Session Handoff — AmplifAI Visibility: pills removed live + eyebrows/pills banned workspace-wide

WHERE WE JUST WERE — verbatim (MANDATORY, always first)

Final substantive exchange, word-for-word:

Sondra asked: what is the PAT issue, does she need to address it, answer right now.

Claude answered:

Straight answer: worth fixing, but it is NOT an emergency — nothing is on fire.

Plain English:

• A PAT (Personal Access Token) is basically a password that lets code push to your GitHub without you logging in each time.
• When your repos were set up, that token got saved inside a hidden settings file on your computer (.git/config), written in plain text instead of scrambled.

The fact that makes this not urgent: that file lives only on your computer — it is never uploaded to GitHub. Git never ships its own settings file. So your token is not sitting out in public for strangers to grab.

Why it's on the list at all: the token has been printed into chat transcripts in past sessions (and once more just now when I checked the remote). If one of those transcripts ever got shared or synced somewhere, someone reading it could use the token to push to or mess with your GitHub.

So — do you need to drop everything? No. Is swapping it for a fresh one good hygiene? Yes, and it's about a 2-minute job:

What "rotating" means: make a new token on GitHub → paste it into your two repo configs → delete the old one. The instant you delete the old one, it stops working, so nobody who ever saw it can use it.

She then said: run /session-log AND /session-handoff, push to git if not done, and do not forget she wants to work on the PAT issue (call it out in the handoff). That is the #1 pick-up item below.

Earlier in the session (the substantive work), the last status was: all decorative pills removed from the live AmplifAI Visibility page + redeployed + verified (0 pill DOM elements, 0 overflow, headline-led hero), and the eyebrow/pill ban baked permanently into the theme skill + design rules + memory. CTA left untouched (parked, her call later). App-safety-check confirmed already done last session — no re-run needed.

ACTIVE MODES — RE-INVOKE THESE FIRST (MANDATORY)

All were governing this session and do NOT survive a /clear — re-invoke before touching the work:

• fable-mode — five-gate discipline (scope → evidence → adversarial → verify → report)
• premium-web-design — anti-slop design pass
• conversion-landing-page — copy/conversion structure
• amplifai-video-studio-theme — navy/gold/cream visual theme (NOW carries the pill/eyebrow ban)
• ponytail full — hook-enforced, lazy-senior-dev restraint

Where it started

Handoff from the prior session said AmplifAI Visibility was LIVE + safety-hardened, only open item = Sondra's 30-second human test. She ran it (Turnstile failed-then-passed = normal retry), then flagged that the page had eyebrow pills / badges in the middle with the title — "stuff I would never have on a page." She asked whether an app-safety-check was done, and said the anti-AI-slop rules she has "should definitely be built in" to the theme. Decision: kill pills everywhere + bake the anti-slop rules into the theme skill.

Decisions locked + what shipped

• Eyebrows/kickers + pill badges BANNED EVERYWHERE — sales pages included. Root cause was a rule conflict: her amplifai-video-studio-theme skill PRESCRIBED eyebrow pills while context/design-rules-no-ai-tells.md BANNED them (with an old sales-page loophole). She chose pills-gone-everywhere; the old app-UI-only split is dead.
• Live page fixed + redeployed + verified — removed the "FREE AI VISIBILITY SCORE" eyebrow pill (hero now leads with the headline), the "FULL REPORT LOCKED" badge, the pill-pulse animation; flattened weight/issue/severity tags from 100px pills to plain text or 4px-radius tags. New live bundle index-PnnnwMBD.js; screenshot verified 0 pill DOM elements, 0 horizontal overflow. Files: c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\GEO-Agency\lead-magnet-site\app\src\{App.tsx,Result.tsx,theme.css}.
• Ban baked into the theme skill — C:\Users\srver\.claude\skills\amplifai-video-studio-theme\SKILL.md got a 🛑 Anti-Slop Gate section at the top (runs on every themed page, points to design-rules + premium-web-design Part 2); Pill Badges → plain-text Status Labels; pill-pulse/pulse-dot deleted; 100px pill radius banned. Committed to the claude-skills repo (f9fd75c, pushed).
• Standing rule rewritten — c:\Users\srver\AIOS-Workspace\aios-starter-kit\context\design-rules-no-ai-tells.md §3 removed the sales-page eyebrow exception.
• Memory updated — feedback_sales_page_design_dna.md + MEMORY.md index line.
• CTA parked — she's unsure "Join the Free Community" fits this tool's audience; deferred, one-config-spot change in app/worker/config.ts.
• App-safety-check = already done last session (adversarial, FIX-FIRST → all blockers fixed same session). No re-run needed.
• Git: workspace commit d0b12a3 (pushed as dd4b861) + a parallel-session IdeaScore commit 598722a pushed this session. Both repos clean/pushed.

Key files for next session

• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\GEO-Agency\lead-magnet-site\app\worker\config.ts — the ONE spot to change the funnel CTA when she decides the destination.
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\GEO-Agency\lead-magnet-site\REFRESH-CHECKLIST.md — quarterly refresh, due 2026-10-11.
• C:\Users\srver\.claude\skills\amplifai-video-studio-theme\SKILL.md — now carries the Anti-Slop Gate; any future themed page must pass it.
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\context\design-rules-no-ai-tells.md — the canonical anti-slop ruleset.
• Session log: c:\Users\srver\AIOS-Workspace\aios-starter-kit\outputs\session-logs\2026-07-12-1033.md
• Memory touched: feedback_sales_page_design_dna.md, MEMORY.md

Running state

• Background processes: none (all wrangler dev servers stopped; deploy was one-shot wrangler deploy).
• Dev servers / ports: none.
• Open worktrees / branches: none — both repos on main, clean, pushed.
• Note: the Playwright MCP browser is locked by another tab/session; screenshots this session were taken via a borrowed local Playwright (PROJECTS/App Storefront/app) with channel: 'msedge'.

Verification — how to confirm things still work

• curl -s https://visibility.amplifaiyourbusiness.com/assets/index-PnnnwMBD.js | grep -c "eyebrow-pill\|pill-pulse\|FULL REPORT LOCKED" → expect 0.
• Live site loads headline-first (no pill above "Is your website invisible to AI search?"), 0 horizontal overflow.
• cd c:/Users/srver/AIOS-Workspace/aios-starter-kit && git log origin/main..main --oneline → empty (fully pushed).

Deferred + open questions

• 🔴 PAT rotation — SONDRA WANTS THIS NEXT (her explicit call-out for this handoff). GitHub Personal Access Token is stored in plaintext in both repos' .git/config (aios-workspace + claude-skills) and has been printed into session transcripts. NOT public (git config never uploads to GitHub) — hygiene, not a fire. ~2-min fix: generate a new fine-grained PAT on GitHub (account = digitalbeachgirl; token var GITHUB_PERSONAL_ACCESS_TOKEN in master .env) → update origin URL in both repo configs → delete the old token on GitHub so it stops working. Then close the security note in open-questions.md.
• Open: funnel CTA destination — her call whether "Join the Free Community" is right for this tool's audience (she's unsure she wants to attract coaches via the Amplif-AI community). One-config-spot change.
• Open: announce AmplifAI Visibility (Skool/FB) when she's happy.
• Deferred (from prior session, unchanged): owner-alert on Resend/Supabase send failures (currently only console.error); v2 blog traffic layer (GEO-Agency/blog-strategy.md) + paid deep report on DataForSEO; CEO-dashboard project card not yet added.
• Context was ~262K tokens at handoff (past her 250K freshness line) — this handoff is the reset.

Pick up here

Re-invoke fable-mode first, then rotate the GitHub PAT with Sondra (she flagged it as the thing she wants to work on): walk her through creating a fresh token on GitHub, update origin in both aios-workspace and claude-skills repo configs, delete the old token, and close the open-questions security note.