`consensus/bubbesblock.md`

24 lines

# Consensus — bubbesblock
Generated 2026-04-30T23:48:03-07:00. Source: codex review/fix/rereview/round-2 artifacts (round-3 was quota-blocked).

## Codex pass-1 review (top risks)
## Top Risks (P0 — fix this week)
- `.env:2`, `.env:3`, `.env:5`: real API keys live in the project root; accidental sync/commit leaks Google/DPLA access. Rotate keys if shared, keep `.env` out of VCS/backups, and enforce domain/IP/API restrictions.
- `README.md:9`: claimed-address posting gate is only documented, with no enforceable auth code present. If this repo is deployed as-is or rebuilt later, posting can ship without verification; implement server-side verification against `claimmyaddress.com`.

## Round-1 applied
## Applied
- None — no P0/P1 review item matched the approved autonomous safe-fix list in the current project contents.

## Still deferred for Steve
- P0 — `.env:2` — real `GOOGLE_MAPS_API_KEY` appears to live in the project root environment file — deferred because `.env` must be left alone and any real key exposure requires Steve to rotate/restrict the key.
- P0 — `.env:3` — real `GOOGLE_GEOCODING_API_KEY` appears to live in the project root environment file — deferred because `.env` must be left alone and any real key exposure requires Steve to rotate/restrict the key.
- P0 — `.env:5` — real `DPLA_API_KEY` appears to live in the project root environment file — deferred because `.env` must be left alone and any real key exposure requires Steve to rotate/restrict the key.
- P0 — `README.md:9` — posting verification is documented but no enforceable server-side auth code exists in this repo — deferred because implementing identity/claim enforcement is product/application work, not one of the approved safe fixes.
- P1 — `README.md:5` — master plan points to a sibling-relative file, so the repo is not self-contained — deferred because copying or defining the operational contract is documentation/product scope outside the approved safe-fix list.
- P1 — `README.md:7` — cross-domain identity/history flow lacks API contracts, trust model, and outage behavior — deferred because designing those contracts is architecture work outside the approved safe-fix list.
- P1 — project root — no source, tests, package/deploy config, or datastore schema is present — deferred because creating application scaffolding or tests would exceed the requested surgical safe fixes.