The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Problem/Motivation
Alpha2 has synthetic HTTP and isolated upgrade coverage. Earlier live-provider evidence predates this release, and optional reconciliation uses a fake HTTP client. Stable acceptance needs a reproducible upgrade and provider verification of the released package.
Proposed resolution
Use a disposable staging installation and a dedicated Postmark test server or approved test stream. Document generic steps and sanitized evidence so other sites can reproduce them. Consumer deployment remains in the consuming site's own tracker.
Acceptance criteria
- Install the Drupal.org archive through Composer, record its version/checksum, and exercise both a fresh install and an alpha1 upgrade with interrupted/resumed update batches.
- Verify settings, enabled/disabled suppression, legacy data, permission boundaries and successful cache rebuild after updates.
- Exercise Delivery, Bounce, SpamComplaint and SubscriptionChange through the real provider using controlled test recipients or provider-supported test mechanisms; identify any fixture-only cases honestly.
- Verify duplicate and delayed events, Basic Auth, source matching, credential rotation and provider-visible failure/retry behavior without publishing credentials or recipient data.
- Exercise the optional reconciliation read path against a dedicated provider source, confirm preview/apply behavior and that no provider data changes.
- Record provider webhook verification status and operational recovery steps for paused delivery; link public evidence from docs/integration-verification.md.
Scope and dependencies
Stable-release acceptance task under #3621224: Complete the 1.0.0 stable release verification gates. Builds on #3621137: Expand integration coverage to routing, mail transport, forms and Drush; the completed original issue remains fixed.
Comments
Comment #6
jmcerdaPartial on 1.x. The Drupal.org 1.0.0-alpha2 archive is verified through Composer, including an alpha1-to-alpha2 file replacement. Live Postmark webhook acceptance is still outstanding; no dedicated test-server token is available and production is not used. Remaining evidence is recorded in docs/published-package-verification.md. This issue stays Active until that provider evidence exists.
Comment #12
jmcerdaLive provider evidence is recorded on 1.x-dev against a dedicated Postmark sandbox server (DeliveryType Sandbox). Production was not used.
Published package (already recorded): Drupal.org 1.0.0-alpha2 zip SHA-1 e31e9f67b554cdaf35d04549d955310c0d1d3c30; alpha1 SHA-1 df706da9dfc7fcaa3de161776dd8391e27ac655e.
Webhook: POST /webhooks with JSON body field "Verify": true. HttpAuth username postmark so Postmark authenticates to the Drupal receiver. POST /webhooks/{id}/verify: Delivery, Bounce, SpamComplaint and SubscriptionChange all StatusCode 200; trigger statuses verified.
Events (real server ID, time_basis provider):
- Delivery: sandbox POST /email from a confirmed sender signature. MessageID prefix d5cffe2a-c5b.
- Bounce: POST /email to hardbounce@bounce-testing.postmarkapp.com. MessageID prefix 0e56e774-b6e.
- SubscriptionChange: hard-bounce suppression plus POST /message-streams/outbound/suppressions (manual).
- SpamComplaint: provider verify test tool only. Fake-bounce addresses do not support SpamComplaint; sandbox never delivers to a real inbox.
Auth: unauthenticated POST 401 with WWW-Authenticate. Current and previous secrets 200. Wrong password 401, zero rows stored. Duplicate MessageID posted twice: both 200, one stored row.
Source allowlist locked to the real server ID returned 403 on Postmark verify payloads (dummy ServerID 23/1234) and blocked webhook save (error 1364). Verify succeeded with the allowlist unset.
Provider-visible 401: with an incorrect Drupal secret, verify returned Success false, all four StatusCode 401, triggers unverified. Restoring the secret and verifying again returned all four 200 and verified. Postmark does not retry 401 (permanent 4xx). Recovery is restore credentials and re-verify.
Reconciliation: GET-only. GET /server matched. Unfiltered suppression dump 3 rows. Dated dump fromdate=2026-09-07&todate=2026-09-07 returned 0 despite CreatedAt 2026-09-07. drush reconcile-preview reported provider_writes false and local_suppression_changed false. Apply was not run.
Health JSON reported the secret configured and intake counters without recipient labels. The temporary webhook configuration was removed after the run.
Sanitized write-up: docs/published-package-verification.md on 1.x (https://git.drupalcode.org/project/postmark_webhooks/-/blob/1.x/docs/pub...), linked from docs/integration-verification.md. Merge 3ef06eb8.
sender@example.org is not a Sender Signature (error 400). @example.com recipients were inactive on this stream (error 406). @example.org accepted sandbox Delivery.
This issue is Fixed on 1.x-dev. Tagging 1.0.0 is not part of this issue.