`consensus/Forza.md`

32 lines
# Consensus — Forza
Generated 2026-04-30T23:48:03-07:00. Source: codex review/fix/rereview/round-2 artifacts (round-3 was quota-blocked).

## Codex pass-1 review (top risks)
## Top Risks (P0 — fix this week)
- `index.html:17-21` public root is a “3 theme mockups” chooser, not the winning production site; visitors land on internal design artifacts. Fix: make root serve `theme-3-costa-rica-modern/` or redirect permanently.
- `theme-3-costa-rica-modern/contact/index.html:115`, `theme-3-costa-rica-modern/index.html:555` lead forms call `preventDefault()` and never send data; real leads are silently lost or shown a mockup alert. Fix: wire to a form backend/mail handler with success/error states.
- `theme-3-costa-rica-modern/index.html:14`, `contact/index.html:13`, `about/index.html:15`, `services-legal/index.html:15` load Figma MCP capture JS in production pages; third-party design tooling can execute on every visitor session. Fix: remove from deploy or gate behind local/dev-only build.
- `README.md:6`, `README.md:63`, `DIARY.md:164` SSL/DNS are documented as unfinished; site may be unreachable or HTTP-only. Fix: confirm DNS A record, run certbot, force HTTPS.
- Known SQL injection/auth/CVE issues: none observed; there is no backend, auth layer, SQL, or package manifest.


## Round-1 applied
## Applied

- None — no P0/P1 review item matched the approved safe fix list for autonomous edits.


## Still deferred for Steve

- P0 — `index.html:17` — public root serves the theme mockup chooser — deferred because changing production routing/customer-facing HTML is out of scope.
- P0 — `theme-3-costa-rica-modern/contact/index.html:115`, `theme-3-costa-rica-modern/index.html:555` — lead forms prevent submission and do not send data — deferred because wiring a real lead backend/mail handler requires a product/infrastructure decision.
- P0 — `theme-3-costa-rica-modern/index.html:14`, `theme-3-costa-rica-modern/contact/index.html:13`, `theme-3-costa-rica-modern/about/index.html:15`, `theme-3-costa-rica-modern/services-legal/index.html:15` — production pages load Figma MCP capture JavaScript — deferred because removing scripts from public-facing pages is outside the approved safe fix list and may affect the current design workflow.
- P0 — `README.md:6`, `README.md:63`, `DIARY.md:164` — SSL/DNS are documented as unfinished — deferred because DNS, certbot, nginx, and certificate work are explicitly excluded and require Steve/server access.
- P0 — `CODEX_REVIEW.md:13` — no SQL injection/auth/CVE backend issue observed — deferred because there is no fix to apply.
- P1 — `README.md:27`, `DIARY.md:116`, `DIARY.md:272` — public docs include root SSH/deploy runbook details — deferred because this is documentation/content cleanup, not one of the approved safe fixes.
- P1 — `theme-3-costa-rica-modern/contact/index.html:184` — privacy policy link is `href="#"` while collecting personal data — deferred because adding a real privacy policy is a legal/content decision.
- P1 — `theme-3-costa-rica-modern/index.html:489`, `theme-3-costa-rica-modern/index.html:551`, `theme-3-costa-rica-modern/contact/index.html:249`, `theme-3-costa-rica-modern/contact/index.html:321` — core CTAs are dead `#` links — deferred because replacing them changes public-facing behavior/content and needs real destination choices.
- P1 — `theme-3-costa-rica-modern/index.html:15` — homepage duplicates shared CSS — deferred because CSS migration is not in the approved safe fix list and touches customer-facing presentation.
- P1 — `README.md:41` — docs say About and Legal are planned though files exist — deferred because documentation cleanup is outside the approved safe fix list.