Pulse Split — Sol Architect Review

The Good

• ✅ publish-briefs.py is the single writer — no other path writes to Pulse data
• ✅ server/api/brief.ts reads only from pulse-site/data/ — zero vault paths
• ✅ server/api/stock/[ticker].ts fetches Yahoo Finance only — clean
• ✅ Chat context builds from PUBLIC_BRIEFS only — no vault, no private data
• ✅ Account gate correctly differentiates public vs private brief serving

Leak Vectors

🔴 CRITICAL: /api/charts serves from vault (line 4)

const CHARTS = resolve('/home/ubuntu/workspace/min/obsidian-vault/Daily Briefings/charts')

This resolves and serves image files directly from the vault. Charts contain portfolio visualisations, holdings, trade signals. No auth gate. Any visitor can enumerate chart files. Fix: publish charts to data/charts/ alongside briefs.

🟡 MODERATE: chat.ts references ~/.solos/personas/min.md

Not a vault leak, but breaks the standalone project boundary. Copy persona text into Pulse's own config or bake into the chat handler.

🟡 MODERATE: Sanitization edges

publish-briefs.py strips capital figures (keyword-anchored $ regex) and portfolio/watchlist/charts sections. Worth adding a pass for any line containing $X,XXX+ regardless of keywords — portfolio data sometimes appears outside named sections.

Account Gate Assessment

HMAC + localStorage is fine for test phase. Threat model: public random visitors should not see private data. A Bearer token in localStorage prevents casual scraping. Upgrade considerations:

• Switch to HttpOnly cookie (requires backend-proxied auth, not Nuxt SPA-only)
• Rate-limit /api/login to prevent brute-force

Eve Structure Mirror

Pulse is simpler — Nuxt SPA + API + HMAC gate. The only structural gap is the charts leak.

Priority Order for Public Launch

1. IMMEDIATE (SHIP-BLOCKER): Fix charts.ts — copy chart images to data/charts/ in publish-briefs.py, serve from there, remove vault path
2. SHIP WITH: Account gate as-is (HMAC + localStorage)
3. SCHEDULE NEXT: Inline/relocate ~/.solos persona reference in chat.ts
4. DEFER: HttpOnly cookie upgrade, rate-limiting, improved sanitization (belt-and-braces only)