Operator decisions outstanding — 2026-08-02
Every item below is blocked on a human decision, not on engineering. Each card state was read back from Boards on 2026-08-02; the evidence column is what has already been measured, so the decision does not require re-investigation.
1. AB#11107 — reap 114 leaked fixture properties on TEST? (P2, Active)
Decision: run reap-leaked-fixture-properties.mjs --execute, or leave the backlog in place.
| Measured | TEST holds 123 properties; 114 match fixture patterns. It was 121 the same morning — the leak is still growing |
| Tool | Shipped d2fa914f, dry-run by default, --execute required |
| Safety proven, not asserted | Rejects a non-test/qa host (verified against api.keynova.ai); --older-than-hours 24 verified to keep 2 in-flight properties; ALLOWLIST-based so anything unclassifiable is kept |
| ⚠ Why allowlist | The card's own text calls the 22 "real-looking" properties test artefacts. That is wrong — 6 are the genuine KeyNova seed estate (created 2026-05-16). Reaping on the card's stated basis would have destroyed real data |
Recommendation: run it. The dry run lists every name; review that list, then execute. This is cleanup only — the root fix is harness teardown with retain-on-failure.
2. AB#11079 + AB#11098 — the MFA rollout coupling (P2 Active / P2 Proposed)
Decision: is admin-MFA enforcement ON in staging and prod today?
This is the highest-consequence item and it is one question that unblocks two cards.
- AB#11079 — role changes go stale up to 5 min on every service except auth-service. The fix
requires adopting
@hmp/auth ≥1.6.0. - AB#11098 — 9 of 17 services run
@hmp/common ≤1.10.5, which lacksIS_MFA_EXEMPT_KEY— including API gateway, payment, and frontdesk.
The coupling: adopting the auth package to fix the role-cache turns ON admin MFA enforcement. On services missing the exempt key, that is an availability risk on the three most critical services.
What is needed before anyone bumps a version: confirmation of whether enforcement is currently on in staging/prod. If it is already on, AB#11098 is a live production risk, not a rollout concern.
3. AB#10977 — probe brute-force lockout on PROD? (P2, Proposed)
Decision: authorise a live lockout probe against production, or accept it stays unverified.
Config is correct at 20 failures, but the behaviour has never been verified live. A probe means deliberately failing logins against prod until lockout triggers. I have not run this and will not without explicit sign-off — it writes auth-failure state against real accounts.
4. AB#10965 — SUPER_ADMIN for ResAvenue provisioning (P2, Proposed)
Decision: provision the ResAvenue fixture on TEST, or accept 4 security assertions stay skipped.
FT_RESAVENUE_PROPERTY_ID is a hardcoded fixture that does not exist on a fresh tenant, so
channel-webhook-security (4 assertions) skips. Confirmed again in the 12:42 round: SEC-WEBHOOK
0/4 — a harness gap, not a security defect. But a skip is not a pass, and webhook signature
verification is currently uncertified.
5. AB#11112 — where should the platform-root CLAUDE.md live? (P2, Proposed)
Decision: which repo owns it.
It is in no git repo, so it cannot be corrected through review — and it is provably wrong
about the gateway header allowlist. That error directly obscured a SEV-1 (AB#11111): it claims
filterHeaders forwards x-tenant-id/x-property-id, while the code deliberately excludes them.
Two guards were built dead on the strength of that line.
6. Credential hygiene (task #13)
Rotate the TEST admin password and revoke the expired Azure PAT. Routine, but the TEST password appears in harness docs and scripts.
Not blocked — recorded so nobody re-triages them
| Card | State |
|---|---|
| AB#10842 / AB#10840 | Product-blocked, not deferred. AB#10840's own description says it needs product decisions; AB#10842 needs real plan/pricing/support copy. Engineering cannot invent either |
| AB#11125 | New class card — three date-parameter conventions across endpoints, 4 known victims incl. AB#10728 (a readiness barrier that never waited) and AB#11092 (a guest-facing 500) |
| AB#11124 | Block-range inventory is correct but invisible for ~60s (cached read). Cause stated as a hypothesis — confirm before "fixing" |
| AB#11123 | e-invoice webhook is dead surface, not a functional gap — the cron obtains the IRN |