`5x/REPORT.md`

37 lines
# /5x REPORT — Butlr (holdforme) · scenario: "new york pizza places"

Target: http://127.0.0.1:9932 (local dev only; prod NEVER touched)
Scope guardrail: UI/flow verification only — NO real outbound calls placed.

## Sweep ledger
| sweep | six-way | caught | fixed | commit |
|-------|---------|--------|-------|--------|
| 1 | 3/4 (M3 fail) | 2 | 1 | dep-install |
| 2 | confirm | 0 new | — | (report-only item remains) |

## Caught & disposition
1. **Server would not boot** — `Cannot find module 'dotenv'`; local `node_modules` empty.
   → FIXED: `npm install` (97 pkgs). Server now boots, healthz=200. REAL fix.
2. **Home-page console CSP error** — `abrams-family-nav.js` redirects to SSO-gated
   `auth.agentabrams.com`, blocked by CSP `script-src`. → REPORT, not auto-fixed:
   likely local-dev-only (no aafleet SSO cookie); "fixing" CSP would be a fake fix
   (redirect target is a login page, not JS); real fix is fleet SSO-side. Unrelated
   to the pizza-search scenario.

## Scenario result — "new york pizza places"
- `GET /api/places/search?q=pizza&zip=10001` → 200, ok=true. PASS (contract).
- Location gate: no zip → 400 `location_required`. PASS.
- Short-query guard: q="p" → empty ok. PASS.
- Auth gate: `/new` wizard → 302 `/login` (requireOwner). Correct by design.
- FINDING (quality, not a bug): only 1 result, in Union NJ — free OSM Nominatim is a
  geocoder, not a POI index, so it misses real Manhattan pizzerias. Better results
  would need a POI source (Overpass API = free; Google Places = paid/HARD NO-SPEND).
  Data-source decision for Steve — NOT auto-changed.

## Cross-browser
- B4 Chrome PASS. B5 Safari / B6 Firefox SKIP (engines not installed on this box).

## Open items
- [external/infra] SSO-gated shared nav asset + CSP (local-dev artifact; verify on prod).
- [product decision] Nominatim → Overpass for real POI/business results ($0).