governance(TK-11370): make live-by-default Shopify writers dry-run by default

ad9f2ad148e6c1a31d29ceea205fa66b166ebe88 · 2026-09-10 17:52:29 -0700 · Steve Abrams

Flip `DRY = argv.includes('--dry')` -> `DRY = !argv.includes('--apply')` so a
zero-argument run no longer fires customer-facing Shopify writes.

Backward compatible: `--dry` still means dry; `--apply` now required to write.
Only zero-arg invocations change behaviour, and every candidate was checked
against its launchd/cron/pm2/wrapper invocation sites first (4 scripts that a
cadence job runs flagless were EXCLUDED so this cannot silently disable them).

Verified: node --check/py_compile 87/87 with a positive control proving the
checker rejects an injected fault; argv truth-table negative test 5/5.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L53y4oP2itY3qeJ8WQgMzc

Files touched

M video_worker_safe.js

Diff

commit ad9f2ad148e6c1a31d29ceea205fa66b166ebe88
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 10 17:52:29 2026 -0700

    governance(TK-11370): make live-by-default Shopify writers dry-run by default
    
    Flip `DRY = argv.includes('--dry')` -> `DRY = !argv.includes('--apply')` so a
    zero-argument run no longer fires customer-facing Shopify writes.
    
    Backward compatible: `--dry` still means dry; `--apply` now required to write.
    Only zero-arg invocations change behaviour, and every candidate was checked
    against its launchd/cron/pm2/wrapper invocation sites first (4 scripts that a
    cadence job runs flagless were EXCLUDED so this cannot silently disable them).
    
    Verified: node --check/py_compile 87/87 with a positive control proving the
    checker rejects an injected fault; argv truth-table negative test 5/5.
    
    Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01L53y4oP2itY3qeJ8WQgMzc
---
 video_worker_safe.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/video_worker_safe.js b/video_worker_safe.js
index c65f321..b5348a8 100644
--- a/video_worker_safe.js
+++ b/video_worker_safe.js
@@ -15,7 +15,7 @@ const SHOP='designer-laboratory-sandbox.myshopify.com';
 const ATOK=fs.readFileSync('/Users/macstudio3/Projects/secrets-manager/.env','utf8').split('\n').find(l=>l.startsWith('SHOPIFY_ADMIN_TOKEN=')).split('=').slice(1).join('=').replace(/["' ]/g,'');
 const arg=(k,d)=>{const a=process.argv.find(x=>x.startsWith('--'+k+'='));return a?a.split('=').slice(1).join('='):d;};
 const LIMIT=+arg('limit','0')||1e9, WID=arg('wid','v'+process.pid);
-const DRY=process.argv.includes('--dry-run');
+const DRY=!process.argv.includes('--apply');
 const TARGET_H=+arg('target-h','1080'), CRF=+arg('crf','23');
 const sleep=ms=>new Promise(r=>setTimeout(r,ms));
 const MB=b=>(b/1048576).toFixed(1)+'MB';

← bdffd8b chore: lint ✓ (0 fixes needed), v1.1.0 (video-shrink pipelin · back to Dw Image Shrink · (newest)