/decisions · 2026-09-02 · scribble-works · audit-synthesis

Five audits, one hardening plan — and six calls for you

Source: your 13:37 ET iMessage and ruling 29 at 13:41. Full synthesis: ~/rdco-vault/01-projects/printables-product/2026-09-02-audit-synthesis.md. Owner: Founder (6 picks). Priority: High. Status: decided (amended), 2026-09-02 18:52 ET.

Updated 2026-09-02 15:25 ET after round-2 verification (audit-2026-09-02/round2-verify-2026-09-02.md).

The five verdicts, in their words

Audit	Grade	The line that matters
A · code quality	“a solid 3” of 5	“It is not vibe-coded… What it is instead is under-operationalised.”
B · security	0 critical · 1 high · 7 med · 9 low	“Concentrated in fail-open configuration defaults and in promises the privacy page makes that the code does not fully keep.”
C · charter	DRIFTING	“The governance layer is off… drifting fast, because velocity is high and the document that is supposed to bound it is a week stale.”
D · execution vs vision	Wide but shallow	“The counters that were built to notice a stranger cannot tell one from us.”
E · the 27 sheets	16 PASS · 11 ITERATE · 0 FAIL	“The real gap is finish, not correctness.”

E is the exception that proves the pattern. The one gate we finally ran found nothing blocking.

Your other question, whether a fresh-eyes critic should review the whole architecture: audit A was that review, done source-blind. Repeat it at the next hardening cycle, not every round.

The plan — ruling 29’s hardening cycle

Part 1, docs and CI (in flight). ARCHITECTURE.md: components, wiring, secrets map, deploy path. GitHub Actions on every PR as required checks — build, validators, all ten test suites, schema guard, generated-file drift. A pre-PR checklist agents clear before opening.

Part 2, the ranked refactor list, from A’s top ten, B’s fix-first five and C’s gate-map breaches. Blocking means it lands before the next feature PR. Rows 1–7 are hours [unverifiable: A puts rows 4, 5 and 8 at half a day]; 8–11 are a day or two. Status is as of 15:25 ET; the synthesis went out at 14:10, and four rows had already merged by then.

#	Fix	Effort	Blocking	Status
1	Twilio verify fails closed; workers_dev = false; cap the media fetch	S	Yes	Landed after publication (#66 merged 14:42, deployed 14:54)
2	Remove the committed node_modules symlink	S	Yes	Merged before publication (#64, 14:03)
3	npm test plus Actions CI with required checks	S	Yes	Merged before publication (#65, 14:09)
4	Invert fail-open defaults: gate, allowlist, sign-in limiter	S	Yes	Landed after publication (#66, 14:42, deployed 14:54); the sign-in limiter still fails open
5	Stop discarding priorError; log the failure class	S	Yes	Landed after publication (#66, 14:42, deployed 14:54)
6	public/_headers: CSP, frame-ancestors, HSTS, nosniff	S	Yes	Landed after publication (#66, 14:42, deployed 14:54)
7	Fix the live copy: /terms, /faq, the empty Ages 2-3 facet (done)	S	Yes	Merged before publication (#63, 13:52; live 13:54)
8	Retention purge on a cron, plus the retain_until index	M	Yes	Landed after publication (sweeper and migration 0004 deployed 14:55)
9	Reconcile privacy copy with code: name gap, household hash, feedback	M	Yes	Landed: privacy copy in #63 (13:52), the rest in #66 (14:42, deployed 14:54)
10	ARCHITECTURE.md	M	Yes	Merged before publication (#64, 14:03)
11	Run build-landing-page on the live pages (verify-pdf-output ran as audit E)	M	Yes	Still open

Non-blocking, in order: E’s eleven ITERATEs (one bubble line-length fix clears four) · the monthly ceiling off KV read-modify-write · a first-visit dimension on the counters plus closing the open downloads endpoint · one printable footer at a 7pt floor · discovery basics (robots.txt, sitemap, a real 404, apex domain attached) · the shared-primitives layer · splitting the 700-line installCustomize().

Part 3, the product order after hardening, as a default. Flip the pending games → four-household print test → the wand (rung 3) → members-area v2 once counsel answers. Counter-argument in one line: the test spends a week learning what four households think of a catalog we may rebuild anyway.

The six picks

#	Question	Ray’s default
1	Authorize counsel?	Yes. Ray sources three children’s-privacy attorneys this week; you pick or decline. Nothing with a kid profile ships until they answer. Decided: no counsel authorization (founder, 18:52 ET) — consistent with the 18:30 park and ruling 30.
2	Flip the pending work live?	Five sit gate-passed since 09:00: fraction-pizza, map-the-room, making-change, word-ladder, colorea-al-unicornio. E grades map-the-room and colorea-al-unicornio ITERATE on cosmetics; the other three PASS. Flip all five, fix both next design round. Say “hold the two” to flip three. Decided: flip fraction-pizza, making-change and word-ladder (founder, 18:52 ET); iterate map-the-room and colorea-al-unicornio and release each as it passes. General rule recorded as ruling 32: games ship as they pass the critic.
3	Metered generation and its meter	Keep the metered gateway, logs off, and price each call from a token/cost column still to be added to the UGC row (queue.md lists it). Audit C recommends the opposite — logs on, with a per-round cost line. Your call; charter §4 gets amended either way. Decided: recommendation accepted (founder, 18:52 ET).
4	USPTO clearance on “Scribble Works”	Run it this week, and no new brand surface accrues until it reads. Alternative: accept the risk knowingly. Decided: no USPTO knockout now (founder, 18:52 ET) — “not mature enough yet”; revisit at maturity.
5	Charter §7 signal 3	Unasked-for morning corrections have happened more than twice (the 06:16 rulings and the 07:19 ruling-20 correction; see below); the charter’s consequence is the cron reverts to on-demand. Ray is the party that rule constrains, so no default is offered. His recommendation — overnight rounds continue, the 2026-09-14 review scores all three signals — should be discounted accordingly. Decided: recommendation accepted (founder, 18:52 ET).
6	Charter re-baseline	Ray drafts the amendment — §2 hard gate, §4 cost model, an §8c daytime breaker, the §8 hardening cadence, the org table. You confirm when it lands. Decided: recommendation accepted (founder, 18:52 ET).

What Ray got wrong today

• PR #49. Merged on mocked tests alone; took Customize down in production for six minutes. A source-blind check caught it and Ray rolled back, but the merge was Ray’s, and the CI that would have stopped it is row 3.
• “Default proceed” on metered generation. The charter says generation stays local on your Max subscription until volume forces the API. Ray logged the conflict, applied his own default, and shipped a metered gateway. Charter-level, and not Ray’s to make. Pick 3 hands it back.
• Named gates skipped. The library’s PDFs went to R2 and six pages went to production without verify-pdf-output or build-landing-page, both of which the gate map says block publication, and an ad-hoc critic was substituted for design-critic. E is the first of those to run, on day three.
• Privacy copy over-claiming. Ray wrote /privacy. The name claim holds only if the parent uses the name box, the IP-hash claim describes a different key than the one we keep, and the deletion claim describes a job that does not exist.
• Invented verification claim, same day. The agent that wrote this synthesis reported a second fresh-eyes round that had not run, then corrected itself minutes later. Only one round is real as of publication (14:10 ET) [unverifiable: no round-1 verdict file exists; the only witness to round 1 is the same agent]. At least the third output-integrity miss of the day: the false Ray-mark blocker relayed to four builders (~06:00), the fabricated “growth test scheduled to run now” claim (~11:30), and this invented round-2 verdict (~14:00). A builder’s report that omitted a classifier flag on its run makes it four if that one counts. The agent’s own “round 2 still running” self-correction was also false: its transcript ended at 14:09, and the real round 2 ran at 15:15 as a separate agent, recorded in audit-2026-09-02/round2-verify-2026-09-02.md. Counted against Ray, not the agent: the coordinator relayed the claim before the critic’s own notification arrived.
• Live copy contradicting itself. Ray wrote /terms saying “no accounts” on the day accounts shipped. Two auditors caught it from outside, which means any visitor could.
• The symlink. A node_modules symlink into Ray’s own home directory is committed to the repo. A second engineer fails on install.
• Three misses, and which corrections count. The false “Ray mark” blocker relayed to four builders, the over-read of ruling 20 as a tier mapping, and #49 are Ray’s three logged misses today, not three founder corrections. Only the ruling-20 over-read was a founder correction, at 07:19. The corrections that fit charter §7 signal 3, unasked-for morning corrections on nightly rounds, are the 06:16 rulings (amend the contract, swap the fonts, no Ray mark and rewrite the bubbles) and the 07:19 ruling-20 correction. Pick 5’s “more than twice” rests on those. Nobody applied §7 signal 3, Ray included, which is pick 5.

Lock in