Consulting Designerwallcoverings Com

repo: ~/Projects/consulting-designerwallcoverings-com · 57 commits · 17 in last 24h, 57 in last 7d · ▄█▅

Search the build

57 commits indexed

  1. c46dce5 2026-07-27 TK-22 signin: hydrate front door from /api/client (fixes stale empty tagline + dangling 'Reach ·')
  2. 4fcf330 2026-07-27 TK-22 admin-UX: add created date+time chip to Low Hanging Fruit cards
  3. b28b741 2026-07-27 TK-22 red-team FINDING 4: fix XFF-spoof rate-limit bypass on /api/intake
  4. fdbc2a7 2026-07-27 TK-22 red-team FINDING 2: validate admin bucket writes + atomic write w/ .bak
  5. 3cc6bd7 2026-07-27 TK-22 red-team: harden ungated POST /api/intake (rate-limit + size cap + FIFO cap)
  6. 9d15ef6 2026-07-27 TK-21: honest fleet per-site depth — rank/report by crawled handleCount, drop aggregators (DTD verdict B)
  7. afc0d96 2026-07-27 auto-save: 2026-07-27T20:24:23 (5 files) — build.mjs data/dw-analysis.json public/portal.html public/versions/gallery.html scripts/collect-dw.mjs
  8. 97105b7 2026-07-27 TK-17: generate read-only Batch A (9684) + Batch B (813) execution worklists
  9. 774241d 2026-07-27 TK-17: execution runbook + Batch B canary worklist (Steve-approved A+A′ quote-tags, B canary, C hold) — maps to canonical bucketA-add-roll-variants.js + tagsAdd; live --apply stays supervised
  10. b206159 2026-07-27 TK-17: Phase-2 dry-run — batched, rule-enforced, contrarian-gated (813 Hollywood variant-eligible, 9,301 quote-tag, 12,397 HOLD; Batch C→0 GO after brand-integrity pulls)
  11. 0c7e77f 2026-07-27 Fix contrarian-caught join errors: Greenland already-buyable (0 in backlog, not a canary); Hollywood is the cost-ready canary (813/843 join via mfr_sku=alt_sku on hw_price)
  12. 4455119 2026-07-27 Correct Phase-1 cost-sourcing: momentum cost col is NULL (join hw_price); surface Greenland/Hollywood as cost-ready canary vs cost-blocked Osborne
  13. 9d147c4 2026-07-27 Phase-1 cost-sourcing plan for the 5 GO lines (read-only)
  14. d4a3527 2026-07-27 Add Phase-0 go/no-go worksheet for sample-only backlog top lines (read-only)
  15. 6b2948a 2026-07-27 auto-save: 2026-07-27T14:21:14 (1 files) — data/media.json
  16. ef33303 2026-07-27 Refresh sample-only backlog work orders (22,895 rows, 130 vendors, malformed 0)
  17. 7ca0f69 2026-07-27 TK-19: reconcile attribution docs to live GA4 measurement ID G-53F1QBZSG0 (property already existed; create-property memo void)
  18. 4bcdbe7 2026-07-27 TK-19 CLOSE: GA4 already live (G-53F1QBZSG0, $6.9k/7d revenue tracked) — brief finding corrected; Consent Mode v2 region-scoped installed on live theme + verified; theme.liquid backup + findings doc
  19. befbf29 2026-07-26 TK-20 EXECUTED: collection FAQ metafields SET (versace/osborne/zuber) + dw-aeo-jsonld snippet & page.liquid hook live on theme 144396058675; LIVE-BACKUP preserved; portal deployed to dw.agentabrams.com
  20. 5f94a3d 2026-07-26 TK-20: apply vp-dw-commerce REVISE — collection JSON-LD branches emit FAQPage-only
  21. f2191dc 2026-07-26 TK-20: harden APPLY-page-jsonld.sh step[2] — fetch-live + abort-on-drift + append-one-line (vp-dw-commerce REVISE resolved); no blind PUT of stale .PROPOSED
  22. d9016b7 2026-07-26 TK-20: AEO JSON-LD injector draft + read-only render-verify
  23. b5fc1de 2026-07-26 TK-20 verify: Playwright render-check (all 3 published, but 2 collection body_html blocks HIDDEN by Boost SD display:none); read-only theme investigation → dw-collection-hero SECTION is metafield-driven & already emits FAQPage; draft handle-keyed dw-aeo-jsonld.liquid snippet + page render-hook + collection custom.faq/category metafieldsSet payloads + gated APPLY scripts + findings doc
  24. 63824ff 2026-07-26 refine: fix 3 contrarian FIX-FIRST findings (DTD opt1, 5/5) — disjoint concept galleries (60-item collector, zero overlap), honest sorts (drop fabricated hue/tier -> Newest/Title/Vendor/Type), hero wordmark APCA clears Lc>=60 (dark-plateau gradient + text-shadow + hero-only champagne gold)
  25. 788d55d 2026-07-26 TK-20 PUBLISHED: AEO blocks live via Admin API (versace smart-collection 3688c, osborne 2681c, NEW page wall-coverings id 219525742643); aeo-render.mjs deterministic md→HTML; rollback baselines preserved
  26. 10291a7 2026-07-26 auto-save: 2026-07-26T20:45:50 (11 files) — build.mjs data/dw-analysis.json public/portal.html public/versions/atelier.html public/versions/gallery.html
  27. ca97015 2026-07-26 weekly snapshot refresh: dw-analysis + build + work-orders (2026-07-26)
  28. 39e8e99 2026-07-26 refinement round: fresh collector snapshot (80,756 active / 174 vendors / 281 fleet) + rebuild
  29. d94d732 2026-07-26 TK-20: README handle-verification note RESOLVED — bake in Admin-API-verified handles (versace-wallpaper, osborne-little, zuber-wallcoverings); wall coverings + designer wallpaper have no collection (NEW-page decision validated)
  30. ca96290 2026-07-26 TK-20: compliance REVISE fix — drop implied-authorization adjacency from O&L FAQ (vp-compliance-policy sign-off)
  31. 30c247e 2026-07-26 TK-20: correct zuber AEO handle zuber -> zuber-wallcoverings (verified via Shopify Admin API; prevents 404 JSON-LD injection)
  32. 99bcb11 2026-07-26 TK-20: verify live Shopify handles for top-3 AEO targets — correct versace-home→versace-wallpaper (543 products), confirm osborne-little (1041), wall-coverings page free
  33. d98f901 2026-07-26 TK-21 P2 polish: hairline ring on doughnut legend markers so dark hues (Black rgb43) read on the #171310 panel (DTD verdict A, 5/5 unanimous)
  34. 601d121 2026-07-26 TK-20: AEO drafts for top-5 striking-distance queries (DTD-C hybrid, draft-only)
  35. bd9f352 2026-07-26 portal P2 polish: gold-styled density slider (matches select) + count/% doughnut legends
  36. 95aeb4a 2026-07-26 chore: lint, refactor, v0.1.1 (session close)
  37. f0b7063 2026-07-26 TK-17 Phase 0: per-line GO/NO-GO decision sheet for the 22,952 backlog (awaiting Steve rulings)
  38. a4ad6c6 2026-07-26 attribution prep (DTD-A): per-channel UTM+coupon scheme (data/attribution-scheme.json), attribution-spec + gtag theme-install docs, inert G-XXXX gtag snippet; GA4 property + gtag-install gated to pending-approval
  39. 2a832f2 2026-07-26 Traffic & Search Reality section: GSC 28d totals, 51% organic-click decline flagged, striking-distance table, branded split, GA4 gap; sections renumbered
  40. ec34562 2026-07-26 weekly-refresh.sh: harden with set -euo pipefail note; drop risky in-job log truncation (vp-operations APPROVE)
  41. 9568f61 2026-07-26 weekly snapshot refresh: dw-analysis + build + work-orders (2026-07-26)
  42. 4e62b5a 2026-07-26 sample-only backlog WORK ORDERS: per-vendor remediation CSVs (22,952 non-quote sample-only actives, 130 lines) + SUMMARY.md in /admin media bucket, gated /work-orders route; read-only from dw_unified mirror
  43. 27e394b 2026-07-26 designer LOW follow-ups: 2x16px line-marker HTML legends on the two doughnuts, styled select+caret chrome on concept sort controls, thin vertical-rule accent on section headers
  44. 26ca9ee 2026-07-26 Unlikely Revenue: quantify sample→roll funnel (Pool 2) from dw_unified mirror
  45. bf9f344 2026-07-26 preserve prior loop: GSC traffic-collector wired into snapshot (collector-side)
  46. 9b9d09a 2026-07-26 graphic-designer advisory pass: chart typography/gridlines, decisive rose accents, burger UR, hero overlay, metric labels
  47. d75255d 2026-07-26 graphics+analysis pass: catalog DNA (style/color/needs-tags), 46x ramp chart, gradient fills, real product imagery in mosaic + concept grids/heroes, #all deep-link
  48. d4a733e 2026-07-26 P2 fixes: honest null fleet counts, Gallery concept to light marketplace-luxe
  49. 2c9b6e0 2026-07-26 contrarian FIX-FIRST pass: data-layer forbidden-vendor filter + product-array coercion, snapshot sanity gate, roadmap KPIs
  50. 4c656f4 2026-07-26 auto-save: 2026-07-26T08:11:40 (1 files) — scripts/collect-dw.mjs
  51. f141e57 2026-07-26 seed growth buckets with live channel state + $0 competitor pixel scan; bind ad-gap finding into brief
  52. 153dc6e 2026-07-26 flagship 14-section DW analysis app + 6 luxury-leader concepts, snapshot-bound
  53. 5f513da 2026-07-26 collector + /api/refresh + deploy conf; live at dw.agentabrams.com :9703
  54. 030bfa0 2026-07-26 auto-save: 2026-07-26T07:41:30 (1 files) — scripts/
  55. 65efc01 2026-07-26 enrich from live DW site: phone, tagline, linkedin
  56. cb206b6 2026-07-26 DW intake scaffold on :9702 with verified auth gates
  57. e4e5bef 2026-07-26 scaffold consulting portal for Designer Wallcoverings

Authors

Agents used

  • vp-dw-commerce2
  • vp-compliance-policy1
  • vp-operations1

Skills used

  • /client4
  • /intake3
  • /versions3
  • /dw-analysis2
  • /portal2
  • /gallery2
  • /collect-dw2
  • /osborne2
  • /zuber2
  • /chip1
  • /design-curator1
  • /health1
  • /empty1
  • /null1
  • /report1
  • /microsites1
  • /no-go1
  • /media1
  • /aeo-drafts1
  • /dw-aeo-jsonld1
  • /aeo-render-verify1
  • /tk20-aeo-jsonld-snippet-and-nav1
  • /category1
  • /tier1
  • /atelier1
  • /attribution-scheme1
  • /work-orders1
  • /gridlines1
  • /color1
  • /needs-tags1

Creative ideas + design notes

Commits with substantial prose (≥120 chars) — the rationale behind each move.

c46dce5 · 2026-07-27 · TK-22 signin: hydrate front door from /api/client (fixes stale empty tagline + dangling 'Reach ·') 
The signin page rendered hard-coded static HTML: an empty <p class=sub> tagline
and a 'Reach: email · ' field with a trailing separator and no phone — even though
client.json now carries a tagline + phone and server.js already serves /api/client
as the "public-safe summary for signin page" that the page never consumed. Wire the
page to hydrate #tagline / #meta / #reach from /api/client (HTML-entity-decoded for
text), keeping the static markup as graceful fallback. Also drop the trailing ' · '
from the static Reach so the no-JS state is clean too. Verified in headless Chrome:
tagline + email·phone render, no double-escape, no console errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
4fcf330 · 2026-07-27 · TK-22 admin-UX: add created date+time chip to Low Hanging Fruit cards 
Standing rule (global CLAUDE.md): every admin card/chip MUST show the
record's created date AND time. The admin command-center's Low Hanging
Fruit cards showed none. Backfill created_at into suggestions.json
(basis = file creation 2026-07-26) and render a 🕓 when-chip via
fmtDate() (admin local tz, full ISO in title=), mirroring the
/admin/design-curator reference impl. Verified headless: 8/8 chips,
0 console errors, gating intact.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
b28b741 · 2026-07-27 · TK-22 red-team FINDING 4: fix XFF-spoof rate-limit bypass on /api/intake 
The /api/intake rate limiter keyed off the raw, client-controllable
X-Forwarded-For header, so rotating XFF per request bypassed the 5/IP/60s
cap entirely (reproduced: 7 rotating-XFF POSTs all 200), defeating FINDING 1.
Now: app.set('trust proxy','loopback') (nginx->Node over loopback on this host,
env-overridable via TRUST_PROXY) + key the limiter off Express's trusted req.ip
instead of the raw header. Verified: rotating attacker-XFF now trips 429 after 5
while distinct real clients stay allowed; oversized still 413, boot/health OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fdbc2a7 · 2026-07-27 · TK-22 red-team FINDING 2: validate admin bucket writes + atomic write w/ .bak 
POST /api/admin/:bucket blind-wrote req.body, so one malformed/empty admin
POST (e.g. {} or a scalar) to 'client' corrupted the PUBLIC /api/client the
signin page reads. Now: require a JSON object|array, reject scalars/null (400),
cap at 512KB (413), and refuse an empty payload that would wipe existing
non-empty content (409). writeJSON is now atomic (tmp+rename) and keeps a
single-copy .bak so any accepted-but-wrong write is recoverable. .bak/.tmp
gitignored. Verified 7 cases locally; deploy Steve-gated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3cc6bd7 · 2026-07-27 · TK-22 red-team: harden ungated POST /api/intake (rate-limit + size cap + FIFO cap) 
FINDING 1 (HIGH, confirmed live): the only unauthenticated write had no
rate-limit, no per-field size cap, and no stored-record cap. A single 400KB
POST grew intakes.json 2KB->402KB, and every POST rewrites the whole growing
file -> unbounded disk-fill DoS with quadratic CPU amplification on the public
dw.agentabrams.com host.

Fix (reversible, local): validate body is an object, reject payloads >16KB
(413), rate-limit to 5/IP/60s (429), and FIFO-cap retained records at 500 so
the file and every rewrite stay bounded. Verified: oversized->413, flood->429,
valid submission->200, file stays small.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
9d15ef6 · 2026-07-27 · TK-21: honest fleet per-site depth — rank/report by crawled handleCount, drop aggregators (DTD verdict B) 
The all.dw /api/microsites feed exposes per-site productCount, but naively using
it was dishonest: type=internal directory sites (all.dw reports productCount=201504
while its OWN handleCount is 49 — it rolls up the whole fleet) and cf-zone mirrors
report inflated rolled-up figures. The old collector summed all productCounts into
products_total=458655 (~123x inflation) and ranked 'Deepest sites by real catalog
depth' by productCount, so the aggregator + mirrors dishonestly topped the list.

Fix (DTD 5/5 Option B):
- collect-dw.mjs: drop type=internal aggregator sites; per-site depth = crawled
  handleCount (summing non-internal handleCounts ~= server total_handles=125624,
  proving it's the faithful signal); retain productCount only as products_rollup
  context; flag capped=200 (feed page-size) sites. Replace inflated products_total
  with the server's honest total_handles + a transparent handles_sum.
- build.mjs: page-capped sites render '200+' so the figure is not misread as exact.
- Result: fleet count 280->271 (aggregators dropped), chips led by real crawled
  depth (japan 29,073, astek 6,167) not the 201,504 aggregator; 0 pageerrors x7,
  leak-scan clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
5f94a3d · 2026-07-26 · TK-20: apply vp-dw-commerce REVISE — collection JSON-LD branches emit FAQPage-only 
dw-collection-hero.liquid already emits CollectionPage+BreadcrumbList on collection
pages, so the snippet's versace-wallpaper + osborne-little branches now emit FAQPage
only (avoids duplicate same-URL CollectionPage entities). Page branch keeps WebPage+FAQPage
(verified structured-data.liquid emits WebPage for ARTICLE templates only, never plain pages).
Draft layer only; no theme write.
d9016b7 · 2026-07-26 · TK-20: AEO JSON-LD injector draft + read-only render-verify 
- docs/aeo-drafts/dw-aeo-jsonld.liquid: handle-keyed FAQPage/CollectionPage/WebPage
  JSON-LD snippet (versace-wallpaper + osborne-little collections, wall-coverings page),
  generated from the committed .jsonld graphs, mirrors visible body_html FAQ verbatim.
  DTD verdict A (unanimous 5/5) — single snippet rendered from theme.liquid head.
- scripts/aeo-render-verify.mjs: read-only Playwright render check (all 3 render body_html;
  hasJsonLdFaq=false confirms the gap this snippet fills).
- render-proof/: saved render-verify JSON.
Gated theme-write memo -> pending-approval/tk20-aeo-jsonld-snippet-and-nav.md. No theme write.
30c247e · 2026-07-26 · TK-20: correct zuber AEO handle zuber -> zuber-wallcoverings (verified via Shopify Admin API; prevents 404 JSON-LD injection) 
Out-of-top-3 courtesy fix completing the handle-verification pass; same approved deliverable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
601d121 · 2026-07-26 · TK-20: AEO drafts for top-5 striking-distance queries (DTD-C hybrid, draft-only) 
5 Julian-Goldie-style AEO blocks (direct-answer + FAQ + JSON-LD + entity mentions):
- versace/osborne/zuber -> AEO blocks appended to EXISTING vendor collection pages
- wall coverings / designer wallpaper -> NEW head-term landing pages
DTD verdict C (hybrid) unanimous 5/5. vp-dw-marketing sign-off REVISE (2 conditions
applied at draft layer). No live theme write; publish memo gated to pending-approval.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
bd9f352 · 2026-07-26 · portal P2 polish: gold-styled density slider (matches select) + count/% doughnut legends 
- versionPage: density input[type=range] now custom-styled to the gold system
  (custom track w/ value-tracking --fill, gold thumb, focus-visible) so the
  Sort+Density controls row reads as one designed system; caret hardened
  (transform-origin centering, focus-visible). All 6 concept versions.
- htmlLegend: doughnut legend rows now carry a right-aligned tabular
  count + percentage (visible-only re-normalization on toggle); .hleg CSS
  gains .lgvl (tabular-nums) + flexed .lgtx.
- Rebuilt; Playwright: 0 pageerrors across portal + 6 concepts; leak-scan
  (schumacher|momentum|wallquest|greenland|tokiwa|rigo)=0. TK-21.
26ca9ee · 2026-07-26 · Unlikely Revenue: quantify sample→roll funnel (Pool 2) from dw_unified mirror 
Collector: sample_roll block — funnel (78,244 sampleable → 66% buyable, 26,580 gap
split 3,790 quote-only / 22,790 recoverable), per-vendor recoverable leak, and
order-data provenance (no shopify_orders; mp_orders seed, digital_sample_orders thin).
Brief: Pool 2 rewritten with measured figures, one stacked sample→roll chart by line,
and a Tier A/B/C provenance box — upper-bound labeled, Tier-C names the instrumentation
gap as the recommendation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

File tree

209 files tracked. Click any to browse the source at HEAD.

Other build journals

← Compliance Agent  ·  all 4 projects  ·  Consulting Intake →

Export

commits.csv · feed.atom · project.json · commits.json

rendered in 0ms