Everything the walkthrough turned up, in one place — security items waiting on your go-ahead, decisions only you can make, and the top capability gap per tool. Check things off as you clear them; it's saved on this device.
gh login) instead of touching it.401 Bad credentials) — it was already inactive, so no live exposure and nothing to revoke on GitHub's side. Stripped it from .git/config on TI-VPS-01 anyway (git remote set-url to the plain HTTPS URL, no embedded credential). No replacement key added — a full-box audit found this remote has never actually been fetched/pulled/pushed from the VPS itself (no FETCH_HEAD, no cron/systemd job touches it); pushes happen from Alfred's own gh credentials instead, so the VPS doesn't need git auth at all.Agent 0 Webhook workflow's code node still checks for it, even though nothing sends it anymore. Low urgency (that webhook has never fired), but rotate or remove it when the dead path gets cleaned up.JWT_SECRET) currently covers both login sessions and QuickBooks token encryption, with an unsafe fallback if it's ever unset. Give QBO its own dedicated key..env is world-readablechmod 600 and move on.main branch went different ways from the same starting point, and the server that's actually running doesn't cleanly match either one. Won't auto-merge this on a live service — needs your call on how to reconcile it.Agent 0 workflow it was originally built to front. Reconnect it to Agent 0 (which needs its own debugging first — it's never actually run), or upgrade Dashpane's own agent backend instead.guystripapp.ti-builds.com — that isn't mentioned anywhere in ti-context. Just inventoried, not audited. Needs a conversation about what it is before anything else happens to it.--help as its command — looks orphaned from earlier manual work. Worth a look before deleting it.Already tracked in ti-context, still true as of this pass. Listed here so it's all in one place, not because anything changed.
ti-dashboard, repo says ti-dashpane