Live-Site Sweep · acquisto.biz · Lanes A + B

Gold sweep — findings & recommendations

A read-only spider across the live navigation, database, 100 crons, the ticket board, page governance, and anon security. UPDATE 7/4 ~12:34 am CT: all six items approved by Shattique and EXECUTED — green checks below carry the outcome; details in 04-SESSION-LOG-2026-07-03pm.md.

96/96
Nav links resolve
100
Crons · all active
477
Board items open
3
Tables leak to anon

Findings — approve the fix

Internal canon & ticket board are world-readableP1 · security

The anon key ships in every page's JS (by design — it's meant to be public). But pure_memory, pure_board, and prompt_queue carry public SELECT policies, so anyone with that key can read our entire second-brain — I pulled live_backend (project ref, your email, architecture notes) and open ticket bodies in seconds from outside.

Recommended fix (nuanced — chat depends on board reads): keep the anon board read but route it through a SECURITY DEFINER RPC that returns only safe columns (no internal notes); revoke public SELECT on pure_memory + prompt_queue entirely (service-role only). No page breaks — the chat board display already calls an RPC. This is a Lane-B/Shattique change; I've scoped the exact policy diff.

DONE 12:07 am — 4 policies dropped (memory select + board read/insert/update), verified locked from outside; RPCs/chat unaffected; recreate SQL at pure_memory.security.rls_lockdown_reversal. prompt_queue deferred (lane wire) under the leak-guard tripwire. Canon written.

A cron has failed 72× in 3 daysP2 · reliability

pure-release-settle errors every run: column "version" does not exist inserting into pure_release_retro. So release retros aren't being logged, and the failure log is noisy — which hides real failures.

Fix: one-line column correction in the cron's SQL (the column exists but is mis-referenced). Lane-B/Code owns this cron; I'll file it with the exact statement.
DONE 12:12 am — fixed directly (column corrected in the cron SQL, jobid 60); clean run verified; failure streak ended. Code notified via board note.

29 live pages have broken internal linksP2 · quality

The pages_linkcheck cron runs daily and flags them, but nothing acts on the result. 29 live pages (plus 39 parked, which don't matter) have link_health ≠ ok — dead hrefs users can hit.

Fix: a daily digest that lists only live link failures with their owner hat, into the Poppy brief + a board ticket — turning a silent scan into an action list. (New cron below.)
DONE 12:18 am — built (mcp_linkcheck_digest(), cron jobid 106, daily 6:30am CT, deduped LC-* ticket). Finding corrected: the 29 were never-scanned (null), not failed — zero confirmed broken links today; the digest now catches real ones.

Board lane vocabulary is inconsistentP2 · ops

477 open items across mixed lane labels — A, B, lane-b, Code, ? — and 100 items sit in review with no lane at all. The easiesthardest startup ranking can't sort what it can't classify.

Fix: normalize lane values (lane-bB, backfill ? from assignee) once, then a daily board-triage cron that flags stale/no-lane/no-effort items into the brief.
DONE 12:24 am — 149 rows normalized/backfilled, each with undo.prev_lane; board-triage cron live (jobid 107); first ticket BT-19F2D963105 (96 no-lane · 147 no-effort) filed to Mike.

New daily crons — approve to build

Standing automation, off-hours CT-gated

  • nav-orphan-sweep (daily) — tonight's manual sweep, automated: live pages in pure_pages not in pure_nav_modules auto-nominate into a review queue. Extends boneyard_orphan_scan.
  • rls-leak-guard (daily) — assert the anon role can read only the allowlisted tables; alert the moment a new public policy appears. Turns tonight's finding into a permanent tripwire.
  • live-linkcheck-digest (daily) — live-only broken-link action list Poppy brief + ticket.
  • board-triage (daily) — lane/effort normalization + stale-item digest.
DONE 12:30 am — all four daily crons live (jobids 106–109). First runs found real gold: rls-leak-guard 180 public policies / 96 tables (RG-19F2D9EF8B9, P1, lane Shattique — incl. anon-writable insurance/tax/property-history) · nav-orphan-sweep 261 live pages not in navigation (NO-19F2D9FB323, lane Mike — the real SO-1 number).

Commit to memory & canon — approve

Durable rules from tonight

  • security.rls_exposure — anon gets definer-RPC reads only; never raw SELECT on pure_memory / pure_board / prompt_queue. (CLAUDE.md canon.)
  • routine.orphan_sweep — the two-way navpagesshell sweep as a standing routine (both directions: dead links AND unlinked pages AND separate shells).
  • already added the management-API SQL write path + schema truths (nav row-per-page, no kids column, boneyard category enum).
DONE 12:33 am — security.rls_exposure + routine.orphan_sweep stored in pure_memory and written into CLAUDE.md standing instructions.

Banked — healthy, no action

Zero dead nav links across all 96 routes · strictness ratchet backlog = 0 (governance current) · audit_log is hash-chained · 100 crons all active incl. boneyard orphan-scan, pages register/linkcheck/ratchet, design-system autobuild · Text + Email consoles live and shell-mounted · PurePipeline registered in pure_components.

Read-only sweep · nothing executed · prepared by Lane A for Mike's approval · 7/3/26 late