READ-ONLY designs.json integrity audit 2026-06-01: clean (no local_path leak, 0 dup ids, 0 mural-kind violations, published count sane)

ba89b1ef1cf148cc97062a30926abb2242718c66 · 2026-05-31 21:28:55 -0700 · Steve
Files touched

A output/designs-json-integrity-2026-06-01.md
Diff

commit ba89b1ef1cf148cc97062a30926abb2242718c66
Author: Steve <steve@designerwallcoverings.com>
Date:   Sun May 31 21:28:55 2026 -0700

    READ-ONLY designs.json integrity audit 2026-06-01: clean (no local_path leak, 0 dup ids, 0 mural-kind violations, published count sane)
---
 output/designs-json-integrity-2026-06-01.md | 103 ++++++++++++++++++++++++++++
 1 file changed, 103 insertions(+)

diff --git a/output/designs-json-integrity-2026-06-01.md b/output/designs-json-integrity-2026-06-01.md
new file mode 100644
index 0000000..7976795
--- /dev/null
+++ b/output/designs-json-integrity-2026-06-01.md
@@ -0,0 +1,103 @@
+# wallco.ai `designs.json` integrity audit — 2026-06-01
+
+**Scope:** READ-ONLY integrity check of the live prod catalog snapshot.
+**Target file:** `root@45.61.58.125:/root/public-projects/wallco-ai/data/designs.json`
+**File state:** `25,695,554 bytes`, owner `501:staff` (Mac2-built artifact), mtime `Jun 1 04:19` (fresh deploy).
+**Authoritative DB cross-checked:** Mac2 `dw_unified.all_designs` (table underlying the `spoon_all_designs` view).
+
+**Verdict: ✅ CLEAN on all three required checks. No misclassifications, no path leaks, no duplicate ids. No fixes applied (READ-ONLY by mandate; none were warranted anyway).**
+
+---
+
+## 1. `local_path` / `/Users/` path-leak check — ✅ PASS
+
+| Check | Result |
+|---|---|
+| Records carrying a `local_path` key | **0** of 35,071 |
+| `local_path` in the distinct-keys union | **absent** |
+| Raw `grep -c "/Users/"` across whole file | **0 matches** |
+
+The public `/api/designs` endpoint cannot leak `/Users/stevestudio2/…` paths from this snapshot. The `localPathForDesign()` basename-only convention (commit `6dbeb3b`) is holding — the snapshot exposes only `filename` + `image_url`, never an absolute local path.
+
+**Distinct keys present (clean set):**
+`category, created_at, dominant_hex, filename, generator, handle, id, image_url, is_published, kind, motifs, room_mockups, saturation, seed, tags, title, unpublish_reason, user_color_good, user_removed, user_scale_good, user_stars, user_style_good`
+
+## 2. Duplicate `id` check — ✅ PASS
+
+| Check | Result |
+|---|---|
+| Total records | 35,071 |
+| Distinct ids appearing >1× | **0** |
+
+Every record has a unique `id`.
+
+## 3. Mural-kind misclassification check — ✅ PASS (zero violations)
+
+Per `lib/mural-categories.js`, rows in `monterey-mural`, `cactus-pine-scenic`, `cactus-11ft-mural`, `cactus-accent-mural`, `tree-mural`, `mural-scenic` must be `kind='mural_panel'` (or `'mural'` for `cactus-11ft-mural`) — **never** a tile kind (`seamless_tile` / `tile` / `repeat_tile`).
+
+**Mural-category rows present in snapshot, by category → kind:**
+
+| category | kind | count |
+|---|---|---|
+| `monterey-mural` | `mural_panel` | 857 |
+| `cactus-pine-scenic` | `mural_panel` | 73 |
+| `cactus-11ft-mural` | `mural` | 87 |
+| `cactus-11ft-mural` | `mural_panel` | 1 |
+| `tree-mural` | `mural_panel` | 42 |
+
+- **Tile-kind rows in any mural category: 0** (no `seamless_tile`/`tile`/`repeat_tile`).
+- Cross-checked the authoritative Mac2 DB directly — **also 0** mural-category rows with a tile kind there. The 2026-05-27 fix (12 rows) is holding.
+- `cactus-accent-mural` and `mural-scenic` have **0 rows** in this snapshot (categories defined in the guard but not yet populated — not an error).
+
+**Informational only (not a violation):** the 1 `cactus-11ft-mural` row with `kind='mural_panel'` instead of the category's historical `'mural'`. `lib/mural-categories.js` explicitly accepts BOTH `mural` and `mural_panel` for all mural categories — the guard only refuses tile kinds. PDP/listing renderers handle both. No action needed.
+
+**Global kind distribution:** `seamless_tile` 33,330 · `mural_panel` 1,649 · `mural` 92. (676 `mural_panel` + 5 `mural` rows live in non-mural categories — allowed; the rule is one-directional: mural categories must not be tile, not that mural kinds can't appear elsewhere.)
+
+## 4. Published count sanity vs DB — ✅ SANE
+
+| Source | Total rows | `is_published=true` |
+|---|---|---|
+| prod `designs.json` snapshot | 35,071 | **5,590** |
+| Mac2 `all_designs` (authoritative) | 44,803 | **~5,673–5,687*** |
+
+\* Live DB drifts a few rows between queries (concurrent generation/auto-commit agent active).
+
+**Total delta (44,803 → 35,071, −9,732):** expected. The snapshot omits rows the rebuild filters out (no valid image, hard-removed state, etc.). Not all DB rows are snapshot rows.
+
+**Published delta (~5,673 DB → 5,590 JSON, ≈ −83 to −97, ~1.7%):** sane. The snapshot drops a small number of published-in-DB rows during rebuild (quality/image-presence filtering) plus live drift. Within normal tolerance.
+
+**Snapshot `is_published` × `user_removed` crosstab:**
+
+| is_published | user_removed | count |
+|---|---|---|
+| false | false | 7,567 |
+| false | true | 21,914 |
+| true | false | **3,903** |
+| true | true | **1,687** |
+
+### Observation — published+removed rows in the snapshot are CARRIED but correctly SUPPRESSED at boot (not a leak)
+
+1,687 snapshot rows are `is_published=true` AND `user_removed=true`. This is **not** a customer-visibility problem:
+
+- `server.js:364 loadDesigns()` filters at boot: `const beforeGate = raw.filter(d => !d.user_removed && d.is_published !== false);` then applies `passesAestheticGate`. So `user_removed` rows are dropped from the in-memory `DESIGNS` index regardless of their `is_published` flag.
+- The snapshot intentionally carries full row state (the `user_removed` flag travels with the row); the **server** is the visibility gate, not the raw snapshot.
+- Effective customer-visible published floor = 3,903 (published & not-removed) minus aesthetic-gate drops (memory: ~28% historically filtered).
+- **0** published rows are missing both `image_url` and `filename` (no broken cards).
+
+This matches the authoritative DB (1,743 published-and-removed there) within live drift — the snapshot faithfully mirrors DB state.
+
+---
+
+## Summary table
+
+| # | Check | Result |
+|---|---|---|
+| 1 | No `local_path` / `/Users/` leak | ✅ PASS (0/0/0) |
+| 2 | No duplicate ids | ✅ PASS (0) |
+| 3 | Mural categories never `seamless_tile` | ✅ PASS (0 violations; DB cross-check also 0) |
+| 4 | Published count sane vs DB | ✅ SANE (5,590 vs ~5,673; ~1.7% gap explained) |
+
+**Misclassifications found: 0. Path leaks found: 0. Duplicate ids: 0.**
+Nothing to fix. The 2026-05-27 mural-kind fix and the `local_path` basename convention are both holding in the live snapshot. No `/dtd` convened — every check resolved cleanly with no decision fork (and the mandate is READ-ONLY).
+
+*Generated 2026-06-01 (autonomous YOLO read-only audit).*
← 5024636 generator: read-only /api/generator/cooldowns — surfaces whi · back to Wallco Ai · overnight cohort audit loop — 17 cohorts, 98 unpub, $0.24, D b1e98d1 →