Add cross-project dashboard surface audit and Ops Hub v2 build spec

[DaveHomeAssist]

Adds two documents under docs/ops-hub-v2/, plus README and CHANGELOG pointers. Docs only — no code changes, and no remediation was executed.

What's here

File	Contents
docs/ops-hub-v2/AUDIT-2026-08-18.md	Read-only audit of every historical cross-project dashboard, command center, Ops Hub, Code Dashboard, project manifest, and public portfolio surface. Each artifact classified preserve / migrate / archive / unlink / remove-from-public.
docs/ops-hub-v2/OPS_HUB_V2_SPEC.md	Build spec for the consolidated replacement: registry schema, ops-state.json v2 contract, nine enforced invariants, UI zones, build order, acceptance criteria.

Findings, from crawl evidence rather than inference

Everything below was verified by anonymous curl against the live host and the already-public project-manifest.json on 2026-08-18.

• /command-center-061eed/ serves an internal ops console at HTTP 200 with no robots directive anywhere in the document — the string noindex appears zero times in 229 KB. No canonical, no description, no <h1>. Its manifest entry sets visibility: public, so the hub renders a card linking to it. Recorded design intent was "public (noindex)"; it was never implemented, and nothing existed that would have caught the gap. The surface is also regenerated by recurring automation, so a manual edit to the published output gets reverted — the fix has to land in the generator.
• visibility has no enforcement anywhere. Of the 12 unlisted projects with live URLs: 1 carries noindex, 10 carry no robots meta at all, and 1 carries an explicit index, follow that directly contradicts its own manifest row.
• sitemap.xml and project-manifest.json are disjoint. 48 of 48 on-host project URLs return 200; exactly 1 appears in the sitemap. 8 of the 9 sitemap entries are not projects at all. The sitemap isn't stale — it's an orphan from a different lineage.
• Project discovery is JavaScript-only. The served hub HTML contains no project anchors.
• / and /public-hub.html share a <title>, serve different bodies (91 KB vs 31 KB), and each self-canonicalizes to its own URL.
• The public manifest still carries localPath and runCommand columns. Empty on all 79 rows today — a closed leak with an open channel.

Root cause, and what the spec does about it

Six dashboard generations were built. Each was a new surface; none established a contract underneath. The concrete expression today is that visibility is decorative metadata — nothing converts it into a robots directive, a sitemap entry, or a link-rendering decision.

The spec inverts the relationship (registries and state contracts own truth; the dashboard renders) and encodes nine invariants as CI checks that fail the build. That's deliberate: the previous five generations already demonstrated that conventions don't hold. The load-bearing one is fail-closed export — every prior generation defaulted to publish and relied on review to catch mistakes, and review did not catch them.

The spec also preserves rather than replaces the Ops Hub v0.5 architecture, which was the one generation that already had the right shape.

Publication boundary

code-dashboard is a public repo, and the audit's central finding is that internal ops material leaked onto public infrastructure — so publishing an unredacted inventory here would reproduce the exact defect being reported.

Both documents are therefore public-safe by construction: they cite only already-public evidence (anonymous crawl results, the public manifest, architecture description) and refer to internal sources by role rather than by name. No workspace URLs, local paths, private project identifiers, run IDs, or client detail. §11 of the spec specifies that the Ops Hub v2 implementation itself — registry, state files, rendered private dashboard — belongs in a private repo, not this one.

Review notes

• Nothing was archived, unlinked, de-indexed, deleted, or republished. Remediation is split into three approval-gated bundles at the end of the audit.
• Recommended order is Bundle A (safety) first — it's the only confirmed high-severity exposure, it's actively being re-published by automation, and it's cheap.
• One open decision blocks a severity grade: /act-two-catering/ carries noindex,nofollow and is the only unlisted page whose live directive matches its declared visibility. If it's a live commercial page that's a serious defect; if it's a client preview it's the one correctly configured page on the property. It can't be graded without you. The audit's actual finding is that the intent isn't recorded anywhere — hence the required indexPolicy + reason field in the v2 registry schema.

---

Generated by Claude Code