Post-run: independent verification section (Hermes), webroot relocated to /mnt/better/appdata/retireapp, gaps & limitations, deploy.sh path fix

REPORT.md

@@ -1,6 +1,6 @@
 # RETIRE PLANNER — Execution Report
 
-**Run:** DSH local agent, PLAN.md v1 (2026-10-08). Status: **IN PROGRESS**.
+**Run:** DSH local agent, PLAN.md v1 (2026-10-08). Status: **COMPLETE** — independently verified post-run by Hermes (see final section).
 **Target:** https://retire.krisforbes.ca — Canadian retirement calculator, 100% client-side.
 
 ---
@@ -52,9 +52,10 @@
 - `.gitignore` excludes `.fetch/`, `dsh-run.log`, duplicate `site/vision/*.jpeg`.
 
 ## Stage 6 — Unraid container ✅
-- `scripts/deploy.sh` (idempotent): `rsync -az --delete site/ → /mnt/cache/docker/retireapp/`, `chmod -R a+rX`, `docker start retireapp || docker run -d --name retireapp --restart unless-stopped -p 8103:80 -v /mnt/cache/docker/retireapp:/usr/share/nginx/html:ro nginx:alpine`, marker grep → `DEPLOY-OK`.
+- `scripts/deploy.sh` (idempotent): `rsync -az --delete site/ → /mnt/better/appdata/retireapp/`, `chmod -R a+rX`, `docker start retireapp || docker run -d --name retireapp --restart unless-stopped -p 8103:80 -v /mnt/better/appdata/retireapp:/usr/share/nginx/html:ro nginx:alpine`, marker grep → `DEPLOY-OK`.
 - Created: `docker run` → container id `978374…`; `docker ps`: `retireapp Up … 0.0.0.0:8103->80/tcp`.
 - Pitfall found & fixed: workspace-written files were mode 0640 → nginx 403 on `/` and `*.css`; `chmod -R a+rX` baked into deploy.sh. Re-ran deploy.sh → `DEPLOY-OK` (idempotency proven). Host-local: index/css/app.js/engine.js = 200, marker count 1.
+- Post-run (Hermes, ~23:20 EDT): webroot relocated `/mnt/cache/docker/retireapp` → `/mnt/better/appdata/retireapp` per plan Stage 6 + skill convention (appdata lives on /mnt/better, never /mnt/cache); container recreated, old dir removed, origin marker re-verified after relocation. `scripts/deploy.sh` updated to match.
 
 ## Stage 7 — Caddy reverse proxy ✅
 - Backup: `/mnt/cache/docker/caddy/config/Caddyfile.bak-retire-<ts>` (cp before edit). No pre-existing retire block (grep 0).
@@ -106,4 +107,26 @@ Final checklist (PLAN.md “Done criteria”):
 - Redeploy after edits: `bash scripts/deploy.sh` (idempotent; prints DEPLOY-OK).
 - Rebuild constants: `node scripts/build_canada.js` (fetches canada.ca; provenance in `scripts/constants-evidence.json`).
 - Regenerate vision art: `bash scripts/gen_all.sh` (reads nano key from `~/.hermes/.env` at runtime).
-- Tests: `node tests/engine.test.js && node tests/ui.smoke.js`.
+- Tests: `node tests/engine.test.js && node tests/ui.smoke.js`
+
+## Gaps & honest limitations
+- L1 Inputs are user-reported; no account linking or verification — garbage-in, garbage-out (stated on site).
+- L2 CPP estimate is the main approximation: 25% replacement on YMPE-capped average earnings × contribution-months ratio — not the official contributory-earnings calculation with the general drop-out. Users can override with their My Service Canada estimate.
+- L3 GIS annualized from 2026 quarterly constants with a linear phase-out; real GIS uses monthly income and different exemptions.
+- L4 Ontario surtax modeled gross-basis; Quebec QPP and QC payroll taxes not modeled (UI insight tells QC users to add QPP as pension income). Manitoba 2026 BPA frozen at the 2025 value.
+- L5 Estimates only — not financial advice (stated on site); future program/tax changes not anticipated.
+
+## Post-run independent verification — Hermes (GLM), 2026-10-08 ~23:20 EDT
+
+DSH's report was treated as a self-report; every external claim was re-verified independently:
+
+- **Engine + UI tests re-run:** `node tests/engine.test.js` → 36/36 PASS; `node tests/ui.smoke.js` → all PASS (incl. G4 SVG render assertion).
+- **DNS:** `dig +short retire.krisforbes.ca @1.1.1.1` → `CNAME dyn.krisforbes.ca` → `172.97.221.30` (current UDR7 WAN).
+- **Origin:** `http://192.168.0.123:8103/` → 200 + marker + `<title>Retire Planner — Canadian retirement, modelled properly</title>`.
+- **Unraid:** `retireapp` Up (nginx:alpine) on 8103; `CaddyV2` Up; Caddyfile block present; Let's Encrypt cert for `retire.krisforbes.ca` obtained; `https://retire.krisforbes.ca:2443/` via `--resolve` → HTTP/2 200 (nginx/1.31.3).
+- **Public URL from workspace (corroborates Stage 9):** `curl https://retire.krisforbes.ca/` → 200, `remote_ip=172.97.221.30`, valid TLS, 21 ms.
+- **Genuine off-LAN (Midhurst troublebox via paramiko, different ISP):** `https://retire.krisforbes.ca/` → **200** + marker + title; assets all 200 — app.js 36,992 B, style.css 7,273 B, engine.js 20,184 B, canada.js 11,999 B, vision/manifest.json 358 B, vision/hero.png 277,366 B, vision/dock.png 312,641 B; `http://` → 308 → https; "Your plan so far" panel present in served HTML.
+- **Secrets:** real values (nano-gpt key, Cloudflare token, Gitea token) extracted and grepped against every tracked git revision and the whole worktree → **0 hits**; 0 raw `cfut_` tokens in the worktree.
+- **Done token:** `dsh-run.log` line 19 = `RETIRE_PLANNER_DONE` (final answer line; later lines are the harness stderr dump).
+- **Correction applied post-run:** webroot relocated to `/mnt/better/appdata/retireapp` (see Stage 6 note above).
+- **Deviations from plan (accepted):** CF record TTL 120 s (plan said 1; grey cloud, harmless); questionnaire is 17 steps (14 base + 3 conditional couple sub-questions); REPORT Stage 4 placed before Stage 3 (generated early, labeled)..

scripts/deploy.sh

@@ -3,9 +3,9 @@
 set -euo pipefail
 cd "$(dirname "$0")/.."
 SSH="ssh -F /dev/null -o BatchMode=yes -o ConnectTimeout=10"
-$SSH root@192.168.0.123 'mkdir -p /mnt/cache/docker/retireapp'
+$SSH root@192.168.0.123 'mkdir -p /mnt/better/appdata/retireapp'
-rsync -az --delete -e "$SSH" site/ root@192.168.0.123:/mnt/cache/docker/retireapp/
+rsync -az --delete -e "$SSH" site/ root@192.168.0.123:/mnt/better/appdata/retireapp/
-$SSH root@192.168.0.123 'chmod -R a+rX /mnt/cache/docker/retireapp
+$SSH root@192.168.0.123 'chmod -R a+rX /mnt/better/appdata/retireapp
-  docker start retireapp >/dev/null 2>&1 || docker run -d --name retireapp --restart unless-stopped -p 8103:80 -v /mnt/cache/docker/retireapp:/usr/share/nginx/html:ro nginx:alpine >/dev/null
+  docker start retireapp >/dev/null 2>&1 || docker run -d --name retireapp --restart unless-stopped -p 8103:80 -v /mnt/better/appdata/retireapp:/usr/share/nginx/html:ro nginx:alpine >/dev/null
   sleep 1
   curl -sf http://127.0.0.1:8103/ | grep -q "retire-planner v1" && echo DEPLOY-OK'