`consensus/Hormuzy.md`

35 lines
# Consensus — Hormuzy
Generated 2026-04-30T23:48:02-07:00. Source: codex review/fix/rereview/round-2 artifacts (round-3 was quota-blocked).

## Codex pass-1 review (top risks)
## Top Risks (P0 — fix this week)
- `clone/index.html:43-46`: references `/assets/index-DNA8aLxR.js`, `/assets/three-s7MRw7i5.js`, `/assets/r3f-DrPHa5mf.js`, `/assets/index-Bjz6pQij.css`, none present in repo; local/static deploy renders empty `#root`. Fix by committing full build output or restoring source/build pipeline.
- `clone/manifest.json:17`: references `/icon-512.png`, not present; PWA install/icon fetch breaks. Add the asset or remove the manifest entry.
- Secrets/auth/SQL injection/prod credentials: none observed.


## Round-1 applied
## Applied
- `clone/recon.js:1` — replaced the hardcoded absolute Playwright dependency path with `require('playwright')` — removes a machine-specific `/root/Projects/Designer-Wallcoverings/...` reference without touching the excluded path.


## Codex re-review verdict: FIX BEFORE SHIP

## New issues introduced
`clone/recon.js:1` — script now requires an undeclared dependency; `node` fails before any recon logic runs with `MODULE_NOT_FOUND: Cannot find module 'playwright'` — P1


## Round-2 applied
## Round 2 Applied
- None.


## Still deferred for Steve
- P0 — `clone/index.html:43` — missing referenced build assets (`/assets/index-DNA8aLxR.js`, `/assets/three-s7MRw7i5.js`, `/assets/r3f-DrPHa5mf.js`, `/assets/index-Bjz6pQij.css`) — deferred because restoring/committing build output is outside the safe-fix list and may require the original build pipeline.
- P0 — `clone/manifest.json:17` — references missing `/icon-512.png` — deferred because adding/removing public PWA assets is outside the safe-fix list and changes deploy-visible behavior.
- P1 — `clone/index.html:42`, `clone/index.html:50` — third-party scripts lack CSP/SRI containment — deferred because public-facing HTML/security policy changes are outside the allowed safe fixes.
- P1 — `clone/recon.js:18`, `clone/recon.js:49` — navigation errors are swallowed — deferred because this behavior change was not one of the allowed safe fixes.
- P1 — `clone/recon.js:18`, `clone/recon.js:49` — recon validates production `https://www.hormuzy.com/` instead of the checked-out static page — deferred because changing test target/workflow is outside the safe-fix list.
- P1 — `clone/recon/*.png`, `clone/recon/*.webm` — generated screenshots/videos are committed as source — deferred because deleting or relocating artifacts is outside the safe-fix list.