governance(TK-11370): make live-by-default Shopify writers dry-run by default

82e0326b68eb053a003cd659e79a6b3224367c58 · 2026-09-10 17:52:31 -0700 · Steve Abrams

Flip `DRY = argv.includes('--dry')` -> `DRY = !argv.includes('--apply')` so a
zero-argument run no longer fires customer-facing Shopify writes.

Backward compatible: `--dry` still means dry; `--apply` now required to write.
Only zero-arg invocations change behaviour, and every candidate was checked
against its launchd/cron/pm2/wrapper invocation sites first (4 scripts that a
cadence job runs flagless were EXCLUDED so this cannot silently disable them).

Verified: node --check/py_compile 87/87 with a positive control proving the
checker rejects an injected fault; argv truth-table negative test 5/5.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L53y4oP2itY3qeJ8WQgMzc

Files touched

M scripts/finish.js

Diff

commit 82e0326b68eb053a003cd659e79a6b3224367c58
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 10 17:52:31 2026 -0700

    governance(TK-11370): make live-by-default Shopify writers dry-run by default
    
    Flip `DRY = argv.includes('--dry')` -> `DRY = !argv.includes('--apply')` so a
    zero-argument run no longer fires customer-facing Shopify writes.
    
    Backward compatible: `--dry` still means dry; `--apply` now required to write.
    Only zero-arg invocations change behaviour, and every candidate was checked
    against its launchd/cron/pm2/wrapper invocation sites first (4 scripts that a
    cadence job runs flagless were EXCLUDED so this cannot silently disable them).
    
    Verified: node --check/py_compile 87/87 with a positive control proving the
    checker rejects an injected fault; argv truth-table negative test 5/5.
    
    Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01L53y4oP2itY3qeJ8WQgMzc
---
 scripts/finish.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/finish.js b/scripts/finish.js
index f54b0ac..4a8717f 100644
--- a/scripts/finish.js
+++ b/scripts/finish.js
@@ -3,7 +3,7 @@ const STORE='designer-laboratory-sandbox.myshopify.com';
 const TOKEN=(fs.readFileSync(path.join(process.env.HOME,'Projects/secrets-manager/.env'),'utf8').match(/^SHOPIFY_ADMIN_TOKEN=(.+)$/m)||[])[1].replace(/["']/g,'').trim();
 const GQL=`https://${STORE}/admin/api/2024-10/graphql.json`;
 const sleep=ms=>new Promise(r=>setTimeout(r,ms));
-const DRY=process.argv.includes('--dry');
+const DRY=!process.argv.includes('--apply');
 async function gql(q,v){for(let a=0;a<6;a++){const r=await fetch(GQL,{method:'POST',headers:{'X-Shopify-Access-Token':TOKEN,'Content-Type':'application/json'},body:JSON.stringify({query:q,variables:v})});const j=await r.json();if(j.errors){if(JSON.stringify(j.errors).includes('THROTTLED')){await sleep(1500*(a+1));continue;}throw new Error(JSON.stringify(j.errors).slice(0,200));}return j.data;}throw new Error('throttled');}
 
 async function allMajilite(){

← 4e9ee41 creds-safe fetch guard: resolve relative fetch vs credential · back to Majilite Onboard · (newest)