Handoff — PawKeeper v2 (builder app) finished to parity + SHIP-SAFE (2026-07-05)

What this is

Sondra pasted the build prompt into the Base44 builder overnight → new app "PawKeeper" (6a49dd89b41992d03116e557, live at https://neon-paw-keep-pro.base44.app, editor chat + preview WORK because it was born in the builder). This session Claude audited it against the finished CLI-built v1 (6a49aa9f..., the one with NO editor — the whole reason for the rebuild), ported everything missing, fixed a catastrophic isolation hole, published, and verified end-to-end.

THE master is now the v2 builder app. The v1 CLI app is a reference archive — deletable.

What the builder had already nailed (kept as-is)

• All 10 features' entities + pages + login flow; getShareData (token-gated, safe fields);

a real platform scheduled workflow for daily reminders (8am ET cron); one-file rebrand config src/lib/branding.js used by every page (cleaner than v1); Bella+Milo demo seed with the overdue-rabies alert + "Clear Demo Data" in Settings; emerald palette.

What Claude fixed/ported this session (all via sandbox edit + checkpoints)

1. 🚨 RLS ISOLATION WAS BROKEN — the big one. Builder wrote

"row_level_security": {"type": "creator_only"} on every entity. The platform stores that key but does NOT enforce it — account B saw account A's pets live. Replaced on all 10 entities with the enforced granular form ("rls": {"create": true, "read": {"created_by": "{{user.email}}"}, ...}), synced, then proven live with two accounts: B fresh-load = empty state; B hitting A's pet URL = no leak. Lesson recorded in memory + base44-workflow skill §4 ("the shorthand trap").

2. sendDailyReminders was open to anyone (would email every user). Added CRON_SECRET guard:

workflow passes {secret} in args, function 403s without it. Verified live: anonymous → 403, with secret → 200 (emailsSent:0, no milestones today).

3. BrandSettings entity had no RLS and is unused by code → locked creator_only (harmless

now; Sondra can also delete the entity in the Data tab if she wants it gone).

4. ErrorBoundary + LoadError (new src/components/ErrorBoundary.jsx + LoadError.jsx),

App wrapped; error states + retry added to Dashboard, Pets, PetDetail, EmergencyCard, Settings, AddPet (all had spinners but NO error branch = infinite-spinner risk). Proven live: B probing A's pet URL renders the LoadError screen, not a blank page.

5. Share tokens upgraded from Math.random to crypto.getRandomValues (32-char).
6. Premium landing hero ported from v1 (the design she approved): two-column hero, real

photo (kenburns), 2 floating alert cards, animated phone cycling 4 app screens, trust avatars + stars. New files src/components/landing-extras.jsx + src/styles/landing.css; brand color scale added to tailwind.config; hero photo transferred into src/assets/. Cycler verified live (slides advance). All copy still branding.js-driven.

7. Published via eject→build(master id)→site deploy (entities aside), Copy app deleted.

Live bundle verified: master id + fixes present; entities untouched by deploy.

8. Remixability ON (is_remixable: true) — members can clone.

Live e2e proof run (account A = srverva+pkv2a@gmail.com / PawV2test!2026a)

signup → OTP (read via gws) → empty dashboard → demo seed → overdue alert fires → pet detail Timeline + 6 tabs → emergency card (chip/allergies/meds/phones, print+QR) → share link created → anonymous fetch = emergency fields only, no email/id leak → revoke tested earlier via exec. Account B (srverva+pkv2b@gmail.com / PawV2test!2026b) = isolation proof (above).

Where things live

• Local link folder: PROJECTS/Pet Health Tracker DFY/app-v2/ (scaffold; sandbox is source of

truth — edit via npx base44 sandbox edit + checkpoint). Edit-JSON scripts + hero.b64 there too.

• Checkpoints: "before parity+security fixes" (a55b0c89) and

"v2 parity complete..." (3011ee77) — restore points if anything goes sideways.

• CRON_SECRET value: in base44/functions/sendDailyReminders/entry.ts + workflow args (source-

private, travels with clones; cloner may rotate it — optional REBRAND-CHECKLIST item).

• v1 (CLI app, no editor): 6a49aa9f3b13507a46060175 — archive, delete when comfortable.
• PRD/research/rebrand checklist: same project folder (still accurate; branding.js path per §Settings).

Open items (Sondra's calls — unchanged from v1 handoff)

final name · how members claim clones (remix link is now ON) · free Stars perk vs paid DFY tier · Skool setup-page copy at launch. Optional cleanup: delete test users +pkv2a/+pkv2b (Users tab) and A's demo data; delete v1 app + old app/ folder.

Watch-outs

• Never edit entities via a code-only deploy — sandbox only (editor owns this app now).
• The builder's chat can overwrite code Claude wrote; that's FINE (it's her editor) — Claude's

fixes are checkpointed and re-appliable. If she asks the builder to change entity access rules, re-verify isolation (the shorthand trap).

• gws gmail search syntax: gws gmail users messages list --params '{"userId":"me","q":"..."}'

(the --user-id/--q flags DON'T exist — they fail silently-ish).