# crm-test, 2026-10-20: first publish of customer #1 (insurance CRM)

Image `kxacr3ec31aca.azurecr.io/insurance-crm@sha256:1aff2b97…08cd` (commit 60f799b), centralus,
domain https://crm.johncabrahams.com, dataClass pii.

## What happened (kx.log has timestamps)
1. eastus attempt 1: stopped on `MissingPolicyParameter` (SOC 2 initiative needs 3 params). Fixed in 35570ac.
2. eastus attempt 2: Postgres refused: `list-skus` says "Provisioning is restricted in this region" for this
   subscription. Stack destroyed (destroy-*.out; a DNS outage on the Mac and a Key Vault data-plane role
   interrupted it twice). Customer stacks moved to centralus with a per-region audit archive (40ce6d8).
3. centralus attempt 1: Private DNS link raced its new VNet. Ordered after subnets (commit after 40ce6d8).
4. centralus attempt 2: stage 0 succeeded, 54 resources. Postgres restarted for pgaudit.
5. NS delegation created in personal Route 53 (`route53-delegation.json`, change C04231252MQFBJBSD04KW).
6. Publish again: stage 0 `same: 54` (idempotent), stage 1 hostname + managed cert (Succeeded), stage 2 SNI bind.

## Checks
- `verify.txt`: 12/12 pass (private Postgres and blob, no shared keys, TLS settings, pgaudit, 35-day PITR,
  7 deny + 2 posture assignments, /healthz 200, document without session 401, anonymous blob 403).
- Certificate: CN=crm.johncabrahams.com, GeoTrust TLS RSA CA G1, notAfter 2027-04-20. http:// → 301 https.
- Deny guardrail: creating a public, shared-key storage account in kx-crm-test → RequestDisallowedByPolicy.
- Archive (kxauditcus3ec31aca): insights-logs-{auditevent, containerappconsolelogs, containerapphttplogs,
  containerappsystemlogs} present.

## What this is not
- Not a test of the app with a signed-in user on Azure: no account exists yet (adduser.js needs a shell in the
  container); upload/download with a session was only proven locally (runs/insurance-crm-azure-port-2026-10-20).
- Postgres and blob logs not yet seen in the archive (hourly); restore drill not run (RESTORE-TEST is designed).
- Posture compliance state not read: initiative evaluation can take up to 24h after assignment.