c-ashud-asga-collector-dbahu-nqwi-af

Website source synchronization and local backups

Authorized October 22, 2026 in the chat Plan founder journal and backups. The user clarified that GitHub is the source repository that will connect to the website; local files are the backup. This supersedes the earlier description of GitHub as the backup destination. The website’s hosting connection has not been configured or verified in this task. No application milestone or Supabase/cloud setup is authorized by this workflow.

Destination and access

• Local folder: /Users/denis/Desktop/Contact Collector.
• Private repository: https://github.com/MonkMonay/c-ashud-asga-collector-dbahu-nqwi-af.
• Remote: origin; branch: main; upstream: origin/main.
• The user confirmed private visibility. GitHub Desktop displayed the repository lock and successfully pushed the initial source upload.
• GitHub Desktop’s existing sign-in works. Command-line Git currently has no HTTPS login; the connected GitHub plugin returns 404 for this repository. Neither failure means the successful Desktop push failed. Do not copy tokens out of Desktop, the Keychain or browser storage.
• Existing local pull.ff=only is retained. No repository visibility, collaborator, deployment, webhook, CI, credential or Supabase settings are changed by sync.

Schedule and session workflow

The hourly Codex scheduled check Sync Contact Collector to GitHub (ID sync-contact-collector-to-github) in the originating chat performs the procedure below. Manage or pause it in the desktop app’s Scheduled view; this document alone does not schedule work. Keep the computer awake and Codex running. GitHub Desktop must remain installed and signed in while it is the authenticated transport.

Development sessions may also fetch before work and commit/push after completing and verifying their authorized task, under the standing permission in AGENTS.md. Hourly checks skip this checkout while another development chat is actively using it. If that cannot be established, defer working-tree mutations until it is safe. Never disturb an existing index selection, merge/rebase/cherry-pick, detached HEAD or Git lock.

Local backup copies

Store dated immutable copies under /Users/denis/Desktop/Contact Collector/.local-backups/. This directory is ignored by Git and must never be force-added or uploaded. Keep the regular checkout for editing; preserved snapshots survive an ordinary pull changing those editable files.

For each distinct committed version, create a source .tar.gz with git archive and a standalone .bundle with git bundle create ... --branches. Name both with the America/New_York date and commit prefix. Use explicit paths, never overwrite an existing verified snapshot, and keep all copies until the user sets a retention policy. Do not include internal Codex refs with --all.

Verify the source archive against that commit’s files, run git bundle verify, and store a small manifest with the full commit, date/timezone and SHA-256 checksums. Only count successful, readable copies as a backup. Skip duplicate copies of the same commit. Before a pull, preserve the current committed version; after a completed local commit, preserve its version before pushing. If snapshot creation/verification fails, stop the sync and report the failure.

Recovery uses a separate empty folder: clone a verified bundle there with git clone --branch main /absolute/path/to/snapshot.bundle /absolute/path/to/recovery-folder, or extract the source archive into a separate folder after verifying its checksum. Inspect the recovered files before replacing any live checkout. Do not automatically restore over current work.

These archives contain committed source, documentation and version history. Uncommitted edits remain in the editable local folder and are not included until committed. Secrets, ignored files, Supabase data/media and full chat exports require a separately scoped local backup policy. A backup on the same disk protects previous versions, but cannot survive loss of that disk.

Safe sync procedure

1. Read applicable instructions. Confirm the exact working directory, origin destination, main branch and upstream. Do not switch a user’s current branch or substitute another repository. Inspect status and any staged work.
2. Fetch the existing remote without modifying the working tree. Prefer authenticated command-line Git when available. Otherwise use GitHub Desktop: verify its selected repository, use Fetch origin, and confirm completion. The initial setup used Desktop successfully. If its view is stale after a shell commit, reacquire the app and verify the displayed commit before pushing.
3. Compare HEAD with the freshly fetched origin/main. First preserve and verify the current committed version locally. If the branch is clean and only behind, run git merge --ff-only origin/main, then preserve the resulting version locally too. If histories have diverged, or incoming commits coexist with local edits, preserve everything and report that reconciliation is needed. Do not stash, rebase, merge divergent histories, reset or force-push automatically.
4. If the remote is not ahead, review completed local source/documentation changes for normal synchronization. Respect existing staged work owned by another task. Require relevant verification evidence for the exact version being pushed; code changes need the applicable project checks, while documentation-only changes need documentation/diff checks. When completion or verification is uncertain, leave the work local and report the missing evidence. Do not push drafts to main for backup purposes because it is intended to feed the website.
5. Inspect new files and deletions; scan the actual staged content for credentials and sensitive data without printing values. Stage only reviewed paths. An empty diff needs no commit. Recheck branch/index, commit the completed work, and create/verify its local archive and bundle before pushing main normally. Use Desktop’s Push origin when CLI authentication is unavailable. Non-fast-forward rejection requires a new fetch/review; never force it through.
6. Confirm successful push, fetch again, and compare local and remote commit IDs. Report repository synchronization and local backup verification separately. Inspect remaining local changes without claiming uncommitted files are inside the archives. No-op fetch/fast-forward checks are valid verification, but do not claim an actual incoming change was exercised when none existed.

The automation stays quiet when nothing changed or the same non-actionable state persists. Report a newly encountered failure, conflict, credential problem, unexpected remote/branch, or recovery requiring the user’s attention. Preserve successful backup evidence in chat or the scheduled run; do not create new documentation commits solely to log every routine no-op run.

Included and excluded data

Synchronize application source, manifests/lockfile, migrations, test source and clearly synthetic fixtures, project specifications, documentation and future sanitized founder-journal entries. Preserve the original handoff as historical material. Keep the local backup files themselves off GitHub.

Honor .gitignore. .env.local and other actual environment files, dependencies, Next build output, coverage and browser-test output remain excluded. .env.example contains placeholders only. Also exclude credentials/private keys, real contact imports or exports, private photos, database dumps/volumes and unreviewed raw conversation exports, even if someone places them outside an ignored directory. Do not use git add -f or push a flagged secret to make backup succeed.

Local snapshots preserve source/documentation and Git branch history. They do not back up Supabase records, authentication accounts, private media, ignored local files or the full chat archive. Supabase setup and its data-backup policy are explicitly deferred by the user. Hosting setup, migrations, seeds, database resets and paid provider calls are outside this workflow. Future hosting may deploy from main; that is why automatic pushes require completed, appropriately verified work.

Initial verification

• git status --short --branch: the repository initially had no commits and all project files were untracked.
• git remote -v: confirmed the configured repository above.
• GIT_TERMINAL_PROMPT=0 git ls-remote --symref origin HEAD: sandbox DNS failed; the authorized network retry reached GitHub but had no command-line login.
• GitHub plugin get_repo: 404; Desktop was the working authenticated fallback.
• git check-ignore .env.local node_modules/ .next/ test-results/ playwright-report/: all five paths ignored.
• Read-only Python scans of the 160 candidate files and then their staged blobs: no matches for private-key headers, common GitHub/provider/AWS token formats, JWTs or credential-bearing URLs. This bounded scan is not a guarantee that every possible secret format is detectable.
• git commit -m "Backup current Contact Recall application and project history": created initial commit 3f0072562767b2d43540f0da754dea85262ef39d with 160 files.
• GitHub Desktop Publish branch: completed the push to the existing repository; UI reported push complete.
• git rev-parse HEAD and git rev-parse refs/remotes/origin/main: both returned that initial commit after the push. git status --short --branch showed a clean main...origin/main checkout.
• git diff --check: passed for the sync documentation changes. The hourly automation was created ACTIVE and viewed through the app’s automation tool. The first unattended execution remains unverified.

The initial source upload used the historical commit title quoted above. Application type checks, lint, unit/integration/browser suites and production build were not rerun for that Git/documentation-only task. Their earlier results remain in BUILD_STATUS.md with their original scope. Later local-backup verification is recorded in the current BUILD_STATUS entry.