2026-06-05 End-to-End Email Workflow Verification Report

Date: 2026-06-05 Conducted by: sre-agent Scope: All six email workflow phases — mailbox routing, waitlist round-trip, inbox placement, bounce/complaint webhooks, delivery latency, and full customer journey Status at time of report: GO-WITH-FIXES

1. Executive Summary

• All three email-authentication signals (DKIM, SPF, DMARC) pass 100% on outbound send, confirming sender-domain health. Postmark-to-MX latency is excellent (p50 148ms, p99 718ms).
• Two prod-blocking middleware gaps — FLAG_SESSION_AUTH_MIDDLEWARE exemption missing for /api/waitlist/ and /webhooks/postmark/ — prevent the waitlist signup public endpoint and the Postmark delivery webhook from functioning on production. Both are code fixes in one file (session_auth.py).
• Two active Postmark suppressions (ops@raxx.app hard-bounce 2026-05-18, support@raxx.app suppressed) prevent delivery to those addresses and must be cleared in the Postmark dashboard before launch.

Launch-readiness verdict: GO-WITH-FIXES

All blockers are tractable and bounded. No architectural redesign required. Estimated remediation window: 2–3 engineering days (see Section 8 for per-item estimates).

2. Per-Mailbox Status Table

Diagnostic note — mailbox probe methodology: All four mailboxes share a common constraint: the Gmail MCP tool (mcp__claude_ai_Gmail__send_email) was not available in this agent session. Sending via Postmark SMTP bypasses the inbound routing rule that Google Workspace applies to route incoming mail through the Postmark inbound webhook → Lambda bridge → FreeScout. Architectural inbound path (Google MX → Google Workspace routing rule → FreeScout IMAP or Lambda bridge) is correct per docs/ops/runbooks/freescout-e2e-test.md but could not be exercised end-to-end without Gmail send capability. Pre-send checks (FreeScout API, Postmark server key validity, MX records) all passed.

3. Waitlist Round-Trip

Root cause: FLAG_SESSION_AUTH_MIDDLEWARE=1 on raxx-api-prod. The path /api/waitlist/signup is not in _EXEMPT_PREFIXES or _EXEMPT_EXACT in backend_v2/api/middleware/session_auth.py. This is a public surface and must be exempted before launch.

Fix: Add /api/waitlist/ to _EXEMPT_PREFIXES in session_auth.py. Requires a prod deploy.

4. Inbox Placement and Email Authentication

Postmark MessageIDs for manual Gmail tab verification:

• db3e7d0e-f027-437e-8bb8-947aa3a62b31 → kris+ip1@moosequest.net
• f5bcde3f-ea3e-456e-a325-38738a734d66 → kris+ip2@moosequest.net
• a58eb20f-2d96-4814-9acc-647c94fd97aa → kris+ip3@moosequest.net

Gmail tab placement could not be read — mcp__claude_ai_Gmail__search_threads was unavailable. Manual verification: open any of the three delivered messages in Gmail and confirm the tab (Primary / Promotions / Updates / Spam).

SPF hygiene gap: raxx.app SPF record uses ~all (softfail) instead of -all (hardfail). DMARC p=quarantine mitigates unauthenticated spoofing, but tightening to -all is recommended post-launch. Low-priority; does not block launch.

5. Bounce and Complaint Webhook Coverage

To bring Path B (Raptor delivery monitor) live, all four of the following must be completed in order:

1. Add /webhooks/postmark/ to _EXEMPT_PREFIXES in session_auth.py (same PR as the waitlist fix).
2. Generate POSTMARK_DELIVERY_WEBHOOK_SECRET and write to vault at /MooseQuest/postmark/POSTMARK_DELIVERY_WEBHOOK_SECRET, then: heroku config:set POSTMARK_DELIVERY_WEBHOOK_SECRET=<value> --app raxx-api-prod >/dev/null 2>&1
3. Set the flag: heroku config:set FLAG_POSTMARK_DELIVERY_MONITOR=1 --app raxx-api-prod >/dev/null 2>&1
4. Configure the Postmark webhook URL in the Postmark dashboard: Server → Settings → Webhooks → Delivery → https://api.raxx.app/webhooks/postmark/delivery

Note on complaint simulation: complaint@postmark.io triggers a HardBounce+SubscriptionChanged suppression on outbound message streams (not a SpamComplaint record). postmark_delivery.py SpamComplaint handling is code-correct but cannot be exercised via the simulator on outbound streams; use Postmark's test webhook payload tool instead.

Path A (Postmark native Slack webhook) remains the active bounce/complaint signal path for pre-launch. Per feedback_pre_launch_digest_notifications.md, remove or reconfigure the per-event Slack webhook when Path B is enabled.

6. Latency Profile

All measurements are Postmark-to-MX (Google Workspace 250 acceptance). They do not include the unmeasured MX-to-inbox delta (typically 1–5s for Google Workspace).

Notes:

• 4 of 10 messages were delivered within the same wall-clock second as the API call. Postmark delivery event timestamps have 1-second resolution; raw latency for those 4 is reported as 0ms (clamped). True latency is in [0, 818ms).
• Latency is measured Postmark-side from ReceivedAt on the Delivered event from /messages/outbound/{id}/details — authoritative confirmation of Google MX 250 acceptance.
• p95 at 694ms and p99 at 718ms are within the same bucket. No outlier pattern detected. Postmark delivery performance is healthy.
• No Gmail-tab-render latency could be measured (Gmail MCP unavailable). Add to the next manual smoke run.

7. Full Customer Journey

Cloudflare Access

CF Access passed. Service tokens (CF_ACCESS_SVC_API_CLIENT_ID + CF_ACCESS_CLIENT_SECRET) correctly scope to api.raxx.app (non-identity decision=non_identity WAF skip rule). Frontend raxx.app remains CF Access-gated; no programmatic probe of signup form HTML was possible (expected and intentional per task spec).

Signup

Orphaned row note: kris+fp1@moosequest.net likely has an orphaned users row in prod DB (bootstrap_token=invalid → INSERT attempted before token validation). No credential attached; not a security risk; normal per anti-enum design. No cleanup action required.

Onboarding (4-step wizard)

All four onboarding steps were not reachable because the WebAuthn login ceremony cannot be completed programmatically. POST /api/onboarding/complete returns 401 (auth required), confirming the route exists and is gated correctly.

FLAG_ONBOARDING_WIZARD=on confirmed live on prod (401 not 404).

Individual step verification requires an operator-authenticated browser session or a Playwright MCP smoke run with a seeded test passkey fixture.

First Paper Trade — Trade Gate

Static analysis of trade_window.py + auth_email.py confirms gate logic is correct: require_email_verified() returns 403 when FLAG_AUTH_EMAIL_VERIFICATION=ON and users.email_verified_at_utc IS NULL.

Flag Audit — All 5 Critical Flags on Prod

All flags are in launch-correct state. Founders gate open=true confirmed.

Launch Readiness Gap — Authenticated Smoke Path

No durable synthetic smoke test exists for the post-signup authenticated customer journey. The existing Playwright spec at frontend/raxx-next/tests/e2e/signup-to-paper-trade.spec.ts targets the frontend UI and cannot run without a seeded passkey fixture.

Recommended actions (tracked in Section 8): 1. Commission qa-agent to verify the e2e spec is runnable in CI with a seeded test passkey fixture. 2. Add a backend-only session-bypass flag (FLAG_AUTH_TEST_SESSION_BYPASS) for operator-only synthetic smoke — never deployed to prod. 3. Document the gap in the launch-readiness checklist.

8. Issues by Severity

9. Operator Decisions Required

The following items require explicit operator action and cannot be resolved by the SRE agent or feature-developer alone.

Immediate (before launch):

1. Clear ops@raxx.app hard-bounce suppression. Command: python3 scripts/ops/postmark_bounce_check.py --reactivate ops@raxx.app Or: PUT https://api.postmarkapp.com/bounces/2153208840/activate with X-Postmark-Server-Token header.

2. Clear support@raxx.app outbound suppression. Path: Postmark dashboard → Activity → Suppressions → delete support@raxx.app from the outbound stream.

3. Confirm or restore account-management@raxx.app Google Workspace routing rule. Path: Google Admin console → Apps → Google Workspace → Gmail → Routing. Confirm the routing rule that forwards account-management@raxx.app to the Postmark inbound address bb43f79c8bfe23d564079fb431583c30@inbound.postmarkapp.com is active.

4. Confirm correct vault path for POSTMARK_SERVER_TOKEN. Documented path: /MooseQuest/postmark/POSTMARK_SERVER_API_KEY. If the secret exists under a different path under /Raxx/*, confirm and update docs/ops/runbooks/postmark.md accordingly.

5. Set Postmark delivery webhook URL (after code deploy in items #1/#2 above). Path: Postmark dashboard → Server → Settings → Webhooks → Delivery. Value: https://api.raxx.app/webhooks/postmark/delivery

6. Set FLAG_POSTMARK_DELIVERY_MONITOR and POSTMARK_DELIVERY_WEBHOOK_SECRET (after code deploy). heroku config:set FLAG_POSTMARK_DELIVERY_MONITOR=1 --app raxx-api-prod >/dev/null 2>&1 heroku config:set POSTMARK_DELIVERY_WEBHOOK_SECRET=<generated-value> --app raxx-api-prod >/dev/null 2>&1

Post-launch (low urgency):

7. Verify Gmail tab placement for the three inbox-placement test emails listed in Section 4.

8. Tighten SPF record from ~all to -all on raxx.app DNS.

10. Cleanup Notes

Operator chose NOT to run automated cleanup. The following artifacts were created during the six phases and remain in place. Commands are provided for later manual cleanup.

Postmark — suppressed addresses

kris+ip1@moosequest.net, kris+ip2@moosequest.net, kris+ip3@moosequest.net may have received the 3 inbox-placement test emails. No suppression was added for these addresses (they received valid sends). No cleanup required.

complaint@postmark.io triggered a HardBounce+SubscriptionChanged suppression on the Postmark outbound stream for the complaint test recipient (the specific address used in Phase 4). Postmark dashboard → Activity → Suppressions to review and remove if needed.

Postmark — test message records

10 outbound test messages from the latency profile (Phase 5) + 3 inbox placement messages (Phase 3) + at least 1 bounce test (Phase 4) are recorded in Postmark message activity. These are read-only log records; no cleanup possible or needed.

FreeScout — existing conversations

FreeScout mailbox ID 1 (support@raxx.app) had 16 existing conversations at time of probe. No new conversations were created during the test (inbound path was not triggered). No cleanup needed.

FreeScout mailbox ID 3 (account-management@raxx.app) received no new conversations during the test. No cleanup needed.

Prod DB — orphaned user row

kris+fp1@moosequest.net likely has an orphaned users row in the prod database with no WebAuthn credential. This is a normal artifact of the anti-enum design. If cleanup is desired:

-- Verify first:
SELECT id, email, created_at, email_verified_at_utc
FROM users
WHERE email = 'kris+fp1@moosequest.net';

-- Delete only if no credential exists:
DELETE FROM users
WHERE email = 'kris+fp1@moosequest.net'
  AND id NOT IN (SELECT user_id FROM webauthn_credentials);

Run against the prod database via:

heroku pg:psql --app raxx-api-prod

Google Workspace — test email delivery

Three test emails (inbox placement, Phase 3) were delivered to kris+ip1@moosequest.net, kris+ip2@moosequest.net, and kris+ip3@moosequest.net in Google Workspace. Search in Gmail: from:no-reply@raxx.app subject:"Raxx" after:2026/06/04 to locate and delete if desired.

References

• docs/ops/runbooks/postmark.md — Postmark failure modes, suppression reactivation, Path A vs Path B architecture
• docs/ops/runbooks/freescout-e2e-test.md — inbound email pipeline architecture and test procedure
• docs/ops/runbooks/freescout-postmark-relay.md — relay architecture
• backend_v2/api/middleware/session_auth.py — session auth middleware, exempt path lists
• backend_v2/api/postmark_delivery.py — delivery webhook handler
• backend_v2/api/auth_email.py — email verification gate
• scripts/ops/postmark_bounce_check.py — bounce reactivation CLI