Pass B buys. Nothing unbuys. The reverse paths -- refund, chargeback,
cancellation, failed renewal -- are where builds implement the checkout-success
webhook and stop, so access is granted once and never revoked.
Marked *(only where money moves)*, and the instruction with it is to delete the
pass outright from projects that take no money rather than carry it as a
permanently skipped row. That is this file's own rule about passes applied to
itself.
Also marked *(precautionary)*: the evidence is borrowed, not ours. It comes from
auditors of AI-built applications, one of whom names it the single thing they
most often fix, and from a report of a refund defect costing a financial
institution six figures a month. The two markers are deliberately separate --
applicability says whether to keep the pass, provenance says whether to argue
with it.
closes#3
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The passes stopped at G, and A-G share an assumption that hides an entire class
of defect: every one of them asks a legitimate user to do legitimate things.
Nothing looked at what happens when the caller is not who they claim, does not
own what they ask for, or asks too often.
That assumption has already cost this portfolio once. requireCoupleContext in
Closer-Couples never verified the caller belonged to the couple whose data was
returned -- authentication present, correct, and proving nothing about
ownership. No pass A-G would have found it.
Pass H covers six cases: authenticated endpoints called logged-out, a list
endpoint checked for rows the caller should not see, User A requesting User B's
object by id, a privileged route opened as an ordinary user, the expensive
endpoint hit repeatedly, and the built bundle and localStorage inspected.
The organising sentence, which is the reason it is a separate pass rather than
more rows in B: authenticated is not the same as owning, and neither is the
same as permitted.
closes#2
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The basis for every project here was itself unversioned: no .git, no remote,
no history. Changes to it had no diff and no revert, and two of its own guards
could not run at all -- doc-claims.sh and doc-triggers.py both read git
history, so the script written to catch documentation drift could not be run
against the documents that define drift.
This is the tree as it stands, including work that until now existed only as
loose files on disk: WORK_CYCLE.md, TOOLS.md, the Portainer image-line fix in
deploy.py, the status vocabulary corrected to the four words the conformance
checker actually enforces, the Exempt: mechanism documented, and the Forgejo
instance named in README.md.
secrets.sh --tracked reports one candidate, migrate.sh:480. It is the comment
documenting the three Postgres credential shapes that script redacts, with
literal placeholders, and it is left alone deliberately: GUARDS.md section 2
is that a source-grep guard must tell code from the comment about code, and
deleting an explanation to quiet a scanner is the failure it names.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
null