FamReynaBrain/projects/factory/emi-read-only-discovery-2026-08-18.md

# EMI read-only discovery — 2026-08-18

Scope: manifest/git/runtime/Paseo inspection only. No dependency installation, source/configuration changes, service actions, or secrets access.

## Verified mapping

| Host | Checkout | Git head / branch | Registered Paseo workspace |
|---|---|---|---|
| Mac mini `.102` | `~/Projects/EMI/expoApp` | `4e26cc3` / `master` | `wks_f013c2c89410419b` — `EMI · Expo App — Main Checkout` |
| Mac mini `.102` | `~/Projects/EMI/website` | `d329c0c` / `master` | `wks_baf03fce83b6b3b7` — `EMI · Website — Main Checkout` |
| Mac mini `.102` | `~/Projects/EMI/EMI-Backend` | `c257fd1` / `codex/bible-verse-notes` | `wks_740a1fe0494b5cc9` — `EMI · Backend — Mac mini Checkout` |
| EMI server `.119` | `~/EMI-Backend` (`/home/aeroreyna/EMI-Backend`) | `92320c9` / `master` | `wks_fc39b6c9d2ebc9e0` — `EMI · Backend Production Checkout` |

All four are registered as local/main-checkout workspaces, not isolated worktrees. No `paseo.json` exists in any inspected root. The Mac mini daemon is running/reachable on loopback; providers reported available: Codex, OpenCode, pi, hermes. On `.119`, the daemon is running/reachable on `127.0.0.1:6767`; available providers are Codex, OpenCode, and pi (Claude/copilot unavailable).

## Declared candidate commands (not executed)

Confidence means that the command is explicitly declared by the manifest, not that it is safe, hermetic, or passing.

| Repository | Candidate command | Purpose | Confidence |
|---|---|---|---|
| expoApp | `npm start` | Expo dev server | High |
| expoApp | `npm run web` | Expo web dev server | High |
| expoApp | `npm run ios` / `npm run android` | native development/run | High |
| expoApp | No manifest lint, typecheck, test, or production-build script | — | High absence finding |
| website | `npm run lint` | Vue CLI lint; command sets `NODE_OPTIONS=--openssl-legacy-provider` | High |
| website | `npm run build` | Vue CLI production build; same Node option | High |
| website | `npm run serve` | development server on port 8080 | High |
| website | No manifest test or typecheck script | — | High absence finding |
| Mac mini backend | `npm run dev` | `node --watch index.js` development process | High |
| Mac mini backend | `npm start` | `node index.js` | High |
| Mac mini backend | `npm test` | declared `npx mocha test/auth.test.js` | High command / medium execution confidence: environment and test data were not examined |
| Mac mini backend | No manifest lint, typecheck, or build script | — | High absence finding |
| `.119` backend | same `npm run dev`, `npm start`, and `npm test` declarations | source checkout commands only | High declaration / low direct-host execution confidence: non-login SSH PATH has no `node`/`npm`; runtime is containerized |
| `.119` runtime | `curl --head --max-time 5 http://127.0.0.1:3001/` | reachability probe, not authenticated API health | High; executed: HTTP 302 to `/login` |

Each Node repository has `package-lock.json`; no yarn/pnpm lockfile was found. No `tsconfig.json` or `jsconfig.json` was found in any root, so no typecheck command is evidenced. The backend has `docker-compose.yml` and `test/auth.test.js`; the local app and website have no compose manifest.

## Local-change protection

- expoApp is dirty: modified `Views/PrayerTimer.js`, `components/PrayerTracker.js`, `i18nMessages.js`, `package.json`; untracked `ios/`. Remotes: `gitea`, `origin`.
- website is clean. Remote: `origin`.
- Mac mini backend is dirty: modified `config/cookiesOptions.js`, `config/corsOptions.js`, `index.js`; untracked `.DS_Store`. Remote: `gitea` only (no `origin`).
- `.119` backend is dirty: modified `docker-compose.yml`; untracked `update.sh`. Remote: `origin`.

Do not create a worktree from, reset, stash, clean, or dispatch an editing agent into any dirty checkout until the owner identifies and protects those changes. The existing workspaces point directly at those checkouts.

## `.119` runtime, service, and deployment facts

- Docker is the active system service. Container `emi-backend-app-1` (image `emi-backend-app`) has been up about five hours and publishes `0.0.0.0:3001` and `[::]:3001` to container port 3001.
- Host port 3001 is listening publicly on IPv4 and IPv6. The root probe returned `302 Found`, Express-powered, redirecting to `/login`; this confirms listener/reverse-route behavior only, not application health, authentication, dependencies, or database connectivity.
- `node index.js` is running in the backend container. The checkout's compose file exists, but it was not read because it is locally modified and may contain deployment-sensitive configuration.
- A user-managed Paseo daemon and supervisor are running. The CLI works after placing the discovered NVM Node path on `PATH`; its initial non-login SSH invocation failed only because that PATH was absent.
- Unknown: authoritative deployment/update procedure; relation of `/home/aeroreyna/EMI-Backend` to the running container (bind mount versus image build); compose project/working directory; image provenance; rollback procedure; authenticated/API health endpoint; database dependency health; expected Node version; and whether untracked `update.sh` is the intended release mechanism.

## Human review required before `paseo.json` or worktree/agent setup

1. Confirm ownership/disposition of every listed local modification and untracked path, especially `.119` `docker-compose.yml` and `update.sh`.
2. Select one repository and bounded goal; main-checkout workspaces are not writable task targets. Approve an isolated worktree location and branch policy for that repository.
3. Review the repository-specific command contract rather than inventing missing lint/typecheck/test/build steps; decide whether existing commands may access external services or mutate data.
4. For `.119`, verify the deployment source-to-container relationship, named deployment executor, health endpoint, rollback procedure, and a separately approved production boundary before any agent/worktree or `paseo.json` work.
5. Approve provider choice and required permissions; no provider/workspace/agent state was changed in this lane.

## Proposed next bounded task

Human-approved, read-only backend release-path audit on `.119`: inspect only non-secret Docker/compose metadata and container mount/image metadata to establish checkout-to-container provenance, deployment command, health endpoint, and rollback evidence; write one update to this record and make no runtime changes.