## Outcome

- **No active FinanceManager production deployment was found.**
- No FinanceManager systemd service or Docker container is running.
- The sprint-6 worktree is **not running** on any listener.
- Audit was read-only: **no service restart, deployment, file edit, secret read, or financial-content read** occurred.

## Current runtime

- Canonical runtime root: `~/jarvis_runtime/finance-system/`
- Expected database: `~/jarvis_runtime/finance-system/data/finance.sqlite3`
- PID files exist but reference dead processes:
  - backend PID `790908`
  - frontend PID `790936`
- Startup logs also exist, but were deliberately not opened.
- Current defaults `8000` and `5173` are occupied by **FamilyDashboard Docker containers**, not FinanceManager.
- FinanceManager has several loopback-only Vite development previews:
  - `4173` sprint 2
  - `4174` sprint 3
  - `4175` sprint 3.1
  - `4176` sprint 4
  - `15174` sprint 4.1
  - `15175` sprint 5 at `480d7a1`
- No sprint-6 process was found.

## Revisions

- Sprint-6 worktree HEAD: `480d7a1b72a950e864c4bb021d3f58af8f8c15f9`
- Canonical repo HEAD: `95155c6127fd2c699ccb7d9674518eac51e4316d`
- These revisions are on divergent branches; neither is an ancestor of the other.
- The target worktree became modified concurrently during the audit:
  - `M src/jarvis_finance/storage/migrations.py`
- Therefore, **do not deploy the current sprint-6 tree until the concurrent change is reviewed and the tree is clean**.

## Service and startup mechanism

Repository scripts use unmanaged background processes and PID files:

```text
scripts/start_vue_dashboard.sh
scripts/stop_vue_dashboard.sh
scripts/restart_vue_dashboard.sh
scripts/restart_backend.sh
scripts/restart_frontend.sh
```

They hard-code the canonical repo at:

```text
/home/agent/.hermes/repos/FinanceManager
```

and use runtime logs/PIDs under:

```text
~/jarvis_runtime/finance-system/logs/
```

Issues:

- Default ports conflict with FamilyDashboard.
- Backend defaults to `0.0.0.0`, exposing it on LAN and Tailnet unnecessarily.
- Frontend uses Vite’s development server rather than a versioned production build/service.
- Restart scripts can kill any process on the configured port via `fuser`; unsafe while defaults collide.
- `system_status()` can incorrectly classify FamilyDashboard listeners as FinanceManager.
- Runtime operations still contain stale host `100.85.29.67`.
- Scripts set `VITE_API_BASE_URL`; the current Vite config instead uses `VITE_FINANCE_API_PROXY_TARGET`. The frontend proxy defaults to `127.0.0.1:8000`.

## Tailscale

- State: `Running`, online
- Host: `PC-1`
- DNS: `pc-1.tailbd371b.ts.net`
- IPv4: `100.101.173.25`
- IPv6: `fd7a:115c:a1e0::4901:ada6`
- Version: `1.98.4-t9e69045b2-ged3a62f14`

Current Serve/Funnel configuration:

```text
https://pc-1.tailbd371b.ts.net/ -> http://127.0.0.1:8765
TCP 18789 -> localhost:18789
AllowFunnel: true
```

Port `8765` has no listener, so the HTTPS URL currently returns **502**. This configuration is unrelated to FinanceManager. Funnel is enabled/allowed and should be explicitly disabled before placing any financial dashboard behind this hostname.

## CORS and access

Finance API defaults include obsolete Tailnet origins:

```text
http://100.85.29.67:5173
http://agent.tailbd371b.ts.net:5173
```

The current PC-1 Tailnet origin is not a static default. Additional origins can be added through `JARVIS_FINANCE_CORS_ORIGINS`, but the startup scripts do not set it. The preferred deployment should avoid browser-to-backend cross-origin traffic entirely by proxying `/api` through the frontend and binding the backend to loopback.

## Rollback and data protection

Code provides:

```bash
python -m jarvis_finance.cli.main backup-runtime-db
python -m jarvis_finance.cli.main verify-backup --file <backup>
python -m jarvis_finance.cli.main restore-runtime-db --from <backup> --yes
```

Backups use SHA-256 sidecars and restore refuses unverified backups. However:

- No atomic application-release rollback mechanism exists.
- No tested one-command service rollback was found.
- Backup inventory has 42 SQLite backups but only 25 checksum files, so not every apparent backup has a checksum sidecar.
- Runtime data, DB, reports, exports, logs, and most backups are currently mode `0644` inside `0755` directories—readable by other local users.
- Secrets are better restricted under a `0750` directory.
- No backup contents or checksums were printed.

## Safest deployment plan

1. **Do not deploy the current dirty sprint-6 worktree.**
2. Select an approved commit and create a clean, detached release worktree or immutable release directory.
3. Run the full required gate:
   ```bash
   make PYTHON=.venv/bin/python verify
   git diff --check
   ```
4. Before migrations, create and verify a runtime DB backup; perform a synthetic restore test to a separate temporary path.
5. Tighten runtime permissions before launch: directories `0700`, sensitive files/backups/logs `0600`.
6. Allocate dedicated, conflict-free FinanceManager ports; do not reuse `5173` or `8000`.
7. Bind the backend to `127.0.0.1` only.
8. Serve a built frontend through a supervised user systemd service or equivalent stable reverse proxy; proxy `/api` server-side to the loopback backend.
9. Disable the existing Funnel configuration. Configure **Tailnet-only Tailscale Serve** to the Finance frontend.
10. Record deployed commit, previous commit, schema version, backup identifier, ports, and service-unit version in a non-sensitive release manifest.
11. Smoke-test only safe surfaces: frontend status, `/api/health`, Tailnet HTTPS, expected CORS/proxy behavior, and absence of direct backend exposure.
12. Roll back application code by switching the immutable release symlink/service reference to the recorded prior commit. Restore the DB only if the migration is incompatible and only from the pre-deployment checksum-verified backup.

## Changes and issues

- **Files created or modified by me:** none.
- **Issues encountered:** firewall rules could not be inspected because root privileges are required; a concurrent worker modified the sprint-6 migration file during the audit.