The prioritized backlog of fixes/builds decided by the owner while documenting the
platform (2026-07-08). Each item links to the page with the full evidence. This is the
companion to Known Risks & Tech Debt — risks are the problem, this is
the committed work.
The gate: items marked 🔴 must ship before the first real (paying) Client is
onboarded. Everything runs demo-only today, which is why they're parked — but the
moment money/PII belongs to a real Client, the gate applies. Ops is currently
bus-factor 1 (solo), so sequence accordingly.
| # | Build | Why | Ref |
|---|---|---|---|
| 1 | Enroll TOTP for CP god-mode | Fleet admin is password-only today; one leaked password = full-fleet god-mode | Security · known-risks C1 |
| 2 | Offsite backups + escrow TENANT_SECRET_KEY |
Nothing is backed up off-box; losing the Fernet key = all BYO creds undecryptable. First: verify whether the key is escrowed anywhere (owner unsure) | Backup & DR · known-risks C2 |
| 3 | VPC-lock /_admin |
God-mode Admin API is internet-reachable (signature-gated only) | known-risks C3 |
| 4 | Build invoice OTP gate (hard-fail) | Invoice portal has no auth gate; OTP must be default and block when no phone on file | Portals · known-risks C4/H2 |
| 5 | Route Client data off DeepSeek → Gemini | DeepSeek is China-hosted and may train on inputs | AI · known-risks H1 |
| 6 | Encrypt QBO tokens at rest | Plaintext tokens grant write access to a Client's books | Reports & Finance · known-risks H3 |
| # | Build | Decision | Ref |
|---|---|---|---|
| 7 | Real server-side entitlement gates | Enforce every sold feature with require_feature — nav-hiding isn't enough; a Starter org can URL-hit paid features |
Entitlements |
| 8 | Rate-limit / abuse-guard public endpoints | /api/track + /api/chat are unauthenticated & unthrottled; validate org_id, throttle per IP/org |
API |
| 9 | AI-bar write guardrails | Add an audit log of AI-initiated writes, dollar thresholds, and an owner-only tier for money/people actions | AI · known-risks H4 |
| 10 | Go-live un-go-live + orphaned-org cleanup | No rollback path exists; a failed site-import orphans an org | Go-live |
| 11 | Correct vaporware sales labels | Strip "Xero" from the entitlement label; downgrade "Ads" to draft-only (quick fix) | Entitlements |
| 12 | Wall off Voice/Twilio per tenant | Pooled orgs' paid tracking numbers currently bill GoBuild's master account | Integrations · known-risks H8 |
| 12b | Live concierge: add 'AI assistant' disclosure + per-org config | Concierge auto-replies to visitors as the owner ("can't tell it's AI") with hardcoded gautam@gobuild.ca / gobuild.ca/demo — add transparent AI disclosure and make the inbox/URL per-org |
GoBuild Live |
| 12c | Enforce human review on AI estimates → Client | The AI estimator's review gate is soft (drafts, but nothing blocks sending). Require a human to approve before an AI estimate reaches a Client (+ margin-floor / disclaimer) | AI estimator |
| # | Build | Note |
|---|---|---|
| 13 | CI gate + real staging env | No CI today; Dev box = staging + canary + authoring. Add green-pytest+build gate before deploy |
| 14 | Monitor dead-man's switch | If email is down, the monitor can't page you it's down — needs an external heartbeat |
| 15 | Go-live domain-status poller | domain_status never promotes past pending for folder-sites → stale canonical/OG/sitemap URLs |
| 16 | OpenProject: degrade gracefully | A schedule edit hard-fails HTTP 502 when OP is unreachable; also fix the dependency-mirror field mismatch. Decided: keep OpenProject, make it resilient (not a native rewrite) |
| 17 | Lien-waiver single source of truth | Two disconnected stores (Documenso LienWaiver vs Bill.lien_waiver_status) can disagree |
| 18 | Dead-code cleanup | PO billed status, request_invoice_signature, unused macros, stale selectors, dead critical email flag |
pytest +demo-check.sh before deploy (see Testing & QA).Every item traces to a code-grounded finding (with file:line) surfaced by the
documentation pass and an explicit owner decision. See _meta/capture-log
for the full decision trail.