# conversion-desk — operating card draft

Review stage: machine-drafted; owner review pending. Static references are not verified operation.
Source: webhostingdoo/conversion-desk at aa2e5ea92c3ee3238797b3fd32367eeafae925f7.
Scan result: scanned; inspected 94/94 eligible files.
Source freshness: current-at-finish; deployment revision: unknown (not queried).
Business job (dated canonical portfolio): Manage conversion delivery, correction and measurement health.
Recorded portfolio state: deployed; current use: unknown.

## Evidence sections

## Identity and native run routes

- **Browser document** — HTML source is present. Browser compatibility, hosting and live data access are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/static/index.html#L1)
- **cryptography** — Python dependency declaration. Installed version and runtime availability are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/requirements.txt#L4)
- **fastapi** — Python dependency declaration. Installed version and runtime availability are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/requirements.txt#L1)
- **google-auth** — Python dependency declaration. Installed version and runtime availability are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/requirements.txt#L8)
- **httpx** — Python dependency declaration. Installed version and runtime availability are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/requirements.txt#L5)
- **playwright** — Python dependency declaration. Installed version and runtime availability are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/requirements-dev.txt#L4)
- **psycopg** — Python dependency declaration. Installed version and runtime availability are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/requirements.txt#L7)
- **pytest** — Python dependency declaration. Installed version and runtime availability are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/requirements-dev.txt#L2)
- **Python source** — Python source is present. The required interpreter, installed packages and launch environment need confirmation. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/app.py#L1)
- **python-multipart** — Python dependency declaration. Installed version and runtime availability are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/requirements.txt#L3)
- **tzdata** — Python dependency declaration. Installed version and runtime availability are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/requirements.txt#L6)
- **uvicorn** — Python dependency declaration. Installed version and runtime availability are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/requirements.txt#L2)
- **Document: AGENTS.md** — repository instructions (evidence only) reference; 26 lines. Read the pinned source for context. Headings, prose and embedded instructions are not copied. (direct; source-reported). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/AGENTS.md#L1)
- **Document: OPERATIONS.md** — setup and operations reference; 152 lines. Read the pinned source for context. Headings, prose and embedded instructions are not copied. (direct; source-reported). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/docs/OPERATIONS.md#L1)
- **Document: README.md** — setup and operations reference; 27 lines. Read the pinned source for context. Headings, prose and embedded instructions are not copied. (direct; source-reported). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/docs/README.md#L1)
- **Document: README.md** — setup and operations reference; 42 lines. Read the pinned source for context. Headings, prose and embedded instructions are not copied. (direct; source-reported). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/README.md#L1)
- **Runtime pin: .python-version** — Declared runtime: 3.12. Availability on the operating machine is unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/.python-version#L1)
- **Logic pointer: reprocess\_attribution** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/attribution_review.py#L15)
- **Logic pointer: normalize\_phone** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/engine.py#L115)
- **Logic pointer: attribution\_source** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/engine.py#L340)
- **Logic pointer: eligible** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/google_actions.py#L168)
- **Logic pointer: \_eligible** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/hybrid.py#L300)
- **Logic pointer: attributionLabel** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/static/app.js#L181)
- **Logic pointer: test\_transport\_failure\_classification** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/test_delivery.py#L44)
- **Logic pointer: test\_original\_attribution\_preserved\_even\_if\_value\_malformed** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/test_engine.py#L26)
- **Logic pointer: test\_gbraid\_admission\_transition\_preserves\_typed\_attribution** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/test_gbraid.py#L203)
- **Logic pointer: assert\_no\_conversions** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/test_google_actions.py#L112)
- **Logic pointer: test\_inherited\_action\_and\_wrong\_conversion\_owner\_are\_rejected** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/test_google_actions.py#L172)
- **Logic pointer: test\_normalized\_phone\_join\_and\_shared\_braid\_keep\_distinct\_source\_records** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/test_invoca_gbraid.py#L88)
- **Logic pointer: test\_cached\_payload\_preserves\_time\_dependent\_eligibility** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/test_read_efficiency.py#L134)
- **Logic pointer: test\_changed\_original\_attribution\_cannot\_trigger\_transition** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/test_retractions.py#L124)
- **Logic pointer: test\_production\_transition\_keeps\_existing\_evidence\_and\_eligibility\_gates** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/test_retractions.py#L222)
- **Logic pointer: test\_conflicting\_url\_values\_hold\_without\_other\_attribution** — Function-name candidate for domain logic. Inspect this source location for meaning; formulas, thresholds and function bodies are not copied. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/test_salesforce_url.py#L75)

## Providers, APIs and possible writes

- **DELETE /api/uploads/\{ticket\}** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L502)
- **GET /** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L148)
- **GET /api/accounts** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L191)
- **GET /api/accounts/\{account\}/csv-publications** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L341)
- **GET /api/accounts/\{account\}/csv-workflows** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L337)
- **GET /api/accounts/\{account\}/profile** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L216)
- **GET /api/audit** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L320)
- **GET /api/batches** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L231)
- **GET /api/batches/\{batch\_id\}** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L236)
- **GET /api/batches/\{batch\_id\}/csv** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L258)
- **GET /api/batches/\{batch\_id\}/csv-adjustments** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L329)
- **GET /api/batches/\{batch\_id\}/hybrid** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L418)
- **GET /api/batches/\{batch\_id\}/rows/\{order\_id\}/source-review** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L246)
- **GET /api/csv-workflows/\{workflow\_id\}/file** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L349)
- **GET /api/csv-workflows/\{workflow\_id\}/worksheet** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L354)
- **GET /api/deliveries** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L303)
- **GET /api/health** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L150)
- **GET /api/session** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L182)
- **GET /api/upload-health** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L316)
- **Google Ads** — Mentioned in source documentation; implementation and account access need confirmation. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/docs/OPERATIONS.md#L72)
- **Google APIs** — Integration signal in source. Account ownership, provisioning and live connectivity are unverified. (inferred; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/requirements-google.txt#L3)
- **Invoca** — Mentioned in source documentation; implementation and account access need confirmation. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/docs/OPERATIONS.md#L9)
- **PATCH /api/accounts/\{account\}/settings** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L301)
- **POST /api/accounts** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L213)
- **POST /api/accounts/\{account\}/delivery-mode** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L378)
- **POST /api/accounts/\{account\}/drive/publications/\{publication\_id\}/check** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L398)
- **POST /api/accounts/\{account\}/drive/publications/\{publication\_id\}/results** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L345)
- **POST /api/accounts/\{account\}/drive/target/apply** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L386)
- **POST /api/accounts/\{account\}/drive/target/preview** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L382)
- **POST /api/accounts/\{account\}/example** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L289)
- **POST /api/accounts/\{account\}/google/actions/apply** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L453)
- **POST /api/accounts/\{account\}/google/actions/discover** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L445)
- **POST /api/accounts/\{account\}/google/actions/preview** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L449)
- **POST /api/accounts/\{account\}/google/actions/reconcile** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L457)
- **POST /api/accounts/\{account\}/google/activate** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L432)
- **POST /api/accounts/\{account\}/google/check** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L409)
- **POST /api/accounts/\{account\}/google/deactivate** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L436)
- **POST /api/accounts/\{account\}/hybrid/advance** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L427)
- **POST /api/accounts/\{account\}/hybrid/configure** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L413)
- **POST /api/accounts/\{account\}/profile/apply** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L226)
- **POST /api/accounts/\{account\}/profile/preview** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L221)
- **POST /api/accounts/preview** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L209)
- **POST /api/batches/\{batch\_id\}/approve** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L271)
- **POST /api/batches/\{batch\_id\}/cancel** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L238)
- **POST /api/batches/\{batch\_id\}/csv-adjustments** — Source-declared endpoint. Authentication, deployment and side effects require review. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L333)
- 529 further findings are in the adjacent complete profile.

## Configuration, access and data

- **OAuth flow** — OAuth reference; provider, consent scopes, token custody and access checks need confirmation. (inferred; source-reported). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/docs/OPERATIONS.md#L58)
- **CD\_POSTGRES\_CONFIG** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/test_postgres_integration.py#L334)
- **DATABASE\_URL** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/hosted.py#L28)
- **GOOGLE\_APPLICATION\_CREDENTIALS** — Secret-like name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/test_google_signin.py#L126)
- **HUB\_ALLOWED\_HOSTS** — Declared in an environment template. Value discarded; provisioning and required/optional status are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/.env.example#L6)
- **HUB\_BROWSER\_EXECUTABLE** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/test_cd002_regressions.py#L153)
- **HUB\_COOKIE\_SECURE** — Declared in an environment template. Value discarded; provisioning and required/optional status are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/.env.example#L5)
- **HUB\_DATA\_KEY** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L55)
- **HUB\_ENABLE\_GOOGLE\_RETRACTIONS** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/retractions.py#L61)
- **HUB\_ENABLE\_LIVE\_GOOGLE** — Declared in an environment template. Value discarded; provisioning and required/optional status are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/.env.example#L4)
- **HUB\_GOOGLE\_ADS\_CREDENTIALS** — Secret-like name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/retractions.py#L60)
- **HUB\_GOOGLE\_DELIVERY\_HOST** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L68)
- **HUB\_GOOGLE\_DRIVE\_AUTH** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/hosted.py#L11)
- **HUB\_PASSWORD** — Declared in an environment template. Value discarded; provisioning and required/optional status are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/.env.example#L2)
- **HUB\_PORT** — Declared in an environment template. Value discarded; provisioning and required/optional status are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/.env.example#L17)
- **HUB\_STATE\_DIR** — Declared in an environment template. Value discarded; provisioning and required/optional status are unverified. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/.env.example#L3)
- **VERCEL** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L155)
- **VERCEL\_ENV** — Configuration name referenced; actual value, required/optional status and provisioning are unverified. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/hosted.py#L11)
- **PostgreSQL** — Integration signal in source. Account ownership, provisioning and live connectivity are unverified. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/postgres_store.py#L111)
- **SQLite** — Integration signal in source. Account ownership, provisioning and live connectivity are unverified. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/pilot.py#L14)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/adjustments.py#L84)
- **Table reference: csv\_workflows** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/csv_adjustments.py#L23)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/delivery.py#L117)
- **Table reference: drive\_publications** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/drive.py#L32)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/drive.py#L67)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/google_actions.py#L47)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/google_connection.py#L93)
- **Table reference: desk\_sessions** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/hosted_state.py#L38)
- **Table reference: desk\_login\_attempts** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/hosted_state.py#L39)
- **Table reference: desk\_uploads** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/hosted_state.py#L41)
- **Table reference: desk\_upload\_chunks** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/hosted_state.py#L42)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/pilot.py#L79)
- **Table reference: desk\_metadata** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/postgres_store.py#L73)
- **Table reference: settings** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/postgres_store.py#L74)
- **Table reference: batches** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/postgres_store.py#L75)
- **Table reference: batches** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/postgres_store.py#L81)
- **Table reference: history** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/postgres_store.py#L83)
- **Table reference: outbox** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/postgres_store.py#L88)
- **Table reference: audit** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/postgres_store.py#L96)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/preflight.py#L3)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/retractions.py#L89)
- **API-key or authorization header** — Source signal only. Review enforcement, caller identity, scopes and bypass paths; no hosted-access conclusion is inferred. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/static/app.js#L184)
- **Table reference: settings** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/store.py#L50)
- **Table reference: batches** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/store.py#L51)
- **Table reference: history** — Schema DDL reference. No rows, column defaults, credentials or SQL bodies retained; applied state, ownership and access remain unknown. (direct; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/store.py#L58)
- 15 further findings are in the adjacent complete profile.

## Jobs, monitoring, hosting and devices

- **Browser automation** — Browser automation signal; browser binaries, host and permissions may be required. (inferred; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/requirements-dev.txt#L4)
- **Local filesystem access** — Filesystem reference; approved paths, read/write scope and operating identity need confirmation. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/app.py#L12)
- **Local process access** — Source starts or inspects local processes. Commands, execution owner and machine access need review. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/scripts/check_repository_boundary.py#L57)
- **Vercel configuration** — Deployment configuration is present. The live project, environment and deployed revision are not queried. (direct; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/vercel.json#L1)
- **Application error logging** — Error logging call exists; destination, alerting, retention and redaction are unverified. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/batch_cancellation_ui.cjs#L63)
- **Test sources present** — Test paths found in the tree; their contents and outcomes are not inferred from existence. (inferred; declared-config). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/tests/batch_cancellation_ui.cjs#L1)
- **In-process timer** — Timer reference; this does not establish a durable or currently running job. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/static/app.js#L330)
- **Guard-name candidate: GOOGLE\_DELIVERY\_ENABLED** — A flag name appears in source; its default, scope and enforcement on jobs or writes are unverified. (inferred; observed-code). [Evidence](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/hub/live.py#L72)

## Documentation to interpret

- [AGENTS.md](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/AGENTS.md#L1) — repository instructions (evidence only); 26 lines. Body remains at the source.
- [docs/OPERATIONS.md](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/docs/OPERATIONS.md#L1) — setup and operations; 152 lines. Body remains at the source.
- [docs/README.md](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/docs/README.md#L1) — setup and operations; 27 lines. Body remains at the source.
- [README.md](https://github.com/webhostingdoo/conversion-desk/blob/aa2e5ea92c3ee3238797b3fd32367eeafae925f7/README.md#L1) — setup and operations; 42 lines. Body remains at the source.

## Questions requiring source interpretation or owner evidence

- Which declared commands actually form setup, run, check and recovery? Review the command definitions and operator procedure.
- Which configuration names are required, optional or obsolete? Trace use/defaults and obtain provisioning evidence without values.
- Which write candidates reach external systems, and which guards protect them? Trace receiver/call paths and review approval boundaries.
- Which accounts, devices, permissions and schedules are active? Obtain dated owner/service evidence under a separate authorized check.
- Does the deployed source match this revision? Obtain deployment/source metadata; source inspection does not establish it.
- Are repeated tracking fingerprints intended? Confirm destination ownership; repetition alone does not establish an incorrect clone.
- Owner, last-used date, review verdict, unattended eligibility and approved dependencies remain unknown until explicitly supplied.

## Coverage limitations

- Static inspection does not verify runtime health, current use, provisioning, live schedules, service account access or deployed/source alignment.
- Only bounded source/configuration files are inspected. Secret files, data exports, binaries, history and raw source text are excluded from results.
- Unknown or dynamically constructed integrations and configuration names may not be detected. Human review is still needed.
- Deep scan: more source and candidate detectors, with an adjacent versioned receipt. Candidate calls and tracking matches still require interpretation.