Path7 Stack Audit

2026-05-29 · scott@path7.co · v0.2 · prev v0.1 (2026-05-10)

Headline findings — deltas vs v0.1

1. Identity & AccessUnverified — re-check

Not re-verified this run. Carried forward verbatim from v0.1 (2026-05-10); ykman was not executed and no account states were re-checked. If you hardened these since v0.1, mark resolved at next audit.

ServicePassword2FAHW keyStatus (v0.1)
Google scott@path7.coPrompt + TOTP + SMSSoft
Shopify (scott.scherp)Never setOffWeak
1PasswordMaster?Verify
GitHub (scottscherp)??Verify
Vercel?Verify
2× YubiKey 5 NFCbought 2026-04-05 / shipped 04-08Enroll state ?
2. Hosting / VercelSprawl

Live from vercel project ls --scope scotts-projects-6f1b3caa: 22 projects, all under one team. v0.1 flagged "6+ … no DR" — the count has nearly quadrupled and several are untracked or duplicates. The *.path7labs.com → Vercel wildcard CNAME is the single front door for 14+ of these.

ProjectURLIn registry?State
content-path7labscontent.path7labs.comyestracked
voice-lessonsvoice.path7labs.comyestracked
usas-trackerusas.path7labs.comyes (usas)tracked
tactix-dashdash.path7labs.comyes (operator-dash)tracked
path7labs-landinglanding.path7labs.comyestracked
tactics-previewtactics.path7labs.comyestracked
augustapotsaugustapots.path7labs.comyes (augusta-pots)tracked
shopify-token-guideshopify-token-guide.path7labs.comyestracked
mikesaiguidemikesaiguide.path7labs.comyestracked
endless-grind-portalendless-grind-portal.vercel.appyestracked
stack-auditaudit.path7.coyestracked
eastern-mvp-portaleastern.path7labs.comyes (eastern)tracked
easterneastern-one.vercel.appyes (eastern-one)dup-ish
eastern-demoeastern-demo.vercel.appnountracked dup
tsc-appthe-skateboard-co.vercel.appyes (the-skateboard-company)tracked
the-skateboard-companythe-skateboard-company.vercel.appname-collisiondup
powell-mmapowell-mma.vercel.appnountracked
roninronin-blush.vercel.appnountracked
sk8xsk8x.vercel.appnountracked
sale-123sale-lakai.vercel.appnountracked (Lakai sale?)
deploydeploy-jet-five-82.vercel.appnoorphan / scratch
project-5nple— (no prod URL)noorphan / empty

Read: ~14 tracked, ~3 duplicates (eastern / TSC variants), ~5 genuinely untracked (powell-mma, ronin, sk8x, sale-lakai, eastern-demo), ~2 orphans (deploy, project-5nple). The registry — your new source of truth — is blind to 7 of these.

3. Commerce / ShopifyMixed
ClientStorePlanState
Lakailakailtd.myshopify.comPlusproduction (backs lakai.com)
Tacticsinversal-tactics.myshopify.comPlusmid-migration
Phoenix Unitedphoenix-united-2.myshopify.comRegularLiquid in progress
Augusta Potsmigration phase 2

Access is via 1Password-stored OAuth client-credentials (Lakai) and a read-only custom app (Tactics MCP). The v0.1 crit on the Shopify account identity (no password / 2SV) is unverified this run — see §1.

4. Communications & AutomationHealthy
ServiceWhereState
Resend (transactional email)notes@path7.co via send.path7.colive
n8n (automation)n8n.path7labs.com — Coolifylive (migrated 05-15)
Registry Telegram botpath7_ops_bot — /status /deps /listlive (new)
7am dispatchn8n cron → Telegram (Australia/Perth)scheduled
Registry ingest loopdesktop build_index → n8n webhook → Supabaseverified

n8n moved off the local PC to Coolify on 2026-05-15 (was never truly server-side before). Secrets (registry-api bearer, Supabase service key) live in Coolify/n8n credentials, never on the desktop — good posture.

5. Local Rig & AILocal-only
ItemWhereState
arb-engineWSL (FastAPI + Postgres + Redis + Prometheus + Grafana)in-dev; Coolify target
site-pipeline-scraperlocal Docker :8000 (Playwright)must reach Coolify before n8n flows call it
AnythingLLMlocal Docker :3001tooling
Open WebUIlocal Docker :3000tooling
Lakai/Tactics dashboardslocal static (:8765) + DuckDB warehouselocal

Local stack is started via 90-System/workflows/start-stack.ps1. n8n is deliberately not in that list (it's on the server). The scraper being PC-only blocks any server-side n8n flow that would call it.

6. Cost SnapshotPartial
ItemPlanCost / mo
DigitalOcean droplets-4vcpu-8gb (path7-platform)$48
TailscalePersonal (post-trial)$0
Vercel22 projects, one team?
Supabase4 projects (_path7, voice-lessons, the-skateboard-company, grocery-chef)? (free tier?)
Resendpath7.co domain?
Domainspath7.co (GoDaddy) + path7labs.com?
AssemblyAI / Anthropic / Firecrawlusage-based (voice-lessons, etc.)?

Only the droplet is firmly known ($48/mo). The rest are ? pending a billing pass — don't trust guesses.

7. Risk RegisterReview
RiskBlast radiusSeverity
*.path7labs.com → Vercel wildcard14+ live apps dark on one DNS/host failurecrit
Identity hardening (carry-over, unverified)keystone Google + Shopify accountcrit
Coolify on a single dropletpowers n8n, grocery, registry-apiwarn
Vercel project sprawl / orphans7 untracked; attack surface + confusionwarn
Registry ↔ live driftsource of truth misses live projectswarn
Tailscale node-key expirytailnet-only Coolify admin could vanishmitigated (disable key expiry)
Secrets postureservice keys in Coolify/n8n, not desktopgood
8. Recommended Sequence — next 7 daysDo
  1. Close the identity carry-over. ykman info → enroll both YubiKeys on scott@path7.co + Google Advanced Protection; set Shopify password + 2SV. (Oldest open crit — from v0.1.)
  2. Reconcile Vercel into the registry. For each untracked project (powell-mma, ronin, sk8x, sale-lakai, eastern-demo): add a registry node or archive/delete. Kill the orphans (project-5nple, deploy) and the TSC/eastern duplicates.
  3. Decide the wildcard SPOF posture. Either accept it (document) or pre-flight a second host / split critical apps off the shared wildcard.
  4. Deploy site-pipeline-scraper to Coolify before wiring any server-side n8n flow that calls it (PC :8000 is unreachable from the droplet).
  5. Billing pass to fill the Cost Snapshot ?s (Vercel, Supabase, Resend, domains).
9. Audit MetadataProvenance
Version
v0.2 (prev v0.1 inaugural, 2026-05-10)
Generated
2026-05-29
By
stack-audit skill (Claude Code)
Inputs consulted
MEMORY.md + linked memories; 90-System/live-apps.md + the 38-node apps/ + services/ registry; live vercel project ls (22 projects); live registry-api /status; previous audit v0.1
Blindspots
Identity NOT re-verified (ykman not run); YubiKey enrollment state unknown; costs mostly ? (no billing pass); hosting verified for Vercel only (Coolify/local cross-referenced from registry, not re-pinged); Shopify account 2SV unconfirmed
Next audit
Re-verify identity (flip §1 if hardened); confirm Vercel reconciliation; check arb-engine Coolify deploy + arb.path7.co; billing pass for §6

Biggest change since v0.1: the stack now audits itself. The registry + bot mean the next run can pull live state instead of memory — but live Vercel still holds 7 projects the registry has never heard of. Truth lives where you look, not where you file.