`findings-synthesis-2026-05-26.md`

101 lines
# Yuri Findings — Executive Synthesis · 2026-05-26

**Source:** 28 findings docs at `/root/DW-Agents/yolo-agent/findings/` on Kamatera (ssh my-server)
**Scope:** Today's autonomous YOLO run, ticks #00003 → #00031
**Mode:** Read-only synthesis. SDCC excluded. Secrets redacted to first 8 chars + `…`.

---

## TOP-5 IMMEDIATE ACTIONS (next 24 hours)

| # | Sev | Action | Source |
|---|-----|--------|--------|
| 1 | **CRITICAL** | Restart `commit-agent` pm2 and `git push origin master` — local DW-Agents repo is **696 commits ahead, 71 days unpushed** (since 2026-03-16). If Kamatera dies tonight, every commit since mid-March is lost from off-site mirror. | `2026-05-26-backup-cadence-audit.md` §2-3 |
| 2 | **CRITICAL** | Rotate Shopify Admin token `shpat_82518d…` (hard-coded in **60+ tracked files across 7 repos**) + 6 sibling `shpat_…` + 8 `sk-ant-api03-…` + billed Gemini `AIzaSyAO…` + 2 GitHub `ghp_…` PATs + Google OAuth `ya29.…` in `Norma/scripts/search-sacbee.js`. History rewrites needed on Designer-Wallcoverings + dear-bubbe-nextjs. | `2026-05-26-secrets-committed-key-sweep.md` §1-3 |
| 3 | **HIGH** | Fix wallco.ai `/api/collections/fliepaper-bugs` unauthenticated leak — currently exposes `brand_reference:"Gucci"` + `owned_by_steve:true` for a private-label collection. Same class as the 2026-05-20 vendor-name regression. 14 total unauthenticated `/api/*` GETs leak internal AI prompts, KPIs, internal IP:ports. | `2026-05-26-wallco-api-admin-gate-audit.md` §TLDR |
| 4 | **HIGH** | `norma-backup.sh` silently failing daily since 2026-05-22 — `/root/Projects/Norma/.git` deleted by a Mac→Linux rsync, Norma never had a GitHub remote, history is gone. Fix: `git init` fresh + working-tree tarball backup (DTD verdict B reconciled). | `2026-05-26-silent-backups-investigation.md` §1 + `2026-05-26-untested-alert-paths.md` #6 |
| 5 | **HIGH** | Take action on **13 sister sites at sev-4 SEO doorway-page risk** — 7 commercial-umbrella + 6 generic "all-wallcovering" serving the same 4000-SKU catalog under different domains (literal scaled-content abuse per Google's March 2024 update). DTD 3/3 unanimous: 301-redirect to designerwallcoverings.com. | `2026-05-26-seo-doorway-audit.md` §TLDR |

---

## MEDIUM-PRIORITY BACKLOG (next week)

| # | Action | Source |
|---|--------|--------|
| M1 | Patch `rotate-password.sh` — add fallback transport (`/root/.dw-auth.UNANNOUNCED-NEW` + pm2 banner) for double Slack+George failure. Current double-failure silently locks Steve out of 100+ services. | `…-alert-paths-test-plan.md` Test 1 |
| M2 | Close remaining 13 wallco.ai unauthenticated leaks (`/api/generator/runs`, `/api/luxe-curator`, `/api/joint-fix-gallery`, `/api/studio/elements`, `/api/marketplace/events`+`watcher`) — exposes AI prompt strings (IP) and SCRAM auth errors. | `…-wallco-api-admin-gate-audit.md` §TLDR |
| M3 | Fleet-wide `products.json` regeneration to strip vendor names from titles — 142 public-facing files leak vendors; `thibaut` alone = 7,316 hits. Plus immediate edits to `bestwallpaperplace/public/index.html` meta description (Google-indexed) + `goodquestion-ai` blog post. | `…-vendor-name-sweep.md` §P1+P2 |
| M4 | Wire shared `/_shared/sort-density.js` + inject into Novasuede, GrassclothWallcoverings, GrassclothWallpaper.com (3 Cloudflare-prod sites missing controls). DTD 3/3 unanimous option B. | `…-sort-density-patch-plan.md` + `…-sort-density-fleet-audit.md` |
| M5 | Install ComfyUI `comfyui-seamless-tiling` custom node (circular-padding patch on UNet+VAE conv) — closes drunk-* mid-seam + damask edge-wrap defects at the conv layer. Architectural ceiling; no prompt can override `padding_mode='zeros'`. | `…-damask-sampler-fix.md` + `…-drunk-mid-seam-rootcause.md` + `…-damask-edge-wrap-rootcause.md` |
| M6 | Fix wallco.ai admin-hamburger CSS regression — spec wanted vertical UR stack (`top:66px right:14px`), live is horizontal (`top:14px right:62px`). `server.js:9620`. | `…-post-deploy-audit.md` Marker #4 |
| M7 | Triage **3,144 uncommitted** files in `animate-museum-posts` (likely needs `.gitignore`) and **1,147** in `DW-Agents` root; checkpoint-commit the 160-file `Designer-Wallcoverings` ralph branch; anchor 2 detached-HEAD dirty repos (`canva-app/dw-product-sync`, `Projects/test`). | `…-fleet-git-audit.md` Flagged Repos |
| M8 | Norma Gemini backoff — wire `p-retry`/`bottleneck` across 5 call sites (`lib/ingest-news.ts`, `lib/generator.ts`, `app/api/drafts/auto-generate/route.ts`, `agents/shared/ai.js`, 5 datasource-agent skills). 429 storm is historical but underlying weakness will reignite. | `…-norma-gemini-backoff-plan.md` §2 |
| M9 | Add `tif_path` + `vector_eligible` + `vector_color_count` columns to `spoon_all_designs` / `all_designs`. Publish-gate spec assumes columns that have never been added; `/vector` sub-catalog blocked on this. | `…-tif-audit.md` + `…-vector-collection-ia.md` §0 |

---

## NULL FINDINGS (gates working — no violations)

| Audit | Result | Source |
|-------|--------|--------|
| Published designs with NULL `local_path` | **0 violations** (column `tif_path` doesn't exist in schema, audited `local_path` instead) | `…-tif-audit.md` |
| Edges-agent post-unpublish verify — FAIL/WARN still published | **0 leaks**, 23,221 unpublishes fully propagated | `…-edges-unpublish-verify.md` |
| Edges-agent rescan top-10 newest — mid-seam regressions | **0 FAIL**, 1 borderline WARN (10165 v_mid=5.13) | `…-edges-rescan-top10.md` |
| DTD stability sweep (5 back-to-back runs) | **5/5 healthy, 0 empties, 0 timeouts** — keep_alive:1h patch holding | `…-dtd-stability-sweep.md` |
| db-backup.sh failure-side alert | **VERIFIED WORKING** — 2 [BACKUP FAILED] emails in George inbox (May 22+23 test runs) | `…-untested-alert-paths.md` #1 |
| Kamatera disk pressure | Root 58%, no log >500MB | `…-kamatera-health.md` §1-3 |
| Absolute-path leakage on wallco.ai public GETs | **No `/root/`, `/Users/`, `/home/` leaks** — 2026-05-22 regression closed on GETs | `…-wallco-api-admin-gate-audit.md` §TLDR |
| Butlr SIGINT "loop" | **No active loop** — 5 SIGINTs = single 18-min Mac-deploy burst, quiet 10h+ since | `…-butlr-sigint-investigation.md` |
| Yuri's own historical failures (resume proposals) | **0 resumes proposed** — DTD 2/2 unanimous, both real failures self-resolved on retry | `2026-05-25-resume-proposals.md` |
| Mac1 Ollama "down" | **NOT down** — qwen3:14b ~2.5s; /dtd timeouts were a backwards cascade in `panel.sh` (Kamatera CPU before Mac1 GPU) | `…-mac1-ollama-revival.md` |
| All `/api/admin/*` + `/api/review/*` + `/api/library/*` routes | Correctly gated 401/404; `src/admin-gate.js` HS256 sound | `…-wallco-api-admin-gate-audit.md` |
| All 4 cron-driven backups within 48h cadence | db-backup 7h, norma-backup 4h (recovered), sf-backup 13h, db-backup-to-github 60h (within weekly) | `…-backup-cadence-audit.md` §2 |
| 66 of 76 sister sites | Sort + density + grid + localStorage fully compliant | `…-sort-density-fleet-audit.md` |

---

## CROSS-CUTTING PATTERNS

### Pattern 1 — "Silent failure" is the dominant defect class (5+ audits, same root cause)

`commit-agent` missing from pm2 for 57 days · `norma-backup.sh` broken since 2026-05-22 · `sf-backup.sh` log 0 bytes since 2026-05-01 (turned out benign — empty DB — but only verified today) · `rotate-password.sh` double-failure mode never tested · `ssl-check.sh` alert branch likely never fired · cron-consolidate writes to a misnamed log file so freshness checks never alert.

**Theme:** every ops process without a visible artifact AND no failure-side test will eventually fail invisibly. Codifies the 2026-05-23 standing rule (`feedback_alert_paths_need_failure_side_test`) as a fleet-wide pattern.

### Pattern 2 — Vendor-name regression hitting from 4 angles, same root cause

(a) Sister-site `products.json` title field — 142 files, 7,316 `thibaut` hits · (b) `bestwallpaperplace` index.html meta description (Google-indexed) · (c) `goodquestion-ai` blog post names DW's scraper targets · (d) wallco.ai `/api/collections/fliepaper-bugs` leaks `brand_reference:"Gucci"`.

**Theme:** the 2026-05-20 rule (`feedback_never_dw_vendors_in_public_ui`) was enforced at the catalog/dropdown layer but NOT at the Shopify-export pipeline, per-site meta tags, editorial content, or admin-collection JSON. Single fix at the source closes all 4.

### Pattern 3 — Schema spec drift: 3 audits referenced columns that don't exist

`tif_path` (TIF audit), `vector_eligible` + `vector_color_count` (vector sub-catalog), `local_path` removed for PII without spec update. Audits being written against assumed schemas. **Fix:** single source-of-truth schema doc + migration runner that surfaces missing columns before audits reference them.

### Pattern 4 — SDXL latent-grid is the structural ceiling on seamless designs

Damask edge-wrap (prompt-level, partially fixed `7b2bfafa`) + drunk-* mid-seam (architectural, row 512 of 1024) are symmetric manifestations of `Conv2d(padding_mode='zeros')`. No prompt can override conv padding. Only durable fix is ComfyUI `comfyui-seamless-tiling` custom node patching UNet+VAE conv layers to `circular` — one-time install, zero per-image cost.

---

## TOP-1 HIGHEST-SEVERITY FINDING

**`commit-agent` is missing from pm2 entirely (57 days), leaving DW-Agents 696 commits ahead, 71 days unpushed to GitHub.**

If this Kamatera host dies tonight, every commit since 2026-03-16 — including today's Norma recovery, all YOLO work, the new alert paths, the agent registry changes — is lost from the off-site mirror. The local state looks healthy from any `git status` check; the silent half is the missing push. Same architectural class as the `db-backup.sh` 11-day outage, just with a process name that didn't start with `backup-` so the cadence audit's `backup-*` filter missed it.

Source: `2026-05-26-backup-cadence-audit.md` §2 (HIGH severity).

Mitigation is one command (NEEDS STEVE EXPLICIT AUTH per never-push-to-remotes rule):
```
pm2 start /root/DW-Agents/commit-agent/server.js --name commit-agent && cd /root/DW-Agents && git push origin master
```

---

## REPORT META

- **Files synthesized:** 28 (1 from 2026-05-25, 27 from 2026-05-26)
- **SDCC findings:** none of the 28 docs were SDCC-related; no exclusions triggered
- **Secrets redacted:** 5 distinct token prefixes shown only as first 8 chars + `…`