Handoff — SEO RankLab: first Lovable→Base44 migration, fixed, clone-tested + workflow documented

What happened

Sondra imported her Lovable app "SEO RankLab" into Base44 (via GitHub import, Supabase fields left blank — correct for a fresh template). Claude then ran the full native-Base44 verify/fix pass, published the fix to the live master, turned remixability ON, and proved it works by actually cloning it and running the clone as a fresh buyer. The whole proven process is now a reusable skill so any future migration follows it.

The app

• Master: app id 6a4a79146de0ebe309872a0a — SEO RankLab, live at https://seo-ranklab.base44.app
• Sandbox app (editor-native), is_remixable: true, slug seo-ranklab.
• Local scaffold: PROJECTS/PushTen Templates/seo-ranklab-base44/ (app-definition.json + verify/ screenshots).

5 real issues found + fixed (all IN the sandbox → clones inherit)

1. 🔴 Audits never ran — src/functions/runAudit.js (frontend wrapper) was lost in migration;

every @/functions/runAudit import pointed at a missing file → audits stuck "pending" forever. Recreated it (base44.functions.invoke("runAudit", payload)). ROOT-CAUSE fix.

2. 🔴 No data privacy — Audit + AuditPage had empty RLS ({}); any user could read all users'

audits. Set owner-only (created_by == {{user.email}}) on both.

3. Backend ownership guard — runAudit used service role (bypasses RLS); added

if (audit.created_by !== user.email) return 403 and switched report-row creation to the user context so owner-only read keeps reports visible.

4. Renamed "Migrated from Lovable" → SEO RankLab; slug → seo-ranklab.
5. Remixability turned ON (is_remixable: true) — required for buyers to clone.

• Clean: zero Brian/PushTen branding, zero Supabase leftovers (Base44 import was clean).

Verification (proven by running, not asserting)

• Master e2e: 2 fresh accounts (seotest3/4) — signup w/ email OTP, real audit ran from the

live UI (LLM + web search, full report, 0 console errors); user #2 saw ZERO of user #1's audits.

• CLONE TEST (the part Sondra insisted on):
• Remixed master → fresh app via POST /api/apps/<id>/remix. Confirmed the clone carried:

entities + RLS, function_names: ['runAudit'], has_backend_functions_enabled: true, auth config, sandbox.

• KEY FINDING: a fresh clone shows **"Your app is waiting to shine! Publish it to make it

visible here" — the new owner must click Publish once** before their copy goes live. Normal Base44 behavior; MUST be in buyer delivery instructions.

• Published the clone (simulating that one click), then a brand-new buyer account (clonetest1)

ran a full audit ON THE CLONE end-to-end: SEO 68 / AEO 62, complete report, 0 console errors. Screenshot: seo-ranklab-base44/verify/clone-2-audit-report.png.

• Cleaned up: deleted the test clone + eject-copies (all named Copy); master intact.

The reusable workflow (NEW)

• Skill: lovable-to-base44-migration (~/.claude/skills/lovable-to-base44-migration/SKILL.md)

— fires whenever Sondra says "migrate/move/import a Lovable app to Base44", "make this cloneable", "turn the remix button on", etc. Documents all 8 steps incl. the migration defect checklist, sandbox-only fixing, publish, remixable, and the full clone-test with the buyer simulation. Built on top of base44-workflow.

Open / next

• Test users to delete (optional, in the builder Users tab): srverva+seotest1..4@gmail.com

(on master), srverva+clonetest1@gmail.com (clone was deleted, so this one's gone with it).

• Next template: Sondra uploads the next Lovable app + says go → run the migration skill.
• Store delivery: when SEO RankLab is ready to sell, drop its remix link into the Template

Studio KV (product:signal on amplifai-template-studio), and the buyer access page should include the "remix → Publish once" instruction.

• Parked: Template Studio $1 test purchase link still live (buy.stripe.com/00wbJ31Oj69JeC52qx8Zq0z).