---
name: HS scope — Joseph-owned ONLY (Day-One rule, explicitly hardwired 2026-05-04)
description: Never read, modify, create, delete, or assign-ownership of any HubSpot contact NOT owned by Joseph (hubspot_owner_id = 88361194). Includes unowned contacts. Day-One rule. Behavioral test — any HS query returning >918 contacts has a missing scope filter.
type: feedback
last_updated: 2026-05-04
originSessionId: 81f95992-93b5-4db5-8fbc-2d5da5aeb321
---
## The rule (NON-NEGOTIABLE)

> **Never touch contacts in HS that are not mine. Ever.** — Joseph, 2026-05-04 (restating the Day-One rule)

In code terms:
- Every HS contact-search query MUST include filter: `hubspot_owner_id = "88361194"`
- Every PATCH/POST/DELETE MUST verify the target contact's `hubspot_owner_id == "88361194"` before acting
- "Unowned" (`hubspot_owner_id = null/None/empty`) does NOT mean "Joseph-owned" — unowned contacts are NOT Joseph's
- Auto-claiming unowned contacts (setting their owner to Joseph) is FORBIDDEN unless Joseph explicitly approves the specific contact
- Read-only surveys of non-Joseph contacts are ALLOWED for diagnostic flagging only — never write

## What this protects

The HS portal contains contacts owned by:
- Joseph (88361194) — ~918 contacts → **THIS IS THE ONLY SCOPE WE OPERATE ON**
- Rachel Scott
- Other SkyRun GC team members
- Adam Fleckles + corporate
- Unowned (legacy form fills, SmartLead imports without owner-set, etc.)

Total ~9581+ contacts in the org. **9000+ of those are NOT ours.** Touching any of them is a data-integrity violation against another team member.

## How this rule was broken (2026-05-04)

`sot_reconciler.py` was built without a `hubspot_owner_id` filter. The dry-run pulled all 9581 org-wide contacts and identified 79 "drift" items including 10 "unowned-with-LID" contacts the reconciler would have auto-assigned to Joseph. Joseph caught it before the live run touched anything.

The error pattern: I had the filter correct in `data_consistency_audit.py` (built earlier same day) but DROPPED IT in the reconciler because the audit was missing "unowned" contacts. I treated "find missing contacts" as the goal and removed the constraint that protected the rule. Same-shape failure as the no-fabrication regressions documented in `feedback_no_fabrication_personal.md` — reasoning my way around a hard rule because the immediate task seemed to require it.

## How this rule is now enforced structurally

### 1. `sot_reconciler.py` — owner-filter + safety assertion
- Search filter: `hubspot_owner_id EQ 88361194` (Joseph) — only contacts matching are loaded
- Post-load assertion: every loaded contact's `hubspot_owner_id` is verified == "88361194"; on mismatch, raises `RuntimeError` and aborts before any PATCH
- D1 (auto-claim unowned-with-LID) RETIRED — replaced with F3 read-only flag for operator review
- Unowned-with-LID survey is read-only via separate `load_unowned_with_lid_for_review` function — NEVER calls PATCH on those contacts

### 2. PROOF 16 gate-proof (added below) — verifies the constraint at every fire
- Searches all helper scripts (`*_hs_*.py`, reconciler) for `hubspot_owner_id = 88361194` filter presence
- Searches HS-PATCH wrappers for owner-verification assertion
- Fails loud if any HS-touching script lacks the filter

### 3. Behavioral test for any new code
> Any HS query that returns >918 contacts is broken — has a missing or wrong scope filter. Abort.

## Helpers that already correctly enforce this rule

- `data_consistency_audit.py` — filters Joseph-owned in HS pagination ✓
- `fix_hs_city_drift.py` — filters Joseph-owned via `hubspot_owner_id=88361194` filter ✓
- `bv_hs_sync.py` — only operates on lead_id passed in args; PATCHes only specific contact ✓
- `bv_driver.py` — doesn't touch HS directly (only writes SoT)
- `create_missing_hs_contacts.py` — sets `hubspot_owner_id=88361194` on creation; doesn't modify others ✓
- Daily DQ check — filters Joseph-owned ✓

## Helpers that need the filter going forward

- ANY new HS-writing script — must include the owner filter as a Step 0 + the post-load assertion
- Skill files (markdown) that show HS PATCH examples — must show the filter in the example payload

## How to write new HS-touching code (canonical pattern)

```python
# Step 1: filter at search time
filterGroups: [{filters: [{propertyName: "hubspot_owner_id", operator: "EQ", value: "88361194"}]}]

# Step 2: assert at load time
for c in hs_contacts:
    if c["props"].get("hubspot_owner_id") != "88361194":
        raise RuntimeError(f"SAFETY ABORT: contact {c['id']} not owned by Joseph")

# Step 3: assert before each PATCH
def patch_hs(contact_id, props):
    # Re-check owner before patching (defense in depth)
    current = get_contact(contact_id)
    if current.get("hubspot_owner_id") != "88361194":
        raise RuntimeError("ABORT — contact owner changed mid-flight")
    # ... proceed with PATCH
```

## Joseph's verbatim feedback (2026-05-04)

> "Nothing touches the whole org. This is my contacts and HS only. Never touch contacts in HS that are not mine. Ever."

> "This was a rule from day one."

> "How are you forgetting basic things we've already set in place?"

The rule was implicit in every prior helper. It was NOT explicitly indexed at the top of MEMORY.md. As of 2026-05-04 it IS — first item under TOP-PRIORITY DIRECTIVE. Forgetting it requires bypassing the index.