Unified Platform — September 18, 2026
Staged ce:full run (S1 foundation → S5 report) · honest scoring min(rubric 6.5, matrix 6.4) · status REMEDIATED (audit-day read-only run; post-audit remediation + delta re-score verified in place — see below) · 41 artifacts + 70-capture rendered evidence (35 routes × both themes)
The product surface keeps improving — the Sep-15→17 wave shipped Admin Reporting, four approved redesign ports, schedule-studio depth, SCL canonical reads, and the eval-reminder fix is verified firing since the Sep-18 00:55 deploy. What this run found is a discipline failure, not a product failure: 19 fixes from the Aug-20/21 remediation were applied directly on the live tree and never committed — every subsequent deploy.sh run silently reverted them, and the Sep-17 "pre-port baseline" snapshotted the reverted state into git. Meanwhile the login page shipped plaintext credentials for 5 accounts (including Admin) as one-click buttons in the public bundle — a "remove before going live" panel that was live Sep-7 → Sep-18 and was closed the same day as this report (see Delta re-score).
Verified strengths worth protecting: byte-identical build reproduction (source under review == served bundle, proven by hash), 163/163 tests, clean-install with zero missing deps, zero FK orphans, healthy daily backups, strong token discipline (impeccable scan: 7 findings, all previously waived with recorded reasons), and a 70-capture rendered sweep with zero page errors, working login, verified theme switching on all 35 routes, and clean mobile.
Where the platform stands
| Phase group | P0 | P1 | P2 | P3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Security / compliance | 1 | 1 | 2 | 2 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Correctness / data | 0 | 2 | 4 | 3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Ops / deploy / DR | 0 | 3 | 4 | 3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Perf / bundle | 0 | 1 | 1 | 3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| UX / flow / design | 0 | 1 | 4 | 4 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Docs / DX / deps | 0 | 0 | 2 | 2 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Total 42 | 1 | 7 | 17 | Remediation · Wave 1 · deployed & verified 2026-09-18 (15:00–16:30 UTC, same day as this audit)
What changed after the auditPost-audit remediation was executed and verified the same day. The audit score above (6.4) remains the audit-day baseline and is not re-scored here; the same-evening delta re-score (6.4 → 6.9) is below. Every row carries live evidence. Full artifacts: /artifacts-2026-09-18/. 11 Fix classes resolved All P1 fix classes re-applied & verified except SEC-1 (deferred by instruction) 8be13fa Repo = origin 38-commit wave pushed; no unpushed work remains (ls-remote verified) 79.6KB Admin chunk Down from 349.7KB — lazy split restored, verified in the live build 6s Restore drill Today's dump → scratch DB; all counts matched; scratch dropped 0 Known vulns npm audit 0 (was 7: 4 high) — nodemailer 10 + qs/js-yaml/fast-uri/multer fixes, smoke-verified
Wave 3 (same day): route guard wired into the deploy gate · offsite backup LIVE (encrypted + verified) · login panel env-gated. Remaining by design: SEC-1 removed 2026-09-18 (flag off · bundle scan clean · all five credentials rotated — old password verified dead) · interim delta re-score below; full staged run to ≥ 8.0 after the priced sprint >17 |
Post-remediation delta re-score — 6.4 → 6.9
Every moved score below was re-verified against the live system on 2026-09-18, the same day as the audit: vitest 163/163 · client + server typecheck 0 errors · route guard 0 dead calls · npm audit --omit=dev 0 vulnerabilities · health 5/5 pools + migrations · served-bundle credential scan 0 hits · Admin chunk 79.6 KB (was 349.7) · repo == origin · backups ran + offsite push verified · migration 032 present · restore drill recorded. Score = min(rubric, matrix) — not an estimate.
| Dimension | Audit | Now | What moved it / status |
|---|---|---|---|
| Security | 5.5 | 7.0 | P0 closed (panel removed · bundle proof · all 5 credentials rotated, old one verified dead) · 7 vulns → 0 · caps lifted. Still open: MFA, express-5. |
| Ops | 6.0 | 7.0 | Repo pushed · deploy gate live (typecheck + route guard + vitest, hard-fail) · alerting deployed · restore drill + offsite backup verified. Still open: GitHub Actions step (token scope). |
| DX | 7.0 | 7.5 | Gates in deploy + verify · push restored · live-edit trap closed by ADR-0002. |
| Correctness | 6.5 | 7.0 | Server tsc 1 error → 0 · role SoT live · dead DELETE route implemented · print/PDF restored · 163/163. |
| Performance | 6.5 | 7.0 | Lazy-split restored 349.7 → 79.6 KB. LCP unchanged (fonts still remote); Lighthouse not re-run — cap ≤7.0 held. |
| Architecture | 7.5 | 7.5 | carried — no new evidence. |
| Design/UX | 7.5 | 7.5 | carried (login re-verified clean; cap ≤8.0 held). |
| Testing | 5.5 | 5.5 | carried — coverage unchanged (2.04%); cap ≤5.5 held. |
| Docs | 6.5 | 6.5 | carried — README partly refreshed; shadcn/SQLite rows + post-mortem remain. |
| Conversion | 6.0 | 6.0 | carried — waived for scope as audited. |
| Brand/Emotional | 7.0 | 7.0 | carried — no new evidence. |
Math: min(rubric 6.5 → 7.0, matrix 6.4 → 6.9) = 6.9 (audit day: min(6.5, 6.4) = 6.4). Remaining to ≥ 8.0: coverage program · GitHub Actions token · LCP/font self-host · express-5 decision · contract tests · P2/P3 backlog — the priced sprint is in the roadmap below.
[TEST] digest storm — frozen, root-caused, fixed
Symptom: the admin inbox received a "[TEST] 18 emails for 14 recipient(s)" digest every ~10–25 minutes (14:56–17:41 UTC).
Root cause: reminderScheduler's 24h re-notification dedup lived only in process memory. Every app restart re-notified the same 18 pending OR evaluations; in TEST mode each batch becomes one digest email. Today had unusually frequent restarts (two parallel Hermes sessions deploying to this repo + freeze attempts), so the same 18 were re-sent at each boot — 6+ digests traced to single boot events.
Freeze (immediate, per request): SUPPRESS_EMAIL=1 — sendEmail() becomes a no-op for ALL outbound mail. Verified: post-freeze boots log "EMAIL SUPPRESSED", zero mail leaves. One env flip re-enables. (Ops note: this container reads its env via compose env_file — a plain restart does NOT reload it; use docker compose up -d unified-platform.)
Durable fix (deployed · commit b65d69d): migration 032 adds unified.or_evaluations.last_reminder_at + partial index; the pending-eval query now excludes rows reminded within 24h — dedup survives restarts, crashes and deploys. Verified live: boot stamped 18/18 rows; subsequent scheduler runs produce zero additional sends. Daily reminders for still-pending evals continue by design (once per 24h).
Housekeeping same hour: integrity watchdog baseline re-blessed for today's legit deploys (false alarms since 14:47 now stopped); floater_finder.py restored after the live-tree cleanup over-archived it (caught by that same watchdog — it earns its keep).
Critical — 1 item
The production login page ships plaintext credentials for 5 accounts — including Admin — as one-click buttons
The platform holds reimbursement ledgers, evaluation text and personnel data, and its admin surface includes the audit-log reverter. An admin credential reachable by anyone with the URL is the highest-severity finding this run can produce; the code comment own says the panel should not exist in production.
Fix: env-gate or delete the panel (import.meta.env.DEV), rotate all five passwords via the GoTrue admin API, rebuild, and prove the served bundle contains zero credential literals; then re-run the rendered sweep on the login page.
High — the safety net and the regressions
The Reversion Incident: 19 remediation fixes were destroyed because live-tree edits are silently overwritten by deploys — and git is not a safety net
The Sep-17 commits literally call the baseline "stale" ("wip: partial ports on stale baseline — do not deploy"). Every subsequent feature deploys onto a tree whose fixes can vanish again.
Fix: Restore push credentials → commit + push now (37 commits) → make the rule explicit (ADR: never edit live; deploy only from git; live tree gets git for rollback) → re-implement the lost 19 from the Aug remediation log with commits this time.
Role source-of-truth regression — real users mislabeled, two blocked at login, ledgers inflated
The Aug fix (derive role from unified.reimb_persons.beneficiary_type) was in the lost set (34-baseline).
Fix: Re-apply the beneficiary_type resolution in server/middleware/auth.ts (+ expose in /api/me), correct the CRM rows, deactivate graduated rows, resolve the ghost rows.
No gate between code and production: build skips tsc, deploy skips tests, CI never runs
Fix: Fix eval.ts:481 → add typecheck + typecheck:server scripts → wire into build or deploy step 0 → restore the push so Actions runs.
Admin lazy-split lost — Admin chunk back to 349.7 KB raw (was 83 KB after the Aug split)
Fix: Re-apply the proven split (lazy 9 tabs, keep Dashboard/UserAccess/Audit eager) — mechanical, verified pattern from the Aug wave.
The admin "delete transaction" button calls an endpoint that does not exist
Fix: Implement the route (requireAdmin + audit) or remove the affordance — decide which; then add the route-existence CI check (TECH-2).
Print paging and branded PDF export — both regressed to nothing
Fix: Re-implement both from the Aug remediation log descriptions (they are detailed); verify paging multi-page + PDF branded with real data.
No failure alerting — the eval-reminder failure ran ~1000 times silently for two days
Fix: Minimal failure hook: scheduler error counters + health transitions → email/Telegram. Verify with a forced failure.
Medium & low — priced, verifiable
| # | Item | Where / effort |
|---|---|---|
| P2-1 | Re-apply lost /schedule critique fixes (plural guards "sessions"; "Updates on load" pill) | roster/ScheduleViewTab.tsx · 2SP |
| P2-2 | ENL vs load-failure split + retry surface in ProtectedRoute (429s show "Email Not Linked") | components/ProtectedRoute.tsx · 3SP |
| P2-3 | Rebuild voice-session retention purge job per retention-policy.md (currently 0 rows — no live exposure) | server/services + scheduler · 3SP |
| P2-4 | Off-VPS backup copy + documented RPO/RTO + quarterly restore drill | ops scripts/docs · 3SP |
| P2-5 | Field-level API contract tests (reimb + eval surfaces) | server tests · 5SP |
| P2-6 | Route-existence CI check from the _api-xref recipe (catches dead calls like RB-1) | ci + script · 3SP |
| P2-7 | npm audit fix (7 vulns: multer ×4 DoS classes, nodemailer, fast-uri, js-yaml, qs) + retest uploads/email | package.json · 2SP |
| P2-8 | Consolidate 4 eval-admin surfaces into one command center (R-1) | nav + pages · 8SP |
| P2-9 | Manager/episodic guards via flags, not category checks; add Fellow + Medical Student to fallback map (R-3/R-5) | auth map + App.tsx · 3SP |
| P2-10 | Post-mortem/ADR for the reversion incident + "never edit live" deploy rule | docs/adr · 2SP |
| P2-11 | Move slop-waivers.md into the repo; delete stale live copies (README/dr.md/e2e) | repo + VPS · 1SP |
| P2-12 | reimb_persons hygiene: ghosts, duplicates, is_active graduation rule (DI-1/DI-2) | data + admin flow · 3SP |
| P2-13 | README stack-table refresh + runbook pointer (Express version, roster pool, Postgres reimb) | README · 1SP |
| P2-14 | Dependency: drop unused `compression`; decide express-5 (skip/retry) | package.json · 1SP |
| P2-15 | Delete dead duplicate stylesheet src/index.css (main.tsx imports styles/index.css) | src/index.css · 15min |
| P2-16 | 429-burst hardening: review limiter policy for SPA bursts + friendlier messaging | server/index.ts · 2SP |
| P2-17 | Auth deep-link aliases for admin tabs (?tab=user-access → users) | Admin.tsx · 15min |
| # | Item | Where / effort |
| P3-1 | Self-host Inter/JetBrains fonts (drop fonts.googleapis.com from PHI-adjacent surface) | index.html · 1hr |
| P3-2 | Prune live-tree junk: dist.old, 5× _bak-*, _clobbered-*, scraper scratch, cookies.txt | VPS tree · 30min |
| P3-3 | DB-persisted reminder dedup (in-memory window resets on restart) | reminderScheduler · 2SP |
| P3-4 | Log-noise cleanup: rate-limit IPv6 keyGenerator, pg@9 reentrant-query deprecation | server · 1SP |
| P3-5 | Junk rows: empty-email app_access + 2 empty contacts; leftover backup tables; EZ-format variance | DB · 30min |
| P3-6 | Public-router contract tests (public-schedule editor, attending-swap) | tests · 3SP |
| P3-7 | Skip-to-content link (Layout) | Layout.tsx · 15min |
| P3-8 | Frontend Sentry: wire it or drop the dep | main.tsx · 30min |
| P3-9 | N+1 spot-check on the heavy list endpoints (schedule matrix, reporting) | open verification · 2SP |
| P3-10 | Migration prefix collisions (2×026, 2×027) rename hygiene | migrations · 15min |
| P3-11 | "spender delta on empty month" copy — suppress -100% when $0 | Dashboard · 15min |
| P3-12 | Motion/reduced-motion explicit guard in CSS (motion is minimal; belt-and-braces) | index.css · 30min |
| P3-13 | Label-the-dash sweep (any remaining bare "—") | dashboard cards · 30min |
| P3-14 | e2e live copy refresh (api.spec.ts targets retired /api/qgenda path) | e2e · 15min |
| P3-15 | Runbook: document cron entries (backup, OR-eval feeder) in repo ops/ | docs · 30min |
| P3-16 | Write the missing regression test for eval-reminder date normalization | tests · 1SP |
| P3-17 | Prune ~12 dead endpoints after external-consumer grep (swap-requests, colleagues, team-list, upcoming/float-shifts, reimb/trash…) | server routes · 2SP |
Highest-value, lowest-effort
eval.ts:481 → add typecheck scripts → wire the gate (P1-3 unblocked)src/index.css (main.tsx imports styles/index.css) — kills the edit-the-wrong-file trapslop-waivers.md into the repo (it is live-only today)?tab=user-access → users alias (bookmark rot)/var/backups/unified (one rsync line) — cheapest DR upgradeEvery happy path works end-to-end; the failures cluster around artifacts & failure-states
J1 Resident reimbursement: dashboard → ledger → submit (draft/upload/submit) → status — ≤3 clicks, states legible. Gap: no branded PDF download.
J2 Manager call-out: /scl intake (PIN, 3–4 digit date, no-replacement notice) → /coverage (reassign/float/assign) → notifications (test mode). Rebuilt Aug–Sep; verified rendered + source.
J3 Admin review→report: review queue → inline actions (audited live) → Reports Explore/saved views/CSV → fund views. Rough edges: dead delete-transaction (P1-5), tab alias (P2-17).
J4 Faculty eval + swap: eval links + /call-swap (authenticated in-portal) + /attending-swap standalone. J5 Schedule studio: OR-per-row procedures, helper pickers, templates, pool/blocks — richest surface, renders healthy; regressed pill/plural fixes (P2-1).
Flow findings: PF-1 dead-end only on the failure path (ENL vs load-failure) · PF-3 two category-based guards drift from the flag system · PF-4 four separate eval-admin nav items · PF-5 the print journey breaks at the artifact step. Verified: all retired URLs redirect correctly (no nav dead ends).
Sound shape; the structural risk is the deploy loop
React 18 + Vite SPA (32 routes) → Express 4.22 (tsx runtime, node 20) → 4 PG pools (postgres / urology_roster / milestone_evaluations / or_schedule) + legacy SQLite import path. 26 routers all mounted (263 routes); 21 v1 mounts + 5 public routers; boot migrations fail-loud; health endpoint genuinely deep (5 pools + migrations).
Structural risk (P1-1 class): deploy = one-way rsync from the repo working tree into a non-git live directory — any live-side edit is silently reverted on the next deploy; there is no server-side history for rollback. That loop is exactly how 19 fixes died and is the single change with the highest blast-radius reduction.
Hygiene: dead duplicate src/index.css; stale live copies of README/dr.md/e2e contradicting the repo; ~12 no-caller endpoints; 15 .bak files; live tree doubling as a scratch workspace (scrapers, cookies.txt, 1.1 GB incl .venv/dist.old).
New wave is clean; the Δ is the reversion set
Positives (verified): Admin Reporting (+migrations 030/031) fully gated and audited; token discipline near-perfect (3 literal grays across admin); zero TODO/FIXME; public routers have documented access policies; reminder fix proven in logs (0 failures in 10 h).
The Δ review found: CR-1 reversion incident · CR-2 role regression · CR-3 admin split · CR-4 critique-fix reversion · CR-5 live-tree pollution · CR-6 debris/stale copies · CR-7 runtime warnings (rate-limit IPv6 active in logs; pg@9 deprecation) · CR-8 migration prefix collisions. Every one is dispositioned in the ledger and backlog.
Referential integrity clean; people-layer hygiene is the work
Migrations all applied (through 031, tracked + fail-loud). FK orphans: 0 on reimb allocations/submissions/files. Call-schedule current (2026-07 → 2027-01, 561 rows). No seed-drift trap (the old 503 class absent).
People-layer: 9 active reimb rows with no email/EZ (5 ghosts + duplicates) · 2 archived-but-active residents · 1 junk empty-email app_access row + 2 empty contacts · leftover backup tables in-schema · EZ format variance (000517772 vs 517772) breaks ez-id joins. All priced in P2-12/P3-5.
Lean and complete — with 7 known vulns
32 prod + 29 dev deps · npm ci clean-install exit 0 · npm ls missing = 0 · @e965/xlsx present (the Aug P0 class is gone). Real unused deps: 1 (compression).
Vulns (prod): 7 — 4 high, 3 moderate — multer (4× DoS classes; uploads are live in reimb), nodemailer (IDN domain bypass + legacy resolveContent file access), fast-uri (SSRF/host-confusion badges), js-yaml, qs via express. `npm audit fix` available. → P2-7.
163/163 green — deep where it matters, thin everywhere else
163/163 pass (3.56 s) in a clean throwaway against the live DBs; integration tests isolate safely (900000+ id ranges with hard-delete cleanup; roster write-path on a disposable clone DB with clean skips). Security area coverage 94.7% (twilio/vapi signatures, eval/editor tokens, caps, GR compliance).
Honesty anchor: overall coverage 2.04% — pages/routes/services ≈ 0. CI exists but has never run (unpushed). 2× act() warnings. Missing regression test for the eval-reminder date class (P3-16). Testing dimension capped accordingly (≤5.5).
Ops docs accurate; README stale; the incident has no post-mortem
dr.md + restore.sh verified against live behavior (backups ran today 03:05). Commit messages are receipt-grade. Stale: README stack rows (Express 4.21, "Prisma QGenda", "SQLite reimb", shadcn) · live copies of README/dr.md/e2e contradict the repo (say QGenda where code says roster) · slop-waivers.md exists only on the VPS (same loss risk that killed the fixes). No ADR/post-mortem for the reversion incident → P2-10/P2-11/P2-13.
263 routes, 26 mounted routers — one dead frontend call found
Every frontend call (117 extracted) cross-referenced: 1 real dead call — the DELETE transaction route (P1-5). 4 other "unmatched" were scanner artifacts (fetch-with-POST, dynamic suffixes) and were mis-flagged, corrected, and verified by hand. Health probes: real paths /api/health/ready|live = 200; /api/ready|live aliases still 308 (lost — cosmetic, in 34). Swagger + contract test live. ~12 endpoints have no in-app caller (verify-then-remove list).
Gaps: no field-level contract tests (CT-1) and no route-existence CI check (CT-3) — the tools that would have caught P1-5 in CI.
Rendered at 390px: no overflow, drawer works
423 responsive utilities; `lg:hidden` slide-in drawer + backdrop verified opening at 390×844; 44×44 targets on new controls. Rendered spot-check (5 routes, touch): no horizontal overflow on any route, zero console errors. Dense schedule grids scroll inside their containers, not the page. Older h-9 controls remain a polish item.
Strong system, verified under both themes
Impeccable gate (mandatory): 7 findings — one family (the semantic colored left-edge bar) — all previously waived with recorded reasons (slop-waivers.md, Sep-17); zero new findings, zero drift. Token discipline near-perfect (3 literal grays across admin; CoverageCenter 0).
Rendered: both themes verified on 35/35 routes (dark rgb(8,9,10) ↔ light rgb(238,240,243)); fonts Inter + JetBrains Mono (computed); motion restrained (0–7 animations/page; tokenized easings); above-fold is real working content everywhere; honest empty states. Light-theme contrast now passes at token level (tertiary 4.8:1 AA). Sep-14 lens F1/F2/F4 resolved; F3 substantially improved; F5 not reproduced.
Open design items: dead stylesheet (P2-15) · the login dev panel (P0-1) · ENL failure-state redesign (P2-2) · self-host fonts (P3-1).
Deploys work; the release discipline doesn't
deploy.sh verified accurate (rsync → conditional npm install → vite build in container → restart → health gate). Container compose-managed, restart=unless-stopped, up since 00:55 with 0 restarts. Backup suite runs daily 03:05 (4× pg_dump + uploads + env, 14-day retention; ran today).
Gaps: no gate step in deploy (P1-3) · live tree not git + fixes lost (P1-1) · 37 unpushed commits (P1-1) · no restore drill (P2-4) · no off-VPS backup copy (P2-4) · RPO 24 h / RTO undocumented. Integration probes: clean-install PASS, byte-identical build PASS, health PASS, signature gates PASS, cron integrity PASS, bundle-credential scan FAIL (P0-1), git/Actions FAIL (P1-1).
Client 0 errors; server 1 — and nothing checks either at deploy
tsc --noEmit client (strict) = 0 (verified twice; an earlier 2-error reading was a harness artifact and was retracted) · server (strict) = 1 real error: routes/eval.ts:481 null→string|number|undefined. 264 explicit `any`/`as any` remain (burn-down item). No typecheck script exists; build skips tsc → P1-3.
Fast server, honest client weights — one regression
Lighthouse (live, today): /login 80 perf · 95 a11y · 100 BP · 82 SEO (LCP 3.8 s, CLS 0.001, TBT 0 ms) · /public-schedule 87 · 100 · 96 · 45 (LCP 3.2 s). Server-response 0–10 ms.
Bundle (reproduced byte-identical): 8.0 MB dist · 58 chunks + 58 gz · Schedule 568 KB raw/99 gz · vendor-charts 435 · xlsx 364 · Admin 350 raw (lazy-split lost — P1-4) · index 335 · gzip pipeline healthy. P1-4 is the single biggest client-perf lever; LCP improvement path = fonts self-host + hero trim (P3-1).
Events, identity threading, accessibility
Event architecture (13): scheduler trio runs idempotently (reminders verified every 30 min since the fix; swapIntervention live; ptoReminder documented no-op). Voice-purge job missing (P2-3; 0 rows currently). No failure alerting (P1-7). VPS crons (OR-eval feeder 22:30; backups) verified present.
Identity (14): req.user threaded via JWT→CRM+DB with fail-closed flags; audit trail live (482 rows; write actions logged). Role regression = P1-2. EMAIL_MODE=test is a deliberate built-but-suppressed state — flip deliberately at go-live.
Accessibility (16): A11y 95–100 live; Table primitives with captions/scope; focus-ring tokens; 44px targets in new UI. Open: skip-link (P3-7), reduced-motion guard (P3-12). Substitution note: design-gate.py absent in this profile → impeccable detect + rendered sweep used.
Right architecture, wrong source data
role_defaults (8 roles) + per-user app_access overrides + fail-closed — the right pattern, admin-editable, audited. The experience defects are data/metrics: P1-2 role regression (largest user group affected), Manager guards via category checks (P2-9), four eval-admin surfaces for one persona (P2-8), Fellow/Medical Student missing from the hardcoded fallback map.
Verified by nav/guard mapping + live DB probes: 8-role × 12-surface matrix in artifact 31.
The ledger: what held, what died
✅ Held: B-01 dedupe (structure re-architected Sep-9), B-07 swap SQL safe, B-08 admin kit (near-zero bypass), FIX-13 DR (healthy backups), /schedule critique fixes #1/#4/#5, eval-reminder fix (Sep-18), /dashboard 404 fix, F2/F4 light+avatar fixes.
🔴 Regressed (the lost set): B-02 role SoT · B-03 gate · B-04 PDF · B-05 print paging · B-06 aliases · B-10 pools env · FIX-11 rate-limit · FIX-14 admin split · FIX-16 partial · FIX-17 voice purge · FIX-18 CI · FIX-19 express 5 · critique fixes #2 (partial)/#3.
⏳ Verified this run: F1 ✅ F2 ✅ (token-level) F3 improved F4 ✅ F5 not reproduced; Lighthouse re-measured; impeccable = same 7 waived.
Net: 12 resolved/still-true · 11 regressed · 3 superseded · 8 verified-this-run.
Money math and window rules are test-backed
Reimbursement caps ($1,250/AY GME, $10k/CY stipend class) verified via the passing cap/access suites (94.7% area coverage) + fund rows live; submission→review→approve gate audited live; eval 2×/AY pair cap tested; date-window logic TZ-safe with the reminder fix. Policy gaps: role→access math wrong for mislabeled users (P1-2), `is_active` graduation rule undefined (P2-12), manager guards non-flag (P2-9). Never assumed — every row carries its receipt in artifact 32.
Reports got stronger exactly where trust matters
Admin Reporting rebuild (Explore + Reports + saved views + CSV; cents on totals; requireAdmin; audited) = the flagship. GME fund status, SCL analytics, coverage center, schedule reports, eval tracker all answer real operational questions. Weaknesses: people-layer over-count (P1-2/P2-12 feeds reports), PDF/print artifact regressions (P1-6), no scheduled digests (recommendation), chart-level review still open (P3-9).
Session log
Read-only run: zero application changes. Two harness corrections were logged (evidence integrity): the anchored-rsync fix (retracted 2 fake tsc/build findings) and the /api/v1 prefix matcher fix (retracted 114 fake unmatched calls). Both are in artifact 23 so the retraction trail is auditable. Rendered evidence (70 captures + mini + mobile) lives on the VPS at /opt/webcapture/ce-full-20260918/.
42 findings → 1 P0 · 7 P1 · 17 P2 · 17 P3
Epics: SEC-1 (P0, 3 SP) · COR-1 role (8 SP) · OPS-1 safety net (5 SP) · OPS-2 gates (3 SP) · OPS-3 alerting (3 SP) · COR-2 dead route (2 SP) · PERF-1 split (3 SP) · UX-1 artifacts (5 SP) · UX-2 critique re-apply (2 SP) + the P2/P3 tables above (full text in artifact 12). Every P1 is committed-by-default: re-implement with a commit, deploy through the gate, verify live.
Total priced: ~58 SP core sprint + ~45 SP P2 sweep. Nothing in the list requires new architecture — this is disciplined re-application of proven patterns plus one security fix.
2-week sprint → 6-month vision
- W1 (2 h): SEC-1 panel removal + rotations — the P0.
- W2 (2–3 h): git push restored; 37 commits pushed; ADR: never edit live.
- W3 (4–6 h): COR-1 role SoT re-apply + people-data cleanup.
- W4 (2 h): gates on (eval.ts:481 fix + typecheck scripts + deploy step 0).
- W5 (3 h): PERF-1 split + critique fixes re-applied.
- W6 (4–6 h): print paging + PDF restored; dead route/endpoint cleanup.
- W7 (2 h): alerting hook + off-VPS backup copy; restore-drill scheduled.
- W8: dep hygiene, junk prune, README/waiver docs, re-score (delta ce:full).
- Q4: Trust & discipline — release checklist doc, quarterly restore drill.
- Q1: Consolidation — eval command center; reporting PDF + scheduled digests.
- Q2: Depth — contract tests + coverage floor 30% + p95 observability.
- Q3: Reach — deliberate EMAIL_MODE=live rollout; font self-host; SSO polish.
Projection after the sprint: ≈8.0–8.3 (each move re-verified live before its score moves — rule 12). Non-goals for 8.0: full coverage program, express-5, multi-host DR.
Five ideas worth building — grounded in this run's evidence
System Health tab (admin)
One screen answering "is everything running?": 5 pool statuses, last backup age, scheduler last-runs/error counts, last email sent, deploy SHA. Ties directly to P1-7 and kills the silent-failure class where it starts.
Eval Command Center
Merge the four eval-admin surfaces into one tabbed hub with per-cycle progress rings ("who still owes evaluations") — the consolidation the role lens has flagged twice (P2-8).
Weekly digests (email)
Program-spend + coverage + call-out digest Sundays via the existing SMTP path, reusing saved views as the query layer. Pull-based reporting becomes pulse-based.
Schedule change log (weekly diff view)
A before/after view of the week's schedule edits (who changed what, when) — the audit middleware already records the writes; surface them as a readable diff for the coordinator.
Staff PWA quick-actions
Installable PWA with shortcuts for the two staff flows that happen away from a desk: report a call-out and check today's coverage. SCL is already the most mobile-shaped module.
What to change visually — from the 70-capture sweep
Login page, minus the panel
Remove the credential panel (P0); the login design itself is strong — keep the value strip, tighten LCP with self-hosted fonts (3.8 s → target <2.5 s).
Failure states that tell the truth
Split "Email Not Linked" (a data state) from "couldn't load your profile" (a temporary state with Retry) — the sweep caught 429s producing the misleading dead-end.
Admin per-tab payload diet
Re-apply the lazy-split (P1-4) and add per-tab loading skeletons — admin opens should feel instant like the rest of the app does.
Print & PDF artifacts
Restore real page numbers + branded PDF headers/footers — the print path is the last rough surface for institutional documents.
Micro-polish pass
Label remaining bare "—" states, suppress "-100%" delta on empty months, alias admin tab deep-links, add a skip-link. Small, visible, cheap.
The probes that separate "looks fine" from "is fine"
Clean-install reproducibility PASS (npm ci exit 0, zero missing) · declared-vs-installed PASS · ambient build PASS (hash-identical to served dist) · live health PASS (5/5 pools) · auth POST-path behavior PASS · supervisor/script drift PASS · cron integrity PASS · integration-test wins PASS (163/163) · domain capabilities PASS (reminders firing since fix; backups ran today) · suppression knobs audited (EMAIL_MODE=test, declared) · served-bundle credential scan FAIL (P0-1) · git/release probes FAIL (P1-1) · DNS/TLS PASS.
Post-audit re-run (2026-09-18 evening): served-bundle credential scan PASS (0 literals) · git/release PASS (repo == origin) · login render PASS (panel gone, form clean) · tests / typecheck / route-guard / vulns re-run PASS — see the delta re-score.
REMEDIATED — 6.4 → 6.9 / 10
verified by ce:full · staged run (S1–S5) · Sept 18, 2026 · honest scoring min(rubric 6.5, matrix 6.4) · status REMEDIATED (audit-day read-only run; Lighthouse run on public pages; auth-gated pages covered by the rendered sweep instead) · delta re-score 6.4 → 6.9 (2026-09-18)
Gate conditions for a FULL certification: ✓ P0-1 closed (panel removed · bundle proof · rotations) · ✓ lost set re-applied via commits · ✓ gates on + repo pushed · ✓ role SoT live-verified · ✓ restore drill + offsite backup · remaining: full staged delta run ≥ 8.0 (interim delta re-score 2026-09-18: 6.4 → 6.9)