--- name: robco-audit-program description: "CLOSED origin program (the 2026-06-26 audit-first plan and everything sequenced after it). Kept for the owner decisions, rejections, and incident lessons it produced — the build log has been stripped." metadata: node_type: memory type: project originSessionId: 0b7c5f41-bb34-4ab4-93be-fdb363f5eb40 --- On 2026-06-26 the owner requested a comprehensive audit-first program: five Opus audits (UX/features, data/weapon-DB, architecture/AI/scalability, performance, security/infra) feeding a master plan, sequenced foundational-first, gated on owner sign-off. That program — and the phases sequenced after it (security, gate/CI hardening, accounts/cloud, runtime hardening, scalability, content) — is **CLOSED**. See [[robco-uos-project]]. *This file previously carried a phase-by-phase build log: versions, cache revs, test/suite counts, commit hashes, "live now" claims, console TODOs, and a next-queue. All of it was derivable and most had gone stale; stripped 2026-07-20. For what shipped see `CHANGELOG.md` + git log; for the queue see `QUEUE.md`; for protocols see `CLAUDE.md` + `rules/`; for architecture see `library/CODE_MAP.md`; for the version see `APP_VERSION` in source.* ## Owner decisions and standing instructions - **Accounts (the shape the owner asked for):** existing LOCAL saves must be addable/migratable to an account — signing in must never cost the player their current saves. The account holds BOTH cloud saves AND the Gemini key. Add an in-app link to the Gemini API-key page so users can copy-paste their own key. - **HARD REQUIREMENT — surface every required Firebase-console change to the owner BEFORE that code goes live.** Reason: two console moments (publishing security rules, flipping App Check to enforce) lock users out if mistimed. - **TRUE passkeys / Face ID — CANCELLED (2026-06-27).** Firebase Auth has no native passkey support; real WebAuthn needs the paid Blaze plan. The owner **will not pay for Blaze**: *"Do NOT bring it up again / do not remind."* Google Sign-In is the permanent biometric path (device biometrics unlock the Google credential, free). - **Auth design reasoning:** anonymous-on-boot → Google *link*. NOT email-link — enumeration protection breaks anon→email linking by default. - **The kill switch must be AUTOMATIC** (owner: he shouldn't have to tell me when to use it). Two halves: the client self-disables a failing feature with a graceful fallback, AND the dev process proactively flips the remote flag the moment a post-deploy regression is detected, without waiting for the owner. Prefer a flag flip over a git revert. - **Cache-bump policy — owner chose CONDITIONAL over unconditional:** bump only when a served/precached file is staged, so doc/config/test-only commits don't churn the cache. - **Holotapes and Notes trackers — DROPPED by the owner (2026-06-28):** too many, low value, *"most players won't read them."* Do NOT re-add. - **Crafting must be REAL canonical Fallout crafting** (ammo handloading, repair kits, healing/food) — the owner confirmed he wants it once he understood that's what it meant, not a token feature. - **The owner's crafting/cloud reasoning was CORRECT and is the general rule:** a feature that only mutates already-synced state needs no cloud change of its own; only a NEW state field forces a serialize/migrate change. - **UI consistency must be enforced MECHANICALLY** — gate guards that fail the build when a new panel/tracker deviates from the shared pattern, *"so consistency is enforced mechanically going forward, not just by hand."* - **Version bumps:** the owner delegates the number to me but rules out a major bump for backward-compatible feature work — quantity of features ≠ tier. A backward-compatible release is a single minor bump. - **PARKED means parked** (owner 2026-06-28): keep it in memory, do NOT act until the owner explicitly says go. "Parked" is reserved for genuinely later-down-the-road work, not near-term deferrals. See [[parked-task-workflow]]. - **The mobile-layout-stretch-on-refresh bug is DROPPED** (owner 2026-06-28, says it's fine). Do NOT pursue unless the owner re-raises it. - **How the owner wants options presented:** when he asks "what else could we do," he wants a comprehensive list marked *already-planned vs new*, quick-wins first, and he picks what gets folded in. ## Incidents that explain existing rules 1. **A file committed to git is NOT a deployed file.** The deploy workflow copied one named asset into the published artifact, so newly added assets 404'd on the live site while the old one served — it looked like propagation lag and wasn't. Any NEW served file type must be covered by the copy globs, and served assets are verified via the deployed URL, never the git tree. 2. **Gating deploy on CI connected an already-red CI to deploy and silently froze the live site.** Commits landed but never published; to the owner that presented as "the feature you said you shipped isn't there." When the owner reports a shipped feature missing, check the deploy pipeline before the code. 3. **Unconditional `signInAnonymously` on boot REPLACES a persisted Google user** — the SDK only no-ops when currentUser is already anonymous — so sign-in was wiped on every reload. This is why the call must always be guarded. 4. **Mobile Google sign-in via redirect cannot work on this hosting.** Cross-origin storage partitioning blocks the hidden third-party iframe the redirect handler reads the credential from, so the redirect result comes back null. GitHub Pages can't self-host the auth handler. Hence popup-only. Residual unknown: a popup inside an *installed standalone PWA on iOS* is a hosting ceiling — verify on a real device. 5. **Sanitizing an imported save/cloud container is TYPE-COERCION only, never HTML-escaping** — the render layer owns escaping. Escaping at import produced a double-escape regression that corrupted apostrophes and ampersands in players' data. 6. **A session spawn that times out may still spawn LATE.** One retry produced two concurrent sessions editing the same working tree. Wait and list sessions before re-dispatching. Related: keep the auditor a different session from the builder. 7. **"Duplicate" data can be real.** A flagged duplicate turned out to be two genuinely distinct FNV items sharing one name (a chem and a unique weapon). Verify apparent duplicates against the source before deleting. 8. **Test-harness gotcha:** the app saves state on `beforeunload`, so navigating away from the app clobbers a manually set game context. Set context from a non-app same-origin page first, then navigate in. 9. **fallout.wiki returns 403 to server-side fetch.** Re-verify game data through a policy-compliant browser path, not curl.