Back to Store Audit | Back to daily
Store Audit Setup
AI evidence page
Return to /daily for daily decisions
- AI runs collection, analysis, drafting, and queueing from the daily pipeline.
- Humans only approve, reject, or request edits from Today's decisions.
- Store Audit setup is connector readiness evidence; decisions stay in /daily.
Use this page to understand what AI did; do not use it as the normal daily operating path.
Status: needs_setup. Store Audit setup evidence is shown below; daily decisions stay in /daily.
Technical evidence links
These links are for debugging and audit evidence. Daily operators should use /daily unless checking setup diagnostics.
Setup JSON API · Event-chain integrityNext Actions
| # | Action |
|---|---|
| 1 | Add read_metafields to GROWTHOS_SHOPIFY_SCOPES, release the Shopify app version, then reconnect. |
| 2 | Set GROWTHOS_ADMIN_TOKEN before exposing Store Audit job endpoints. |
| 3 | Set GROWTHOS_ALERT_WEBHOOK_URL to receive realtime high-risk Store Audit alerts. |
| 4 | AI will ensure Store Audit webhooks after Shopify Admin access is configured; inspect setup details only if /daily flags a connection issue. |
| 5 | Use /daily when Store Audit flags high-risk alerts; inspect /reports/store-audit/alerts only as evidence before deciding. |
Validation Runbook
- Run the local drill first. It does not need Shopify credentials and should create a synthetic event, alert, snapshot, evidence package, and readiness warning.
- After Shopify Admin access is configured, ensure audit webhooks.
- Run the first real Store Audit snapshot, then verify events, alerts, snapshot, evidence, and integrity links.
AI validation details
Store Audit validation runs are scheduled by AI through the daily pipeline and admin diagnostics flow. Humans should not run validation jobs from this page; use /daily for decisions and open evidence only when investigating a monitoring issue.
- AI performs local drill, acceptance, webhook ensure, snapshot, screenshot, daily report, alert test, alert retry, and production acceptance steps when prerequisites are ready.
- Humans configure missing credentials/scopes and review alerts or evidence if /daily flags a problem.
- Validation output is available through Store Audit alerts, events, latest snapshot, evidence package, workflow runs, and technical evidence links.
Alerts · Events · Latest snapshot · Evidence package · Workflow runs
Checks
| Status | Check | Evidence | Action |
|---|---|---|---|
| ready | Shopify store domain | afp0a0-1i.myshopify.com | Set SHOPIFY_STORE_DOMAIN to the myshopify.com admin domain. |
| ready | Shopify Admin access token | SHOPIFY_ADMIN_ACCESS_TOKEN is configured. | Reconnect Shopify OAuth or set SHOPIFY_ADMIN_ACCESS_TOKEN before running audit jobs. |
| ready | Shopify webhook HMAC secret | SHOPIFY_CLIENT_SECRET is configured for webhook HMAC verification. | Set SHOPIFY_CLIENT_SECRET from the Shopify app dashboard before exposing /webhooks/shopify. |
| needs action | Audit read scopes | Missing: read_metafields. | Add read_metafields to GROWTHOS_SHOPIFY_SCOPES, release the Shopify app version, then reconnect. |
| ready | Public webhook URL | https://growthos.petvibess.com/webhooks/shopify | Set GROWTHOS_APP_URL to the public HTTPS GrowthOS URL. |
| needs action | Admin token protection | GROWTHOS_ADMIN_TOKEN is not set; Store Audit job endpoints would be unprotected. | Set GROWTHOS_ADMIN_TOKEN before exposing Store Audit job endpoints. |
| ready | Login protection | GROWTHOS_LOGIN_PASSWORD is configured for Store Audit pages and read APIs. | Set GROWTHOS_LOGIN_PASSWORD or GROWTHOS_ADMIN_TOKEN before exposing Store Audit pages and read APIs. |
| needs action | Realtime alert webhook | GROWTHOS_ALERT_WEBHOOK_URL is not set; high-risk changes will be stored locally but not pushed in realtime. | Set GROWTHOS_ALERT_WEBHOOK_URL to receive realtime high-risk Store Audit alerts. |
| ready | Audit evidence directory | /opt/growthos-petvibess/app/data/audit is writable. | No action required. |
| needs action | Audit webhook subscriptions | Webhook subscriptions have not been ensured yet. | AI will ensure Store Audit webhooks after Shopify Admin access is configured; inspect setup details only if /daily flags a connection issue. |
| ready | Initial resource snapshot | 2580 resources captured at 2026-07-20T19:03:00.847Z. | AI will generate Store Audit snapshots after Shopify Admin access is configured; inspect evidence only if /daily flags a monitoring issue. |
| ready | Tamper-evident event chain | 24533 event(s) checked, 0 break(s). | No action required. |
| needs action | Open high-risk alerts | 1000 open, 0 acknowledged, 0 resolved, 0 ignored. | Use /daily when Store Audit flags high-risk alerts; inspect /reports/store-audit/alerts only as evidence before deciding. |
Runbook Links
Webhook callback URL: https://growthos.petvibess.com/webhooks/shopify
Required scopes: read_products,read_orders,read_content,read_themes,read_files,read_inventory,read_metafields
Missing scopes: read_metafields
After configuration, AI will ensure Store Audit webhooks and generate snapshots from the admin diagnostics flow. Verify events, latest snapshot, and event-chain integrity from technical evidence links.
Realtime Alert Push
Status: not configured.
Set GROWTHOS_ALERT_WEBHOOK_URL to a Feishu, WeChat, Slack, DingTalk, email relay, or generic webhook receiver. Optional format: GROWTHOS_ALERT_WEBHOOK_FORMAT=auto, generic, feishu, lark, wechat, slack, or dingtalk. High-risk Store Audit changes are still stored locally in Store Audit Alerts when the external webhook is missing.
After setting it, restart GrowthOS and let AI run production acceptance from the admin diagnostics flow; then use alerts only to review failed dispatch evidence.
Environment Template
Required env: SHOPIFY_STORE_DOMAIN, SHOPIFY_ADMIN_ACCESS_TOKEN, SHOPIFY_CLIENT_SECRET, GROWTHOS_APP_URL, GROWTHOS_ADMIN_TOKEN, GROWTHOS_LOGIN_PASSWORD, GROWTHOS_SHOPIFY_SCOPES
Recommended env: GROWTHOS_STORE_AUDIT_DATA_DIR, GROWTHOS_ALERT_WEBHOOK_URL, GROWTHOS_ENABLE_SCHEDULER, GROWTHOS_STORE_AUDIT_INTERVAL_MINUTES
SHOPIFY_STORE_DOMAIN=dimxv1-b8.myshopify.com SHOPIFY_ADMIN_ACCESS_TOKEN=shpat_... SHOPIFY_CLIENT_SECRET=... GROWTHOS_APP_URL=https://growthos.petvibess.com GROWTHOS_ADMIN_TOKEN=... GROWTHOS_LOGIN_PASSWORD=... GROWTHOS_SHOPIFY_SCOPES=read_products,read_orders,read_content,read_themes,read_files,read_inventory,read_metafields GROWTHOS_STORE_AUDIT_DATA_DIR=/opt/growthos/audit GROWTHOS_ALERT_WEBHOOK_URL=https://... GROWTHOS_ENABLE_SCHEDULER=true GROWTHOS_STORE_AUDIT_INTERVAL_MINUTES=15