auto-save: 2026-07-23T10:20:16 (1 files) — 5x/

9c34807eef2bec1992e12609e3aa71e68d84195f · 2026-07-23 10:20:24 -0700 · Steve Abrams

Files touched

A 5x/REPORT.md

Diff

commit 9c34807eef2bec1992e12609e3aa71e68d84195f
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 23 10:20:24 2026 -0700

    auto-save: 2026-07-23T10:20:16 (1 files) — 5x/
---
 5x/REPORT.md | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/5x/REPORT.md b/5x/REPORT.md
new file mode 100644
index 0000000..7957e46
--- /dev/null
+++ b/5x/REPORT.md
@@ -0,0 +1,36 @@
+# /5x REPORT — Butlr (holdforme) · scenario: "new york pizza places"
+
+Target: http://127.0.0.1:9932 (local dev only; prod NEVER touched)
+Scope guardrail: UI/flow verification only — NO real outbound calls placed.
+
+## Sweep ledger
+| sweep | six-way | caught | fixed | commit |
+|-------|---------|--------|-------|--------|
+| 1 | 3/4 (M3 fail) | 2 | 1 | dep-install |
+| 2 | confirm | 0 new | — | (report-only item remains) |
+
+## Caught & disposition
+1. **Server would not boot** — `Cannot find module 'dotenv'`; local `node_modules` empty.
+   → FIXED: `npm install` (97 pkgs). Server now boots, healthz=200. REAL fix.
+2. **Home-page console CSP error** — `abrams-family-nav.js` redirects to SSO-gated
+   `auth.agentabrams.com`, blocked by CSP `script-src`. → REPORT, not auto-fixed:
+   likely local-dev-only (no aafleet SSO cookie); "fixing" CSP would be a fake fix
+   (redirect target is a login page, not JS); real fix is fleet SSO-side. Unrelated
+   to the pizza-search scenario.
+
+## Scenario result — "new york pizza places"
+- `GET /api/places/search?q=pizza&zip=10001` → 200, ok=true. PASS (contract).
+- Location gate: no zip → 400 `location_required`. PASS.
+- Short-query guard: q="p" → empty ok. PASS.
+- Auth gate: `/new` wizard → 302 `/login` (requireOwner). Correct by design.
+- FINDING (quality, not a bug): only 1 result, in Union NJ — free OSM Nominatim is a
+  geocoder, not a POI index, so it misses real Manhattan pizzerias. Better results
+  would need a POI source (Overpass API = free; Google Places = paid/HARD NO-SPEND).
+  Data-source decision for Steve — NOT auto-changed.
+
+## Cross-browser
+- B4 Chrome PASS. B5 Safari / B6 Firefox SKIP (engines not installed on this box).
+
+## Open items
+- [external/infra] SSO-gated shared nav asset + CSP (local-dev artifact; verify on prod).
+- [product decision] Nominatim → Overpass for real POI/business results ($0).

← c9f8417 chore: macstudio3 migration — reconcile from mac2 + repoint · back to Butlr · (newest)