HALO current-product research synthesis

Canonical source: immutable upstream/shared-drive at 83ab4ba88a30ec33696cc900acebfa1b7fddf400 Research state: PASS / COMPLETE / RESEARCH_ONLY Reconciled: 2026-08-30 Asia/Ho_Chi_Minh

This is the concise entry point for current HALO product truth. The complete human hierarchy lives in research/current-83ab4ba/, and its machine entry point is indexes/manifest.json.

Executive ruling

HALO at 83ab4ba is a materially expanded creator-agency CRM, not the older 39-page mid-Supabase product and not the historical PostgreSQL/Better Auth proof line. It has 61 unique route declarations, 63 Convex schema tables, 314 exported Convex functions, 137 frontend useQuery call sites, 331 terminal Convex reads, 115 schema indexes, 12 source-backed workflow summaries, and nine current provider/storage records.

Its strongest source-defined systems are the creator and onboarding spine, Google-Drive-backed content operations, contracts, customs, creator/staff/ referral money workflows, the unified payment log, gamification, and AI voice. Its primary constraint is trust: browser-held identity, plaintext third-party credentials, public destructive/bootstrap paths, and no source-proven handler-local server-derived authorization across the 314 functions make security containment the prerequisite for production authority. Its main scale constraint is unbounded data access: the static inventory records 234 .collect() calls, zero pagination, 103 guaranteed-unbounded reads, and several global multi-table reads.

The safe program ruling is therefore:

1. preserve HALO's current domain, route, workflow, state, provider, export, and

visible-behavior contracts;

1. contain identity, credentials, destructive paths, and server authorization

before extending authority;

1. bound and measure the worst reads without replacing intentional historical

access with arbitrary caps;

1. prove current route/persona/state/provider behavior with synthetic data;
2. admit only bounded presentation blocks or provider adapters after their

identity, authority, provenance, revocation, recovery, and acceptance gates;

1. never treat an artifact PASS, local synthetic proof, or donor ranking as

production proof or implementation authorization.

Canonical current inventory

The complete maps are routes.json, source-inventory.json, workflows.json, and providers.json.

Product and authority shape

Identity and people

Creators, profiles, teams, assignments, invitations, onboarding submissions, contracts, schedules, announcements, creator views, staff views, and role/ permission surfaces form a coherent product spine. The current login path calls Convex haloAuth and stores role-shaped identity in local storage; Auth0 is mounted but its writer/session authority is unproven. The current local session does not establish a trusted server session and does not reliably carry creator identity. Sidebar filtering and ProtectedRoute are presentation behavior, not backend authorization.

Content and operations

Google Drive owns shared-content bytes while Convex owns the application index, metadata, and workflow. Selected uploads, receipts, and voice blobs use Convex Storage. Contracts have a source-backed create/pending/sign/cancel/remove lifecycle and a 20-byte CSPRNG signing token. Customs has concrete status, payment, submission, attachment, and history paths. Embedded Notes and announcements are useful current features, but no normalized Notes history, ACL, retention, export, or offboarding lifecycle is proven.

Money

Creator invoices, currency rates, referral partners and payments, payment-log entries and confirmations, recurring expenses, attendance, staff payroll, and staff invoices represent substantial agency workflow. They are not yet proven as a mature accounting authority: money uses floating numbers, state vocabularies diverge, broad reads are common, and production rounding, reconciliation, tax, rail, return, and dispute behavior is blocked. The durable research principle is minor-unit liabilities plus reversible maker-checker reconciliation; historical Blnk/PostgreSQL proofs are not current integrations.

Gamification, AI voice, messaging, and analytics

Fourteen active gamification tables and 55 gamification/leaderboard functions make the game board a real source-defined subsystem. AI voice has source, job, generated-clone, and ElevenLabs execution paths. Both still need trusted actor authorization, governance, provider failure semantics, and runtime parity.

By contrast, /messages is a thin webhook form with an empty N8N URL and no messages table; creator analytics selects fixed mock data; account settings retain migration-pending mutations. These surfaces must not be described as mature current domains.

Highest-consequence risks

P0 trust boundary

• Plaintext third-party passwords are stored and exposed through public

credential-management functions.

• The secure-area password path is publicly readable/changeable without a

trusted actor contract.

• Browser-controlled identity and roles substitute for a trusted server

session.

• The inventory found no source-proven handler-local server-derived identity or

capability check across the 314 exported functions.

• Public maintenance, reset, bootstrap, and fixed-secret paths create data-loss

and unauthorized-account risk.

These are static source findings. No real credentials, production data, client systems, or exploit attempts were used.

P0/P1 scale and correctness

• paymentLog.ledger performs eight whole-table reads and filters the visible

range in the browser.

• Drive creator overview performs four complete reads per subscription.
• The monthly/all-time leaderboard performs seven full-table reads.
• Creator/dashboard/customs surfaces use broad reads and N+1-style formatting.
• Money precision, implicit defaults, destructive history paths, inconsistent

errors, and provider retry/idempotency/deletion/export contracts remain open.

The full risk ledger is 09-PERFORMANCE-SECURITY-RISKS.md with machine records in risks.json.

Donor and reusable-block ruling

The canonical current bakeoff contains 17 candidates across ten categories. The top five are Twenty, Documenso, Plane, Teable, and Chatwoot. The first bounded proof descriptors are a Twenty record surface, Teable grid surface, and Documenso signing adapter. This ranking authorizes no code import, fork, runtime, service, mount, migration, or authority transfer.

• Twenty: exact MIT primitive/file port or clean-room record presentation only.
• Documenso: bounded signing adapter; HALO retains contract/token/status truth.
• Plane and Teable: reimplement interaction/presentation patterns over HALO

projections and commands.

• Chatwoot: future federation only after identity, mapping, revocation, and

operations gates.

• Outline, Papermark, AppFlowy Web, and similar services remain deferred or

blocked.

• Buzz product/runtime reuse is rejected by the UI bakeoff. The separate Buzz

sidecar assimilation architecture remains held and not admitted; it cannot own HALO identity, business records, money, approvals, credentials, or audit.

The full allocation is 10-DONOR-REUSABLE-BLOCK-ALLOCATION.md and donors.json.

Stale evidence policy

Earlier 347329a, d74563c, 126073c, and f1487087 work remains available as historical method, strategic context, bounded test intent, or local proof. It is forbidden as current-product truth unless independently reverified at 83ab4ba.

The reconciliation retires, among other claims:

• 38/39 pages, 48 routes, 56/57 tables, 221+22 functions, and 18 domains as

current counts;

• a configured current Supabase runtime or current PostgreSQL/Better Auth

foundation;

• old showroom/browser PASS results as current parity;
• frontend route/sidebar gates as backend authorization;
• indexed reads as necessarily bounded;
• creator analytics, messaging, payroll, or UI admission at either unsupported

extreme;

• the 18-donor Blockroom ranking as canonical;
• any Sol/verifier PASS as donor, production, migration, or authority-flip

authorization.

The exhaustive retirement ledger is 11-STALE-CLAIM-RETIREMENT.md and stale-claims.json.

Evidence limits and next admitted program work

This research does not establish production rows/cardinality, latency, payload size, memory, SLOs, live provider behavior, exhaustive function result/error contracts, server-derived authorization, full 61-route × persona × loading/ empty/error/deep-link parity, retention/residency, restore/RPO/RTO, or client authority decisions.

The smallest safe implementation sequence outside this research lane is:

1. complete secure-login/identity/destructive-path containment on a new reviewed

non-tracking private-mirror descendant;

1. make Payment Log, Drive, leaderboard, creator/dashboard, and customs reads

bounded while preserving totals, history, ordering, and reconciliation;

1. complete synthetic persona/route/state/provider characterization;
2. define the trusted identity aggregate and ports before any PostgreSQL shadow,

reconcile, zero-legacy-traffic, rollback, or authority-flip gate;

1. evaluate one bounded donor presentation or adapter proof at a time only after

the relevant authority and operations gates pass.

Verification receipt

The recovery pass read all 31 persisted files under research/current-83ab4ba/, parsed all 15 JSON indexes, checked manifest coverage and local Markdown links, reproduced the canonical source, route, table, function, read, workflow, provider, domain, donor, and UI-allocation invariants, and refreshed the corpus index after live-lane artifact digests changed. The refreshed corpus contains 201 artifacts across 11 evidence groups with no missing files or digest mismatches. No install, build, browser, container, source-checkout, production, provider, credential, commit, push, or upstream operation was performed.

The machine completion receipt is completion-receipt.json, and the file-first callback is CALLBACK.md.