Child issues filed:
- Phase 0 — #600 (lock the facts)
- Phase 1 — #601 (cert-first identity + canonical price, the core)
- Phase 2 — #602 (Card Hedge catalog crosswalk)
- Phase 3 — #603…
Follow-up landed: GitHub PR #410 (main 48a5be1a, 2026-09-04). The promote workflows now chain off verify finishing green on main instead of the image build, so the d0cb3b47 case (red verify still…
Both halves in motion 2026-09-04. SETTINGS (done): main protected — required checks verify + gitleaks, force-push + deletion blocked, no required review (D2), admin bypass left on as the…
DECIDED (Kris, 2026-09-04): the fast lane stays — merging to main keeps auto-promoting to prod. The 2026-09-03 comment above specifying workflow_dispatch as the ONLY path to production is…
DONE (settings half) — branch protection is now live on main, 2026-09-04:
- required status checks:
verify+gitleaks— red cannot land on main, which is the property that…
Prep complete against production, verified:
- gambit_app role created: SELECT/INSERT/UPDATE/DELETE confirmed via has_table_privilege (true/true/true), TRUNCATE confirmed false. Not superuser. -…
STATUS — PR Gambit-Inc/gambit#398 open, verify green, changes requested.
Blocker found in review: routes/public_catalog.py:34 and routes/api_explorer.py:24 still
hold byte-identical…
STATUS — PR Gambit-Inc/gambit#399 open, verify green, changes requested.
Two money-path findings from review, both small: the max(price_date) subquery picks the
newest row before testing…
STATUS — both halves of this plan are open as PRs, verify green on both, changes
requested on both (2026-09-04):
- kana corruption at ingest → Gambit-Inc/gambit#398, see #579 for the…
STATUS — PR Gambit-Inc/gambit#397 merged (20:49 UTC). The archived-SQL half landed earlier as #389.
FOLLOW-THROUGH — PR Gambit-Inc/gambit#396 extends this closed issue: a sweep of all ~323 backend routes for the same pattern, adding limiters to 33 more across 19 files, plus an `import_max_upload…