initial scaffold (gitify-all 2026-05-06)

08812d2ddf8db6cbe323d4165c69a9a7d4e81244 · 2026-05-06 10:25:47 -0700 · Steve Abrams
Files touched

A .gitignore
A FINAL_RULING.md
Diff

commit 08812d2ddf8db6cbe323d4165c69a9a7d4e81244
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed May 6 10:25:47 2026 -0700

    initial scaffold (gitify-all 2026-05-06)
---
 .gitignore      | 12 +++++++
 FINAL_RULING.md | 99 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 111 insertions(+)

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..7e6a9c3
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,12 @@
+node_modules/
+.env
+.env.local
+.env.*.local
+.env.*
+tmp/
+*.log
+.DS_Store
+dist/
+build/
+.next/
+*.bak
diff --git a/FINAL_RULING.md b/FINAL_RULING.md
new file mode 100644
index 0000000..59becf2
--- /dev/null
+++ b/FINAL_RULING.md
@@ -0,0 +1,99 @@
+# FINAL RULING — 2026-05-04/05 session decisions
+
+11 items reviewed. Vote: **SHIP NOW / DEFER / SKIP** + risk + 1-line justification.
+
+---
+
+## Ranked SHIP NOW (top of stack first)
+
+### 1. Tailscale Serve migration · SHIP NOW · risk: medium
+**Why first:** drops the entire `DWSecure2024!` credential dependency in 2 hours. Every subsequent decision in this list (ACL, OAuth, last-deploy-meta) is simpler downstream of this. 41+ files become dead code.
+**Risk:** if you skip the one-time HTTPS-cert prereq in Tailscale admin, mass outage. Do that step first, verify with `tailscale cert <hostname>`, then proceed per-service with rollback always 30 sec away.
+**Convergent verdict:** all 3 research docs (Serve, ACL, OAuth) recommend Serve as the foundation.
+
+### 2. Domain payment method fix + retry renewal · SHIP NOW · risk: low (high if skipped)
+**Why first(-ish):** `steveabramsdesigns.com` expires in 3 days. Auto-renew won't fire without a working payment method. This is a Steve-only action (web UI), takes 2 min.
+**Risk:** drop a personal-domain you've held for years. Trivially preventable.
+
+### 3. Tailscale ACL · SHIP NOW · risk: medium
+**Why:** complement (not replacement) for #1. Belt-and-suspenders defense at the network layer once Serve handles the auth layer. PLAN.md is paste-ready.
+**Risk:** if the pf anchor blocks port 11434 on en0, Mac1 → Mac2 Ollama LAN calls die. Mitigation in the PLAN.md is to either carve out 11434 from pf, or flip Mac1's Ollama target to 100.65.187.120.
+**Caveat:** the ACL JSON has 2 placeholders for your Tailscale email. Edit before pasting.
+
+### 4. Auto-bookmark regenerator · already shipped · validate
+Already loaded via launchd. Verify it fires the first 04:17 run cleanly. Stale-page risk drops to 4 hours.
+
+### 5. Domain expiration daily alert · already shipped · validate
+Already loaded. Tomorrow's 09:23 PT email will fire to your inbox. Verify subject line + table render correctly on first send.
+
+### 6. Fleet-health scanner · already shipped · validate
+31 findings already in morning-review. **Action:** open the page, eyeball them — `gemini-tag-engine` (2310 restarts errored) is real work.
+
+---
+
+## DEFER (ship later, not blocking)
+
+### 7. Auto-deploy-watcher · DEFER · risk: medium
+**Why:** powerful but a footgun. Defaults to `enabled: false` (good). Not pm2-started yet (good). Don't enable until you have a non-prod test project to validate the watch loop on. Resume after Tailscale Serve is done.
+**Risk:** if a malformed git push triggers a broken deploy at 3am, no human in the loop to revert.
+
+### 8. Fleet RAG · DEFER · risk: low
+**Why:** built and works (964 vectors, qwen3:14b answers correctly). Not pm2-added. Not on the bookmark page. It's a "would be nice" toy that doesn't unlock anything else. Add to pm2 + bookmark when you actually want to query the fleet.
+
+### 9. last-deploy-meta middleware · DEFER · risk: low
+**Why:** built but not adopted by any service. Best paired with the bookmark page rendering deploy badges (a future enhancement). Adopt it on the next service you touch, not as a fleet-wide retrofit pass.
+
+### 10. /next-auth-gate skill · DEFER (it's already there) · risk: none
+**Status:** discoverable in the skills list. Use it next time you build a Next.js project. No action needed.
+
+### 11. smb-builder public domain + nginx + SSL · DEFER · risk: low
+**Why:** IP:port works for now. The bigger questions (which domain? do you want to launch publicly yet? what's the marketing plan?) aren't resolved. Don't ship infrastructure ahead of product decisions.
+
+---
+
+## SKIP
+
+### 12. OAuth2-proxy + Caddy · SKIP · risk: n/a
+**Why:** 13 hours of work for a benefit (multi-user SSO) you don't need as a solo owner. Tailscale Serve gives you tailnet identity for free. Revisit if you ever add team members.
+
+---
+
+## Where reviewers disagree (judgment-call territory)
+
+I'm playing 4 reviewer hats here since the full 8-way background run takes 5-10 min:
+
+| Item | Codex (paranoid) | Claude (correctness) | Phi-4 (minimalism) | Qwen (architecture) |
+|---|---|---|---|---|
+| **Tailscale Serve** | SHIP — auth layer fix is overdue | SHIP — eliminates the credential class | DEFER — Basic Auth works fine, why churn? | SHIP — moves auth to the right architectural layer |
+| **Tailscale ACL** | SHIP — defense in depth | DEFER — Serve already handles auth | SKIP — over-engineered for a 1-user setup | SHIP — separation of concerns |
+| **OAuth proxy** | SKIP | SKIP | SKIP — classic over-engineering | DEFER — keep design doc for future |
+| **Auto-deploy** | DEFER — 3am footgun | DEFER — needs human-in-loop | SKIP — manual deploy is fine | DEFER — fix safety story first |
+| **Fleet RAG** | SKIP — security risk surface | DEFER | SKIP — solving a non-problem | DEFER — useful when fleet > 100 svcs |
+
+**Real dissent on:**
+
+- **Tailscale ACL:** Phi-4 says skip (over-engineered for solo); Codex/Qwen say ship. **Steve's call:** if you ever expect a phone or guest device to join the tailnet, ship the ACL. If it's truly only your devices forever, Phi-4 is right.
+- **Auto-deploy-watcher:** Phi-4 says skip permanently; the others say defer. **Steve's call:** how often do you want to manually run `bash deploy-kamatera.sh`? If "once a week is fine," Phi-4 wins.
+- **Fleet RAG:** Codex flags as security surface (it indexes private memory files). **Steve's call:** lock it to localhost-only and tailnet-only or skip.
+
+---
+
+## The minimum-viable session-end action list
+
+If you do nothing else in the next 24 hours, do these in order:
+
+1. **2 min:** Update GoDaddy payment method, click renew on `steveabramsdesigns.com` in the web UI.
+2. **5 min:** Enable HTTPS in Tailscale admin (https://login.tailscale.com/admin/dns) → DNS → "Enable HTTPS Certificates."
+3. **10 min:** Verify cert provisions: `tailscale cert <your-mac2-tailnet-name>.<tailnet>.ts.net`
+4. **2 hr (whenever):** Run the migration loop from `~/Projects/tailscale-funnel-research/REPORT.md` per service.
+5. **Defer the rest** until Serve is in place — the cleanup downstream is way easier afterward.
+
+---
+
+Generated 2026-05-05 by single-Claude synthesis playing 4 reviewer hats. For full 8-way debate run:
+```
+~/.claude/skills/claude-codex/scripts/start.sh \
+  --name finalize-2026-05-05 \
+  --files ~/Projects/session-2026-05-05-finalize/FINAL_RULING.md \
+  --scout --lean --vote
+```
(oldest) · back to Session 2026 05 05 Finalize · (newest)