Grep across docs/** found zero mentions of security headers, token storage,
account enumeration, audit trail, test environment or rate limiting. The
standing list had four entries and stopped at the boundary of the repository.
Grouped by the question each group answers rather than listed flat, because the
grouping is the argument:
- Authorisation, the three questions login does not answer. Logged-out callers
refused, objects and lists scoped to the caller, privileged routes checking a
role. Login is the front door; every room inside needs its own lock.
- What the browser is handed. No secret in the built bundle, session tokens in
HttpOnly cookies rather than localStorage, a CSP and a frame policy with
nothing on plain HTTP.
- What a stranger can learn or exhaust. Responses that do not confirm whether an
account exists, and *(precautionary)* rate limits on authentication and on
anything costing money per request.
- The compliance bar, which is not the launch bar: a record of who changed what
and when, and an environment that is not production to test against. Called
out as a different bar on purpose -- the rest of the list gets a release out
of the door, those two get it through the first compliance review.
Each entry says what it proves, per this file's own rule that a check whose
purpose is unstated gets skipped the first time it is inconvenient.
closes#4
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Pass B buys. Nothing unbuys. The reverse paths -- refund, chargeback,
cancellation, failed renewal -- are where builds implement the checkout-success
webhook and stop, so access is granted once and never revoked.
Marked *(only where money moves)*, and the instruction with it is to delete the
pass outright from projects that take no money rather than carry it as a
permanently skipped row. That is this file's own rule about passes applied to
itself.
Also marked *(precautionary)*: the evidence is borrowed, not ours. It comes from
auditors of AI-built applications, one of whom names it the single thing they
most often fix, and from a report of a refund defect costing a financial
institution six figures a month. The two markers are deliberately separate --
applicability says whether to keep the pass, provenance says whether to argue
with it.
closes#3
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The passes stopped at G, and A-G share an assumption that hides an entire class
of defect: every one of them asks a legitimate user to do legitimate things.
Nothing looked at what happens when the caller is not who they claim, does not
own what they ask for, or asks too often.
That assumption has already cost this portfolio once. requireCoupleContext in
Closer-Couples never verified the caller belonged to the couple whose data was
returned -- authentication present, correct, and proving nothing about
ownership. No pass A-G would have found it.
Pass H covers six cases: authenticated endpoints called logged-out, a list
endpoint checked for rows the caller should not see, User A requesting User B's
object by id, a privileged route opened as an ordinary user, the expensive
endpoint hit repeatedly, and the built bundle and localStorage inspected.
The organising sentence, which is the reason it is a separate pass rather than
more rows in B: authenticated is not the same as owning, and neither is the
same as permitted.
closes#2
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
forgejo-issue.py warns that a milestone title starting with a version token has
everything after it dropped from the dashboard phase -- `0.2 Payments` displays
as `0.2`. README.md was teaching exactly that form, and two adopted repos
followed it: Closer-Couples and fruit-fall both carry version-first titles and
lose their batch names on the card. PrivacyLLC-Web uses `Batch 05 — ...` and
displays whole.
The guidance now names the working form, and carries the comma rule the script
also enforces: a comma breaks the `milestones=` filter and the card shows the
wrong next action.
WORK_CYCLE.md gains the trap the same script documents and no document did: the
dashboard's next action is the NEWEST open issue in the current milestone, not
the most severe -- severity labels have no influence at all. Filing a routine P2
into the active batch silently replaces what the project card shows.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
README.md's status header named a person; it now names _null.
healthcheck.sh's crontab example hard-coded one operator's home directory in
two lines. Those are now $HOME, rather than a literal /home/_null, because a
template copied into every project should not carry anyone's home path and an
invented one would be a path that does not exist -- which this tree refuses
everywhere else.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
doc-claims.sh could not run on this tree until the previous commit, and its
first run found both immediately.
docs/data/README.md illustrated the wrong place to put an asset by naming
`docs/data/logo.webp` in backticks. A backticked path is a claim the file
exists, so the example of where NOT to put a file asserted that a file was
there. Reworded to name the two directories instead, both of which exist.
project-readme-template.md linked docs/architecture/Engineering_Reference_Manual.md,
a document the template does not ship and most projects will never write. It
now points at docs/architecture/README.md, which every scaffolded project has,
and says to name a reference manual beside it once there is one.
Left unfixed, every project adopting this template would inherit a red
doc-claims from its first day, and a permanently red gate is one everybody
learns to ignore -- audit-gate.mjs makes that argument at length about npm
advisories, and it applies here.
This is the third instance this session of one shape: a document that
describes an absent or forbidden path becomes an assertion that it exists.
The others were docs/planning/FUTURE.md in BATCH_LEDGER.md and an `Exempt:`
line inside a code fence.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The basis for every project here was itself unversioned: no .git, no remote,
no history. Changes to it had no diff and no revert, and two of its own guards
could not run at all -- doc-claims.sh and doc-triggers.py both read git
history, so the script written to catch documentation drift could not be run
against the documents that define drift.
This is the tree as it stands, including work that until now existed only as
loose files on disk: WORK_CYCLE.md, TOOLS.md, the Portainer image-line fix in
deploy.py, the status vocabulary corrected to the four words the conformance
checker actually enforces, the Exempt: mechanism documented, and the Forgejo
instance named in README.md.
secrets.sh --tracked reports one candidate, migrate.sh:480. It is the comment
documenting the three Postgres credential shapes that script redacts, with
literal placeholders, and it is left alone deliberately: GUARDS.md section 2
is that a source-grep guard must tell code from the comment about code, and
deleting an explanation to quiet a scanner is the failure it names.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
null