1 files changed, 9 insertions(+), 0 deletions(-)

M .up/phase5a-webhooks.md

@@ 56,6 56,15 @@ Reference: /Users/blikh/data/home/tmp/pages.sr.ht (same fork).
   refuse AUTH_COOKIE). Owner "user" row seeded at startup so core-go's LookupUser
   never calls out to meta.sr.ht.
 
+### New deploy requirements (faithful path)
+- `[mail] smtp-from` is now REQUIRED — WithDefaultMiddleware builds core-go's
+  notification/email queue, which panics without it. A valid address; SMTP need
+  not actually work for webhooks.
+- Redis: WithDefaultMiddleware creates a client (default `redis://`), but it is
+  lazy and outbound webhook delivery never touches it — no redis server needed.
+- Agents can no longer read GraphQL /query (core-go auth is OAuth2/cookie only);
+  they use MCP + REST. Owner keeps /query (cookie).
+
 ### Deferred (needs user input)
 - extensions-go / `sr-ht-ext` module — extracting spec's agent model into a
   shared module (location, name, publish target, CI wiring). User said it's