Add email waitlist and durable Telegram notification backend #1

Merged

backmeupplz merged 5 commits from feat/waitlist-22 into main

2026-10-04 14:25:21 +00:00

backmeupplz commented

2026-10-04 14:06:46 +00:00

(Migrated from github.com)

Summary

Agentboard #22: add the exact requested waitlist copy and accessible responsive email form without changing hardware/CAD or build-log content.

Static GitHub Pages frontend with loading/success/error/retry feedback.
Minimal Python stdlib API, durable SQLite unique signup + transactional leased Telegram outbox. Finite retry/backoff and Retry-After, missing bot configuration never rejects signup.
Server validation, narrow CORS, bounded HTTP concurrency/rate limits/honeypot; no public subscriber reads or private data logging.
Native Nixpacks configuration, operator backup/export guidance, Python/Node tests and CI.

Validation

uv run --python 3.12 --no-project python -m unittest discover -s waitlist -v: 22 passed.
node --test tests/waitlist.test.cjs: 7 passed.
git diff --check main...HEAD: clean.
Independent Astra APPROVE on exact head e1f303f9aec197c433b6c1b9259cf1a2e624f8b0, final review 287bb83e-30dd-422c-908e-9bfc36add29f; prior full and integration reviews also approved. CI passed with Python 3.12 + Node 22. First CI failure was a test-only shared clock mock issue, corrected without weakening assertions.

Release requirements (not yet deployed)

Frontend remains GitHub Pages main:/. Release owner must deploy API before exposing a broken form: new Easypanel app borodutch/horae-waitlist, source /waitlist, Nixpacks, one replica, stop-first, persistent volume /data, port 3000. Existing authorized Cloudflare zone supports new horae-waitlist.borodutch.com A record to existing Hetzner host; DNS currently absent. Configure HTTPS domain, verify health/CORS and synthetic dedup + persistence through managed restart. Follow waitlist/README.md.

Owner supplies TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID manually in Easypanel. No bot secret accessed; mock contract tests only, real delivery unverified. Ambiguous external timeouts may produce duplicate notifications (not duplicate stored signups).

Protected Easypanel/Cloudflare reads and dedicated SSH verified; no infrastructure changes in this implementation phase. GitHub main currently has no branch protection; release must still use exact-head independent review + green CI and guarded PR merge, never direct main push.

## Summary Agentboard [#22](https://agentboard.icefish-betta.ts.net/#22): add the exact requested waitlist copy and accessible responsive email form without changing hardware/CAD or build-log content. - Static GitHub Pages frontend with loading/success/error/retry feedback. - Minimal Python stdlib API, durable SQLite unique signup + transactional leased Telegram outbox. Finite retry/backoff and Retry-After, missing bot configuration never rejects signup. - Server validation, narrow CORS, bounded HTTP concurrency/rate limits/honeypot; no public subscriber reads or private data logging. - Native Nixpacks configuration, operator backup/export guidance, Python/Node tests and CI. ## Validation - `uv run --python 3.12 --no-project python -m unittest discover -s waitlist -v`: 22 passed. - `node --test tests/waitlist.test.cjs`: 7 passed. - `git diff --check main...HEAD`: clean. - Independent Astra APPROVE on exact head `e1f303f9aec197c433b6c1b9259cf1a2e624f8b0`, final review `287bb83e-30dd-422c-908e-9bfc36add29f`; prior full and integration reviews also approved. [CI passed](https://github.com/backmeupplz/project-horae/actions/runs/37208171147) with Python 3.12 + Node 22. First CI failure was a test-only shared clock mock issue, corrected without weakening assertions. ## Release requirements (not yet deployed) Frontend remains GitHub Pages `main:/`. Release owner must deploy API before exposing a broken form: new Easypanel app `borodutch/horae-waitlist`, source `/waitlist`, Nixpacks, one replica, stop-first, persistent volume `/data`, port 3000. Existing authorized Cloudflare zone supports new `horae-waitlist.borodutch.com` A record to existing Hetzner host; DNS currently absent. Configure HTTPS domain, verify health/CORS and synthetic dedup + persistence through managed restart. Follow `waitlist/README.md`. Owner supplies **TELEGRAM_BOT_TOKEN** and **TELEGRAM_CHAT_ID** manually in Easypanel. No bot secret accessed; mock contract tests only, real delivery unverified. Ambiguous external timeouts may produce duplicate notifications (not duplicate stored signups). Protected Easypanel/Cloudflare reads and dedicated SSH verified; no infrastructure changes in this implementation phase. GitHub main currently has no branch protection; release must still use exact-head independent review + green CI and guarded PR merge, never direct main push.

backmeupplz commented

2026-10-04 14:09:55 +00:00

(Migrated from github.com)

Independent review verdict: APPROVE

Head: e1f303f9aec197c433b6c1b9259cf1a2e624f8b0

Astra independent review chain: full implementation/shared-cooldown approval f7ac98eb-baf6-4c61-8199-9cea4e9b8ebf; combined-main/lightbox approval 6005e20c-12a9-492e-888d-8d0198fde7b6; final exact-head Python 3.12 test-clock correction approval 287bb83e-30dd-422c-908e-9bfc36add29f. No remaining actionable findings.

22 Python 3.12 tests and 7 Node tests pass; Nixpacks plan selects Python 3.12, requirements installation and python server.py; actual image build belongs to Easypanel release. CI 37208171147 passed at this head.

No live deployment or real Telegram delivery claimed. Release owner: stage native backend with durable /data volume, one replica/stop-first and HTTPS domain before homepage exposes the form; guarded PR merge/current-base + green main CI, restore service source to main if pre-staged, verify synthetic signup dedup and managed-restart persistence. Owner configures TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID later; absent variables are not a release blocker. No manual UI gate for this non-Veydrift ticket.

## Independent review verdict: APPROVE Head: `e1f303f9aec197c433b6c1b9259cf1a2e624f8b0` Astra independent review chain: full implementation/shared-cooldown approval `f7ac98eb-baf6-4c61-8199-9cea4e9b8ebf`; combined-main/lightbox approval `6005e20c-12a9-492e-888d-8d0198fde7b6`; final exact-head Python 3.12 test-clock correction approval `287bb83e-30dd-422c-908e-9bfc36add29f`. No remaining actionable findings. 22 Python 3.12 tests and 7 Node tests pass; Nixpacks plan selects Python 3.12, requirements installation and `python server.py`; actual image build belongs to Easypanel release. CI [37208171147](https://github.com/backmeupplz/project-horae/actions/runs/37208171147) passed at this head. No live deployment or real Telegram delivery claimed. Release owner: stage native backend with durable /data volume, one replica/stop-first and HTTPS domain before homepage exposes the form; guarded PR merge/current-base + green main CI, restore service source to main if pre-staged, verify synthetic signup dedup and managed-restart persistence. Owner configures TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID later; absent variables are not a release blocker. No manual UI gate for this non-Veydrift ticket.

backmeupplz commented

2026-10-04 14:16:25 +00:00

(Migrated from github.com)

Independent Astra/high review and release-owner acceptance review APPROVE e1f303f9ae; no actionable findings. 22 Python 3.12 + 7 Node tests pass; separate real-process restart/dedup test passed. Latest main already included, exact-head CI green. Staging durable native Easypanel backend before guarded squash and Pages publication.

Independent Astra/high review and release-owner acceptance review APPROVE e1f303f9aec197c433b6c1b9259cf1a2e624f8b0; no actionable findings. 22 Python 3.12 + 7 Node tests pass; separate real-process restart/dedup test passed. Latest main already included, exact-head CI green. Staging durable native Easypanel backend before guarded squash and Pages publication.