01-projects/printables-product/reviews

lifecycle email sms

·review-and-plan
printablesscribble-workslifecycleemailsms

2026-09-22 review-and-plan: lifecycle email/SMS

Reviewed: RayDataCo/scribble-works @ main 222bf3a (13 behind origin/main): workers/daily-playset/{wrangler.toml,README.md,src/*}, workers/feedback-intake/src/twilio.js, migrations-accounts/{0003,0006,0015}*.sql, docs/ARCHITECTURE.md, docs/ROADMAP.md; vault: [[2026-08-31-product-model-rulings]] (rulings 24, 31, multi-kid), [[2026-08-31-studio-charter]] §2 + 09-04 amendment, [[2026-09-02-retention-nudges-plan]] frontmatter, 02-sops/2026-09-14-scribble-works-email-sending-domains.md, queue.md, [[2026-09-08-lifecycle-email-sms]], [[2026-09-15-lifecycle-email-sms]].

Findings

  1. Daily-playset "live" status is stale, not contradictory. README.md:15-16: "deployed and scheduled delivery enabled. Verified 2026-09-10"; wrangler.toml:45's DAILY_PLAYSET_ENABLED="false" is a documented safe-setup default, not production (README.md:113-117) — no real disagreement, but the 2026-09-10 verification is 12 days stale, unrechecked.
  2. DMARC is live; its trigger is now due. Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC) are live at p=none on scribbleworks.co/news.scribbleworks.co, ruled and DNS-verified 09-14 (02-sops/2026-09-14-scribble-works-email-sending-domains.md:6,34-35,49). Its trigger — 7 clean days, propose p=quarantine (:43) — fired a day ago, unactioned.
  3. Schema blocks SMS independent of Twilio. migrations-accounts/0006...sql:42's daily_delivery CHECK allows only ('off','email'), though the same file's comment cites ruling 31's "email/SMS." A Twilio go-ahead alone wouldn't be deliverable without a migration too.
  4. Twilio fail-closed is already shipped; queue.md is stale. twilio.js:57-61's verifyTwilio returns {ok:false, reason:'not_configured'} on a missing token unless TWILIO_ALLOW_UNSIGNED="true" is set (comment :26-32: "audit B, H1 / audit A, #1 — 2026-09-02"). queue.md:250 still lists this as blocking — stale. Twilio stays inbound-only; zero outbound-lifecycle-SMS code repo-wide.
  5. Two prior open items are still open. [[2026-09-02-retention-nudges-plan]]'s own frontmatter still reads "awaiting founder read" (line 4) — 20 days idle. The 09-15-proposed 100/day-cap alert (queue.md:222) is unbuilt a week later.

Proposed queue.md diff

Engineering-autonomous, reversible, no accounts/pricing/payment:

+ [engineering, S, NEW 2026-09-22] Re-check daily-playset live state: README.md:15-16's "verified 2026-09-10" status is 12 days stale. Confirm current DAILY_PLAYSET_ENABLED/schedule state and refresh the status line.
+ [engineering, S, NEW 2026-09-22] Retire queue.md:250 (Twilio fail-closed) — already shipped in twilio.js:57-61 (audit B H1 / audit A #1, 2026-09-02). Stale backlog line.

Decisions needed

  1. Open Twilio for outbound lifecycle SMS, or stay email-only — third consecutive Tuesday review carrying this (ruling 24: new external account, ~$10/mo).
  2. Read/greenlight the retention-nudges-plan (20 days idle) — gates the nudges table (queue.md:278) and the still-unresolved day-0-welcome-email question (raised 09-15).
  3. Per-kid pricing (2026-08-31-product-model-rulings.md:59, "open pricing lever, not yet decided") — bears directly on paid-tier SMS cost; resolve alongside the Twilio call, not after.
  4. Propose p=quarantine for DMARC — the SOP's 7-day trigger fired a day ago (02-sops/2026-09-14-scribble-works-email-sending-domains.md:43); founder's one-line tap, not a silent flip.