ELP · Exponential Leader Practice · John Anderson / CEO Advantage
Staging (ceoa.braceyourself.solutions) is 96 commits ahead of production. This page groups that work into real features, states what each one does, and says what's actually safe to ship.
Checked live against the desktop repo and the running staging stack · nothing below has been promoted or approved
Waiting on you
Nothing has been promoted. Three feature groups below are marked needs verification or do not promote yet — they need a live check on staging (or, for one, a finished fix) before they're safe for John's clients. Everything else is small, low-risk, and ready whenever you say go.
The staging site itself
All ten containers (php, nginx, database, redis, horizon, brain, gotenberg, scheduler) are running, and the live page returns real content, not an error page. This is the tree the 96 commits below actually live on.
Ready to promote
Small, verified fixes. Nothing here touches money, auth, or a schema in a way that carries real downside.
Two bugs together made every empty field (a blank goal slot, or any field with no text yet) accept focus but eat every keystroke on live staging. This is a data-entry bug real users would hit constantly.
A route that shows one client's weekly triangle was silently redirecting instead of blocking when someone tried to view a triangle belonging to a different tenant, because a generic "not found" handler swallowed the real error. Now it correctly refuses the cross-tenant request instead of masking it as a normal redirect.
The toolbar's Export dropdown now anchors correctly to its own button instead of floating in the wrong spot.
The admin panel no longer polls a "who's online" endpoint when the coach-prewarm feature is switched off for that account.
Several commits remove test-runner calls from git hooks and fix CI trigger config, per your own standing rule that tests never run in hooks. None of this touches anything a client would see.
Needs verification
These are substantial and the code looks finished, but each one needs a genuine live check — a real signed-in session, a real email, a real API token — before it goes in front of John's clients.
A brand new screen letting a human coach run a live Legacy Map session: track which stage you're in, capture notes per stage, advance/go back. This is a real, sizeable feature built for John's own methodology. The build history shows every flagged issue from its adversarial review was addressed, but I found no record of it being clicked through live on staging.
A new programmatic API: exchange an email/password for a token, then list/read/update a client's own documents by that token. Worth noting: the build process itself caught and fixed a real cross-auth leak during testing (a web session could silently authenticate API requests with no token at all). Token revocation and rate-limiting were added afterward. This is a new auth surface reaching client data — the highest-risk category in the pending set — and deserves a live token-mint-and-call test before production, even though the code history looks careful.
Scheduled nudge emails (weekly, month/quarter-end) plus a "email me this as a PDF" button on weekly triangles. Tests only fake the email send (Mail::fake) — nobody has proven a real email actually arrives with a real attachment on staging.
Do not promote yet
This is the one item I'd actively hold back, based on its own build history rather than a guess.
Lets a client customize when their weekly reminders send. Its own commit trail is explicit: a fix-pass report on staging's version states two adversarial findings were still open when that work landed. A later attempt to close them out happened on a separate, unmerged branch — and that attempt was reviewed again and refuted (3 major findings). The fixed version never made it back onto staging.
The one thing worth reading twice
Everything in Ready to promote is safe to ship today. The cross-tenant security fix is the highest-priority item in that group. Nothing else needs to wait on it — but nothing in Needs verification or Do not promote yet should go out until it's actually been checked or fixed.
A note on main vs staging
I checked this directly rather than assuming. Those 4 commits are merge-PR commits recording staging work that was already promoted earlier (PRs #204, #206, #208, #209). A direct diff confirms production's content is fully contained in staging except for a handful of documentation-file deletions — there's no independent hotfix on production that staging is missing.
Out of scope for this decision
The desktop checkout has well over 150 other branches and worktrees (in-progress features, experiments, WIP snapshots). None of them are merged into staging yet, so none of them are candidates for a production promotion right now — they're a separate backlog question, not part of this one. A couple worth knowing about if you're curious: a multi-tenant "organizations" model and a billing/Stripe integration are both mid-build on their own branches, untouched by anything above.