Session Handoff — PeptidePal Fable-mode audit, money-path fixes shipped, redesign scoped

WHERE WE JUST WERE — verbatim (MANDATORY, always first)

Sondra answered the design-direction questions:

• "which design skill?" → "many of them - look at what others are using and i want photorealistic and not cartoon like"
• "what visual direction?" → "Fresh premium direction"

Final substantive assistant message (verbatim):

> Done. Here's where PeptidePal stands. > > Money-path: all 5 fixes shipped and verified live — admin hole closed, refund clawback in, compound bypass closed, share-links were already safe, CORS pinned. The app's payment/data layer is now genuinely locked down (still TEST Stripe, so no rush). > > Redesign: your direction is captured and I wrote the build prompt → FABLE-REDESIGN-PROMPT.md. It bakes in exactly what you said: fresh premium look (dropping the current teal), photorealistic not cartoon, benchmarked against real premium health apps (Oura / Whoop / Levels / Zero / MacroFactor / Function Health — study them first, don't invent), and a real desktop layout plus polished mobile — with a hard rule to not touch the money/auth code we just fixed. > > My recommendation: run the redesign as a fresh Fable session in PROJECTS/Peptide Pal/app-v2/ (paste that prompt, Fable 5 / high). This session is very long now, and a design overhaul deserves a full, clean context to do the reference research and screenshot-verify properly — that's how it comes out premium instead of rushed. > > Two small loops still open, both yours to trigger: > 1. Commit the money fixes to git? They're deployed live but not committed yet — say the word. > 2. Stripe refund events — the clawback code is live but only fires once the webhook subscribes to charge.refunded + charge.dispute.created; I'll wire that via the Stripe API when you flip PeptidePal to live money. > > Want me to kick off the redesign now, or commit the fixes first?

(This handoff commits the money fixes as part of wrap-up. The redesign has NOT been started — it is scoped only.)

ACTIVE MODES — RE-INVOKE THESE FIRST (MANDATORY)

• fable-mode — this whole session ran under the five-gate discipline (scope → evidence → adversarial → verify → report). It is what caught (a) that the first is_admin fix was ineffective and (b) that finding #4 was a false alarm, both via live-DB verification. Re-invoke fable-mode FIRST before touching PeptidePal again — especially the redesign, which must verify on real desktop/mobile widths, not assume.
• ponytail — active via SessionStart hook (persists across /clear via the hook, but named here for completeness). Lazy/minimal-diff discipline.
• For the redesign, the prompt calls for premium-web-design (pre-ship quality gate) + ui-ux-pro-max + design-premium — invoke those in the fresh session per FABLE-REDESIGN-PROMPT.md.

Where it started

Sondra asked for a Fable-mode audit of PeptidePal (live at getpeptidepal.com) — "see where everything's at first" before a likely overhaul — and flagged she's unhappy with how the app looks vs the Emergent original. Audit surfaced a design fork + 4 money-path holes; she then said "patch the 4 money holes and the cors too," and later locked the redesign direction (fresh premium, photorealistic, responsive desktop+mobile).

Decisions locked + what shipped

• Money-path: ALL fixes shipped + verified live on Supabase zhcxygxjvcatvdodovtd:
• #1 admin self-elevation CLOSED — migration 0008 (PROJECTS/Peptide Pal/app-v2/supabase/migrations/0008_lock_is_admin_column.sql): revoke update on profiles from anon+authenticated, then grant update (<15 settings cols>) back — NOT is_admin. Verified has_column_privilege(authenticated, is_admin, UPDATE)=false. NOTE: migration 0007's revoke update (is_admin) was INEFFECTIVE (table-wide grant overrides column revoke) — 0008 is the real fix.
• #3 compound free-limit bypass CLOSED — migration 0007 (0007_security_patch_admin_and_compound.sql): trigger now BEFORE INSERT OR UPDATE, id <> new.id guard. Verified live.
• #2 refund/dispute clawback SHIPPED — stripe-webhook (v6) handles charge.refunded (full only) + charge.dispute.created → revokeByCustomer() → apply_subscription(premium=false).
• #4 share-links — was ALREADY safe live (share_links_premium_gate trigger via repo-missing 0005); no change.
• #5 CORS pinned on all 5 fns (create-checkout, admin, delete-account, generate-insights, share-view) — allowlist (apex+www+pages.dev+localhost:4780), reflect-or-default. Wildcard gone.
• 6 edge functions redeployed via Supabase MCP, each with verify_jwt PRESERVED (webhook + share-view = false; other 4 = true). Do NOT redeploy webhook/share-view with verify_jwt=true — it breaks them.
• Redesign direction LOCKED (Sondra): FRESH premium (drop the teal / not required to reuse Emergent palette) · PHOTOREALISTIC not cartoon · benchmark real apps (Oura/Whoop/Levels/Zero/MacroFactor/Function Health) · real desktop + mobile responsive. Seed prompt written to PROJECTS/Peptide Pal/FABLE-REDESIGN-PROMPT.md. NOT started.
• Living checklist updated — logged the new hole pattern ("privilege column on a user-writable row" + "column-revoke can't override a table-wide grant") to reference/fable-mode-money-path-audit.md.

Key files for next session

• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Peptide Pal\FABLE-REDESIGN-PROMPT.md — the redesign build prompt (READ FIRST for the redesign).
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Peptide Pal\app-v2\ — the app (Vite+React19+TS+Supabase). Theme = CSS vars in src\branding.css; pages in src\pages\; edge fns in supabase\functions\; migrations in supabase\migrations\ (0007/0008 new).
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\reference\fable-mode-money-path-audit.md — money-path checklist (updated this session).
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\Sondra Brain\wiki\memory\open-questions.md — PeptidePal entry has full audit + fix state + the locked redesign direction.
• Plan file: none (audit + direct patches).
• Memory files touched: none (per skill rules).

Running state

• Background processes: none. (An app-reviewer money-path audit subagent ran earlier and completed.)
• Dev servers / ports: none. Local run: cd "PROJECTS\Peptide Pal\app-v2" && npm run dev -- --port 4780.
• Open worktrees / branches: none. app-v2 is tracked by the MAIN workspace repo (not a nested repo).

Verification — how to confirm things still work

• has_column_privilege('authenticated','public.profiles','is_admin','UPDATE') on zhcxygxjvcatvdodovtd → must be false; a settings col (e.g. goal_weight) → true.
• Compound trigger: pg_get_triggerdef for compounds_free_limit → must read BEFORE INSERT OR UPDATE.
• CORS: curl -X OPTIONS https://zhcxygxjvcatvdodovtd.supabase.co/functions/v1/create-checkout -H "apikey: <anon>" -H "Origin: https://evil.com" → Access-Control-Allow-Origin: https://getpeptidepal.com (NOT evil.com); allowed origins (pages.dev/localhost:4780) are reflected.
• Webhook boots + sig intact: curl -X POST https://zhcxygxjvcatvdodovtd.supabase.co/functions/v1/stripe-webhook -d '{}' → 400.
• All 4 auth'd fns: POST with anon key but no real user → 401 (never 500).

Deferred + open questions

• Open: Commit the money fixes — being committed as part of THIS handoff (PeptidePal only).
• Open: Stripe refund events must be subscribed (charge.refunded + charge.dispute.created) or the clawback code never fires — do at the live-Stripe flip; offer to wire via Stripe API then. Still TEST mode (STRIPE_API_KEY_MAIN is a restricted rk_live; no live products/webhook for PeptidePal yet).
• Open: Kick off the redesign now vs later — Sondra's call; recommended as a FRESH Fable session.
• Deferred: LOW findings left as-is (negligible claim_ai_run race; Stripe event-ordering stomp).
• Deferred: re-run /app-safety-check after the redesign, before any live-money flip.

Pick up here

Re-invoke fable-mode first. Then either (a) start the redesign — open a fresh session in PROJECTS/Peptide Pal/app-v2/, paste FABLE-REDESIGN-PROMPT.md, invoke premium-web-design + ui-ux-pro-max, research the reference apps, redo landing + interior responsive/photorealistic, screenshot-verify desktop+mobile; or (b) if she flips Stripe to live, wire the refund/dispute webhook events + create live products, then /app-safety-check.