← Davi’s Lab
System Audit — Opportunities & Open Loops
Updated 2026-07-12 14:40 WEDT · 5-agent sweep of every app's idea-space, in-code debt, recent voice notes,
open briefs, and registries. Ordered by what moves the needle. Tap nothing — this is a map.
🚨 MushMe launch-blockers (deep readiness audit)
Good news first: the event lifecycle + steward-ratio gate are properly server-enforced,
and the OTP rewrite fixed the old login bug. But three safety-follow-through gaps must be closed
before a real event:
#1 — Safety reports go into a black hole. (CRITICAL) "Wave at a steward" and
the anonymous safety concern both write to a table nobody reads and nothing notifies on. The
UI promises "a steward will come meet you" / "sent to the safety team ✓" — but no steward is ever
told. For a touch-based event the safety UI is currently theater. Must fix before the first
real event. Cody — briefed, top priority
#2 — The "mandatory vestibule" isn't a gate. It's an explainer page;
orientation is a localStorage stamp, not a server precondition for RSVP. Either enforce it in the
attendance RPC or soften the "you can never arrive directly inside" claim for v1.
Cody — briefed
#3 — New accounts can end up with no profile row + no adult-confirmation. If a
user skips the optional name field, adult-confirm silently saves to 0 rows and they render nameless.
One idempotent "ensure profile" step fixes it. Cody — briefed
#6 needs your call: hosting is currently open to anyone who attended ≥1 mush
(HOST_MIN_STAGE = Musher), which the code itself flags as contradicting "hosting ≈ Steward." Should
first-launch hosting require Steward, or stay open? Davi
🔴 Pre-launch — review or fix before public
Test-login rests on unverified assumptions. Comments flag "birthday = month"
+ column-name guesses (first_name vs firstName). Friends are testing on the test env right now — a
wrong guess = silent sign-in failure.
packages/shared/src/testLogin.js:7,43
Cody — briefed
Discomfort / auto-reject safety pref is client-side only. A safety control
(auto-decline from events with people on your discomfort list) lives in localStorage — not
server-enforced, so the approval engine can't honor it and it's bypassable.
apps/wemush/src/lib/discomfortPrefs.js:7-8
Cody — briefed
✅ FIXED — Git-metadata exposure OFF. Bundle verified clean.
✓ 14:33 WEDT
✅ FIXED — Landing prod deploys. Root cause = vite-build project
vs prebuilt push; project switched to prebuilt-static. Front door is LIVE + current (env chip, pruned
slate, guide carousel). ✓ 14:24 WEDT
Witness-invite-by-email is broken in 3 apps. Shows a fallback error (can't
read auth.users). One shared server-side profiles-RPC fixes all three — Davi said GO; queued in Cody's migration lane. Cody — in flight
Coin wallet is device-local (clear storage = coins gone) &
lottery
odds are a flat placeholder. Fine for beta if labeled/understood; shouldn't hit full launch
unlabeled.
wemush CoinWallet.jsx / Rsvp.jsx:1256
Cody — briefed
🔐 Security (live-DB advisor scan — pre-launch)
~45 sensitive safety/discipline/token RPCs are callable by anonymous users.
Functions like decide_safety_case, issue_discipline_card, grant_signup_tokens,
admit_walk_up run as SECURITY DEFINER and are reachable unauthenticated — the ones that trust
a passed-in user id (vs the session's) would be forgeable by an attacker. Cody confirmed each derives actor from auth.uid(); the anon-EXECUTE revoke migration is NEXT in his queue. Cody — in flight
✅ FIXED — definer view hardened + all search_paths pinned
(verified on prod: anon SELECT false, 0 unpinned definer fns).
✓ 14:33 WEDT
🟢 Quick wins — built backend, missing only UI (high ROI)
These apps have DB tables + RLS already applied and just need a screen on top — cheap
to revive.
JamSpace has ~7 shipped-schema features with no UI: Tune-in, host
endorsements, conditional RSVP, 3-tier conflict/safety, event subscriptions + structured chat,
gender-balance filter. Each migration is live; the UI is the only gap.
Cody
Ask-Jasper (Claude API) — serverless handler + Haiku 4.5 designed; blocked
only on adding ANTHROPIC_API_KEY. Davi: key
Cody: wire
Apply 3 unapplied baseline migrations — ReleaseMe / DayIni / LingerLong can't
persist signed-in writes until their baseline SQL is applied. One quick sweep.
Cody
LingerLong fan-adventure + moderation UI — full schema + status pipeline
(draft→verified→approved) exists; no screen. Cody
SeeBe history view — sessions accumulate in cyb_sessions
but nothing reads them back. Cody
🔵 Decisions waiting on you
Council calls with no answer on record (3): the big
vocabulary sweep
(dial/knob/notches, realme spelling, realmz-z), the
gendered-vowel scheme (-eo/-ea/-ee) +
company gender stance, and the
env-count (2 vs 3).
council → you
Note: env-count is effectively already 3 (dks→dkt→dkl) — I can unblock Cody's held work.
Tesserarium 5⁶ Skill Cube cutover. The 15,625-skill corpus + adapter are
built + tested but the live app still shows the old 13,800. Needs your go to flip (+ a 1-line
"Belonging" name-collision fix). Davi
Dynamik K letter-mark — Craftee is holding until you sketch it in the
coin-mark-builder and send the PNG. Davi: sketch
sciency.app → labs cutover — gated on your shell-approval + a dashboard move,
plus my greenlight on the redirect-hub reconcile (18 Science domains still point at the games hub).
DaviDesignee
C→K cleanup (from 07-07, may be stale) — add
mushme.dynamiksocial.app/* to Supabase auth allow-list + say "go" to redeploy
~17 apps. Davi
Domains to confirm/buy: brothertime · sportplex · craftplex (checked, avail);
designee.com, scienceee.app, gravitee.app, escuelasdinamicas.com + dynamikschool.com ($11 ea) flagged.
Domain count (419 vs 420) never reconciled. Davi
💡 Net-new ideas from your recent voice notes
Surfaced from Recordings 34–46 + others — none acted on; parking here for your call.
New app concepts: Co-parent / playdate-coordination (mush matching for
kids) · "Mush-mode" carpool/car-swap · Castee casting umbrella (deep/soul/mind/jam/mushcast) ·
PodMe mastermind pods (3–7) · curated permissioned audio-inbox (leave-no-trace tier).
Economy — you said you feel lost & want ONE canonical writeup. Rename
participant token → access token (role tokens = a subtype); credits→coin convertible; can't
buy tokens with money; tools can cost money but community-access apps are always free; token cute
uses (gift-a-token-with-a-voice-note, spotlighter, adopt-inactive-token). Open Q: is a tessera = a
token = a tile? Designee: I'll draft the explainer next
Pricing schema you asked to resurface: $1 first month · community-credit
($2 + 2 invites) · multi-app $1-try → ~$3–5/app, discount past 5 apps. Confirm still current.
TessaCraft: "elastic menu buttons" (spring-back, locked-deeper shows a lock) —
a reusable primitive for every page; all explainers must be draggable pop-ups (inline text shifts the
board — recurring bug); a Tessellator bug cluster. CrafteeCody
🧹 Engineering sweeps — one pass, many apps
- Witness-by-email shared fn → unblocks RePrana + ThroughWard + ReleaseMe together.
- Telemetry / escape-valve / versioned-prompt sweep → Foray + RePrana + JamSpace check-in/out surfaces don't log to prompt_choice_events.
- Lift 8 primitives to @desa/shared (PersonBadge, pledgeEconomy, RegulationTriangle, socialModel, ZoomPanSvg, checkoutProgress, mushyReveal, MessengerChips) + consolidate the 3 draggable-popup impls.
- Cross-app notifications — lift jamspace notifications.js → shared (Anchor/JamSpace/WeMush all need it).
- ~55 in-code debt markers catalogued (mostly "confirm intended for beta"); ~120 noise dropped.
Cody / KodyB🗂️ Canon reconcile — stale/conflicting flags to prune
The lexicon & STATUS board carry self-contradicting entries (one copy OPEN,
a later copy RESOLVED): P3★ U/W chirality, clarifier character (PENDING vs "no
clarifier"), mushmovement.com funnel, Playably/PlexMe. Plus older transcripts carry
JamLux/Crafty which the newer -Plex canon (JamPlex/CraftPlex) supersedes. Worth a
reconcile pass so the source-of-truth stops disagreeing with itself. Designee