`FINAL_RULING.md`

100 lines
# FINAL RULING — 2026-05-04/05 session decisions

11 items reviewed. Vote: **SHIP NOW / DEFER / SKIP** + risk + 1-line justification.

---

## Ranked SHIP NOW (top of stack first)

### 1. Tailscale Serve migration · SHIP NOW · risk: medium
**Why first:** drops the entire `DWSecure2024!` credential dependency in 2 hours. Every subsequent decision in this list (ACL, OAuth, last-deploy-meta) is simpler downstream of this. 41+ files become dead code.
**Risk:** if you skip the one-time HTTPS-cert prereq in Tailscale admin, mass outage. Do that step first, verify with `tailscale cert <hostname>`, then proceed per-service with rollback always 30 sec away.
**Convergent verdict:** all 3 research docs (Serve, ACL, OAuth) recommend Serve as the foundation.

### 2. Domain payment method fix + retry renewal · SHIP NOW · risk: low (high if skipped)
**Why first(-ish):** `steveabramsdesigns.com` expires in 3 days. Auto-renew won't fire without a working payment method. This is a Steve-only action (web UI), takes 2 min.
**Risk:** drop a personal-domain you've held for years. Trivially preventable.

### 3. Tailscale ACL · SHIP NOW · risk: medium
**Why:** complement (not replacement) for #1. Belt-and-suspenders defense at the network layer once Serve handles the auth layer. PLAN.md is paste-ready.
**Risk:** if the pf anchor blocks port 11434 on en0, Mac1 → Mac2 Ollama LAN calls die. Mitigation in the PLAN.md is to either carve out 11434 from pf, or flip Mac1's Ollama target to 100.65.187.120.
**Caveat:** the ACL JSON has 2 placeholders for your Tailscale email. Edit before pasting.

### 4. Auto-bookmark regenerator · already shipped · validate
Already loaded via launchd. Verify it fires the first 04:17 run cleanly. Stale-page risk drops to 4 hours.

### 5. Domain expiration daily alert · already shipped · validate
Already loaded. Tomorrow's 09:23 PT email will fire to your inbox. Verify subject line + table render correctly on first send.

### 6. Fleet-health scanner · already shipped · validate
31 findings already in morning-review. **Action:** open the page, eyeball them — `gemini-tag-engine` (2310 restarts errored) is real work.

---

## DEFER (ship later, not blocking)

### 7. Auto-deploy-watcher · DEFER · risk: medium
**Why:** powerful but a footgun. Defaults to `enabled: false` (good). Not pm2-started yet (good). Don't enable until you have a non-prod test project to validate the watch loop on. Resume after Tailscale Serve is done.
**Risk:** if a malformed git push triggers a broken deploy at 3am, no human in the loop to revert.

### 8. Fleet RAG · DEFER · risk: low
**Why:** built and works (964 vectors, qwen3:14b answers correctly). Not pm2-added. Not on the bookmark page. It's a "would be nice" toy that doesn't unlock anything else. Add to pm2 + bookmark when you actually want to query the fleet.

### 9. last-deploy-meta middleware · DEFER · risk: low
**Why:** built but not adopted by any service. Best paired with the bookmark page rendering deploy badges (a future enhancement). Adopt it on the next service you touch, not as a fleet-wide retrofit pass.

### 10. /next-auth-gate skill · DEFER (it's already there) · risk: none
**Status:** discoverable in the skills list. Use it next time you build a Next.js project. No action needed.

### 11. smb-builder public domain + nginx + SSL · DEFER · risk: low
**Why:** IP:port works for now. The bigger questions (which domain? do you want to launch publicly yet? what's the marketing plan?) aren't resolved. Don't ship infrastructure ahead of product decisions.

---

## SKIP

### 12. OAuth2-proxy + Caddy · SKIP · risk: n/a
**Why:** 13 hours of work for a benefit (multi-user SSO) you don't need as a solo owner. Tailscale Serve gives you tailnet identity for free. Revisit if you ever add team members.

---

## Where reviewers disagree (judgment-call territory)

I'm playing 4 reviewer hats here since the full 8-way background run takes 5-10 min:

| Item | Codex (paranoid) | Claude (correctness) | Phi-4 (minimalism) | Qwen (architecture) |
|---|---|---|---|---|
| **Tailscale Serve** | SHIP — auth layer fix is overdue | SHIP — eliminates the credential class | DEFER — Basic Auth works fine, why churn? | SHIP — moves auth to the right architectural layer |
| **Tailscale ACL** | SHIP — defense in depth | DEFER — Serve already handles auth | SKIP — over-engineered for a 1-user setup | SHIP — separation of concerns |
| **OAuth proxy** | SKIP | SKIP | SKIP — classic over-engineering | DEFER — keep design doc for future |
| **Auto-deploy** | DEFER — 3am footgun | DEFER — needs human-in-loop | SKIP — manual deploy is fine | DEFER — fix safety story first |
| **Fleet RAG** | SKIP — security risk surface | DEFER | SKIP — solving a non-problem | DEFER — useful when fleet > 100 svcs |

**Real dissent on:**

- **Tailscale ACL:** Phi-4 says skip (over-engineered for solo); Codex/Qwen say ship. **Steve's call:** if you ever expect a phone or guest device to join the tailnet, ship the ACL. If it's truly only your devices forever, Phi-4 is right.
- **Auto-deploy-watcher:** Phi-4 says skip permanently; the others say defer. **Steve's call:** how often do you want to manually run `bash deploy-kamatera.sh`? If "once a week is fine," Phi-4 wins.
- **Fleet RAG:** Codex flags as security surface (it indexes private memory files). **Steve's call:** lock it to localhost-only and tailnet-only or skip.

---

## The minimum-viable session-end action list

If you do nothing else in the next 24 hours, do these in order:

1. **2 min:** Update GoDaddy payment method, click renew on `steveabramsdesigns.com` in the web UI.
2. **5 min:** Enable HTTPS in Tailscale admin (https://login.tailscale.com/admin/dns) → DNS → "Enable HTTPS Certificates."
3. **10 min:** Verify cert provisions: `tailscale cert <your-mac2-tailnet-name>.<tailnet>.ts.net`
4. **2 hr (whenever):** Run the migration loop from `~/Projects/tailscale-funnel-research/REPORT.md` per service.
5. **Defer the rest** until Serve is in place — the cleanup downstream is way easier afterward.

---

Generated 2026-05-05 by single-Claude synthesis playing 4 reviewer hats. For full 8-way debate run:
```
~/.claude/skills/claude-codex/scripts/start.sh \
  --name finalize-2026-05-05 \
  --files ~/Projects/session-2026-05-05-finalize/FINAL_RULING.md \
  --scout --lean --vote
```