migrate-to-sent

Migrate to Sent

Every migration from a major CPaaS provider hits the same five translation problems. Work them in this order, because the first one silently doubles cost and is invisible in tests.

1. Ordered fallback becomes automatic routing

Incumbent platforms express cross-channel delivery through different caller-side arrays, failover objects, messaging-service features, or application-level priority configuration. Do not assume those shapes have a direct Sent request-field equivalent.

Sent's channel array is a broadcast list. Porting an ordered array produces one message and one charge per recipient-channel pair, which passes tests and multiplies production spend. The correct translation is automatic routing — omit channel or send ["sent"] — which lets the platform select a route and reroute across up to three channel-and-provider pairs on the same message_id. Details belong to sent-routing-strategist; the migration rule is simply: never port an ordered channel list.

2. Status vocabularies do not line up

Incumbent statuses map onto Sent's, but Sent adds two states that have no equivalent and that break naive retry logic.

Two consequences for ported code. Handlers that treat every non-delivered terminal state as retryable will retry consent blocks, which is a compliance failure rather than a bug. And handlers keyed on numeric provider error codes — Twilio's 21610 is the classic — must be rewritten against Sent's string error.code families.

3. Webhook verification is a rewrite, not a port

No two providers sign the same way, and no Sent SDK ships a verifier.

Sent's key is the signing secret with whsec_ stripped and the remainder base64-decoded, compared in constant time, with timestamps outside 300 seconds rejected. Because Sent provides no per-event id, dedupe keys must be derived from payload semantics. Build the receiver with sent-webhook-engineer rather than adapting the incumbent's verifier.

4. Opt-out stores must be reconciled, not migrated by copy

Every provider keeps its own suppression list — Twilio Advanced Opt-Out, Infobip Blocklist, Sinch OPT_IN/OPT_OUT events. Sent enforces consent at the platform level before events reach the application, stores it as opt_out on the contact, and applies it channel-agnostically: a STOP on SMS suppresses WhatsApp and RCS too.

Reconciliation rules: export the incumbent's suppression list before cutover, treat any opt-out on any incumbent channel as a global Sent opt-out, and never clear opt_out to "clean up" migrated data. Sent's ten default keywords are STOP, CANCEL, UNSUBSCRIBE, QUIT, END, START, UNSTOP, SUBSCRIBE, HELP, INFO, matched only when the entire trimmed body equals the keyword — so incumbent-specific keywords need custom keyword entries. Rewrite any incumbent keyword matcher as an exact local consent mirror and audit mechanism; the matcher must not write consent to Sent again. Consent semantics belong to sent-two-way-messaging.

5. Templates and tenancy are re-registered, not transferred

WhatsApp templates live with the WABA, so the migration question is whether the WABA moves. Positional placeholders ({{1}}, {{2}}) become named parameters in Sent, which means every call site that passed an ordered array must pass a named map. Approval is asynchronous and arrives as a templates webhook event, so build the template inventory before cutover rather than during it.

Tenancy maps as follows, with the boundary decision owned by sender-profile-architect and the API work by sent-profile-provisioning:

Migration sequence

1. Inventory every send call site, webhook handler, status branch, template, suppression list, and credential. Use scripts/inventory_scan.py to find them mechanically.
2. Map each item using references/provider-mapping.md, flagging ordered-fallback arrays and numeric error codes as required rewrites.
3. Stand up Sent in parallel: credentials, one webhook per environment, verified receiver, templates re-registered and approved.
4. Prove equivalence in sandbox with "sandbox": true, then with a small live cohort confirmed to DELIVERED.
5. Dual-run with a traffic split, comparing delivery rates, latency, and cost per message on the same message classes.
6. Cut over by message class — lowest-risk transactional first, marketing last — keeping the incumbent receiver live.
7. Decommission only after a full billing cycle of clean data, then revoke incumbent credentials.

Sequencing detail, verification gates, and rollback triggers are in references/cutover-playbook.md.

Mistakes that survive testing

• Porting an ordered channel array. Doubles cost, never errors.
• Treating FILTERED as retryable. Compliance exposure.
• Reusing the incumbent's signature verifier. Every delivery returns 401.
• Assuming 202 means delivered. Sent acknowledges acceptance only.
• Keeping positional template placeholders. Parameters silently mismatch.
• Retrying on 401. Ten consecutive auth failures lock the credential with escalating lockout.
• Omitting Idempotency-Key during dual-run. A timeout retry sends twice.
• Sending x-profile-id with a profile-scoped key. Returns 403.
• Copying an incumbent's Authorization: Bearer pattern. Sent authenticates with x-api-key.

Boundaries

This skill owns provider mapping and line-by-line migration planning. Hand the resulting Sent client and resilience work to sent-integration-starter, channel semantics to sent-routing-strategist, receiver construction to sent-webhook-engineer, WhatsApp onboarding to waba-embedded-signup, and US campaign registration to sms-10dlc-registration.