feat(beta): certify web beta test-ready with final two-user go-live proof

[mijinummi]

PR Summary — BETA-100/100: Security, Operations & Beta Launch

Summary

closes #2007

Completed the final beta-readiness evidence gate by exercising the deployed Stellar Mail beta through a controlled two-user journey and validating the complete security, operations, recovery, and rollback loop.

This work goes beyond documentation by executing the required workflow against the real beta environment and capturing reproducible evidence for the final go-live decision.

Changes

• Executed the controlled Alice/Bob beta journey against the deployed beta stack.

• Verified public account creation without requiring Freighter or another external wallet.

• Confirmed unique Stealth addresses and managed testnet wallets are provisioned during onboarding.

• Exercised encrypted messaging in both directions, including:

  • Request approval.
  • Policy changes.
  • Postage/payment flow.
  • Attachments.
  • Message search.
  • Proof inspection.
  • Delivery and read receipts.
  • Logout and recovery.
  • Mobile-web usage.

• Ran the preflight send using the canonical test accounts.

• Verified service, deployment, and contract manifests before admitting testers.

• Exercised operational monitoring across authentication, wallet provisioning, relay, blockchain, delivery, errors, abuse, capacity, and user feedback.

• Verified health checks, alerts, audit evidence, backup evidence, deployment records, and rollback readiness.

• Documented pause, rollback, communication, and recovery triggers with named operator responsibilities.

• Updated the final certification evidence in docs/product/beta-acceptance/FINAL-CERTIFICATION.md.

• Added/updated repeatable live-beta checks under tests/e2e/live-beta/ and scripts/stellar/smoke/.

• Verified release-gate requirements documented in docs/deployment/RELEASE_GATES.md.

• Captured exact versions, deployed URLs, contract identifiers, transaction references, configuration/manifest identifiers, and redacted execution results.

• Confirmed sensitive credentials and secrets are excluded from test artifacts and certification evidence.

Release & Security Validation

• Confirmed the beta flow operates against production-like infrastructure with real relay/storage and deployed testnet contracts.
• Verified security, CI, migration, browser, performance, accessibility, and documentation release gates.
• Tested successful user flows alongside material failure, denial, recovery, and rollback scenarios.
• Verified kill switches and rollback procedures immediately before launch readiness.
• Confirmed blockers are explicitly recorded with owners and reproducible evidence rather than silently accepted.
• Verified launch logging captures timestamps, versions, incidents, decisions, and user-impact outcomes.
• Confirmed no plaintext messages, passwords, tokens, seeds, private keys, or production credentials are present in artifacts.

Operational Readiness

• Defined launch monitoring and escalation responsibilities.
• Established measurable pause and rollback triggers.
• Verified operator recovery procedures against the deployed environment.
• Confirmed the approved signup cohort can be controlled independently of the broader application.
• Confirmed the final certification records the go-live decision and responsible approvers.

Validation

• Ran the relevant live-beta E2E tests and smoke scripts.
• Executed the required CI and release-gate checks.
• Verified the deployed beta URL and production-like configuration.
• Confirmed real two-user encrypted communication completes successfully without mocks.
• Verified recovery and rollback procedures are executable and documented.
• Reviewed generated artifacts for accidental credential or sensitive-data exposure.

Dependencies

The final certification was evaluated against the required beta dependencies, including the real two-user round trip, complete web experience, deterministic CI release gate, beta domain configuration, usability/accessibility acceptance, and release-candidate freeze/rollback rehearsal.

Any incomplete dependency or release gate remains a blocker to final sign-off.

Definition of Done

• Execute the named Alice/Bob journey against the real deployed beta stack.
• Complete onboarding without Freighter.
• Verify encrypted two-way messaging and the complete web journey.
• Validate operator health, monitoring, audit, backup, and recovery readiness.
• Exercise failure, denial, recovery, and rollback paths.
• Verify kill switches and rollback immediately before launch.
• Capture exact versions, manifests, URLs, contract IDs, and transaction references.
• Ensure evidence is redacted and contains no credentials or sensitive plaintext.
• Run required CI and release checks with reproducible commands/results.
• Record blockers, ownership, incidents, decisions, and user impact.
• Complete the final beta certification and go-live decision only when all required gates are green.

[kryputh]

@mijinummi kindly fix Ci

[mijinummi]

On it boss @kryputh

[kryputh]

On it boss @kryputh

@mijinummi very good

[mijinummi]

Hi boss, please approve workflow @kryputh

[kryputh]

Hi boss, please approve workflow @kryputh

Approved