#448 Telemetry admin reindex endpoint is gated on a defunct @systeminit.com email domain — permanently 403

Summary

handleReindex in services/telemetry/lib/server.ts authorizes the admin reindex endpoints by checking resolved.email.endsWith("@systeminit.com") (server.ts:443). That domain belongs to a company that no longer exists — no current account has an @systeminit.com email, so no one can pass the gate. The /v1/stats/reindex admin operations (reindex by distinct_id / username / ?all) are effectively bricked: every request returns 403.

Impact

• Not a security leak. The gate fails closed — because nobody can satisfy it, there is no unauthorized access. Nothing is exposed.
• It's dead/broken access control: the reindex tooling (rebuild identity_map / username_metrics from S3/Athena) is unreachable for legitimate operators.

Root cause

The guard hardcodes a now-defunct email domain as the admin identity check:

if (!resolved || !resolved.email.endsWith("@systeminit.com")) {
  return json({ error: "Forbidden" }, 403);
}

Introduced in #75 ("Restrict reindex endpoint to @systeminit.com emails"). The org behind that domain is gone, so the predicate is now always false for real accounts.

Suggested fix

Replace the hardcoded-domain check with a real admin/role check (e.g. an operative role flag, an allowlist of admin usernames, or a dedicated admin API key) rather than email-suffix matching. Whatever replaces it should fail closed the same way but actually admit current operators.

Related

Discovered while triaging swamp-club #446 (collective-token telemetry attribution). Unrelated to that bug's fix — filing separately to keep #446 scoped. Note for #446: when broadening the ingest resolveApiKey return shape, this call site must not throw on a result lacking email (default to empty string).