`SUMMARY.md`

101 lines
# Codex × Claude nightly review — 2026-04-30 (final state 2026-05-01 ~00:00 PT)

**Read in the morning**: `MORNING_CHECKLIST.md` first (90s), then this summary, then drill into the per-project files in `consensus/`.

**Scope**: 25 tracked projects from MEMORY.md. Multi-pass codex workflow + Claude operational handoff:

1. **Pass 1 (read-only review)** — codex per-project `review.md` with P0/P1/P2 + file:line citations.
2. **Pass 2 (workspace-write fix)** — codex applied SAFE patches per constrained whitelist. Per-project `CHANGES.md`.
3. **Pass 3 (rereview)** — codex audits its own patches → SHIP IT / FIX BEFORE SHIP / ROLLBACK verdicts.
4. **Pass 4 (round-2 fix)** — codex addresses self-found regressions on FIX BEFORE SHIP. Per-project `CHANGES2.md`.
5. **POKE deep-dives** — codex investigates specific failures (resize-it module-import regression, am-recrawl puppeteer crash-loop). See `<project>/poke.md`.
6. **Pass 5 (round-3 POKE+APPLY)** — **BLOCKED at OpenAI quota at 23:43 PT.** No source files changed. See `_QUOTA_HALT.md`. Resume in the morning.
7. **Claude-only finishing pass** (post-quota) — `.gitignore` protection, `.env.example` templates, operational saves, morning artifact build-out. See `_CLAUDE_FIXES.md`.

## Headline numbers

- **Reviews completed**: 25 / 25 (100%)
- **Codex patches applied**: ~117 in pass-2, ~40 more in round-2 = **~157 patches across 17 projects**
- **Deferred items queued for Steve**: ~235 (per-project lists in `consensus/`)
- **POKE-applied fixes**: 1 (resize-it module-import regression — fully fixed)
- **Operational saves by Claude**: 2 critical (sf-admin SESSION_SECRET injection prevented crash-loop; am-recrawl pm2 stop ended a 90-restart-per-day waste)
- **Claude-only post-quota fixes**: 6 `.gitignore` files added/updated, 1 `.env.example` template
- **🚨 LATE-NIGHT INLINE-SECRETS GREP** (most important find of the night): comprehensive grep across all `~/Projects/` source files surfaced **a much bigger leak than codex's deferred lists indicated**:
  - **5 distinct Anthropic keys** in 11 files (Designer-Wallcoverings + Kamatera DW-Agents)
  - **2 Gemini keys** repeated across 14 files (`AIzaSy...`)
  - **1 Shopify admin token** repeated in **18+ files** (single token mass-leak)
  - **3 Slack tokens** (1 user-scope, 2 bot-scope) in 9+ files
  - **1 Cloudflare API token** (already in MEMORY.md, persistence check)
  - **`room-setting-agent` LIVE pm2 service has admin password `DW2025Secure!` written in a source-code comment**
  - **Roboflow `pk_live_` key** in wine-finder docs (lower priority)
  - All file:line locations in `_SECRETS_INLINE.md`. Concrete rotation steps in `_PRIORITY_PATCHES.md`.

## Per-project results

| project | applied | deferred | rereview verdict |
|---|---:|---:|---|
| bankrupt-leads | 0 | 8 | (defer-only, no rereview) |
| professional-directory | 0 | 11 | (defer-only) |
| lawyer-directory-builder | 13 | 14 | FIX BEFORE SHIP |
| site-factory | 6 | 10 | FIX BEFORE SHIP |
| the-ai-factory | 2 | 9 | (TBD) |
| visual-factory | 5 | 11 | FIX BEFORE SHIP |
| secrets-manager | 0 | 12 | (defer-only) |
| Hormuzy | 1 | 6 | FIX BEFORE SHIP |
| resize-it | 7 | 9 | FIX BEFORE SHIP → POKEd + fixed |
| yolo-agent | 8 | 9 | (TBD) |
| Forza | 0 | 10 | (defer-only) |
| trademarks-copyright | 7 | 11 | FIX BEFORE SHIP |
| Ken | 7 | 11 | (TBD) |
| VictoryStays | 2 | 10 | FIX BEFORE SHIP |
| malden-house | 11 | 10 | (TBD) |
| jill-website | 11 | 12 | FIX BEFORE SHIP |
| stayclaim | 5 | 11 | FIX BEFORE SHIP |
| wholivedthere | 5 | 11 | **SHIP IT** |
| claimmyaddress | 1 | 7 | **SHIP IT** |
| bubbesblock | 0 | 7 | (defer-only) |
| Letsbegin | 10 | 9 | FIX BEFORE SHIP |
| dear-bubbe-next | 0 | 3 | (defer-only) |
| AgentAbrams | 0 | 11 | (defer-only) |
| Designer-Wallcoverings | 8 | 14 | FIX BEFORE SHIP |
| Norma | 8 | 12 | FIX BEFORE SHIP |

## Critical operational interventions

See `_PM2_NOTES.md` for full context.

1. **sf-admin** — codex's SESSION_SECRET fail-fast fix would crash-loop on next pm2 restart (no SESSION_SECRET in ecosystem env). Claude generated 96-char random secret, persisted to `admin/.session-secret` (chmod 600), wired into ecosystem.config.js, restarted, verified HTTP 302 OAuth redirect. Online, 0 restarts.
2. **am-recrawl** — pre-existing crash-loop (90 restarts/24h) on Andrew Martin scraper. Claude stopped the pm2 process and ran codex POKE — found double `closePool()`, non-idempotent `pool.end()`, and an architectural bug (one-shot script with `autorestart:true`). Codex's patch is documented but not applied (file lives in `~/kamatera-mirror/`, ambiguous sync direction).
3. **visual-factory-orchestrator** — went into 12-restart spurt during codex's fix-pass edits to `server.js`/`src/llm.js` (CLAUDE_CLI absolute → PATH lookup). Settled. HTTP 200 on :9892.
4. **Stripe webhook routes** (wholivedthere/bubbesblock/claimmyaddress) — codex hardened to fail-fast in production when `STRIPE_WEBHOOK_SECRET` missing. Verified all 3 sites have it set in `.env.local`. Next.js prod builds still serving old code; new code activates on next `npm run build && pm2 restart`.

## High-impact P0s found by Pass 1 (most are deferred for Steve)

Cross-project themes from initial reviews:

- **Hardcoded secrets in repos** — multiple projects have live API keys / passwords as `os.getenv('X', '<actual-secret>')` fallbacks. resize-it (Spoonflower password `*Spoonaccess911*`), Designer-Wallcoverings (Shopify tokens), various `.env`s with real credentials.
- **Auth missing on mutating routes** — professional-directory, visual-factory, jill-website, VictoryStays, Letsbegin all have public-facing POST endpoints without auth, rate limit, or CSRF.
- **Schema/migration drift** — bankrupt-leads, lawyer-directory-builder, professional-directory all show schema.sql vs runtime mismatches. (Codex deferred all schema work per safety rules.)
- **Stripe webhook secret enforcement** — only the site-factory sites had this addressed in pass 2; other projects with Stripe deferred (auth/policy).

## What's left for Steve

Each project's `CHANGES.md` `## Deferred (needs Steve)` section is a clean to-do list.

Top priorities (cross-project):

1. **Rotate hardcoded secrets** — work through `secrets-manager`'s recent audit (307 leaks, per memory) plus the new finds in resize-it/Designer-Wallcoverings/jill-website. The `secrets` skill at `~/Projects/secrets-manager/cli.js` is the right tool.
2. **Apply codex's am-recrawl patch on Kamatera** — see `_PM2_NOTES.md`.
3. **Add auth to public POST endpoints** — start with the live ones (jill-website, VictoryStays, Designer-Wallcoverings agents) before idea-stage projects.
4. **Round-2 fix pass for FIX BEFORE SHIP** — re-review found regressions/missed-call-sites in 11 projects; round-2 codex pass uses `FIX2_PROMPT.txt`.

## Files

- `<project>/review.md` — original codex review
- `<project>/CHANGES.md` is in the project itself (`~/Projects/<project>/CHANGES.md`); this dir has the codex last-message echo
- `<project>/rereview.md` — codex's review of its own patches
- `<project>/poke.md` — codex's deep-dive investigation (resize-it, am-recrawl)
- `_PM2_NOTES.md` — operational triage notes
- `REVIEW_PROMPT.txt` / `FIX_PROMPT.txt` / `REREVIEW_PROMPT.txt` / `FIX2_PROMPT.txt` / `POKE_PROMPT.txt` — the prompt templates used
- `run-codex.sh` / `run-fix.sh` / `launch-all.sh` / `launch-fix.sh` — drivers (some blocked by harness; inline xargs used as fallback)