivy validation; exact-main CodeQL run 30416007906 passed with 0 open alerts.

No Azure resources, email, or billable hosted proof were run. Every acceptance checkbox in this issue remains open until an isolated subscription, cost ceiling, controlled recipients, and cleanup plan are explicitly authorized and the guarded workflow evidence is reviewed.

[yhay81]

Azure combined capability and doctor verification — 2026-07-29

PR #169 merged as verified main commit fdca3c05b848b28e73ea493c5c222395019cfc77.

The repository now publishes a generated azure-container-apps-acs combined deployment document instead of relying on separate runtime and provider descriptions. It declares the portable PostgreSQL runtime plus ACS Email/Event Grid transport, records conservative 50-recipient / 10 MB request / 20-attachment / 7.5 MB decoded-attachment limits, remains experimental, and keeps every hosted evidence gate pending. hayasend doctor now validates the committed ACS capability digest and accepts the portable PostgreSQL recovery diagnostics used by the Azure pack.

• PR CI: https://github.com/haya-inc/hayasend/actions/runs/30417490481
• PR CodeQL: https://github.com/haya-inc/hayasend/actions/runs/30417489237
• Exact-main CI: https://github.com/haya-inc/hayasend/actions/runs/30417653298
• Exact-main CodeQL: https://github.com/haya-inc/hayasend/actions/runs/30417652859
• Open main code-scanning alerts: 0

No Azure resource, DNS record, ACS domain, Event Grid subscription, database, storage object, identity, role assignment, email, or billing change was made. Every hosted lifecycle and terminal-delivery checkbox remains open pending an explicitly isolated subscription and cost ceiling.

[yhay81]

Shared recovery contract is now available for the Azure Container Apps path.

Implemented on main via #172 at b4e35579ba221b6740675f73ee13040971be1b8a:

• provider-neutral, console-only PostgreSQL + private attachment backup/restore proof;
• retained future-due fixture with ledger/outbox/idempotency and SHA-256-bound attachment evidence;
• restored worker recovery from the authoritative due row after the wake-up job is removed;
• runtime rehash of restored attachment bytes before console-only acceptance;
• separate fixed seed and restore executables (no user-controlled mode switch);
• privacy-safe evidence and database fixture cleanup.

Exact-main evidence:

• CI: https://github.com/haya-inc/hayasend/actions/runs/30422292857 — all jobs passed, including PostgreSQL 18 and npm-package
• CodeQL: https://github.com/haya-inc/hayasend/actions/runs/30422292627 — Actions, JavaScript/TypeScript, and Python passed
• repository open code-scanning alerts: 0
• Project site: https://github.com/haya-inc/hayasend/actions/runs/30422292877 — passed

This is implementation evidence only. No hosted provider backup/restore run was performed, no provider resources were created, and this issue must remain open until its native database + object-store restoration and zero-residue/cost evidence are captured.

Remaining Azure acceptance work: create and restore the PostgreSQL backup/PITR target plus Blob attachment copy, execute the restored Container Apps API/worker, and verify cleanup and cost.

[yhay81]

Parked under the accepted 2026-07-29 two-speed strategy in #81/#132. The implementation and evidence plan are preserved as Labs work, but this hosted proof is not on the active Certified roadmap and does not justify new billable infrastructure now. Applications on this platform can consume the AWS-hosted HayaSend API without hosting HayaSend here. Resume only with measurable user demand, a committed maintainer/sponsor, or a material capability gap that the AWS path cannot serve. Repository CI alone still cannot promote this composition.