90-System/apps|services, a live read API (registry-api on Coolify), Telegram bot path7_ops_bot, and an edit→Supabase auto-ingest loop. This audit's app data is drawn from that layer.*.path7labs.com → Vercel wildcard fronts 14+ live apps. Single DNS+host dependency; one Vercel/DNS issue dark-fails most of the estate.Not re-verified this run. Carried forward verbatim from v0.1 (2026-05-10); ykman was not executed and no account states were re-checked. If you hardened these since v0.1, mark resolved at next audit.
| Service | Password | 2FA | HW key | Status (v0.1) |
|---|---|---|---|---|
| Google scott@path7.co | — | Prompt + TOTP + SMS | — | Soft |
| Shopify (scott.scherp) | Never set | Off | — | Weak |
| 1Password | Master | ? | — | Verify |
| GitHub (scottscherp) | ? | ? | — | Verify |
| Vercel | — | ? | — | Verify |
| 2× YubiKey 5 NFC | bought 2026-04-05 / shipped 04-08 | — | Enroll state ? | |
ykman info, confirm YubiKey enrollment on scott@path7.co + Google Advanced Protection; set Shopify password + 2SV + secondary email. Then this section can flip to ok.Live from vercel project ls --scope scotts-projects-6f1b3caa: 22 projects, all under one team. v0.1 flagged "6+ … no DR" — the count has nearly quadrupled and several are untracked or duplicates. The *.path7labs.com → Vercel wildcard CNAME is the single front door for 14+ of these.
| Project | URL | In registry? | State |
|---|---|---|---|
| content-path7labs | content.path7labs.com | yes | tracked |
| voice-lessons | voice.path7labs.com | yes | tracked |
| usas-tracker | usas.path7labs.com | yes (usas) | tracked |
| tactix-dash | dash.path7labs.com | yes (operator-dash) | tracked |
| path7labs-landing | landing.path7labs.com | yes | tracked |
| tactics-preview | tactics.path7labs.com | yes | tracked |
| augustapots | augustapots.path7labs.com | yes (augusta-pots) | tracked |
| shopify-token-guide | shopify-token-guide.path7labs.com | yes | tracked |
| mikesaiguide | mikesaiguide.path7labs.com | yes | tracked |
| endless-grind-portal | endless-grind-portal.vercel.app | yes | tracked |
| stack-audit | audit.path7.co | yes | tracked |
| eastern-mvp-portal | eastern.path7labs.com | yes (eastern) | tracked |
| eastern | eastern-one.vercel.app | yes (eastern-one) | dup-ish |
| eastern-demo | eastern-demo.vercel.app | no | untracked dup |
| tsc-app | the-skateboard-co.vercel.app | yes (the-skateboard-company) | tracked |
| the-skateboard-company | the-skateboard-company.vercel.app | name-collision | dup |
| powell-mma | powell-mma.vercel.app | no | untracked |
| ronin | ronin-blush.vercel.app | no | untracked |
| sk8x | sk8x.vercel.app | no | untracked |
| sale-123 | sale-lakai.vercel.app | no | untracked (Lakai sale?) |
| deploy | deploy-jet-five-82.vercel.app | no | orphan / scratch |
| project-5nple | — (no prod URL) | no | orphan / empty |
Read: ~14 tracked, ~3 duplicates (eastern / TSC variants), ~5 genuinely untracked (powell-mma, ronin, sk8x, sale-lakai, eastern-demo), ~2 orphans (deploy, project-5nple). The registry — your new source of truth — is blind to 7 of these.
| Client | Store | Plan | State |
|---|---|---|---|
| Lakai | lakailtd.myshopify.com | Plus | production (backs lakai.com) |
| Tactics | inversal-tactics.myshopify.com | Plus | mid-migration |
| Phoenix United | phoenix-united-2.myshopify.com | Regular | Liquid in progress |
| Augusta Pots | — | — | migration phase 2 |
Access is via 1Password-stored OAuth client-credentials (Lakai) and a read-only custom app (Tactics MCP). The v0.1 crit on the Shopify account identity (no password / 2SV) is unverified this run — see §1.
| Service | Where | State |
|---|---|---|
| Resend (transactional email) | notes@path7.co via send.path7.co | live |
| n8n (automation) | n8n.path7labs.com — Coolify | live (migrated 05-15) |
| Registry Telegram bot | path7_ops_bot — /status /deps /list | live (new) |
| 7am dispatch | n8n cron → Telegram (Australia/Perth) | scheduled |
| Registry ingest loop | desktop build_index → n8n webhook → Supabase | verified |
n8n moved off the local PC to Coolify on 2026-05-15 (was never truly server-side before). Secrets (registry-api bearer, Supabase service key) live in Coolify/n8n credentials, never on the desktop — good posture.
| Item | Where | State |
|---|---|---|
| arb-engine | WSL (FastAPI + Postgres + Redis + Prometheus + Grafana) | in-dev; Coolify target |
| site-pipeline-scraper | local Docker :8000 (Playwright) | must reach Coolify before n8n flows call it |
| AnythingLLM | local Docker :3001 | tooling |
| Open WebUI | local Docker :3000 | tooling |
| Lakai/Tactics dashboards | local static (:8765) + DuckDB warehouse | local |
Local stack is started via 90-System/workflows/start-stack.ps1. n8n is deliberately not in that list (it's on the server). The scraper being PC-only blocks any server-side n8n flow that would call it.
| Item | Plan | Cost / mo |
|---|---|---|
| DigitalOcean droplet | s-4vcpu-8gb (path7-platform) | $48 |
| Tailscale | Personal (post-trial) | $0 |
| Vercel | 22 projects, one team | ? |
| Supabase | 4 projects (_path7, voice-lessons, the-skateboard-company, grocery-chef) | ? (free tier?) |
| Resend | path7.co domain | ? |
| Domains | path7.co (GoDaddy) + path7labs.com | ? |
| AssemblyAI / Anthropic / Firecrawl | usage-based (voice-lessons, etc.) | ? |
Only the droplet is firmly known ($48/mo). The rest are ? pending a billing pass — don't trust guesses.
| Risk | Blast radius | Severity |
|---|---|---|
| *.path7labs.com → Vercel wildcard | 14+ live apps dark on one DNS/host failure | crit |
| Identity hardening (carry-over, unverified) | keystone Google + Shopify account | crit |
| Coolify on a single droplet | powers n8n, grocery, registry-api | warn |
| Vercel project sprawl / orphans | 7 untracked; attack surface + confusion | warn |
| Registry ↔ live drift | source of truth misses live projects | warn |
| Tailscale node-key expiry | tailnet-only Coolify admin could vanish | mitigated (disable key expiry) |
| Secrets posture | service keys in Coolify/n8n, not desktop | good |
ykman info → enroll both YubiKeys on scott@path7.co + Google Advanced Protection; set Shopify password + 2SV. (Oldest open crit — from v0.1.)?s (Vercel, Supabase, Resend, domains).90-System/live-apps.md + the 38-node apps/ + services/ registry; live vercel project ls (22 projects); live registry-api /status; previous audit v0.1? (no billing pass); hosting verified for Vercel only (Coolify/local cross-referenced from registry, not re-pinged); Shopify account 2SV unconfirmedBiggest change since v0.1: the stack now audits itself. The registry + bot mean the next run can pull live state instead of memory — but live Vercel still holds 7 projects the registry has never heard of. Truth lives where you look, not where you file.