I'm parked on you

Pick an option on each card and press Done; your answer goes straight back to the session. The raiser's pick is marked. "I'm not sure" and "Take it to the engineering bridge" are real answers.

1

In plain terms. jpco's AppFolio robot account can't see unit lists on the Willows test property, which is blocking every work order we try to send there — should we roll it back to the shared login right now, or try to fix its permissions in AppFolio first?
The full question, as raised

jpco's AppFolio login switched from the shared account to its own 'robot' user yesterday (PR #498, re-seed applied — account-config confirms login.passwordSecretName=APPFOLIO_JPCO_PASSWORD, old context retired). Since then, every AppFolio write that goes through the universal scope guard (appfolio-browser-agent PR #287) for jpco property 45 fails closed: GET /properties/45/units -> 403. Reproduced twice (tonight's turnover-eval-daily cron AND a fresh manual repro just now, same error both times). The create call never reaches AppFolio (scopeGuard aborts first), so no orphaned WOs, but ALSO: the SAME scope guard runs on every real jpco maintenance work-order dispatch (not just the eval), and propflowai's dispatch.ts swallows the create exception with zero logging/Sentry capture, so real jpco (Camellia/Yale) work orders could be failing silently right now with no alert. allowedPropertyIds for jpco already includes '45' and '7', so this isn't a config-allowlist gap -- it looks like the robot AppFolio user itself lacks permission to view the units listing (or a similar report) that Fede's shared login had.

Why, and what was tried
The session raising this recommends: Roll back to the shared login now
the exposure window the cutover's own runbook planned for was 'a couple of minutes'; it's been broken since yesterday with likely silent real-WO impact, and the rollback is fast + reversible while a permissions fix needs AppFolio admin access I don't have
Tried first, unsuccessfully: read propflowai's dispatch/turnover-sync code, reproduced the red eval twice (tonight's log + a fresh manual run with added error logging), traced the thrown error to appfolio-browser-agent's scopeGuard, found PR #498 (jpco robot-login cutover, merged yesterday) via git log, and confirmed via a read-only GET to the browser-agent's account-config admin endpoint that jpco is currently on the robot login with its old context retired

585c45ae is parked on this.

Pick an option above, then press Done.
PropFlow Docs