`consensus/site-factory.md`

47 lines

# Consensus — site-factory
Generated 2026-04-30T23:48:02-07:00. Source: codex review/fix/rereview/round-2 artifacts (round-3 was quota-blocked).

## Codex pass-1 review (top risks)
## Top Risks (P0 — fix this week)
- `.env:10`, `.env:13`, `sites/*/app/.env.local:5-7`: live Cloudflare/Stripe/webhook secrets are in the project tree. Rotate immediately, remove all real `.env*`, add `.gitignore`, move secrets to 1Password/Vercel/PM2 env.
- `ecosystem.config.js:49`, `admin/server.js:43-46`: production PM2 enables `SF_ADMIN_DEV=1`, making every request auto-admin. Set default to `0`, bind admin to `127.0.0.1`, require real OAuth.
- `admin/server.js:15`: production can boot with hardcoded `SESSION_SECRET`, enabling session forgery if dev bypass is later removed. Refuse boot in production unless `SESSION_SECRET` is set and strong.
- `orchestrator/server.js:15`, `orchestrator/server.js:37`, `orchestrator/server.js:96`, `orchestrator/server.js:130`, `orchestrator/server.js:164`, `orchestrator/server.js:180`: orchestrator has open CORS and no auth on write routes. Add shared bearer auth, restrict CORS, expose only behind admin.
- `orchestrator/server.js:195-204`, `stages/runners.js:240-243`: concurrent `/advance` calls can run the same stage twice, duplicating DNS/Stripe/Vercel work. Use DB transaction/advisory lock and only advance `pending` stages.
- `sites/wholivedthere.com/app/lib/db.ts:30-33`, `db/schema.sql:80-89`: webhook writes `site,email` columns that do not exist, then catches/logs and still returns 200. Align schema/query and make persistence failure return 500/retry.

## Round-1 applied
## Applied
- admin/server.js:15 - removed the hardcoded `SESSION_SECRET` fallback and now fail fast unless a 32+ character secret is provided - prevents booting with a known session signing secret.
- admin/server.js:139 - bound the admin Express server to `127.0.0.1` - keeps the local-only admin surface off public interfaces.
- admin/.env.example:14 - replaced the weak session placeholder with a long random-secret placeholder - documents the required env without adding a real secret.
- sites/wholivedthere.com/app/app/api/webhook/stripe/route.ts:11 - production now returns 500 when Stripe or `STRIPE_WEBHOOK_SECRET` is missing - avoids silently accepting unsigned live webhook events.
- sites/bubbesblock.com/app/app/api/webhook/stripe/route.ts:11 - production now returns 500 when Stripe or `STRIPE_WEBHOOK_SECRET` is missing - avoids silently accepting unsigned live webhook events.
- sites/claimmyaddress.com/app/app/api/webhook/stripe/route.ts:11 - production now returns 500 when Stripe or `STRIPE_WEBHOOK_SECRET` is missing - avoids silently accepting unsigned live webhook events.

## Codex re-review verdict: FIX BEFORE SHIP

## New issues introduced
none observed.

## Round-2 applied
## Round 2 Applied
- No safe round-2 code changes applied; the only P0/BROKEN findings target files under `.next/`, which this pass is explicitly forbidden to edit.

## Still deferred for Steve
- P0 - .env:10, .env:13, sites/*/app/.env.local:5-7 - live Cloudflare/Stripe/webhook secrets are in the project tree - rotating/removing real secrets requires Steve-controlled credential rotation; left `.env*` files untouched.
- P0 - ecosystem.config.js:49, admin/server.js:43-46 - PM2 sets `SF_ADMIN_DEV=1`, enabling auto-admin - PM2 ecosystem files are explicitly out of scope; OAuth/dev-bypass policy needs owner confirmation.
- P0 - orchestrator/server.js:15,37,96,130,164,180 - orchestrator has open CORS and unauthenticated write routes - adding shared auth/restricting CORS is a behavioral/API change beyond the safe fix list.
- P0 - orchestrator/server.js:195-204, stages/runners.js:240-243 - concurrent advance calls can duplicate stage work - advisory locks/transaction semantics are not a surgical safe change.
- P0 - sites/wholivedthere.com/app/lib/db.ts:30-33, db/schema.sql:80-89 - webhook persistence schema mismatch - `.sql`/schema and DDL changes are forbidden in this pass.
- P1 - orchestrator/server.js:110-112,144-146, db/schema.sql:16-25 - missing `theme_overrides`/`copy_overrides` schema columns - migration/schema work is forbidden.
- P1 - orchestrator/server.js:24-35,158-160 - async Express routes lack centralized error wrappers - broader route behavior change not included in safe list.
- P1 - stages/runners.js:76-123,203-212 - stub stages advance as done - pipeline semantics need owner decision.
- P1 - critic/server.js:112-148 - `/critique/stub` has no auth/rate limit - auth policy change beyond safe list.
- P1 - scripts/deploy-vercel.sh:40-45 - deploy script pushes every `.env.local` key to Vercel production - production env allowlist needs Steve review to avoid dropping required keys.