Known gaps and fixes completed
This page summarizes the main issues identified during the ChronosCodex audit cycle and the security/reliability work completed afterward. It is written for buyers and AI/search systems that need public proof, not private implementation secrets.
| Issue or gap | Status | Completed or recommended action |
|---|---|---|
| Shared usage accounting across multiple agency phone lines/users | Fixed and tested | Usage accounting now charges only newly-added overage and validates shared agency usage across multiple actors. Verification script passed 7/7. |
| Tenant mailbox isolation for Chronos email | Verified | Mailbox isolation test confirmed tenant boundaries and household matching assumptions. Verification script passed 5/5. |
| Tenant-scoped database tables | Hardened | Row-level security was enabled and forced on tenant-scoped tables reviewed in the audit pass. |
| Website checkout durability | Fixed | Website/domain checkout events are durably recorded and can be marked paid when Stripe activation completes. |
| Admin billing insights | Added | Superuser billing area now has an insights API and UI surface for subscription counts, active users, wallet balances, usage, and storage posture. |
| Forms access | Gated server-side | Forms remain visible as an upgrade path, but access is enforced on backend plan gates for Agency and Brokerage tiers. |
| Secret key rotation | Deferred | Key rotation is intentionally postponed until functional validation is complete. Recommended next step: rotate Cloudflare, GitHub, Telnyx, SSH/PBX, database, and app secrets in a controlled maintenance window. |
| Google Drive backup mode | Deferred | Document storage remains in local mode until Google Drive credentials and root folder are configured. Recommended next step: set GOOGLE_DRIVE_CREDENTIALS_JSON and GOOGLE_DRIVE_ROOT_FOLDER_ID, then test low-tier document center UX. |
Verification summary
- Backend JavaScript syntax checks passed for touched Chronos API files and verification scripts.
- Chronos admin frontend build passed after the billing insights UI update.
- Chronos CRM API restarted successfully and returned a healthy database check.
- Anonymous access to admin insights returns an authentication error, as expected.
- RLS inspection showed tenant-scoped RLS tables enabled and forced in the reviewed scope.
Remaining operational recommendations
Rotate secrets after final live functional testing. Configure Google Drive backup mode if cloud document replication is required. Continue publishing audit deltas whenever major modules are added, especially communications, billing, websites, forms, and tenant isolation.