---
id: w4/m7/t005
title: "Prod wiring + docs: deploy.yml step, docs/ADR012-auth.md consequences updated, reset-password page verified"
worker: worker4
status: done
estimate: 25m
depends_on: [w4/m7/t004]
---

## Objective

Close the prod and human loop: the deploy pipeline provides the SMTP secret on every deploy (t001's plumbing riding the existing "apply auth secrets" step), the relay's **second consumer** gets wired — `BEX_SMTP_ADDR`/`BEX_SMTP_FROM` (values) + `BEX_SMTP_USERNAME`/`BEX_SMTP_PASSWORD` (Secret) into the bex-api deployment so w4/m12's workspace invites actually send (SendGrid prod, Mailpit local) — `docs/ADR012-auth.md`'s "no SMTP / courier off" consequence is replaced by the shipped design, and the dashboard's forgot-password → reset-password journey is walked once against the mock cluster (Playwright MCP or manual) to confirm the `ui_url` handoffs land on working pages.

## Context

- `deploy.yml` already runs `auth-secrets.sh`; t001 made it carry the SMTP URI — verify the GH secret name is wired end-to-end.
- Code prerequisite (2026-07-11): `lego/operator/config/api/deployment.yaml` carries **no** `BEX_SMTP_*` env today, so the w4/m12 mailer is nil in prod (invites recorded, never emailed) — this task adds the env wiring there; note the Mailpit values for local.
- Dashboard pages: `dashboard/src/routes/auth.forgot-password.tsx`, `auth.reset-password.tsx` — already Kratos-wired via Ory Elements (recovery only — there is **no** `auth.verification` route; see the README's 2026-07-11 note); screenshots go to `.playwright-mcp/` with bare filenames per repo rule.
- Also update the `CLAUDE.md` env table if any new var names surfaced.

## Steps

1. Verify/adjust `deploy.yml` + `gh-secrets.sh` end-to-end naming.
2. Wire `BEX_SMTP_ADDR/FROM` (values) + `BEX_SMTP_USERNAME/PASSWORD` (Secret ref) into `lego/operator/config/api/deployment.yaml`; document the Mailpit values for local.
3. Rewrite the SMTP consequence in `docs/ADR012-auth.md` (design, local Mailpit note, verification pointer).
4. Walk the dashboard recovery journey on the mock cluster; capture a screenshot.
5. `npx prettier@3.4.2 --write "**/*.md"`.

## Files

- `.github/workflows/deploy.yml`, `scripts/gh-secrets.sh` (verify)
- `lego/operator/config/api/deployment.yaml` (`BEX_SMTP_*` env)
- `docs/ADR012-auth.md`, `CLAUDE.md`

## Acceptance criteria

- [ ] Prod deploy path supplies the SMTP secret with no manual step beyond `.env`/GH secrets.
- [ ] bex-api pods carry `BEX_SMTP_*` (SendGrid prod / Mailpit local) — a workspace invite actually emails.
- [ ] Docs reflect reality (no stale "courier off" claims); prettier-clean.
- [ ] Dashboard recovery journey completes against the mock cluster.

## Out of scope

- New dashboard UI work (the pages exist).
