10/6Maintenance mode
9/22Automated scrubbing from ReadyGOP with daily email digest
9/15Created a new app at optouts.coefficient.org
9/15Live behind hub Google auth at /opt-outs; public URL and password gate retired
Skye shipped the service-binding proxy and tile (verified, including upload POSTs and the cookie collision check: none, hub uses tools_session). App redeployed with SCRUB_TRUST_PROXY_AUTH=1, a new env flag that skips the app's own password page; flag is off by default so Walker's original gate is unchanged anywhere else the app runs. workers_dev and preview URLs disabled: the hub's Google sign-in is now the only way in (public URL 404s, /opt-outs/healthz 302s to hub sign-in when anonymous). Single sign-in end to end, per house auth standard for internal apps.
9/15Deployed live to Cloudflare Containers as jessica-scrub-app
Walker's scrub app (Flask + DuckDB Docker image) deployed code-unmodified behind a thin Worker. Live at https://jessica-scrub-app.ryan-b48.workers.dev behind a password gate; AWS credentials bound from the account Secrets Store (coefficientp2p key pair), nothing in the bundle. Verified against the live bucket: login flow, org freshness table (4 orgs). Ryan approved via Signal. Skye requested (thread 1a0a5d0ae266c84f): tools hub tile plus mounting behind the hub's Google auth at /opt-outs via service-binding proxy; the public workers.dev URL gets disabled after that cutover. Known limits: uploads capped around 100-200 MB by Workers; container cold start ~15s after 30 min idle.
Show 3 older
9/14Walker acquired credentials for the Creative Direct and Big Dog opt-out buckets; first batch of opt-outs uploaded successfully
Open questions from PUSH: get more people access to limit bottlenecks; streamline communication; clearly define which clients/accounts go into which buckets
9/14Walker is the only one who can currently update this and it's all manual
9/14Promoted from intake (submitted 9/14/2026 by Jessica (app)). Why: MAGA, Inc. asked for it
