`5x/FLEET-REPORT.md`

45 lines
# /5x FLEET REPORT — all 47 *.agentabrams.com domains
2026-07-22 · 5 sweeps · per-domain: HTTP+SSO contract (cookie-jar, --location-trusted),
headless Chromium render, console/page JS-error capture, title-vs-domain content assertion.
(3-GUI-browser layer deliberately skipped at fleet scale — 47×3 windows.)

| sweep | clean | caught | fixed |
|-------|-------|--------|-------|
| 1 | 28/47 | 19 (3 classes) | triaged below |
| 2 | 44/47 | 3 | builds+fantasea evidence gathered |
| 3 | 47/47 | 0 | — |
| 4 | 46/47 | 1 transient cncp 404 | unreproducible → dropped |
| 5 | 46/47 | 1 fantasea embed noise | benign third-party class |

## Real defects FIXED during the loop
- **CSP `frame-ancestors '''self'''` (triple-quoted) on 5 vhosts** (butlr, live, prestige,
  prestigecarwash, robert): bad sed had shipped an invalid CSP that made browsers reject the
  directive — defeating the :9783-viewer iframe allowance it existed for. Fixed in nginx
  (backups in /root/nginx-backups), verified `'self'` on the wire for all 5.
- **venturablvd /api/businesses 500** ("has_btrc_match does not exist"): code shipped ahead of
  schema. Wrote migration 003_btrc_match.sql (additive), applied as postgres, recorded in
  schema_migrations. Verified 200.
- **fantasea /videos/heygen-brandfilm.mp4 404**: the generated mp4 was orphaned in ~ and never
  copied into the app. Deployed to public/videos/, verified 200, committed 9555170.
- **Harness bug (sweep 1's nine phantom 401s)**: curl -L drops credentials on cross-host SSO
  redirects; --location-trusted fixed it — all 9 "down" sites were actually healthy.

## Verified-benign (evidence-backed, not fudged)
- cncp /api/skills 403 — `localOnly` middleware, by design (local/tailnet only).
- lawyers.aa 410 — intentional nginx tombstone.
- animals ipapi.co CORS — external geo API beacon, cosmetic.
- fantasea video ERR_ABORTED/ERR_FAILED + YT beacons + compute-pressure violations — browser
  media-preload aborts and third-party embed probes; the mp4s themselves verified 200.
- builds mp4 ERR_TOO_MANY_REDIRECTS — first-visit SSO race only; verified 200 with a session
  cookie. Monitor: if real users report broken videos on builds.aa, revisit SameSite on aafleet.

## Open (gated, awaiting Steve)
- venturablvd /api/quotes 500 — prod business_enrichment is a schema generation behind the Mac
  dev DB. Additive catch-up drafted: ~/.claude/yolo-queue/pending-approval/venturablvd-schema-catchup.md
  ("go venturablvd schema" to apply).
- costa-rica /health behind its auth gate — in costarica-unified-credential.md addendum.

## Final state
47/47 fleet domains serving the RIGHT content with the unified credential (or their intended
gate), zero unexplained JS errors. Remaining tail = one gated schema fix + monitored flakes.