sms — built, and deliberately not sending

Templates, campaigns, and drops: the machinery for sending a text message to a list of people. What makes it interesting is what is in front of it — a consent gate that asks corpus whether each recipient may be contacted, and a STOP path behind it that takes them off the list when they say so.

Health — live

not asked

This check runs in your browser and has not run yet. With JavaScript off it never runs, and this line stays as it is — which is the honest answer: nothing was asked, so nothing is known.

This route is open to anybody and carries no Access-Control-Allow-Origin header, so a browser on this origin normally cannot read the answer even though the request succeeds. That is deliberate — the route exists for the deploy's health-checked auto-revert and for monitoring — and it is why the badge above usually says answered, unreadable here rather than up. The curl below is not bound by the same-origin policy and shows what it actually returns.

Verify it yourself — recorded 2026-09-06

$ curl -s https://sms.lrs.amtechhq.com/api/sms/health
{"service":"sms","status":"ok"}

$ curl -s https://sms.lrs.amtechhq.com/api/v1/campaigns
{"success":false,"errors":["invalid service credential"],"meta":{"timestamp":"2026-09-06T18:06:14Z"}}
# HTTP 401

No campaign, template, drop or recipient count appears on this page. All of it is behind the credential above, and every recipient is a real phone number belonging to a real person. There is no version of a public demonstration that should show you one.

The one thing to understand about this service

It is a pass, not a daemon. Sending runs as sms run-drops, which makes one pass over the drops that are due and then exits. That shape is the safety property: one pass is safe to run at any time, safe to run twice, and safe to kill, because a per-recipient claim makes a second pass skip everybody the first one reached. Re-running is the recovery, not the hazard.

A timer exists to run it every five minutes, and the deploy does not enable it. Enabling that timer is the cutover decision, and until a person makes it, the old PHP system keeps doing the sending. A service that started sending because somebody deployed it would be a service that sent because a process restarted, which is not a decision anybody made.

The consent gate and the STOP path

Before a message is sent, the recipient is checked against corpus. The rule from that page applies here at its sharpest: not having been told no is not having been told yes, and a lookup that could not run must never read as permission.

Behind it, inbound STOP replies are swept out of the gateway's spool and turned into suppressions. SMS opt-out state is one of only three things the platform allows to carry over from the legacy system, for exactly this reason — a fresh start that lost the opt-outs would be a fresh start that texted everybody who had already asked it to stop.

Status, from platform/docs/ROADMAP.md: slices 1 through 4 built — consent gate, STOP path, templates, campaigns, drops, sending. Carries no traffic.