[thomasluizon]

Refs thomasluizon/orbit-tickets#746. This is the standing API sync ticket; keep it open.

Change

Carry the seven specified main fixes into redesign/main by cherry-pick with source references:

• 7a1e26a9 (Guard web service Terraform plans before apply #631), web service Terraform plan guard, was already on this branch as d45b4d98. It applied without conflict.
• 498015ae (Add manual API release workflow for production and staging #632), manual production and staging release workflow, was already on this branch as b72cea41. It applied without conflict.
• f770b47f (Add Amazon SES delivery and signed event handling #628), SES delivery and signed events, is 48baf3f6. Resolved the two email service conflicts described below.
• ee40ae9c (Keep staging awake and reseed its free database #626), staging keepalive and reseed, is fa40bf05. It applied without conflict.
• 65d355fc (Point apex DNS at Render landing site #634), apex DNS, is 6a9572d6. It applied without conflict.
• 395239fe (Move uploads to private S3 with stable read links #625), private S3 uploads and stable read links, is d01042ad. It applied without conflict.
• 0fd416fd (Fix Render database names in API connection strings #633), Render database names, is fd9390ce. It applied without conflict, including the StagingSeedCommand generated regex.

The followup 0ab1112d adds the redesign error copy required by the carried staging habit guard and regenerates gating-matrix.json. src/Orbit.Api/openapi.json was regenerated by the API build after the picks. EF reports no pending model changes; these picks add no migration. There is no migration ordering question.

Conflict resolution

• src/Orbit.Infrastructure/Services/ResendEmailService.cs: kept main's shared EmailServiceBase extraction so SES and Resend use one composer, while retaining the redesign subject copy, HTML layout, marketing styling, support labels, Resend retry behavior, unsubscribe headers, and test account handling in EmailMessageComposer and the provider service.
• tests/Orbit.Infrastructure.Tests/Services/ResendEmailServiceTests.cs: retained the full redesign suite, including localized copy, plain text, HTML escaping, and layout checks. The main provider and composer cases remain covered by the new EmailMessageComposerTests and SesEmailServiceTests; their subject expectations now match the redesign copy. No test behavior was dropped.

Test evidence

• env -u LANG LC_ALL=en_US.UTF-8 dotnet build Orbit.slnx --verbosity quiet: exit 0, zero errors.
• env -u LANG -u LC_ALL dotnet test --verbosity quiet: exit 0, 7,995 passed.
• env -u LANG LC_ALL=en_US.UTF-8 dotnet test --verbosity quiet: exit 0, 7,995 passed.
• terraform fmt -check -recursive infra: exit 0. After backendless provider initialization, terraform -chdir=infra validate -no-color and terraform -chdir=infra/staging-database validate -no-color: exit 0.
• dotnet ef migrations has-pending-model-changes --project src/Orbit.Infrastructure --startup-project src/Orbit.Api: exit 0, no pending model changes.
• node --test infra/check-web-plan.test.mjs infra/ses-isolation.test.mjs: 9 passed. Focused email and event tests: 62 passed. Focused S3 and staging tests: 25 passed.
• node tools/arch-map.mjs: 198 endpoints, zero orphan endpoints, zero untested feature folders. node tools/gating-matrix.mjs regenerated the tracked matrix.
• The unchanged ErrorCopyTests.EveryDomainErrorConstantHasCopy failed with INVALID_CREATED_AT_UTC after the staging carry. After adding its bilingual copy, dotnet test tests/Orbit.Application.Tests --filter 'FullyQualifiedName~ErrorCopyTests' passed all 716 cases. The existing test caught the defect, so no strengthened test was needed.
• Dash, timeless, and git diff --check checks passed.
• Existing SES processor tests passed with the defect present: 9 passed.
• Strengthened CertificateFetchFailureIsRetryable failed with the defect present for both HTTP and transport failures: no exception was thrown. After the fix, the focused SES and controller tests passed: 16 passed.
• dotnet build Orbit.slnx: zero errors in both requested locale settings. Full dotnet test: 8,001 passed in each setting.
• Terraform format and validation passed. EF reported no pending model changes. The worktree is clean.

External interface evidence

The source PRs record the observed external fields and reproduction commands. Their evidence was checked with gh pr view <number> --json body before this carry:

• #631 and #632 cover the Terraform plan JSON, Render service and deploy fields, and GitHub deployment fields.
• #628 covers the installed SES SDK and Terraform provider fields plus SNS and SES event shapes.
• #626 covers Render Postgres and deploy fields, Terraform state and plan fields, and GitHub OIDC fields.
• #634 records the DNS answers consumed by the cutover check.
• #625 covers the installed S3 SDK signed URL method and an observed offline signed URL.
• #633 covers the Render provider connection fields and observed database names from saved state.

Manual steps

These carried infrastructure changes retain the activation steps in their source PRs. Before enabling them on redesign deployments:

• For SES, use AWS SES in us-east-2 to confirm production access and verified send.useorbit.org and updates.useorbit.org identities. In infra/local.tfvars, set production_email_provider or staging_email_provider to Ses only after the reviewed Terraform apply. Confirm Email__Provider=Ses in the corresponding Render API Environment Group and a confirmed SNS HTTPS subscription. See #628.
• For staging reseed, configure RENDER_API_KEY in GitHub Actions Secrets and SEED_OWNER_EMAIL, STAGING_ENVIRONMENT_ID, STAGING_API_SERVICE_ID, and STAGING_POSTGRES_IP_ALLOW_LIST in GitHub Actions Variables. Complete the documented Terraform state transfer and apply before running Actions > Staging reseed. A successful migration, live deploy, and seed run prove readiness. See #626 and #633.
• For apex DNS, set dns_apex_target = "orbit-landing-aaa7.onrender.com" in infra/local.tfvars and apply only a reviewed apex plan. Confirm the flattened A answers on both Cloudflare nameservers and the verified useorbit.org custom domain in Render > orbit-landing > Settings > Custom Domains. See #634.
• For S3, apply the reviewed infra/ plan, then set production_storage_provider or staging_storage_provider to S3 only after the web client dependency is deployed. Confirm Storage__Provider=S3 and the Storage__S3__Bucket, Storage__S3__Region, Storage__S3__PublicBaseUrl, Storage__S3__AccessKeyId, and Storage__S3__SecretAccessKey keys in Render > Environment Groups. A signed PUT and read through publicUrl prove the cutover. See #625.
• For Render database cutover, complete the staging data copy described in #633. Set api_database = "render" in infra/local.tfvars only after verifying the production database in Render > Postgres > Connections. Confirm both ConnectionStrings__DefaultConnection and ConnectionStrings__SessionConnection in the linked Render API environment group name the correct database and that the API remains healthy.
• The orchestrator must push this commit and complete review on the existing PR. This worker did not push or open a PR.
• Before enabling SES, apply the reviewed infra Terraform plan. In AWS SQS Queues, verify orbit-ses-events-dead-letter and orbit-ses-events-staging-dead-letter; in SNS Subscriptions, verify each webhook’s redrive policy points to its matching queue.
• Deploy the carrying API commit through GitHub Actions Release API (release.yml) for each intended environment. Verify the Render orbit-api or orbit-api-staging service runs that release.
• For an approved SES cutover, set production_email_provider or staging_email_provider to Ses in infra/local.tfvars, apply the reviewed plan, and verify the corresponding Render environment has Email__Provider=Ses and its signed SNS webhook succeeds.

Assumptions

• Certificate HTTP errors, transport failures, and timeouts are retryable. Alternative rejected: returning 400 for those dependency failures.
• Replay republishes the original event through its matching SNS topic after inspecting the actual queue message. Alternative rejected: posting queue content directly to the signed webhook.

[pullfrog]

Important

The SES event path can permanently lose valid bounce and complaint notifications during transient certificate failures or an API outage. Please address both delivery paths before enabling SES.

Reviewed changes Carried release automation, staging database lifecycle, DNS and Terraform guards, SES delivery and event handling, S3 upload storage, the email composer integration, and their tests into redesign/main.

• Releases and infrastructure: Manual production and staging Render releases, a web service plan guard, apex DNS cutover, staging keepalive and reseed, and database connection name fixes.
• Email: SES identities, credentials and event routing, signed SNS processing and marketing suppression, with shared composition for the SES and Resend providers.
• Uploads: Private S3 uploads and stable API read redirects alongside the existing Supabase write path, plus provider configuration and focused tests.
• Redesign carry: Historical habit seed guards, bilingual error copy, OpenAPI output and gating matrix regeneration.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes Re-reviewed the SES event recovery changes in 80d8e7d7 against the full PR diff.

• Retryable verification: Distinguished temporary SNS certificate fetch failures from invalid messages and returned HTTP 503 for the former, with focused tests for HTTP, transport, and timeout failures.
• Recoverable delivery: Added separate encrypted SQS dead-letter queues and SNS redrive policies for production and staging, plus a documented replay procedure and Terraform checks.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}